Aracor AI vs Luminance: how they compare in 2026

Remove the models and nothing remains to sell. Every function the product is described by is an inference over an uploaded document set: a fully cited term comparison produced without setup or prompting, structured due diligence workflows, one-click summarisation of entire folders, redlining against preset or custom criteria, sentence-level citation of answers back to source text, optical character recognition over scanned material, and signature verification. There is no document management system, no data room and no workflow product underneath that a buyer would license on its own; the deal environment exists to hold the documents the models read and the findings they produce. The agreement states the architecture rather than leaving it to marketing, article 4.5 recording that outputs are generated by third-party large language models enhanced by Aracor's own Legal AI Engine. Rebuilt from first-party retrieval 5 September 2026.

The artificial intelligence is the product, and the vendor owns more of the stack than almost anyone on this index. Founded by mathematicians in 2015, it runs a multi model architecture it calls a Panel of Judges combining foundation, fine tuned and proprietary models, and ships its own legal intelligence model, Luna Crescent, trained in house and deployed in its own environment. Remove the models and there is no product.

Grounding is the product's organising claim and it is described concretely, while nothing about accuracy is measured. Outputs are stated to link to exact source language and decision logic, answers carry sentence-level citations drawn directly from the material, and term comparisons are delivered fully cited, so a reader can open the source and check the assertion against it, which is what the band asks for. The candour extends into the agreement: article 4.4 warns that outputs may not always be accurate and may contain material inaccuracies even where they appear accurate because of their level of detail or specificity, and that the customer should not rely on any output without independently confirming it, while article 9.4 records that the models are probabilistic. That is an unusually direct hallucination disclosure for a vendor selling defensibility. What is absent is any test of the claim: no accuracy figure, no evaluation, no test set, no error rate and no benchmark page appears anywhere on the estate, so the traceability architecture is documented and unquantified.

Substantive disclosure with a real gap. The vendor publishes ContractIQ Bench, a proprietary benchmark of 189,000 manually annotated and reviewed data points assessing interpretation of named provision types including liability caps, termination for convenience and confidentiality obligations, tested on held out documents and concepts excluded from training, with blind evaluations by legal experts alongside. It publishes a result, 5 percent higher accuracy than leading general purpose models on contract understanding, and a speed figure of 200 to 400 tokens per second. It also states a design principle directly relevant to this axis: the model is trained to prioritise faithful extraction and to identify absence rather than invent an answer. Two gaps keep it off an A. The published figure is a relative delta with no absolute accuracy rate and no named comparator models, so a reader cannot tell what 5 percent higher is 5 percent higher than. And the benchmark is proprietary, with no sample tasks or rubric published, so an outsider cannot inspect or re run it.

The review obligation is written into the agreement and the threshold is not. Article 9.3 requires that the customer will not rely on any output without seeking the advice of, or vetting the output through, a duly licensed and qualified lawyer in the applicable subject matter and jurisdiction, and article 9.4 adds that output should be evaluated for accuracy as appropriate to the use case, including by ensuring qualified lawyer review. That is a written commitment placing a supervising lawyer between the model and the decision, and the review surface is real rather than nominal, since every output is tied to source language a reviewer can open. What is missing is the machine's side. Nothing states what runs unattended, and the marketing points the other way, selling a fully cited comparison in minutes with no setup and no prompting, which describes autonomous processing of an entire document set. No confidence signal, escalation path or error-handling route is described, and nothing addresses what happens when a cited finding is wrong.

A real published commitment with a described control mechanism, short of the full structure. The Panel of Judges architecture is itself an oversight design and is documented: multiple models analyse each clause independently and reach consensus, which the vendor states reduces hallucination risk. Outputs are described as traceable, and Traffic Light Analysis ranks deviation risk visually so a reviewer sees where to look. The vendor publishes a position piece arguing that human in the loop alone is insufficient and that systems must be designed for accuracy and transparency, which is a real stated philosophy rather than a slogan. Not located as of 29 Aug 2026: where the review point sits when the product negotiates with a counterparty directly, the threshold at which it escalates to a lawyer, and what the vendor commits to when an output is wrong. That first gap matters here more than for most, because the product sends agreements to counterparties and negotiates on the customer's behalf.

