I just launched https://clausyapp.com, a web app that uses AI to analyze contracts and highlight potential issues. You upload a PDF/images or paste text, and Claude AI reads through it to find things like unlimited liability clauses, auto-renewal terms, or aggressive IP assignment language.
Why I Built This
I’ve signed a enough contracts over the years, and I was never quite sure if I was missing something important buried in the legal language. I’d skim through them, but let’s be honest – I didn’t understand half of it. Getting a lawyer to review every contract is also just not something I’m going to do, unless it’s something really big.
I figured: AI is pretty good at reading and understanding text now. And based on how many of these AI contract analysis tools are out there, it’s the new TODO app in the age of AI.
The Stack
I went with a Rails 8 monolith because I wanted something I could ship quickly and maintain solo:
- Rails 8 with Hotwire (Turbo + Stimulus)
- Anthropic’s Claude API
- Solid Queue for background jobs with priority queues (paid users get faster processing)
- Solid Cache for caching and rate limits
- Stripe for subscriptions and billing
- Tesseract OCR for extracting text from scanned images (JPG, PNG, WebP, HEIC)
- Kamal for deployment
Everything runs in Docker containers. No separate frontend framework, no microservices. Just a straightforward Rails app that does one thing well.
Technical Security Challenges
- File Processing Security
- Magic byte validation – Don’t trust file extensions. I check the actual file signature to verify it’s really a PDF or DOCX.
- Size limits – DOCX files are zip archives, so I enforce size limits before decompression to prevent zip bombs.
- Immediate deletion – Original files are deleted right after text extraction. No long-term storage of sensitive documents.
- Command injection prevention – Only use safe extraction tools, never shell out with user-provided filenames.
- Server Access
- Firewall at the provider level
- Firewall at the node level (ufw)
- ssh through certs only, limit access to specific IP’s
- Cloudflare
- Application Security
- Devise authentication – Industry-standard auth framework
- CSRF protection – Rails CSRF tokens on all POST/PUT/PATCH/DELETE requests
- UUID-based URLs – Guest contracts use UUIDs (prevents enumeration attacks)
- Rate Limits (Rack::Attack)
- CSP Policy
- No unsafe-eval – Prevents eval() attacks
- Whitelisted script sources – Only self, HTTPS, Stripe, Cloudflare allowed
- No object embeds – object_src :none blocks Flash/plugin attacks
- Nonce-based scripts – Importmap scripts use session-based nonces
- HTTPS enforced – All resources loaded over HTTPS
- Input Validation
- Fraud Prevention
- Email history tracking – SHA256 email hashing – Email hashes stored, not plain emails
- Payment Security
- Stripe webhook verification – Signature validation on all webhook events
- No card storage – Stripe handles all payment details
- Secret Management
- Rails credentials – All secrets in encrypted credentials.yml.enc
- XSS Prevention
- Automatic HTML escaping
- CSP headers – Content Security Policy blocks inline scripts
- Transport Security
- HTTPS everywhere – All resources loaded over HTTPS
- Secure cookies – Session cookies marked secure in production
- HSTS headers – Forces HTTPS connections
- DoS Prevention
- Job queues – Background processing prevents request timeouts
- Priority queues – Paid users get separate high-priority queue
- Rate limiting – Comprehensive rate limits across all endpoints
- Query optimization – Indexed queries prevent slow lookups
Try it
Demo (no signup): https://clausyapp.com/contracts/new?demo=hn
Full app: https://clausyapp.com
It’s not legal advice – I’m very explicit about that – but it can help you spot things you might want to ask a lawyer about.