C
ContractHero
ContractHero is contract management software for mid sized and larger companies in Germany, Austria and Switzerland, made by ContractHero GmbH, founded in Berlin in 2020. Contracts uploaded to its repository are read by AI, which fills fields for parties, values, clauses and deadlines and links every value back to the passage it came from. A person confirms each field before it counts as verified. An assistant answers questions about the open contract from that contract alone, and an MCP connector gives Claude, ChatGPT, Copilot and Gemini read only access that follows each user's permissions.
Around that sit deadline tracking with a calculated last possible notice date, approval rules, templates and versioning, a Word add in, eIDAS signatures, multi entity groups and a REST API. Legal departments are one of its named users, beside finance, procurement and management. Data is stored and processed in Frankfurt on AWS, the terms bar the language model providers from training on customer content, and ContractHero holds an ISO 27001 certificate from Proks Certification.
Named customers include NUMA Group, Schüttflix, Eurowings and ZDF. Plans are quoted on request, and the help center gives Essential from €390 a month, billed yearly.
ContractHero, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
ContractHero's AI reads each uploaded contract and fills the data the rest of the product runs on. After OCR and layout detection, it splits the document into chunks, finds the passages that match each field's prompt and writes the value, shaped by an optional instruction for filters and special cases. Fields cover parties, contract values, clauses and deadlines, and customers can write their own prompts per field and contract type, with a prompt assistant and a retrigger to run the analysis again.
The same models write summaries, suggest a category from the existing ones, and power the assistant and the MCP connector. Deadline tracking, reminders, approval rules, templates, signatures and reports run on that data, and users can enter or correct any field by hand. ContractHero claims the analysis cuts review time per contract by up to 80 percent.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Every field the AI fills carries a purple marker and a Jump to Source link that opens the contract at the passage the value came from. Tables are highlighted as a whole, images in scans show the nearest text, and where several passages match, the most likely one is marked. The assistant answers only from the contract's own data with source links, works without internet access, and does not answer what the contract does not say.
ContractHero's help center explains the method: OCR, layout detection, chunking and similarity matching on the field prompt. It also notes that the models were trained mostly on English data, so English prompts are often the most reliable, and that summaries are reliable mainly in German and English. No accuracy or error rate is published. The help center warns that poor scans reduce accuracy and that bulk verification misses errors, and recommends checking amounts and deadlines field by field.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
ContractHero separates what the AI fills from what a person confirms. AI values stay marked with a purple sparkle until a user verifies them, field by field or all at once, and a counter such as 6 of 7 verified shows what is still open. The assistant is read only and cannot change fields or tasks. The MCP connector only reads and respects every existing permission, and AI categorization chooses among existing categories and never overwrites a manual choice.
ContractHero's EU AI Act page states that legal and financial decisions are always made by a person, not the AI, and that AI is labeled wherever it is used. The help center tells users to check the original or involve the legal department before acting on a summary in a legal decision. Deleting a contract can be made subject to an approval rule, and a write permission level allows editing without deletion.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
ContractHero names customers with figures, without dates. Schüttflix legal counsel Lukas Berg says the legal team saves about 20 percent of its working time after four years of use. NUMA Group, with more than 120 hotels in 14 countries, migrated more than 5,000 contracts, reports €100,000 saved in its first year and puts potential savings at €600,000 a year, with its senior associate general counsel quoted. Stadtwerke Leonberg reports €80,000 a year, hhpberlin €100,000 in its first year and Everphone more than 100 hours a year, and Wire says finding a contract went from 10 to 15 minutes to seconds.
Logos include Audi, Eurowings, ZDF, MB Leasing, Dorint and Stadtwerke Stuttgart. None of the 16 success stories gives a date or says how its figures were measured. The company states more than 400 customers and over a million contracts under management.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Clause 15 of ContractHero's terms (AGB), updated October 2026, says contract content sent to the language models is processed only to deliver the service. It is not used to train or improve the models of the subprocessor, the model provider or third parties. The clause adds that content is not passed to the model provider and that processing stays within the EU or EEA. The EU AI Act page repeats that customer data trains neither ContractHero's models nor anyone else's. Assistant chats are private to each user, even from administrators and the organization's owner.
The security overview says content is encrypted on the user's device and that ContractHero itself has no access, without describing key management. Permissions are set per contract, and anyone who can see a contract sees all its fields. Privilege and work product are not mentioned.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
ContractHero's terms say it provides no legal advice (keine Rechtsberatung) and does not check contract content for accuracy or completeness. The values the AI reads are shown to the customer to review, and the customer must correct wrong ones or report them. The assistant help article says the assistant explains what a contract says and is not legal advice, leaving the legal assessment with the user, and the EU AI Act page says legal decisions are made by a person.
