06 · Settings & account
Everything about you and your organization's setup lives here: your profile and how you sign in, what the AI has learned about you, your plan and billing, your teammates and their roles, the security and compliance controls that govern your data, and the connections to your other systems. Settings are grouped into four sections, You, Workspace, Security & compliance, and Connections. Some pages are visible only to organization owners; each section below says who can see it.
The settings workspace. Every settings page opens inside the same frame. An index rail runs down the left holding all twenty three pages under their four groups, with your organization, your role, and your plan at the top of it, and the Trust center on a navy plate at the foot. Pages that carry a live fact show it on the entry: the number of people, the plan name, how many systems are connected. A dot marks a setting that needs attention, such as two factor still being off.
- Filter — type in the box at the top of the rail to search every settings page by name and by description; press the forward slash key from anywhere in settings to jump into it, and Escape to clear it.
- Nested sections — the Security page's own sections (Posture, Single sign on, Baseline, Data controls, Audit log) appear indented under Security while you are inside it.
- Narrow screens — below the desktop breakpoint the rail collapses into an All settings button at the top of the page; press it to open the same grouped map.
- Page masthead — every page opens with the icon from the rail entry you pressed, the group it belongs to, the page name, and one sentence on what the page decides.
- Owner-only pages — if a page is managed by owners and you are not one, it says who can change the setting and what to ask for, rather than showing you an empty form.
The Security & compliance section is deliberately short: one Security page carries account security, posture, single sign on, the baseline, data controls, and the audit log as nested sections, and one Trust center page carries the overview and the figures ledger as underline tabs. Each keeps its own section below, and old bookmarks to the former standalone pages redirect to the right place.
Settings home
The overview of your workspace: its current state first, then the map. Use it when you want to know where things stand; use the index rail when you already know the page you want.
On the screen
- Masthead — your organization name, and on the right the account you are acting as, with your role. Settings behave differently for owners and members, so the page states which you are.
- Vitals — four live numbers, each a link to the page behind it: People holding a seat, the Plan paying for the workspace (with days left when you are on a trial), whether Two factor is on for your account, and how many systems are Connected.
- Worth doing now — anything genuinely waiting on a decision, written in plain words with the page that resolves it: two factor still off, a trial inside its last week, no systems connected yet. Nothing appears here when there is nothing to do.
- The four groups — You, Workspace, Security & compliance, and Connections, each page with its one-line description and its live fact.
- Trust center — the navy panel closing the page, leading to how your data is held.
How to use it
- Read the vitals. Anything reading Off or 0 is a gap worth closing.
- Work through Worth doing now; each row goes straight to the page that fixes it.
- Use the index rail on the left for everything else, or the filter if you are not sure which page owns the setting.
Related: Security · Billing · Trust center
Profile
Your personal details: your name, job title, timezone, photo, the vendors you follow, and your password. This is also where you connect your Microsoft account.
On the screen
- Name, title, and timezone — how you appear to teammates and the timezone used for dates and digests.
- Photo — drag an image on or click to upload; used for your avatar across the app.
- Email — your sign-in address, with a Change button. Enter the new address and your current password; we email a confirmation link to the new address, and nothing changes until it is clicked.
- Followed vendors — the vendors you want updates about; they drive your weekly report and vendor alerts. Email subscriptions themselves live under Notifications.
- Password — set a new password without leaving the page. You confirm your current password first, the new one is checked against known breaches, and every other session is signed out when it changes.
- Your data — download everything the platform holds about you as one JSON file (profile, memberships, preferences, assistant memory, sign-in devices, your own activity trail), or file a delete-my-account request our team processes within 30 days. You can cancel the request until it is processed.
- Microsoft account — connect Microsoft so contract files and calendar data can flow in (when your organization has it configured).
- Invite a colleague — a quick invite card; only owners can actually send invites.
- Leave this workspace — remove your own seat from the current workspace. Your account and any other workspaces stay; an owner can invite you back. If you are the only owner, promote someone else first.
How to use it
- Fill in your name, title, and timezone, then save.
- Add the vendors you care about so your alerts and weekly report are relevant.
- Use Change password to rotate your password whenever you need to; use Change next to your email when you move addresses.
Related: Security · Members · Notifications
Security
The landing section (Account security) of the one Security page. Protect your account with two-factor authentication and see the devices where you are signed in; owners also set the organization-wide two-factor policy here. The other five sections, Posture, Single sign on, Baseline, Data controls, and Audit log, sit indented under Security in the index rail while you are inside it, and each is documented below.
