For purchasing and compliance

Approving new software often means a vendor form, a security questionnaire and questions about AI and accessibility. This page collects the answers. For anything else, write to hello@contractplan.com.

The vendor

Available on request

• Form W-9
• A data processing agreement
• Answers to your security questionnaire, usually within a week
• Accessibility conformance report (self-assessed)
• Help with a purchase order or a vendor registration form

Email hello@contractplan.com with what your office needs.

Data handling in brief

• Built for aggregate counts, not client records: ContractPlan holds contract terms, invoices and payments, and aggregate service counts. It is not designed to hold protected health information. If an invoice or report you send lists clients, only its amounts, units and dates are kept. The file is deleted after reading, and what was read from it is deleted within 90 days.
• Each organization's data is kept separate in the database by row-level security, checked by an automated test on every change.
• HTTPS everywhere; the database and stored files are encrypted at rest.
• Every change to contracts and billing is recorded in an audit log that cannot be edited: who and when.
• Admins can export the organization's data at any time: a spreadsheet of every record, every stored file, and the complete data as stored (JSON). When a subscription ends, data is kept 30 days, then deleted.
• No SOC 2 or ISO 27001 certification yet. The hosting and database providers below hold their own.

The full description is on the Security page, and the legal terms are in the Terms and Privacy Policy.

How ContractPlan uses AI

• What it does: reads uploaded contracts, amendments, invoices and reports to fill in fields, and answers questions about your organization's own figures.
• A person decides: nothing it reads is saved until someone reviews it. Automatic recording of emailed invoices is off unless an admin turns it on, and can be undone.
• No training on your data: the model is Anthropic's Claude, under commercial terms that do not allow it to train on customer content.
• No decisions about people: it is not used to decide who receives services or to assess individuals.
• It can be turned off: an admin can switch AI off for the whole organization. Nothing is then sent to the AI provider, and everything works by hand.

Accessibility

ContractPlan is designed to meet the Web Content Accessibility Guidelines (WCAG) 2.1 at level AA, the standard most public agencies use. It has not had an independent audit yet. We fix problems people report.

• Tasks are designed to work with the keyboard alone, with visible focus and a link to skip to the content.
• Charts can also be shown as a table.
• Pace and status have a symbol and a word as well as a color.
• Light and dark modes, text that resizes with the browser, and layouts that work on a phone.

If something gets in your way, email hello@contractplan.com and we will fix it or help you another way.

For area agencies and county departments

If your providers are underspending, write to us about using ContractPlan across your network.

Service providers