ContractHero is sold to legal departments alongside finance, procurement and management, and its legal page says legal departments keep control over content and decisions. Nothing published mentions the German Legal Services Act (Rechtsdienstleistungsgesetz), the duties of in house lawyers, or limits by jurisdiction.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
ContractHero publishes an EU AI Act page. It classifies the contract analysis features as outside the high risk and prohibited categories of Regulation (EU) 2024/1689 and says the AI used is classed as general purpose AI. It commits to labeling AI wherever it appears and states that legal and financial decisions stay with a person. The page says the full assessment sits in ContractHero's trust center at trust.contracthero.com.
In the product, AI values carry a purple marker until verified, and the help center explains the extraction method and its limits, including weaker results on poor scans and in languages other than German and English. No named owner for model behavior, release testing process, evaluation results or AI management certification is published. Nothing addresses whether extraction quality differs across contract types or languages beyond those notes.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
ContractHero's terms set the data lifecycle. After termination the customer keeps read access for 30 calendar days to export, extendable once by 30 days, and ContractHero then deletes its content data, with backups purged within the backup cycle of at most 30 days. Deleted contracts go to a trash first, deletion can require approval, and a write permission level allows editing without deletion. A help article on the data processing agreement, dated February 2026, names the subprocessors.
AWS in Frankfurt is the primary host, Modal Labs supplies compute and AI infrastructure, Qdrant runs the vector database, and Twilio and Crisp complete the list, all in the EU. The terms give 30 days' notice of subprocessor changes and two weeks to object, and commit ContractHero to inform the customer without undue delay of a security incident, with a description of its nature. Encryption is AES 256 at rest and TLS 1.3 in transit, and outside experts run penetration tests twice a year. No retention period is stated for assistant chats, which users can delete.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
ContractHero's published terms (AGB), updated October 2026, cover the self service Start plan, and individually agreed plans run on a version that is not published. Under them, liability is capped at the fees the customer paid in the 12 months before the event, with no cap for intent, gross negligence, injury to life or health, guarantees and product liability. Liability for lost data is limited to what restoring it from proper customer backups would have cost.
The Start plan carries no uptime commitment and no promise of immutable or audit proof storage. ContractHero gives no warranty on what the AI reads and does not check contract content, and the customer must correct wrong values. The customer indemnifies ContractHero against third party claims connected with that processing, including claims by its own employees, and no indemnity from ContractHero to the customer is published. German law applies, with Berlin as the venue.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
ContractHero documents its REST API and webhooks in public OpenAPI docs at api.contracthero.com/docs, available from the Professional plan with an access token. The MCP connector, an add on, gives Claude, ChatGPT, Copilot and Gemini read only access to contract data under each user's permissions, and administrators can switch it on or off for the organization. The Word add in saves a finished document from Word into ContractHero as a PDF, where the AI analysis runs.
Customers set up HubSpot, Power BI, email import and a read only iCal feed for Outlook, Google and Apple calendars themselves, and the Slack app sends notifications and takes slash commands. SharePoint, OneDrive and DocuSign connect on request. The integrations page also calls SAP, DATEV, Salesforce, Dynamics, Personio and Lucanet native, without describing what any of them moves.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
ContractHero is delivered as software as a service from Frankfurt. Its hosting page says storage, processing and archiving take place only in certified data centers in Frankfurt, and the data processing agreement summary names AWS in Frankfurt as the primary host. The AI runs on language models provided as a service by subprocessors, and the terms put that processing within the EU or EEA, while ContractHero's home page places servers and AI models fully in Germany.
Modal Labs supplies compute and AI infrastructure and Qdrant the vector database, both listed in the EU. Enterprise customers can send backups to their own server or bucket over S3, SFTP or FTPS, with eu-central-1 as the default region. No private cloud or on premises option is published.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
ContractHero publishes its ISO/IEC 27001:2022 certificate as a download. Proks Certification GmbH in Düsseldorf issued certificate DE-IS-20240084 for a B2B SaaS platform specializing in contract management, valid from 21 March 2024 to 20 March 2027. It was reissued on 9 February 2026 against a Statement of Applicability dated 20 January 2026, and it shows no accreditation body. ContractHero says the certification covers the whole company and is audited every year.
ISO 27017, ISO 27018 and CSA STAR CCM v4.0 belong to its Frankfurt data centers rather than to ContractHero, and the home page refers to ISO 9001 certified data centers. ContractHero also runs a trust center at trust.contracthero.com, where its EU AI Act page says the AI assessment is published. Outside experts run penetration tests twice a year, and the security policy is dated February 2024.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
ContractHero does not name the language models it uses or their maker. Its terms say the models are provided as a service by one or more subprocessors and that content is not passed to the model provider. The data processing agreement summary names Modal Labs for compute and AI infrastructure and Qdrant for the vector database, both in the EU. The help center describes the architecture: OCR, layout detection, chunking, similarity matching on each field's prompt and an answer shaped by an optional instruction, with training data that is mostly English.