On the screen
- Two-factor authentication — register an authenticator app and turn on the rotating six-digit code. Once on, that code becomes your sign-in: the sign-in screen asks for it in place of your password.
- Backup codes — one-time recovery codes to use if you lose your authenticator; the count remaining is shown.
- Active sessions — the sessions signed in to your account, with the option to sign out everywhere else.
- Sign-in history — every device your account has signed in from, with first seen, last active, and the IP address. A device you have never used before always triggers the new-device email; an entry you do not recognize means change your password (which signs out every other session) and review the active sessions above it.
- Organization policy (owners) — require two-factor for every member of the organization.
How to use it
- Open your authenticator app (Google Authenticator, 1Password, Authy, and the like) and scan the code shown.
- Enter the six-digit code to confirm, then save your backup codes somewhere safe.
- Review active sessions and sign out any you do not recognize.
Tips
- Turning on two-factor is the single highest-value thing you can do for your account. If your organization requires it, you will be held here until you set it up.
Related: Security posture · Two-factor authentication
AI personalization
What the platform has learned about how you like output, in plain language and fully under your control. The more you use Vera AI, the more its answers match your preferences.
On the screen
- Learned preferences — each thing the AI has picked up about how you like answers, newest first.
- Remove — delete any single preference; it stops shaping your answers immediately.
How to use it
- Review the list to see what the AI has inferred.
- Remove anything that is wrong or that you would rather it not use.
Tips
- This list is private to you. Your organization's shared negotiation memory is separate, on the Memory page.
- Learning feeds on what you do with AI output, not on how much you chat: rating an answer, exporting a deliverable, applying or rejecting a suggestion Vera staged, turning an answer into a watch, regenerating, or dismissing an insight. The learning pass runs weekly and writes a preference only after it sees the same pattern a few times, so a new account starts empty. A written feedback comment is the fastest way to teach it something.
Memory
What your organization learned in past negotiations and how it likes to negotiate. Briefs, mandates, and Ask all open with this record, so it is worth keeping current.
On the screen
- Negotiation posture — your organization's stance and preferences, editable by owners.
- Facts — durable conventions about your workspace, for example how a vendor's contracts are classified. Some are added by hand; some are learned automatically when your reviewers correct the same extracted field the same way twice.
- Remembered facts — the individual things learned across past negotiations, each of which you can edit or remove.
How to use it
- Check the posture reflects how your organization actually negotiates.
- Prune or correct any remembered fact that is out of date.
- Corrections you make in the extraction review queue also teach the extractor directly: the next document from that vendor is read with your past corrections in hand.
Related: AI personalization
Billing
See what plan your workspace is on, how much of your allowance you have used, your benchmark credits, and, if you own the organization, upgrade.
On the screen
- Current plan — your plan, its status, and price, with contract, benchmark, AI, and Vera allowances at a glance.
- Usage this period — how many AI reports and agent requests you have used against your cap, plus your personal AI token usage over the last window.
- AI allowance meter — on seat-priced plans, the percent of your monthly allowance used and roughly how many runs are left; the allowance is yours alone, not pooled.
- Plans — the sellable plans side by side, with an upgrade button on each.
How to use it
- Check where you sit against your allowance for the period.
- If you own the organization and need more, pick a plan and message our team; upgrades are set up the same day and billed by invoice, net 30.
- Not an owner? Ask an owner to upgrade, or message the team.
Related: Members
Desktop app
Install Vera AI as its own app on your Windows laptop: its own window, taskbar icon, and Start menu entry, on the same account and data as the browser.
On the screen
- Download for Windows — the installer, with version and size shown; it installs for your user only, no admin rights needed.
- How to install — the numbered steps, including what to do if Windows shows a "Windows protected your PC" screen.
- What you get — drop a contract onto the window or from Explorer, native Windows notifications, Vera on top of any app, Windows Hello lock, and automatic updates.
- Removing it — uninstall any time from Windows Settings; your account and data are untouched.
How to use it
- Click Download for Windows and run the downloaded installer.
- If Windows warns about a new app, choose More info, then Run anyway.
- Sign in with the same email, password, and two-factor code you use in the browser.
Tips
- A macOS version is planned. Until then, Mac users get the same workspace in the browser.
