Backups in ContractHero: Automatic or on Request

The screenshots in this article show the German interface. The English label is given first, with the German label in square brackets.

Your benefit

Anyone who keeps business-critical contracts centrally in one system never wants to have to rely on a single layer of data. The backup options let you meet the usual requirements from compliance, IT security and contingency planning:

• Your data under your control — you send the backup to your own storage (cloud bucket or server).
• Regular automatic backups — once set up, the backup runs in the background.
• One-off backups at the push of a button — for example for a cut-off date, a migration or an audit.

Method 1: Automatic backups (self-service)

Under Settings [Einstellungen] → Backup you set up automatic backups to your own storage. ContractHero currently supports four methods:

How it works (AWS S3 example)

1. Open the backup area

Navigate to Settings [Einstellungen].

Navigate to** Backup**.

You will see the “Backup methods” [Backup-Methoden] card with the subtitle “Configuration for automatic backups via AWS S3, SFTP or FTPS server” [„Konfiguration für automatische Backups über AWS S3, SFTP oder FTPS-Server“] and the choice of the four server types.

2. Select and configure AWS S3

Enter the required values:

• Storage class — default: “S3 Glacier Flexible Retrieval” (cost-efficient for long-term backups).
• Bucket — the name of your S3 bucket.
• Access Key and Secret Access Key — IAM credentials with write permission.
• Region — default: “eu-central-1” (Frankfurt).
• Password for the ZIP file (optional) [Passwort für die Zip-Datei (optional)] — if set, the backup is stored in encrypted form.

3. Set the IAM permissions in your AWS account

We recommend a dedicated IAM user with s3:PutObject rights on the bucket and nothing else. Example policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YourBucket/*"
    }
  ]
}

That way ContractHero can only write — no read or delete operations on your bucket.

4. Enable bucket versioning (recommended)

In the S3 bucket properties, enable Versioning. Several versions of your backup are then available — you can fall back on an earlier state if a backup is damaged or an error comes to light.

5. Save the configuration

Click “Update” [Aktualisieren]. From now on, the automatic backup runs in the background.

SFTP / FTPS / Custom S3

For SFTP, FTPS and Custom S3, select the corresponding radio button and enter the server URL, port, user name, password or key, and target path. The logic stays the same: ContractHero writes the backup periodically to the storage you have specified.

Method 2: Backup on demand

If you need a one-off backup at a particular point in time — for example to migrate to a new system, for an internal audit or as an additional cut-off date backup — we offer Backup on Demand:

• You request the backup through Support.
• We deliver it within 48 hours.
• We agree the format and the scope of the content with you individually (e.g. only certain categories, only metadata, everything including PDFs).

How to request Backup on Demand

1. Write to us via the ContractHero web chat, by email to support@contracthero.com or by phone on 030 / 577 123 32.
2. Tell us the cut-off date, the scope you want and the destination (email, your own S3, SFTP).
3. We deliver the backup within 48 hours — typically sooner.

Frequently asked questions

What is the difference between an automatic backup and Backup on Demand?
The automatic backup is an ongoing self-service backup to your own storage (S3/SFTP/FTPS). Backup on Demand is a one-off backup created manually by Support for special occasions.

Which methods are available for automatic backups?
Currently AWS S3, Custom S3 (S3-compatible storage), SFTP and FTPS.

Which data is included in the backup?
By default the complete contract data — master data, metadata, contract documents (PDFs). With Backup on Demand we can tailor the scope individually.

How often does the automatic backup run?
Periodically in the background — the exact frequency depends on your configuration. With large volumes of data, a backup run can take longer.

Is the backup encrypted?
With AWS S3 you can set an optional password for the ZIP file [Passwort für die Zip-Datei] — the backup is then stored in encrypted form. On top of that, the server-side encryption of your cloud provider (S3, SFTP) applies, provided it is enabled.

Which permissions does ContractHero need in my AWS account?
Only s3:PutObject on the target bucket. We recommend a dedicated IAM user with this single permission — no read access, no delete access.

What happens if the backup fails?
ContractHero logs backup errors. You can enable notifications for “Backup information” [„Backup Informationen“] (see Related articles, on managing notifications) so that you are informed immediately.

How quickly is Backup on Demand available?
Within 48 hours of your request. For urgent requests, please tell us explicitly.

Does Backup on Demand cost extra?
Backup on Demand is part of our service — for a very large scope or particularly short-notice requests, we agree the effort involved individually.

Can I also export into our own database?
For structured data exports into your own database, the Public REST API is the preferred route. For PDF-based or complete data backups, backups are the right tool.

Good to know

• Bucket versioning is essential for a real emergency. Without versioning, every new backup overwrites the previous one. That will not help you if there is a data problem.
• A dedicated IAM user per system. Use a separate AWS user for ContractHero only — auditable and easy to revoke.
• Choose a region close to where the data originates. If you are based in Germany, eu-central-1 (Frankfurt) is the standard choice — a short route, low latency, local compliance.
• Check the backup contents regularly. Run through a test restore once a quarter — otherwise, when it matters, you will not know whether the backup is genuinely usable.
• Plan for Backup on Demand during migrations. If you are moving to a new CLM or want to set up ContractHero in a new organisation, a Backup on Demand is the clean hand-over point.
• We help with the setup. If you are unsure about the S3 configuration or the IAM policy, we will go through the setup together during onboarding — typically half an hour.

Related articles

• How do I manage notifications in ContractHero?
• Public REST API: controlling ContractHero programmatically
• Webhooks: sending real-time events from ContractHero to your systems
• What information does the change log give me?

Updated on: 08/26/2026