Can I upload a contract to test it?

Only if you are authorised to share it. During the preview, use the fictional sample instead; when the beta opens, start with one agreement you are allowed to upload.

Who at Agreedio can see my documents?

Access to customer data is limited to named staff for support and incident response, is logged, and is described in the privacy policy. We will publish the specific access procedure before the paid beta opens.

Where is data stored?

The region and providers are published on this page before the paid beta opens, with links to each provider's own terms. We will not describe this vaguely.

Security and data · updated 2026-09-07

Where your files go, who can see them, and how you leave.

Specific practices rather than reassurance. This page is updated whenever the practice changes, and the date of the last change is printed on it.

Read the privacy policy Ask a question

Access

A workspace belongs to one organisation. Only the internal users you invite can sign in; counterparties are labels on a record and never receive access or messages.

Role-based access within the workspace; owners can be reassigned by an administrator
Every confirmation, edit, reassignment and export is recorded with who did it and when
Removing a member reassigns their agreements and stops any pending reminder to them

Files and processing

Uploaded originals are stored immutably and encrypted in transit and at rest. Extraction runs on the document you uploaded; the excerpt shown beside each term is the actual text from that file.

You must be authorised to upload a document; the product asks you to confirm this
The specific AI provider, region and data-retention terms are published here before the paid beta opens
No contract text, filenames or counterparty names are sent to marketing analytics

Retention and deletion

Records and files are kept for the service term. You can delete an agreement at any time, and the deletion is recorded.

Deleted files are removed from primary storage promptly and from backups on a stated schedule, published here before launch
The proposed 30-day read-only export window after service ends is published as policy only once implemented
Nothing is used to train a model

Export and portability

Leaving is a button. Export the original files, the register as CSV and every confirmation as JSON, with the source references intact.

Exports are available throughout the service term, not only at cancellation
The CSV keeps the same column meanings as our published spreadsheet template
No call, no retention offer, no waiting period

Reliability of reminders

Confirmed reminders run on deterministic application logic, independent of the AI allowance. Delivery is retried and reconciled; a failure is shown in the action queue and can be reassigned.

A reminder that could not be delivered is never marked sent
Reminders for a superseded rule are cancelled; sent ones remain in history
Reminders continue until the exact service-end timestamp you can see in settings

Honesty

What we do not claim

We do not hold a SOC 2 or ISO 27001 certification and will not imply one. If that changes it will be stated here with the report available on request.
We do not offer single sign-on, data residency choices or bespoke security questionnaires in Phase 1.
We do not describe the product as a system of legal record. It is agreement administration.

Common questions.

Read the policy, then judge the product.

The privacy policy and terms are short and specific. The sample agreement shows exactly what a record holds and what leaves the workspace, which is nothing.