Is my contract data secure?
Contract drafts contain sensitive commercial terms. Contract Gorilla is built so that confidentiality is the default, not an afterthought.
Questionnaires and generated contract bodies live in Cloud SQL on GCP with Google-managed encryption at rest. The API connects over the Cloud SQL connector with encryption in transit.
Access is scoped to your organization on every request. Sign-in uses short-lived, hashed magic links and HttpOnly session cookies; logout bumps a server-side token version so stolen cookies stop working.
AI draft generation and PDF export run on the server with signed service calls—keys stay out of the browser. From Settings you can export everything we store or delete your account to wipe contracts and branding while keeping contact and billing for legal obligations.
When you use optional features, content may briefly leave GCP. This post is our published subprocessor list:
- Google Cloud Platform — https://cloud.google.com/
- Stripe — https://stripe.com/
- Brevo — https://www.brevo.com/
- Mailgun — https://www.mailgun.com/
- pdf.co — https://pdf.co/
- Google Gemini — https://ai.google.dev/
- Perplexity — https://www.perplexity.ai/
- ElevenLabs — https://elevenlabs.io/
- Contracts encrypted at rest in Cloud SQL with TLS to the API
- Tenant isolation on every contract read and write
- Server-side AI and PDF—no secrets in the frontend
- Self-service export and business-data deletion in Settings