August vs Vesence: how they compare in 2026

Every named capability on the product pages is model driven. An Assistant answers across a document, a folder, email or the web; Tabular Review turns thousands of contracts into a comparison grid; clause drafting and rewriting run inside Word; and Agents chain research, analysis and drafting into multistep workflows. No underlying document management or practice management system would survive the models being removed. The systems of record belong to someone else: Word, Outlook, SharePoint and SOS are integrations into the firm's existing stack rather than August's own conventional product. The company calls itself 'Configurable Legal AI' in its own footer and describes co developing workflows on a firm's precedent and drafting standards.

There is no conventional product underneath. The four Office add-ins have no non-model function at all: what they do is draft, redline, reformat, cross-check and quality-check, and each of those is model work. The web workspace holds files, chats and drafts in a project, but it exists to give the agent context rather than to be a document management system, and the vendor describes the whole thing as one agent across five products. The systems of record stay where they are, in Word, Outlook, Excel, PowerPoint and the firm's own files. Annex 1 to the data processing agreement puts it plainly from the other direction, describing the processing as machine learning algorithms processing collected text to generate responses and insights. Remove the models and nothing remains to sell.

The AI Policy of January 2026 states that August runs 'testing protocols for accuracy and reliability verification before and after deployment' and conducts regular audits of AI system performance. It publishes no figure, no test set and no evaluation that could be assessed. Grounding is claimed in product terms rather than described: SharePoint documents 'become available for citation, analysis, and drafting', and the Assistant answers from documents, folders and the web. No retrieval method is published, and the product does not ground to primary authority. The Terms of Service at 1.5 and the AI Policy at section 5 both state that output is AI generated and may contain errors, misstatements or be incomplete. That is a real statement of limits rather than a bare claim not to hallucinate. Accuracy is asserted without measurement.

Accuracy is acknowledged candidly but never measured. Clause 3.6 of the general terms says that, because AI is probabilistic, the services may sometimes produce inaccurate output or suggestions, and that this is not a Defect. Putting that acknowledgment in the operative agreement, rather than a footer disclaimer, is the opposite of claiming there are no hallucinations. No accuracy figure, test set, benchmark or evaluation is published. The product's answer is checking rather than grounding: a one click check described as reviewing hundreds of errors across documents and inboxes, and cross checking spreadsheet data against source documents. Neither is a described retrieval method, and the product does not ground answers in primary law.

Review surfaces are real and specific. In Word, August 'applies changes you can accept or reject in Word's review mode', and the drafting surface shows a Preview step before generation. The AI Policy commits in writing to communicating how AI generated output should be reviewed and verified and to 'the importance of human oversight in legal work', and the Terms of Service at 1.5 place the product on the tool side of the advice line. The threshold at which the system acts alone is missing. The product ships Agents running two step workflows and an Outlook capability described as 'Draft and send replies'. Nothing published states what an agent may complete unattended or what happens after it is wrong.

The review step is strong, but nothing says what the agent does on its own. Every edit an agent makes lands as a tracked change in Word, Excel, PowerPoint and Outlook, with accept and reject controls. The human check is the normal review mode of the application the work already lives in, not a separate approval screen. The duty to use it is in the contract. Clause 4.2 requires the customer to assess the accuracy and quality of input and output for its intended use, including through human review, and clause 10.5 repeats it. What is not published is what the agent does unattended. Nothing says which steps finish without a person, what the agent does when uncertain, or what happens when it is wrong. The Outlook feature is described as drafting rather than sending, but that limit is not stated.

Eight named customer stories are published, each on its own page: Hughes Hubbard, described as an Am Law 150 firm deploying August across legal and business teams; Hicksons in Australia; Harrison Drury; Mission Australia; White Summers; ELP in India; HDRB&B; and Dunning Vallejo & MacDonald, a firm of twenty lawyers. One carries a figure, Hicksons at 90 percent faster document review, and a partner at that firm is quoted by name and title. Measurement is missing: the customer index carries no dates and no basis for the 90 percent figure, and no method is published alongside it. The individual case study pages were not opened and may say more.