The AI analysis page says the AI is classified as general purpose AI. Subprocessor changes come with 30 days' notice and two weeks to object under the terms. The MCP help article does not say what contract data reaches Claude, ChatGPT, Copilot or Gemini when a user asks questions through the connector.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
ContractHero's pricing page lists three plans, all quoted on request. Essential covers 500 contracts and 5 users with AI analysis and the assistant. Professional covers unlimited contracts and 15 users and adds the Word add in, unlimited simple electronic signatures, the API and reporting. Enterprise covers 50 users and adds multi entity groups, custom single sign on, approval rules and a service level agreement. The MCP connector and eIDAS QES signatures are add ons.
A help article on billing gives Essential from €390 a month, billed yearly in advance by SEPA or card. The terms set a 12 month term that renews automatically unless cancelled three months ahead, and a 7 day trial with no payment method. The pages disagree in places, listing custom single sign on both as an add on and as part of Enterprise, and simple signatures as part of every plan on the signature page.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
ContractHero is built for the German Mittelstand and sells across Germany, Austria and Switzerland to mid sized companies and groups with several legal entities. Its home page addresses management, legal and compliance, finance, procurement and IT, with a dedicated page for legal departments, and it lists manufacturing, energy, healthcare, SaaS, tourism, real estate, retail and municipal utilities among its industries.
Use cases include buy and build, DORA, NIS2, holdings, due diligence and audits. The help center states several limits. AI summaries work on PDFs and are reliable mainly in German and English, and extraction covers more than 30 languages with eight OCR script packs. Multi entity groups are part of Enterprise, and permissions apply per contract, not per field. The help center is in German only, and law firm use is not addressed.
7 public documents
The public pages on file for ContractHero, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
contracthero.com/agb4 signals
Client Data in Training, Prompt and Output Retention, Third Party Request and Subpoena Notice and 1 more
Read Oct 10, 2026
-
support.contracthero.com/de/article/aktualisierung-des-auftragsverarbeitungsvertrags-avv-1opasko1 signal
Outside Counsel Guideline Readiness
Read Oct 10, 2026
-
Court Disclosure Support
Read Oct 10, 2026
-
Billing and Fee Posture
Read Oct 10, 2026
-
Ethical Walls and Matter Segregation
Read Oct 10, 2026
-
Refusal and Uncertainty Behavior
Read Oct 10, 2026
-
Fabricated Citation Record
Read Oct 10, 2026
From €390 per month
- ContractHero's smallest plan, Essential, starts at €390 a month, paid for a year up front.
- Essential covers 500 contracts and 5 users. Bigger plans cover more users and unlimited contracts, and you ask for their price.
- Some extras cost more, like the connector for AI chat tools and the strongest legal kind of electronic signature.
- You can try it free for 7 days without a payment card.
- The contract runs for a year and renews unless you cancel three months ahead.
ContractHero prices Essential, Professional and Enterprise on request. Essential covers 500 contracts and 5 users, Professional unlimited contracts and 15 users, and Enterprise 50 users with multi entity groups, approval rules and a service level agreement. A help article on billing gives Essential from €390 a month, billed annually in advance. The figure is a floor rather than a rate.
Implementation: Not stated. The home page gives go live in six to eight weeks with guided onboarding, and the Start plan terms exclude onboarding, implementation, migration and training from that plan.
Confidentiality and data terms: Not applicable. ContractHero sells under German and EU law, with an Article 28 GDPR data processing agreement in its terms and a separate agreement signed through PandaDoc.
Note: The €390 figure appears in a ContractHero help article on billing, while ContractHero's pricing page marks every plan as on request. The terms published online cover the self service Start plan, and individually agreed plans use terms that are not published. Payment is by SEPA direct debit or card through Chargebee.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The published terms prohibit training on customer content. Not a policy page, the agreement.
Clause 15 of ContractHero's terms (AGB), updated October 2026, says content sent to the language models is processed only to deliver the contracted service. It is not used to train or improve the models of the subprocessor, the model provider or third parties, and it is not passed to the model provider. The EU AI Act page adds that customer data trains neither ContractHero's own models nor anyone else's, and help articles on the AI analysis and the MCP connector repeat that there is no training on customer data.
Assistant chats stay private to each user. The published terms cover the self service Start plan, and the version for individually agreed plans is not published.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The customer controls the retention window, by product configuration or by contractual instruction, but zero retention is not stated as available.
