Automatic backups: a daily backup to your own storage

The screenshots in this article show the German interface. The English label is given first, with the German label in square brackets.

Your benefit

You are not dependent on ContractHero as the sole storage location: the backups are written directly to storage that you manage and have access to. That simplifies internal compliance and GDPR requirements (availability, recoverability), gives your IT team a clean recovery option in an emergency and builds trust during audits — your contract data never leaves your area of responsibility.

Automatic backups are part of the Enterprise plan.

How it works

1. Open the backup area

Go to Settings [Einstellungen]

Then go to Backup.

You will see the Backup methods [Backup-Methoden] card with the subtitle "Configuration for automatic backups via AWS S3, SFTP or FTPS server" [Konfiguration für automatische Backups über AWS S3, SFTP oder FTPS-Server] and the selection Please select the server [Bitte wählen Sie den Server].

2. Select the server type

Choose one of the four methods:

• AWS S3 — backup to your Amazon S3 bucket. Recommended if your organisation already works in AWS.
• Custom S3 — backup to S3-compatible storage from other providers (e.g. Wasabi, Backblaze B2, MinIO, your own S3 implementation).
• SFTP — backup via SFTP to a classic server (default port 22).
• FTPS — backup via FTPS (FTP over TLS, default port 21).

3. Enter the connection details

Depending on the method, fill in the following mandatory fields:

• AWS S3: Storage class (default: "S3 Glacier Flexible Retrieval"), Bucket, Access Key, Secret Access Key, Region (default: eu-central-1).
• Custom S3: Endpoint URL [Endpunkt-URL] (the full URL for your S3-compatible storage, e.g. https://s3.your-provider.com), Bucket, Access Key, Secret Access Key.
• SFTP / FTPS: Hostname, Port, Username, Password [Passwort], Path (target directory on the server).

Optional: Password for the zip file [Passwort für die Zip-Datei] — if this is set, ContractHero additionally encrypts the backup archive with this password. Recommended if the target storage is only partially secured or if third parties could have read access.

4. AWS S3 — set the IAM permissions

For AWS S3, ContractHero shows a ready-made IAM policy in the help area on the right, with only the rights that are needed (s3:PutObject). Use Copy to clipboard [In die Zwischenablage kopieren] to transfer the JSON straight into your AWS console and create a new IAM user exclusively for ContractHero backups. Enter that user's Access Key and Secret in the backup configuration.

ContractHero's recommendation: enable bucket versioning, so that you keep several versions of every backup and can also restore older states.

5. Save the configuration

Click Update [Aktualisieren]. From the next scheduled backup run onwards, the data will be written to the storage you have configured.

6. Check the ongoing backups

At the bottom of the backup page you will find the Latest actions [Letzte Aktionen] card with the history of all backup activity and of any errors that have occurred. For each entry you can see Created at [Erstellt am], Status and Message [Nachricht] — the quickest way to check whether the backups are running successfully.

Frequently asked questions

How often is a backup created?
Once a day, automatically — you do not have to trigger the run manually.

What exactly is backed up?
Your contracts, including contract data and documents. This means your ContractHero records can be restored independently of the service.

Which plans can use automatic backups?
Automatic backups are part of the Enterprise plan. In all other plans the Backup menu item is not visible, unless you have purchased this add-on.

Where are the backups located physically?
In the storage that you configure — your own S3 bucket, your own SFTP/FTPS server. ContractHero does not keep a copy outside this destination. ContractHero itself does of course create backups at regular intervals, for security reasons.

Can I run several backup destinations in parallel?
At present, exactly one active backup destination per organisation is provided for. If you want to switch destinations, adjust the configuration and click Update [Aktualisieren].

What happens if a backup fails?
The error appears in Latest actions [Letzte Aktionen] with a status and a message (e.g. "Access Denied", "Bucket not found" [Bucket nicht gefunden]). Correct the connection details or the permissions; the next regular run will repeat the attempt.

Do I need my own AWS account?
For the AWS S3 method, yes — you need an AWS account with a bucket and an IAM user with s3:PutObject rights. If you do not have an AWS account, Custom S3, SFTP or FTPS are alternatives.

Good to know

• Security at the target system is your responsibility. ContractHero writes backups to the storage you configure — as the operator, you are responsible for access control (IAM, SFTP user, firewall) and for encryption at the destination.
• The zip password as an additional layer. The optional password for the zip file is a layer of encryption on top of the transport and storage encryption — useful if the target storage is managed by a third party.
• IAM best practice for AWS S3. Do not use a root account or an administrative IAM user for the backup credentials. The policy suggested in the interface contains s3:PutObject only — no read, delete or listing rights.
• Bucket versioning recommended. This keeps backups from being overwritten accidentally and lets you go back to earlier daily states.
• Default region eu-central-1. For AWS S3, Frankfurt is preset — relevant from a GDPR point of view if no other region is necessary.

Related articles

• How can roles and permissions be managed for additional users?
• What is the Advanced Permission Concept (APC)?
• How do I set up SSO?

Updated on: 08/26/2026