Attributed customers and published figures, joined loosely and dated nowhere. Two testimonials carry a full name, role and organisation: Nader A. Mettawa, General Counsel at Dabico Group, and Richard F. Christesen, Senior Commercial and Corporate Counsel at Constructor Group, whose account is linked to a case study whose own title claims 85 per cent of review time saved. A further customer story on the user stories page reports review time on large document sets cut by at least 40 per cent. A logo strip names eight organisations including Dabico Airport Solutions, Virtuozzo, Chainstack, Constructor Capital and Dutchess Management. Three things hold it below the top band and each is checkable. Nothing is dated and no method accompanies either percentage. Fuel Venture Capital appears in the customer logo strip and is also the lead investor in the company, which a reader should be able to see stated. And the first quotation in the user stories carousel is attributed to Kevin J. Sullivan, Senior Advisor, Aracor, which is the vendor's own advisor presented alongside customers.

Real deployment evidence with substance, short of attribution and method. Named customers appear in vendor and trade material including Hitachi, AMD, BBC Studios, Yokogawa and Koch, alongside a stated base of more than 700 organisations across 70 plus countries and all four of the Big Four consultancies. A customers page is published. The recurring figure, negotiation time reduced by up to 90 percent, is a vendor claim carrying a hedge and is not tied to any named customer, dated, or accompanied by a method. Searched the site, the customers page, the press releases and the resources index on 29 Aug 2026 and located no case study pairing a named organisation with figures and a date.

Among the strongest confidentiality architectures in this corpus, and the privilege limb is missing. Zero data retention is the default rather than an option: documents are processed only during a session, never stored or reused, inside isolated execution environments, with runtime isolation for every session, encryption in transit at TLS 1.2 or higher and at rest with AES-256, optional customer-managed encryption keys, role-based access control, multi-factor authentication and comprehensive audit logging. Downstream model providers are contractually required to support zero data retention, and article 4.6 commits that neither the third-party models nor Aracor's own engine will be trained on customer content without explicit consent. Article VI makes customer content the customer's proprietary information, and the deployment options let a customer keep processing inside its own environment entirely. Two things hold it here. No privilege or work product treatment appears anywhere, on a product built for transaction documents where privilege routinely attaches. And the same confidentiality clause qualifies itself, article 6.2 permitting use of proprietary information as necessary to facilitate the provision, improvement and enhancement of the services, with the obligation expiring five years after disclosure.

Substantive published commitments, short of the full picture. Segregation is the strongest element and is documented precisely: each customer receives a dedicated single tenant instance with complete isolation and no co mingling of data, which exceeds the level this buyer segment requires under the amended band. Access control is documented at an unusual depth, including that vendor staff cannot view customer documents without explicit authorisation given through the user interface, with all access tracked and audited. Encryption is specified to the key management service, cipher and rotation practice. Two gaps hold this off an A. No training prohibition on customer content was located anywhere in vendor material, which is a conspicuous absence for a vendor that trains its own models and publishes a corpus figure of 220 million legal documents. Attorney client privilege and work product handling is not addressed directly.

A real published position, specific about jurisdiction, with no engagement with the professional rules themselves. Article 9.3 states that output may concern issues related to legal services or documents but is not formal legal advice, that Aracor's provision of services and all related output are for general informational purposes only, and that the customer will not rely on any output without seeking the advice of, or vetting the output through, a duly licensed and qualified lawyer in the applicable subject matter and jurisdiction. Naming the jurisdiction and the subject matter competence of the reviewing lawyer is more than a boilerplate disclaimer and is the substance of what the axis asks. Article 9.4 reinforces it, making the customer responsible for all decisions taken or not taken on the basis of output and requiring qualified lawyer review. What is absent is the professional layer: no bar association, rule of professional conduct or ethics opinion is named anywhere, and nothing addresses the supervision or competence duties of a firm putting a machine-produced diligence finding in front of a client.

A boilerplate structure sits in the terms while the product is sold well beyond lawyers. Dedicated solution pages target compliance, executive, sales, procurement, finance, human resources and marketing teams alongside legal, and the product negotiates contracts on a customer's behalf. Searched the site, the solution pages, the published terms and conditions, the privacy policy and the resources index on 29 Aug 2026 and located no position on advice versus tooling, no treatment of competence or supervision duties, and no statement of jurisdiction limits, despite operation in more than 70 countries. This is the widest version of the non lawyer distribution question on the index so far, since the tool is marketed to marketing and HR departments.