Customers decide what stays in the account during the term. Deleted contracts go to a trash first, deletion can require approval, and assistant chats are private to each user and can be deleted by that user. After termination the customer keeps read access for 30 calendar days, extendable once by 30 days. ContractHero then deletes its content data under clause 15 of the terms, with backups purged within the backup cycle of at most 30 days.
Enterprise customers can also send backups to their own server or bucket. No retention period is stated for assistant chats left in place, or for data held by Modal Labs, which supplies the AI compute. The terms say content is not passed to the model provider.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
ContractHero keeps its own permission model, documented in its help center. A standard model and a rule based model (APC, from the Professional plan) control which users see which contracts, and permissions apply per contract, so anyone who can see a contract sees all its fields. A write level allows editing without deletion, multi entity groups are handled as teams on the Enterprise plan, and assistant chats are private even from administrators.
Access delegation lets an outside legal team see only defined contract types, with ContractHero's own example of an external legal department reviewing NDAs and employment contracts. The MCP connector only reads and follows every existing permission. The change log cannot be edited, though read and download events are not consistently logged in it.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Clause 15 of ContractHero's terms serves as its data processing agreement under Article 28 GDPR. It says that where EU or member state law obliges ContractHero to process data further, ContractHero informs the customer of that legal requirement before processing. The same clause commits it to inform the customer without undue delay of security incidents and of inspections by a data protection authority. ContractHero's hosting page names Frankfurt as the only location for storage and processing, and says the United States CLOUD Act cannot reach data processed in Germany, technically or legally.
No transparency report is published, and the terms do not address requests made under the law of countries outside the EU.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
ContractHero's AI reads the customer's own contracts and fills fields from passages in them, and the assistant answers only from the open contract, without internet access. It does not retrieve case law or legislation. Customers steer extraction with their own prompts and instructions per field and contract type. The help center says the underlying models were trained mostly on English data, and ContractHero does not name the models or describe their training data. Templates and clauses used for drafting are the customer's own, kept with versioning and comparison.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
ContractHero manages and reads contracts and does not cite case law or legislation, so a citator sits outside the product. Its clause library and templates are maintained by the customer with versioning and comparison, and nothing published describes flagging a clause after a change in the law. The calculated last possible notice date is a formula of contract end minus notice period, fed by the customer's own fields. The home page pitches DORA and NIS2 audits as use cases, and how the product follows changes to those regimes is undescribed.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The vendor describes refusal or abstention behavior in public materials.
The assistant answers only from the open contract, and ContractHero states that what is not in the contract is not answered. Off topic questions get a fixed reply saying the assistant only helps with the customer's own data. Extracted values carry a source link and stay marked until a person verifies them, and where several passages match, Jump to Source marks the most likely one. AI categorization picks only from the customer's existing categories and leaves a manual choice untouched.
No confidence measure is shown for a field, and the help center does not say what extraction writes when a value is absent from the contract.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming ContractHero. ContractHero stores and reads contracts for companies rather than producing court filings, so its output does not ordinarily reach a brief. Its assistant answers only from the contract that is open.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Public materials refer to professional responsibility in general terms without naming guidance.
ContractHero's terms say it provides no legal advice and does not check contract content for accuracy or completeness. The assistant help article says the assistant is not legal advice and leaves the legal assessment with the user, and the EU AI Act page keeps legal decisions with a person. Its legal department page says legal teams keep control over content and decisions. No professional conduct guidance is named, and neither the German Legal Services Act nor the rules for admitted in house lawyers (Syndikusrechtsanwälte) are mentioned.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
ContractHero is bought by companies to manage their own contracts, with legal departments one user group among finance, procurement and management. Its named customers are companies rather than law firms, so no client bill sits in the loop. Its savings claims address the buyer's own costs: up to 80 percent less review time per contract, about 20 percent of the Schüttflix legal team's working time, and euro savings at NUMA Group, hhpberlin and Stadtwerke Leonberg. Nothing published addresses fee treatment of AI assisted work for a firm that bills a client.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
A help article on the data processing agreement dated February 2026 names ContractHero's subprocessors: AWS in Frankfurt, Modal Labs, Qdrant, Twilio and Crisp. The trust center at trust.contracthero.com has a subprocessor page, and the terms say a current overview is kept in the customer account or sent on request in text form. Subprocessor changes come with 30 days' notice and two weeks to object. The ISO 27001 certificate and the EU AI Act page are public, while the full data processing agreement is signed through a PandaDoc portal. The language model behind the AI is not named.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Every AI filled value is marked and linked to its source passage, and the verification counter shows which fields a person has confirmed. ContractHero commits to labeling AI wherever it is used. The change log cannot be edited, but read and download events are not consistently logged, it has no one click export, and permanent deletion removes a contract's log with it. Nothing records which model produced a value. ContractHero's output is a contract register and reports rather than court filings, and no disclosure template is published.