Four law firms are named with their own case studies: Cederquist, Snellman, Andulf and Kanter, all Nordic, covering M&A, fund formation and full service practice. One carries a figure tied to a named person: Maja Wettergren, Managing Partner at Cederquist, is quoted as reaching 90 percent weekly usage across the firm. Several case studies are dated, with the Snellman piece dated 25 June 2026. What is missing is outcome measurement. The one figure is an adoption rate, showing how many lawyers used the product rather than what changed in the work, and no method or basis is given. The individual case studies were not opened, so this rests on the customer index and home page only.

Training, provider retention and deletion are settled in the agreement; privilege and matter segregation are not. Section 11.8 of the Terms of Service prohibits training on Content and Customer Data and extends that to subprocessors other than cloud storage providers, which are also barred from retaining the material for human review. That settles the position of third party model providers. Section 7.4 deletes remaining Content within 30 days of termination, and clause 6 of the Data Processing Addendum requires return or deletion on the customer's reasonable request. Nothing published addresses attorney client privilege or work product treatment. Nothing documents segregation by matter for a product sold to law firms. The home page commits that no client document trains a model reachable outside the firm, which is a boundary at firm level. The SharePoint integration states that August 'gains access to your entire SharePoint repository', which is the shape a firm's ethical walls exist to prevent.

The agreement settles training and retention, but not matter separation or privilege. Clause 7.1 says Vesence will not use Customer Data to train AI models and will not let its subcontractors do so. Annex 1 to the data processing agreement sets out retention in detail, with instantaneous processing and no storage by default. The position on model providers is detailed. Inference entities are named per route. Microsoft has approved Modified Abuse Monitoring, so prompts and completions are not stored on any production Azure OpenAI account, and OpenAI routing is limited to zero data retention endpoints. Two gaps remain. Separation is stated at tenant level, with all customer data logically isolated per tenant, but nothing addresses separation between matters or teams within a firm. And nothing addresses privilege or work product directly.

The advice line is stated twice and in the agreement itself: Terms of Service 1.5 and AI Policy section 5 both say the Service is a research tool and its output is not legal advice. The AI Policy reaches part of supervision and competence by committing to communicate the capabilities and limitations of the systems, how output should be reviewed and verified, and the importance of human oversight. The audience is clear: the product is sold to law firms and in house teams, and there is no surface for consumers. No jurisdiction limits are stated, and no bar or ethics opinion is engaged anywhere.

Vesence states fully in its agreement that its output is not advice. Clause 10.5 says output and materials from the services are not professional advice of any kind, naming legal, tax, accounting, financial and investment advice. It says Vesence is not an advisory firm, does not know the full context in which output will be used, and is not responsible for decisions, actions, omissions or reliance based on it. Clause 4.2 adds the customer's duty to conduct human reviews, which addresses supervision. Two things are missing. No jurisdiction limits are stated, and no bar or ethics guidance is engaged. Vesence is Swedish and engages the EU Artificial Intelligence Act at clause 3.2 instead, which binds the supplier rather than the lawyers using it.

The AI Policy of January 2026 is a real framework rather than a principles page. It commits to the EU Artificial Intelligence Act, Regulation (EU) 2024/1689, by name, and requires AI literacy training for all employees involved in AI development, deployment and operations. It lists internal AI governance policies, testing protocols before and after deployment, change management for regulatory adherence on update, and regular audits of AI system performance and safety. Clause 7.5 of the Data Processing Addendum adds a commitment to review compliance with new AI legislation and negotiate amendments. Two things are absent: no individual or function inside the vendor is named as accountable, and no testing result is published, including nothing on uneven output across matter types or populations.

One real governance commitment exists, in the contract rather than on a web page. Clause 3.2 of the general terms requires the services to comply with laws including the EU Artificial Intelligence Act. That is a named obligation the customer can enforce, and more than a principles page. Nothing else is published. There is no governance framework, no person or team accountable for model behavior, no testing regime before release, no ISO 42001 or similar certification, and nothing on uneven output across matter types, counterparties or groups of people. The third party audits on the security page are security assessments, a different subject.