Members
Invite teammates, set their role, and manage everyone in your organization. Owners also see pending invitations, seat usage against the plan, and any join requests waiting for them.
On the screen
- Seats — the verdict leads with seats in use against your plan's allowance (5 on Trial, 10 on Growth, 25 on Professional, unlimited on Enterprise). Inviting past the cap tells you exactly what is full.
- Member list — everyone in the organization with their role, last sign-in, and recent activity trail. Export the whole roster to CSV for access reviews from the link above the grid.
- Invite — send an email invitation and set the new person's role. Invitations expire after 7 days; resending restarts the clock and refreshes the sign-in details.
- Invite several at once — paste up to 50 addresses (commas, spaces, or new lines) and give them all one role in a single batch.
- Pending invitations — invites not yet accepted, with the days until expiry and a delivery status when an email bounced or was delayed. Revoking a pending invite removes the reserved seat entirely.
- Roles — change a member's role inline, or block a member from the workspace. Blocking or removing someone signs them out everywhere immediately. The workspace always keeps at least one active owner: promote a second owner before demoting or removing the last one.
- Sign out — end every session a member holds without blocking or removing them, for a lost laptop or a departed contractor whose seat stays. They sign back in with their password (and MFA) next time.
- Join requests and domain capture — approve people who asked to join, pick their role at approval, and optionally let anyone on your email domain request to join.
How to use it
- Click Invite, enter the person's email, choose their role, and send. For a whole team, use Invite several people at once instead.
- Watch pending invitations for delivery problems and resend if needed; an expired invite just needs a resend.
- Adjust roles as responsibilities change; block anyone who should no longer have access.
- Before an owner leaves the company, promote their replacement to owner first; the platform refuses changes that would leave no active owner.
Tips
- If an invite shows as bounced, check the address; the person never received the email.
- Any member can leave a workspace themselves from the bottom of Settings › Profile, no owner action needed.
Related: Team activity · Deal approvals
Teams
Named groups you can grant confidential contracts and agreements to as one unit. Membership in a granted team is the access itself: joining the team grants its documents at that moment, leaving revokes them, with nothing to clean up per document.
On the screen
- Create a team — name it after how your company actually organizes: Procurement, Finance, Legal.
- Team cards — each team with its people and how many confidential grants it currently holds. Add or remove people inline; removal takes effect immediately.
- Delete — deleting a team revokes every grant it holds for its members in the same stroke.
How to use it
- Create a team and add the people who share an access need.
- Open a restricted contract and grant the team from its Access panel, next to individual grants.
- When someone changes roles, move them between teams; their document visibility follows automatically.
Tips
- Prefer team grants over long lists of individual names: the grant list stays readable and offboarding is one removal, not a document sweep.
Related: Members
Team activity
What each member actually does on the platform, which features they use, and an on-demand report that turns the numbers into an adoption plan.
On the screen
- Usage verdict — how alive the workspace is this week: active members, page views, most-adopted feature, and features nobody has touched.
- Per-member table — each member's last sign-in, page views over 7 and 30 days, recorded actions, features tried, and last screen.
- Recent activity — the last recorded actions across the workspace, named, newest first.
- The usage report — an analyst read of the numbers that you can generate on demand.
How to use it
- Scan the verdict to gauge overall adoption.
- Use the per-member table to spot who has not started and which features go unused.
- Generate the usage report when you want a written adoption plan to act on.
Deal approvals
An optional sign-off chain: up to ten approvers who must clear a deal before it is signed. Off by default; turn it on when your organization needs a documented approval step.
On the screen
- Enable and mode — turn the chain on and choose how sign-off works.
- Approvers — add up to ten people from your organization as the required approvers.
- Recent sign-off requests — every request negotiators have sent through the chain, with how many approvers have cleared it.
How to use it
- Turn on deal approvals and pick your approvers.
- Negotiators request sign-off from a deal's page under Negotiations; approvers vote from their queue.
- Track progress in the recent requests list.
Related: Approvals
Branding
Put your organization's logo on the documents you export. Once a logo is set it co-brands the exported CFO executive brief and the boardroom deck and brief alongside the Vera AI brand. With no logo set, exports are unchanged.
On the screen
- Logo upload — upload your logo; a preview shows how it will appear on an exported document.
How to use it
- Upload a logo image.
- Export a CFO brief or a boardroom deck to see it applied, alongside the Vera AI brand.
