Security & trust

Understand user-visible controls and responsibilities that apply within each Ecurem CLM organization.

1. Two-factor authentication

Ecurem CLM requires two-factor authentication. Users use the code generated by their authenticator application during sign-in and cannot simply disable 2FA from the profile.

2. Backup codes

Backup codes are one-time recovery credentials. Keep them securely outside Ecurem CLM and never send them by email.

3. Organization isolation

Operational data is processed in the active organization context. Server-side controls scope forms, objects and Assistant tools.

4. Least privilege

Grant only required permissions. Review organization and object count before bulk operations.

5. Secrets

DNS and other integration credentials can contain secret values. Saved secrets are not intended to be redisplayed.

6. AI Assistant

The Assistant uses read-only, tenant-scoped tools. Stored text cannot grant permissions or change organization scope.

7. Traceability

Sensitive operations should remain attributable to a user, organization, job, request or audit event.

8. Shared responsibility

Ecurem operates and protects the SaaS platform; customers remain responsible for authorized users, scan scope, supplied secrets, controlled domains and enabled automation policies.