No governance position was located, and the estate carries a heading that promises one. The security page has a section titled Continuous Security and Responsible AI Development, and everything under it is security engineering: independent penetration testing, continuous vulnerability scanning, security reviews for new features, a controlled bug bounty with vetted researchers, threat modelling, secure coding practices, peer security reviews, red and blue team exercises and formal incident response procedures. Those are real and they are graded on the stewardship row. None of them is AI governance. Nothing published names a person or function accountable for model behaviour, describes pre-release evaluation of outputs, sets out an AI policy or principles, or addresses uneven performance, which on this product would bear on how findings behave across document types, deal sizes, languages and the non-English material the platform advertises support for. No ISO 42001 or equivalent is claimed. The site navigation and footer were inventoried on 5 September 2026 and the published policy set is the terms of service, the privacy policy and a data processing addendum.

Principles and architecture are published without a governance mechanism a buyer could audit. What exists is real and substantial: a published white paper on how the AI is built, a named Director of AI who authors technical material under his own name, a Cambridge based research team, a described validation regime through ContractIQ Bench, and a security advisory board of named external experts. But the security advisory board governs security rather than model behaviour, and no equivalent exists for AI governance. Not located as of 29 Aug 2026: a named owner of model governance, a pre release testing gate as distinct from benchmark results, an AI management certification such as ISO 42001, and anything on uneven output across matter types, parties or populations.

Retention, deletion and access are answered with unusual directness and the supplier picture is incomplete. Zero data retention is the default architecture: data is processed only during a session, never stored, logged or reused, in isolated execution environments, and downstream providers are contractually required to support the same. Article 8.3 gives the customer the option to delete customer content at any time in the product. Access controls are enumerated rather than asserted, covering TLS 1.2 or higher in transit, AES-256 at rest, optional customer-managed encryption keys, runtime isolation per session, role-based access control, multi-factor authentication and comprehensive audit logging. Testing is continuous rather than annual, with independent penetration testing, continuous vulnerability scanning, security review of every new feature and a controlled bug bounty, alongside formal incident response procedures. What keeps this off the top band is what a buyer still cannot see: no subprocessor register is published beyond the model providers and the two named payment processors, no hosting provider is identified for the Aracor-managed option, and no breach notification commitment or timeline was located in the terms or on the security page.

Substantive published policy covering most of the ground, at an unusual level of specificity. Published in the security FAQ: AWS Key Management Service encryption at S3 and EC2 level with AES-256 keys rotated regularly, TLS 1.2 or higher in transit, dedicated single tenant instances, role based and division level permissions configured by the customer under least privilege, configurable password and session timeout policy, mandatory staff security training, named threat detection through Darktrace's Enterprise Immune System and Juniper firewalls, and a described incident management process covering detection, mitigation and communication. Backups are stated precisely: nightly to a secondary AWS data centre in the same region, encrypted, retained a minimum of 14 days. Not located as of 29 Aug 2026: a retention period or deletion control for customer documents in normal operation as distinct from backups, and a named subprocessor list.

The allocation of loss is published, readable before signing, and runs one way to an extent worth stating plainly. Article 10.1 caps Aracor's total liability for all damages, losses and causes of action, in contract or tort including negligence, at one dollar. That is the lowest cap located anywhere in this corpus and, on a product sold for merger and acquisition diligence where a missed obligation is the loss in question, it is effectively no recourse rather than a limited one. Article 9.1 provides the services as is with all warranties disclaimed, and article 9.2 disclaims specifically that the services will produce accurate or relevant content, that output will be satisfactory, and that Aracor has any control over the operation or continued availability of the AI models. Article 10.3 runs the indemnity from the customer to Aracor, covering use of the services, breach and interaction with customer content; there is no vendor-side indemnity of any kind, including for intellectual property. The only recourse published is commercial, a fourteen-day refund window under article 7.4. This is the middle band because the exposure the product creates is squarely addressed rather than unstated.

