Security
How Cloudtract protects contract documents: private storage, per-entity access scoping, human confirmation for consequential actions and a published subprocessor list.
Access is scoped, not shared
Documents belong to a legal entity inside a group. Access is granted per entity and enforced server-side on every request, not in the browser.
Source documents are immutable
An uploaded contract is never overwritten. Extracted and interpreted data is versioned and always shown next to the source it came from.
No autonomous consequential action
Cloudtract never pays, cancels, or contacts a supplier on its own. Every action with a real-world consequence needs an explicit human confirmation.
AI stays inside its lane
Models classify, extract, interpret and draft. Dates, money, percentages and entitlements are always computed by deterministic code.
Hosting region and subprocessors
The production hosting region and the full subprocessor list are published here once the backend project location and every material subprocessor have been verified. Until then Cloudtract makes no data-residency claim.