Display currency
The default currency for amounts your team enters. Benchmarks stay in USD so every market comparison holds.
On the screen
- Workspace display currency — the currency amounts render in when the row that holds them did not record one of its own. Contract values, spend, and invoice lines follow this setting.
- Save — applies to the whole workspace, not just to you.
How to use it
- Pick your currency and press Save.
- Leave rows that already carry their own currency alone; they keep it, whatever this is set to.
Tips
- This setting never converts a number and never relabels a benchmark. Market figures are stored in USD and stay labeled USD.
Notifications
Tune which alerts reach you, on which channel, and when. One preference model governs every channel: a setting made here (or a mute made from the inbox bell) applies to the in-app inbox, push, and email together, so nothing silences you on one surface while interrupting you on another. Renewal alerts are opt in: nothing about a renewal reaches you, on any channel, until you switch it on. Owners can also post alerts to Slack or Teams and set the AI copilot's alert rules.
On the screen
- Weekly briefings — three vendor-intelligence emails, each at most once a week, each strictly opt-in: price list updates per vendor (what moved, by how much, what to do), vendor licensing news (the Monday wire across the 50 most-negotiated vendors, your vendors leading), and the weekly knowledge briefing (new analyst research and what shipped). Every one of these emails carries a one-click unsubscribe that works without signing in, and this card is the standing in-platform switch. When a briefing is on, a link under it leads to its vendor picker (Watch for price lists, the Weekly report page for the wire).
- Tips and lifecycle emails — one switch over the onboarding guidance, trial check-ins, and come-back notes. It is off until you switch it on, so nobody receives these unasked. Nothing here touches invites, security notices, alert emails you enabled, or report deliveries.
- Quiet hours — pick a window (say 10:00 pm to 7:00 am, in your local timezone) and inside it phones stay silent while non critical alert emails wait until the window ends. Money critical alerts (renewal deadlines, deadline escalations, policy checks, above-market warnings, uplift breaches, anomalies) always come through immediately.
- Every alert type is listed — anything that can reach your bell has a row here, so there is always somewhere to switch it off. Six types that nobody addressed to anyone (commitment tracking, invoice findings, vendor health warnings, ecosystem shifts, sourcing events, and renewal engine events) start off until you turn them on, the same way the renewal family does.
- Channel posts — a Slack or Teams channel an owner wires up is the organization consenting for that channel, because the people in it cannot each be asked. What an owner chooses is which alerts belong there; a channel subscribes to the kinds you pick rather than to everything. Workflow agents posting to that channel have to clear the same switch.
- Workflow agent output — the memo a workflow agent mails when a run finishes. Off until you switch it on, because any colleague with edit rights can build a workflow that emails the whole organization, so the person receiving it decides rather than the person who wrote it. Approval requests addressed to you are the deliberate exception and always reach you, because the run waits on your answer.
- Alert preferences — for each kind of alert, up to four toggles: in-app, email, weekly digest, and Chat DM. Email is off until you switch it on, with four exceptions that start on because silence would be a failure: the report delivery email, benchmark status updates, the one-time outcome follow-up 30 days after a delivered benchmark, and @mentions. Every renewal alert that fires on its own goes further and starts off on every channel, in-app included: renewal notice alerts, deadline escalations, policy compliance checks, the AI copilot digest, above-market warnings, stale benchmark reminders, uplift cap breaches, auto-drafted briefs, renewal opening moves, and renewal prep packages say nothing until you turn them on here. The Turn on money-critical alerts button switches on the renewal set in one click. AI renewal agent briefs are the exception: switching the renewal agent on for a contract is itself the opt in, so those briefs send, and this toggle stops them across every contract at once. Weekly digest bundles that alert type into one Monday roll-up email instead of individual sends; money critical kinds cannot be bundled. Alert types you muted from the inbox bell appear here with a Muted chip and are one click to unmute; a mute silences that type on every channel unless you split channels with these toggles.
- Chat DM — send your own renewals and money alerts (renewal notices, deadline escalations, price drift findings, buyer window alerts, and above-market warnings) to your personal Slack or Teams direct messages. Link once by sending the Vera bot a direct message in your company Slack or Teams (an owner connects the bot under Settings › Integrations); the account link happens automatically and the note above the table confirms it. The DM lane is strictly opt in per alert type, only these five types can use it, a bell mute silences it like every other channel, and quiet hours hold the non critical pings. The shared org channel owners configure below is separate and unchanged.