Liability is addressed only through published terms carrying a standard structure. Terms and conditions are published openly alongside a privacy policy, cookie policy and anti slavery statement, so a buyer can read the allocation of loss before entering a sales process, which keeps this above a pure absence. Searched those documents, the security page and the security standards white paper entry point on 29 Aug 2026 and located no indemnity running to the customer for third party claims arising from output, no warranty on output, no stated liability cap figure and no insurance position. Worth noting the product negotiates with counterparties on a customer's behalf, which raises the recourse question more sharply than a review only tool.

One named surface a lawyer already works in, and nothing else. The product material states that contract review can be run in Word or in the Aracor platform, so Microsoft Word is a named integration with its function described at workflow level, and Aracor maintains a listing in Microsoft's own marketplace. That is the whole of it. No document management system is named, so nothing addresses iManage or NetDocuments; no virtual data room is named, which is a conspicuous absence on a diligence product whose input is a data room; no matter management, CLM or e-signature counterparty appears; and no API, developer documentation or field mapping was located on any page read. The agreement gestures at connections without specifying them, article 5.1 reserving rights in technology developed in connection with the services including integrations, while article 3.1(v) prohibits deploying software applications to run automated tasks against the service. A buyer would learn nothing about what moves between Aracor and their existing systems, or what they would need to configure.

Integrations are asserted at platform level with no documentation an implementer could use. The vendor describes connecting intake, negotiation, workflow and repository intelligence in one platform, and a Collaborate product exists for working with counterparties, and third party sources reference Microsoft Word and Outlook working surfaces. What was not located on the vendor's own property as of 29 Aug 2026, after checking the platform pages, the technology page, the security page and the resources index, is any integrations page, any named connector for document management, contract lifecycle, e signature, CRM or ERP, and any description of what an integration moves or what an administrator configures. For an enterprise platform sold to procurement and finance functions, that absence is notable.

The tenancy limb is answered in more depth than anything else in this lane and the region limb is not addressed at all. Three deployment options are published and specified rather than listed. The first uses cloud models managed by Aracor, with data processed inside Aracor's isolated execution environment under zero data retention. The second routes requests through the customer's own API keys with the model provider, so the customer keeps its own contract, vendor terms and obligations, and Aracor acts solely as a secure interface. The third deploys a private model exclusively for the organisation, running either inside the customer's own environment including on premises or in its virtual private cloud, or in a fully isolated Aracor-managed deployment, with all computation and data remaining within the controlled environment. That is a genuine spectrum of isolation a buyer can match to a risk profile. Against it, no region is named anywhere for storage or processing, no cloud provider is identified for the Aracor-managed options, and no residency commitment appears in the terms or on the security page, which matters for a product sold into European transactions.

Deployment model is stated clearly with partial residency detail. Three things are published and specific: a dedicated single tenant AWS instance per customer with complete isolation, deployment within the customer's own environment as an alternative to the hosted option, and backup to a secondary AWS data centre within the same region, which confirms data stays in region. The vendor states AWS global infrastructure provides a solution tailored to geographic requirements. What is missing is the list: no named available regions, no statement of which regions a customer may select, and no statement of where processing happens as distinct from where data is stored. The single tenant and on premises options are genuinely stronger than most of this index.

Certification marks are displayed and the accompanying words stop short of claiming certification. Four badges appear on the home page and twice on the security page, an AICPA SOC mark, an ISO mark, a zero data retention mark and a GDPR mark. The sentence they sit beside says that processing happens within secure, isolated environments aligned with ISO 27001, SOC 2 and GDPR, and a later line says Aracor aligns with globally recognised standards. Aligned with is not certified, and the distinction is the whole question on this axis: no certification body is named, no certificate number, no examination period, no scope or statement of applicability, and no report or summary is published on any readable surface. A Security Whitepaper is offered in the resources list and its link resolves to an empty anchor. One retrieval limit is recorded and is not held against the vendor: a trust centre exists at a published subdomain, is linked from the home page and twice from the security page, and refused automated access through bot detection, so what it contains and whether it is self-serve or gated could not be established, and the lower tier is graded for that reason.

Certification is real and stated with correct nouns, short of accessible evidence. ISO 27001:2022 is named with its version and described as certification, and the SOC 2 Type 2 language is precise: the vendor says successful completion of a SOC 2 Type 2 examination assessing controls related to security, availability and confidentiality, which is the correct noun for SOC 2 and names the trust services criteria in scope. That is more careful phrasing than most vendors on this index manage. Regular independent third party penetration testing is stated. A named external security advisory board including a former Director General of MI5 and two former Darktrace executives is published with full biographies. What is missing is the evidence route: no trust portal was located, no report is downloadable or requestable through a published flow, and no coverage period, report date or auditor name was located as of 29 Aug 2026. A security standards white paper is published, which is the nearest thing to an evidence route.

