Confidential commercial data deserves careful handling.
This page describes controls currently in the product. Contopty does not currently hold security certifications such as SOC 2 or ISO 27001.
Sign-in required
Real contract analysis requires a signed-in account. The public demo uses sample data only.
Workspace-scoped access
Saved contracts and analyses belong to a workspace and are read through database access rules tied to workspace membership.
Encrypted document storage
Stored contract documents are encrypted with application-level AES-256-GCM before being persisted, each with its own encryption key protected by a separate server-side master key. They are not retained as plaintext in storage and are decrypted only temporarily for authorized processing.
Authenticated analysis requests
Extraction and analysis requests to the Contopty engine include the signed-in user's session token for verification.
Secrets kept server-side
Privileged credentials are not included in browser code.
AI data handling
AI assists with term extraction; financial outputs come from calculation and simulation logic, and extracted terms are reviewed before modeling.