- The daily leverage note — one email a morning covering everything that moved under your deals, in place of each watchdog mailing you separately. It is ranked on a single measure: how much the thing that happened changed your position. Money at stake and days left to act are what move that ranking, because between them they decide whether you can still do anything about it, so a price list change on an agreement that renews in two years sits below a notice deadline nine days out even when the price change is the larger number. Findings that scored below the line are counted at the foot of the note rather than dropped silently, so you can see what was judged and set aside. On a day when nothing moved, nothing is sent. This rides on your renewal alert setting above: switch renewal alerts on and the note starts arriving, and every note carries the same one-click Turn it off link.
- Monday brief sections — your weekly emails arrive as one Monday brief with four sections: the vendor market wire, renewals coming up, watchtower changes, and savings and wins. Turn any section off here while keeping the rest.
- AI copilot preferences (owners) — the digest, anomaly watch, board report, community and outcome network sharing, and dispute alert thresholds.
- Webhooks (owners) — post alerts to a Slack or Teams channel.
How to use it
- Pick your weekly briefings: price lists, licensing news, knowledge, any mix. Off is always one toggle (or one email click) away.
- Set quiet hours if you carry the mobile app: nights stay silent and nothing important is lost, it waits for morning.
- Turn on the renewal alerts you want. They start off, so a workspace stays silent about renewal dates until someone here asks for them, and the standard renewal checklist tasks are not filed either; Turn on money-critical alerts switches the whole set on at once. Renewal notice alerts also switch on the Monday renewal radar, one roll-up email covering everything entering or inside its notice window over the next 60 days, and the daily leverage note described above.
- Turn off any alert kind you do not want, move it to a single channel, or send it to the weekly digest. Every renewal alert email also carries a one-click Turn it off link that works without signing in.
- Want your renewals in Slack or Teams? DM the Vera bot once in your company workspace, then flip the Chat DM toggle on the alert types you care about.
- Review the Muted chips: anything you muted from the bell in passing is listed here, so no alert type stays silenced invisibly.
- Choose which Monday brief sections you receive; the others still land in the app.
- Owners: set the copilot alert rules and connect a chat channel if the team wants alerts there.
Security posture
The Posture section of the Security page (formerly the standalone Security Center, whose old address redirects here). Your organization's live security posture on one view: two-factor coverage, single sign-on, retention, API credentials, the audit stream, recent security events, and your sign-in devices. Live state, not marketing.
On the screen
- Posture tiles — two-factor coverage across members, sign-on method, active API keys, and audit events in the last 30 days.
- Controls — each security control with its current state and, for owners, a link to manage it.
- Recent security events — sign-ins, permission changes, and credential events.
- Your sign-in devices — the devices seen on your account, with a link to manage active sessions.
How to use it
- Read the posture tiles for a one-glance health check.
- Owners: work down the controls list and tighten anything that reads as merely "Available" rather than "In force."
- Check your devices and sign out anything unfamiliar from the Account security section.
Related: Security · Trust center · Audit log
Clause positions
Your negotiation playbook as data: the positions, pre-approved language (ideal, fallback, and walk-away), and must-have clauses that every AI review holds your contracts to. This is the settings surface behind the workspace Clause library.
On the screen
- Positions — each clause position with its pre-approved language and walk-away line.
- Must-have flag — mark a position as required so the coverage check sweeps for it across every contract.
How to use it
- Add or edit a position and its ideal, fallback, and walk-away language.
- Mark the positions your organization will not sign without as must-have.
- AI reviews then insert your language verbatim wherever a contract deviates.
Related: Clause library · Security baseline
Security baseline
The Baseline section of the Security page. The data-protection and security requirements every vendor contract should meet. These are the rules the DPA check enforces when it reviews a contract.
On the screen
- Baseline requirements — your written data-protection and security requirements; a default is offered as a starting point.
- Rulepacks — pre-built requirement sets you can switch on.
- Network and session policy (owners only) — pin the workspace to known networks and bound session lifetimes: an IP allowlist that takes exact addresses and CIDR ranges, a maximum session age in hours, and an idle timeout in minutes.
How to use it
- Edit the baseline to match what your organization requires of vendors.
- Turn on any rulepacks that apply.
- The DPA check then measures each contract against this baseline.
