Security

ContractPlan holds contract terms, billing and aggregate service counts for organizations that answer to city, county and grant funders. This page describes how that data is protected. For a security questionnaire or a question this page doesn't answer, write to hello@contractplan.com.

No client-level data

ContractPlan works with aggregate counts only: clients served, units delivered, referrals pending. It has no place for names, case numbers, health information or other records about the people your programs serve, and our Terms prohibit uploading them.

Each organization's data is kept separate in the database

• Every record carries its organization, and Postgres row-level security lets a request read and write only its own organization's rows.
• The application connects with a database role that cannot bypass those rules, and links between records are checked to belong to the same organization.
• An automated test checks every table on every change before it can ship.

Encryption

• All traffic uses HTTPS.
• The database and stored files are encrypted at rest by our hosting providers.

Access within your organization

• Sign-in is handled by Clerk. Each person has their own account; there are no shared logins.
• Admins manage billing and the team. Members can edit. Read-only members, such as board members, can look but not change anything.
• Changes to contracts and billing are recorded in an audit log.

Funder share links

• A share link shows one contract's value, billing to date, spend curve, reporting status and only the files you mark visible. Census, planner assumptions and notes stay private.
• Links are long random codes, stored only in scrambled form. They can expire, can be turned off at any time, and stop working if your subscription ends.

Documents and AI reading

• Uploaded contracts, amendments and invoices are read by Anthropic's Claude model to fill in fields you review before anything is saved. Anthropic's commercial terms do not allow it to train models on customer content.
• Invoices and service-count files are deleted after reading. A contract is kept only if you choose to keep a copy, and any kept file can be deleted from the contract.
• If a document lists clients, the reader is instructed to leave names and other personal details out. What it read is cut down to numbers, dates and totals once the invoice is recorded and deleted after 90 days in any case; stored files nothing needs are removed daily.
• Email sent to your intake address is recorded automatically only when its sender passes DMARC authentication and is someone your organization already knows; everything else waits for a person to confirm.

Keeping the service reliable

• Rate limits on document reading, the assistant, uploads, inbound email and share links.
• Error reports exclude personal information, request contents, AI inputs and outputs, and the values in database queries.
• Pages can't be embedded by other sites, and browsers are told not to guess file types.

Your data, your control

• Admins can export all of the organization's data at any time from the Billing page.
• When a subscription or trial ends, data is kept for 30 days so you can return or export it, then deleted. See the Privacy Policy.

Service providers

These providers process data on our behalf to run ContractPlan. All process it in the United States.

Reporting a security problem

If you believe you have found a vulnerability, email hello@contractplan.com with the details. Please don't access other organizations' data or disrupt the service while testing. We will reply, keep you informed and credit you if you wish.