What sits in a contract repository
Pricing, liability caps, customer names, data processing terms and sometimes personal information about signatories. A repository concentrates all of that in one place, which is what makes it useful and also what makes it worth protecting carefully.
Encryption in transit and at rest
Files and extracted data are encrypted while they travel between your browser and the service, and they are encrypted again when stored. Access to stored contracts is limited to the workspace that uploaded them.
No training on your contracts
Your contracts are never used to train AI models. They are processed to produce your analysis and nothing else, and your data stays yours.
Retention and deletion
You decide how long contracts remain in your repository. Data retention controls on the Business plan let you set the period, and you can ask for deletion of a contract or an entire workspace on request. Deleting a contract removes it from your repository and search results.
Deleting does not refund the analysis it used, because usage is counted when the work is done.
Access control, SSO and audit log
Team assigns admin, editor and viewer roles so only the right people can change or export contracts. Business adds SAML single sign-on, granular roles and permissions, and an audit log that records who viewed, changed or exported what. Multiple workspaces keep business units or client matters separated from each other.
What we do not claim
ContractsAnalyzer does not currently hold an independent security certification, and we do not display badges we have not earned. If your procurement process needs a specific questionnaire answered, write to [email protected] and describe what you need.
Questions worth asking any vendor
When you evaluate contract software, ask where files are stored and how they are encrypted, whether your documents are used to improve models, how deletion works, who inside the vendor can see your content, and whether you can see who inside your own company accessed what. We have answered the first four above, and the audit log on Business answers the last.
Where an answer depends on your setup, such as your identity provider or your records policy, the plan features and the controls described here are the starting point for that conversation.
Plain handling rules are easier to verify than slogans. You can test deletion by removing a contract and searching for it, you can check the audit log on Business to see your own activity recorded, and you can read the exact retention behavior in your workspace settings before uploading anything sensitive. If something is unclear, write to [email protected].