- Owners setting a network policy: the card shows your current IP with one click to add it, and the allowlist refuses to switch on unless your own address is covered, so you cannot lock yourself out at enable time. Every denial lands in your audit log, and a policy change takes up to a minute to reach every server.
Note: if your office IP later changes, everyone including owners is blocked until the policy is updated from an allowed network; prefer ranges over single addresses if your egress IP rotates.
Related: Clause positions
Single sign on
The Single sign on section of the Security page. SAML single sign-on and SCIM provisioning for your organization, for teams that manage access through an identity provider.
On the screen
- SSO configuration — connect your SAML identity provider and choose whether sign-on is enforced for your domain.
- Break-glass policy — a plain statement of the one exception when Require SSO is on: org owners keep password sign-in so a broken identity provider cannot lock the whole tenant out. Every break-glass sign-in is written to your audit log as
auth.sso_breakglass. Members and admins have no bypass. - SCIM tokens — provisioning tokens so your identity provider can create and deactivate accounts automatically.
How to use it
- Enter your identity provider's SAML details.
- Decide whether to enforce single sign-on for everyone on your email domain.
- Issue a SCIM token if you want automatic user provisioning.
- If your identity provider supports group push, push the groups that should map to teams; members must be provisioned as users first.
- Optionally map groups to roles: members of a mapped group get that role on every push (approver, analyst, member, or viewer; ownership is never assigned this way), and leaving the group takes the role with it.
Related: Security posture
Data controls
The Data controls section of the Security page. Retention, export, and deletion for your organization's data, the document retention switch for the analysis tools, plus your consent choices for the community and outcome network. Every hard deletion writes a deletion certificate you can hand to an auditor.
On the screen
- Retention policy — automatically delete contracts a set number of months after they are uploaded, rows and files both. Leave it blank to keep contracts until you delete them. The sweep runs daily, and each automatic removal writes a deletion certificate.
- Documents from analysis tools — on by default: files handed to the decoders, the Verdict Bar, Second opinion, the Vera Deal-Room, Proposal comparison, and the vendor playbook intakes are saved to your workspace as contracts, private to your organization, and each joins your benchmarking queue. Benchmarking extracts only high level data points (the vendor, the price, the term, the key commercial terms); the document itself never leaves your organization, and every saved document can be deleted from its contract record. Turn the switch off and those tools read files in memory and keep nothing; documents already saved stay until you delete them.
- Data location — a read-only statement of where data physically lives: the United States (Vercel and Supabase US regions). EU residency is on the roadmap and tracked publicly on the security page's claim ladder.
- Deletion certificates — one row per completed hard deletion: date, scope (contract or organization), what was deleted, and how many files were removed. "View certificate" opens a print-ready document listing rows removed by table, the storage paths removed, the actor, and the UTC timestamp; use your browser's print dialog to save it as a PDF.
- Community and outcome network consent — opt in or out of contributing anonymized data to the community benchmarks and outcome network.
- Reseller quotes — recent quotes shared for benchmarking.
- Export and deletion — request an export or a deletion of your organization's data.
How to use it
- Set a retention period if your policy requires one; blank keeps contracts until you delete them.
- Choose whether to contribute to the community and outcome network.
- Request an export or deletion when you need it; our team processes deletion requests and confirms by email.
- After any deletion, open its certificate from the Deletion certificates list to verify what was removed.
Related: Trust center · Audit log
Audit log
The Audit log section of the Security page. Who did what in your organization, including views and downloads of contract files. A transparency and compliance record you can filter, search, and export. Old links and saved views under the former standalone address redirect here with their filters intact.
On the screen
- Filters — narrow to file downloads, file views, uploads, report links, deletions, or member changes. A file view is a document opened in the in-app viewer; a file download is a copy saved to the reader's machine. The log records both separately.
- Activity table — each event with the actor, the source device and IP, and when it happened.
- Saved views — save a filter you return to often.
- Export and stream — download the full log as CSV, or stream events to your SIEM with an audit webhook.
How to use it
- Pick a filter or search for an actor or activity.
- Save a view if you audit the same slice regularly.
- Export to CSV, or set up an audit webhook under Integrations for continuous streaming.
Related: Security posture · Integrations
Access reviews
A quarterly attestation of who can reach what. Starting a review snapshots your organization's entire access surface at that moment: every member with their role, every team membership, and every restricted document grant. You then confirm or revoke each line, and the completed review is stored as a durable record you can hand to an auditor.