Three of the four limbs are answered, two of them in the agreement itself rather than in marketing. Article 4.5 identifies the third-party large language models integrated into the service as OpenAI's GPT models, Google Gemini and Anthropic Claude, and names Aracor's own Legal AI Engine as the layer enhancing them, so a buyer learns from the contract which companies process its documents. The security page adds the supported zero-retention model set as ChatGPT, GPT-OSS, Claude and Gemini. The hosting arrangement is described in more detail than most records manage, through the three deployment options, and article 4.7 records that business licences have been purchased with those providers exempting uploaded data from model training. What fails is the fourth limb and one part of the first. No version is given for any model, so the naming is at product-family level only, and no commitment to notify customers when the model set or a provider changes was located anywhere, which matters because the customer's own risk assessment is built on which model is reading the deal.

The supply chain is partly disclosed and the architecture is described in more depth than most. The vendor publishes that it runs a multi model Panel of Judges combining foundation, fine tuned and proprietary models, that it continuously evaluates and selects the best model per task, and that its own model Luna Crescent is deployed inside its own AWS environment. It states the supply chain consequence explicitly and in the customer's terms: owning the model reduces reliance on external model providers, limits data exposure to additional subprocessors, and protects customers from third party availability, pricing and access disruption. Hosting is named as AWS. What is not published is which foundation models sit in the panel, from which providers, or which tasks route to them, and no subprocessor list or change notification commitment was located as of 29 Aug 2026. A buyer therefore knows the shape of the chain and its own model, but not the third party links in it.

No pricing information is published at any level, including the unit of charge. There is no pricing page in the navigation or the footer, and every commercial route across the estate is the same one, talk to sales. Nothing states whether the service is charged per user, per deal, per document, per page or per organisation, no rate, band or minimum appears, no tier names are given, and no term length is stated, which is a live gap on a product whose three deployment options plainly carry different costs. The payment article describes mechanics rather than price: fees are payable in advance and non-refundable, a fourteen-day refund window applies to a new subscription, payment is processed by named third parties, and purchases may also be made through a distributor. One discrepancy is recorded because a buyer would notice it: article 7.1 obliges the customer to pay in accordance with the published prices, charges and billing terms in effect at the time, and no published prices were located anywhere on the estate. Searched the full navigation and footer on 5 September 2026. No pricing row is owed.

Checked the site navigation, the platform and solution pages, the customers page, the about section and the footer on 29 Aug 2026. No pricing page exists on the property, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path terminates in a demo request. No free trial or self serve entry point was located, and no third party pricing figure was located either.

Three buyer segments are defined with real specificity and the boundary is never drawn. Each has its own page and its own stated jobs: investment funds, broken out as private equity, venture capital, growth and family offices, buying to evaluate deals faster and spot issues early; in-house legal and corporate development, buying to keep deal terms aligned across stakeholders and maintain defensible records; and law firms, described as private equity, venture capital, mergers and acquisitions and corporate advisory practices, buying to accelerate reviews and keep work defensible. That is a clearer account of who the product is for than most records in this lane. Practice depth is transactional throughout, covering diligence, term comparison, negotiation, closing and post-closing obligations, and multi-language document support is claimed for global workflows. What is absent is the limit. Nothing states which transaction types or sizes the product does not suit, no jurisdiction is named for the diligence workflows, no firm or fund size is addressed, and the languages behind the multi-language claim are never listed.

Who the product serves is documented precisely across two dimensions, each with its own published pages. Six industries: manufacturing, financial services, pharmaceutical, technology, insurance and chemical. Eight business functions: legal, compliance, executive, sales, procurement, finance, human resources and marketing. Both law firms and corporate legal departments are addressed, with a stated base of more than 700 organisations across more than 70 countries including all four Big Four consultancies and named enterprises. An academic programme is published as a separate segment. The practice boundary is clear from the structure and consistent throughout: this is contract work end to end, from generation through negotiation to post execution analysis and investigation, and nothing on the property claims litigation or research capability it does not have.