Security at Contract Flash
Contract Flash stores contracts in encrypted cloud infrastructure with AES-256 encryption at rest and TLS 1.3 in transit. Every organization's data is isolated from every other organization's, and access inside an organization is governed by role-based permissions.
Uploads are validated and malware-scanned before processing. Authentication uses short-lived JWT access tokens with refresh-token rotation and httpOnly cookies, so session tokens are not reachable from JavaScript. Passwords are hashed with bcrypt.
Contract content is never used to train AI models. The AI providers that process it (OpenAI, Anthropic, Google Cloud Document AI) do so under API terms that prohibit training on submitted data.
Frequently asked questions
How does Contract Flash protect my contract data?
Contracts are stored in encrypted cloud infrastructure with AES-256 encryption at rest and TLS 1.3 in transit, isolated per organization, and governed by role-based access controls. Uploaded files are validated and malware-scanned before processing, passwords are hashed with bcrypt, and authentication uses short-lived JWT access tokens with refresh-token rotation delivered over httpOnly cookies.
Is my contract data used to train AI models?
No. Contract content is never used to train models. The providers that process it — OpenAI, Anthropic, and Google Cloud Document AI — operate under API terms that prohibit training on submitted data.
Are uploaded files scanned for malware?
Yes. Every uploaded file is validated for file-type safety and scanned for known threat patterns before it is stored or processed, because contract PDFs and Word documents are a common malware delivery vector.
Can one customer see another customer's contracts?
No. Data is partitioned by organization at the query layer, and every request is scoped to the caller's organization. Sharing is explicit — a contract becomes visible to someone else only when a user with permission shares it or invites them to a seat.
Is Contract Flash SOC 2 certified?
Not yet. SOC 2 Type II certification work is in progress and Contract Flash does not claim the certification today. The underlying controls — encryption at rest and in transit, per-organization isolation, role-based access, malware scanning, and per-contract audit logging — are already in place and documented on the security page.
Can I delete my data?
Yes. You can delete contracts and, from Settings, your organization's data. Deletion is user-initiated and covered by the retention terms in the privacy policy.
Who are Contract Flash's subprocessors?
OpenAI and Anthropic (AI extraction and agent capabilities), Google Cloud Document AI (OCR for scanned PDFs), Neon (database), Cloudflare R2 (file storage), Cloudflare (CDN and DNS), Hetzner (application hosting), Stripe (payments), Resend (transactional email), Microsoft Graph (document conversion), and Sentry (error tracking). The full list with purpose and location is on the subprocessors page.