Your contract data remains in Germany. Without exception.

ContractHero complies with the requirements of the EU AI Act (Regulation 2024/1689). AI processing takes place in the EU, with transparency, risk classification, and human oversight, and without training on your contract data.

ISO 27001
ISO 27001 certified
GDPR
GDPR-compliant
Hosting in Germany
Hosting in Germany
EU AI Act
Compliant with the EU AI Act

Hundreds of leading companies manage their contracts with ContractHero

Hosting in Germany
100 %
Data Processing in Germany
ISO 27001 certified
ISO 27001
certified
Penetration Tests
twice a year
External penetration tests
Audit Log
Audit Log
for every action
Rating: 4.7 to 4.9 stars
4.7–4.9
OMR · G2 · Capterra
Why ContractHero

Why ContractHero Is the Safe Choice

What sets ContractHero apart from generic and U.S.-based tools.

Compliant with the EU AI Act (Regulation 2024/1689)

The AI used has been classified and documented. Risk classification and compliance verification have been completed, and the assessment is available in the Trust Center.

Transparency & Human Oversight

Every AI detection is linked to the source and can be traced. Decisions are made by humans, not by AI.

AI without training on your data

AI compliant with the EU AI Act: Your contract data will not be used to train models.

This Is How Our AI Works, With Clear Boundaries

Reads contracts

The AI extracts deadlines, clauses, and key figures and links them to their corresponding locations in the contract.

Suggests classifications

The AI makes suggestions, which a human reviews and approves.

Don't decide for yourselves

Legal and financial decisions are always made by a person, not by AI.

Don't learn from your data

Your contract data is not used to train any models, whether our own or those of third parties.

Processed exclusively in the EU

Data processing is carried out in compliance with the GDPR within the EU, without any transfer to third countries.

ISO 27001 and GDPR Certificates
Customer Testimonials

What Customers Say About Security

"Compliance with strict security standards was a key priority for our organization, and ContractHero met these requirements with ease."

Maria Kruber
Maria Kruber
SVP Finance & CFO

“It’s important to have a German provider, because with the certifications that ContractHero has, we’re in a particularly secure position when it comes to storing contract data.”

Jan Kaeten
Jan Kaeten
Group CFO, The Relevance Group

How ContractHero Uses AI Responsibly

Compliant with the EU AI Act (Regulation 2024/1689)

The AI used has been classified and assessed for compliance. The assessment result (EU AI Act Assessment) is publicly available in the Trust Center.

No training on your data

Your contract data will not be used to train AI models, whether our own or those of third parties.

Transparency: AI is clearly labeled

Wherever AI is used, it is clearly labeled as AI. Every AI result is linked to its source via "Jump to Source," and the decision is always made by a human.

AI Processing in the EU

Data processing is carried out in compliance with the GDPR within the EU, with hosting in Germany.

A Clear Distinction from U.S. Tools

ContractHero is a German data processor; the Data Processing Agreement (DPA) is standard, and there is no data transfer to countries outside the EU.

For Your Vendor Assessment

All certificates are consolidated in the Trust Center

Your IT and legal teams can find the relevant documents in one place, where they are publicly accessible.

ISO/IEC 27001:2022 Certificate (publicly available)
Data Processing Agreement (DPA) pursuant to Article 28 of the GDPR
List of subprocessors, including location and role
Technical and Organizational Measures (TOMs)
Summary of the Most Recent Penetration Test
Availability & Status (Status Page)
Trust Center

Publicly accessible; no login or sales pitch required.

trust.contracthero.com →
In detail

Explore Security Topics in Depth

ISO 27001

Certified Information Security for Businesses and Servers.

Learn more →
Hosting in Germany

100% data storage in Frankfurt, protection against access from abroad.

Learn more →
Data Security Overview

All safety measures and documentation at a glance.

Learn more →

Contract data under full control - checked, protected and processed exclusively in Germany

  • Data processing exclusively on servers in Germany

    The processing of your data - including storage, retrieval, forwarding and archiving - takes place exclusively in ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and CSA STAR CCM v4.0. certified data centers in Frankfurt, Germany.

  • US CLOUD Act? Our data structure protects you

    Our technical architecture - including end-to-end encryption - and contractual safeguards ensure that data access from abroad is neither possible nor legally enforceable. Access to confidential content is reserved exclusively for authorized users.

  • Complete traceability of all activities

    ContractHero documents all relevant actions in detailed audit logs. From file accesses and rights changes to user logins, every step is logged completely and comprehensibly. This allows you to meet internal and regulatory requirements for transparency and compliance in a legally compliant manner.

  • Certified security standards and regular penetration tests

    ContractHero has its systems regularly tested by external security experts (penetration testing). In addition, we meet the highest requirements in accordance with international security standards - over and above ISO certifications.

  • Privacy by design & default (according to GDPR)

    Our platform is designed in such a way that data protection is already guaranteed at a technical level and by default. Functions that could disclose data are deactivated by default and must be consciously activated.

Would you like to get to know ContractHero?
Want to know how ContractHero can make your contract management more automated and secure? Request a product demo now to get your questions answered and experience the benefits for yourself.
Schedule a demo
Recommendations

Would you like to learn more about ContractHero?

Want to know how ContractHero can make your contract management more automated and secure? Request a product demo now to get your questions answered and experience the benefits for yourself.

A clear overview of your contracts in 30 minutes – live in the demo

Book a demo

Frequently asked questions

What is the EU AI Act?

The EU AI Act is the EU's first comprehensive AI regulation. It classifies AI systems into risk categories and sets requirements for transparency, risk management, and data quality. ContractHero actively checks its AI features for compliance.

Are my contract details used to train AI?

No. Your contract data is not used to train AI models. The AI analyzes your contracts solely for your use.

Is ContractHero compliant with the EU AI Act?

ContractHeros' AI features are actively being reviewed for compliance with the EU AI Act—with a focus on transparency, risk assessment, and safe use.

Where is the AI processing performed?

AI processing takes place within the EU, in accordance with ContractHero’s policy on data processing in Germany and the EU—without any transfer to unsafe third countries.

Are AI features labeled?

Yes. ContractHero transparently indicates where AI is being used so that users can understand and interpret AI-generated results—a core principle of the EU AI Act.

What is the risk class of ContractHero's AI?

The contract analysis features do not fall under the high-risk or prohibited categories of the EU AI Act; the focus is on transparency and disclosure requirements, which ContractHero fulfills.

How is ContractHero different from U.S. AI tools?

Unlike many U.S. tools, ContractHero processes data in Germany/the EU, does not train models using your contract data, and actively verifies that its AI complies with the EU AI Act.