On the screen
- Start a review — one action that snapshots the access surface. Only one review can be open at a time.
- Review lines — grouped into members and roles, team memberships, and restricted document grants, each with Confirm and Revoke buttons.
- Complete review — enabled only once every line is decided, so a finished review always covers everything.
- Completed reviews — past attestations with line counts and how many grants were revoked or flagged, each exportable as CSV.
How to use it
- Open Settings › Access reviews and choose Start a review.
- Work through each line. Confirm access that is still right; revoke a team membership or document grant that is not. Revocation takes effect immediately.
- A member who should leave the organization is flagged rather than removed here. Finish the removal on the Members page, which protects the last owner and revokes their sessions.
- When nothing is pending, choose Complete review. Every decision is written to the audit log.
- Export any completed review as CSV for an auditor or a security questionnaire.
Related: Members · Teams · Audit log
Trust center
How your data is protected, told in three commitments: kept apart (tenant isolation), kept sealed (encryption and access), and kept yours (audit, deletion, and eyes-off AI). The masthead proves the isolation claim with live numbers. Two underline tabs make this one page: Overview (this view) and the Figures ledger.
On the screen
- Kept apart — tenant isolation at the database, least-privilege access, and roles matched to clearance.
- Kept sealed — private contract storage with short-lived signed links, encryption in transit and at rest, and multifactor authentication.
- Kept yours — the audit record, data deletion, and how the AI handles your data.
- Data journey — a diagram of the path a contract actually takes through the platform.
How to use it
- Read the three chapters to understand the controls applied to your data.
- Share this page with security reviewers who ask how the platform protects information.
Related: Security posture · Data controls · Figures ledger
Figures ledger
Every number the platform has cited for you, in one place. The ledger lists each figure across your reports and briefs, linked to the source fact it traces to and the day that fact was current, so any number you forward can be stood behind.
On the screen
- Cited figures — one row per number the platform has printed for you, with the document it appeared in, the source fact behind it, and the date that fact was current.
- Search and sort — narrow to a vendor, a document, or a value, and sort by any column.
- Not-yet-traceable note — the ledger is honest about the figures it cannot trace to a stored fact yet, rather than hiding them.
How to use it
- Look up any number a report or brief shows to see the fact it came from and when it was current.
- Search for the vendor or figure a reviewer is questioning and hand them the source in one step.
Related: Trust center · Audit log
Integrations
Connect the systems your team already uses: contract intake, tickets and calendars, spend and identity data, your warehouse, and the SAM and ITAM tools that know what you own and use.
On the screen
- Workflow hub — contract intake (five email-in rails, DocuSign, Ironclad, Drive/SharePoint/Box folder watch), renewal workflow (Jira, ServiceNow, calendar invites, Slack, Teams), spend and usage sources (Coupa, Okta, Entra ID, the CSV importers, Smart import), warehouse export, and signed JSON event webhooks.
- Agent Negotiation Protocol — the opt-in card for structured agent-to-agent negotiation, with a link to the public spec.
- Procurement and ERP (P2P) — purchase orders, requisitions, and supplier records from your procure-to-pay systems, with maverick spend flagged.
- License and deployment discovery (SAM / ITAM) — connect the systems that know your entitlements and deployments; the license intelligence table shows entitled vs deployed vs active per vendor, with estimated shelfware.
- Recent activity — the latest sync results for each connected source.
How to use it
- Pick a system, enter its credentials or copy the intake address it needs, and connect.
- Let the first sync run, then review the license and procurement intelligence tables.
- Add an audit webhook if you want to stream events to your SIEM.
Related: Audit log · API · The integration catalog
API
API keys, webhooks, and the MCP connector, so you can connect Claude, ChatGPT, or any other tool to your benchmark data.
On the screen
- API keys — create, view, and revoke keys; keys expire within a year.
- Connect — the base URL and details for connecting an external tool or the MCP connector.
How to use it
- Create an API key and store it securely; you see the full value only once.
- Point your tool or the MCP connector at the connection details shown.
- Revoke any key you no longer use.
Related: Integrations
That covers the settings. When you are not sure where a screen belongs, start from the manual index and follow the chapter that matches the rail group you are looking at.
Next: Chapter 07 · Common workflows
Was this page helpful?
Thank you. Your note goes straight to the team that writes this manual.