All five elements are published and specific enough to hold the vendor to. Retention and deletion: Terms of Service 7.4 deletes remaining Content within 30 days of termination, Data Processing Addendum clause 6 requires return or deletion on reasonable request, and Security Addendum section 9 keeps system audit records for one to ten years. Access control: unique IDs, multi factor authentication and least privilege, with personnel barred from Customer Data except to support the Service or comply with law. Access to systems holding Customer Data is removed within 1 day of separation and all systems within 3 days, with quarterly privilege reviews and background checks. Subprocessors: a dated list names Microsoft, OpenAI, Google Cloud Platform and Amazon Web Services with processing regions, with 30 days advance notice of additions under clause 3.2 and a 15 day objection right at 3.3. Incident practice: notification without undue delay and within 48 hours of becoming aware, one year log preservation, and independent forensic specialists at August's expense. No default retention window for prompts and outputs during the term is published.

All five elements are published, current and specific. Retention is set out in Annex 1 to the data processing agreement: processing is instantaneous and no personal data is stored by default, with the sole exceptions of prompts inside customer-created agents, retained until the customer deletes them, and an optional Cloud agents feature, off unless the customer switches it on, which persists conversations and files until deleted or deactivated. Deletion runs on customer instruction at clause 9.3, with copies destroyed unless law requires retention. Access control covers Microsoft Entra ID with token-based authentication, role-based access with least privilege, enforced multi-factor authentication, audit logging and automated session management, with customer-side administrator control of users at clause 4.5. The subprocessor list is dated 20 May 2026 and names each legal entity, its headquarters, role, processing regions and whether it is required or optional. Incident practice is set out at clause 5 of the DPA: notice without undue delay, root cause investigation, description of the breach and affected data, and coordination on public statements and regulator notices. The one thing not published on a public page is a fixed breach notification deadline in hours.

A buyer can read the whole allocation of loss before signing, with figures. Section 8.1 gives a third party intellectual property indemnity for use in accordance with the Terms and Documentation, with the exclusions stated. There is no obligation where the claim is attributable to materials not provided by August, or where output results from input the customer knew or should have known was likely to lead to infringement. Section 10.2 caps liability at the greater of twelve months of fees or 250,000 dollars. Section 10.3 raises it to the greater of twice twelve months of fees or 500,000 dollars for data breach claims under the Security Addendum or Data Processing Addendum and for confidentiality breaches by either party. Section 9.2 warrants conformity with the Documentation, workmanlike delivery, non infringement to August's knowledge and legal compliance, and 11.11 commits to insurance from carriers rated A.M. Best A minus, VI or better. August does not stand behind output accuracy: the Service is provided as is under 9.3 and the indemnity is confined to infringement.

A buyer can read the whole allocation of loss before signing, with figures. Clause 10.2 caps each party's total liability per contract year at fifty percent of the subscription fees invoiced that year and excludes indirect damages. Clause 10.3 lifts the cap for intent and gross negligence, clause 10.4 lists six exclusions, and clause 10.6 sets claim windows of three months from awareness and six months from occurrence. Clause 11.1 gives an intellectual property indemnity from Vesence to the customer. Clause 11.2 sets the remedies in order: get a license, replace, amend, or terminate and refund prepaid fees. Clause 11.3 makes this the sole and exclusive remedy. Warranties are real. Clause 3.2 promises professional, workmanlike service that complies with law, including the EU AI Act, and clause 6.3 warrants noninfringement to the best of Vesence's knowledge. Vesence does not stand behind output, and says so: clause 3.6 says occasional inaccurate output is not a Defect. The fifty percent cap is lower than the common cap of a year's fees, and a buyer should price that in.

The integrations page describes what moves, in which direction, and what the firm connects. SOS, the practice management system, is bidirectional and says so: August syncs matters, contacts and case data in, workflows run on live matters, and 'Completed reviews, summaries, and outputs sync back to SOS'. SharePoint is inbound after a one time account connection, with selected documents becoming available for citation, analysis and drafting on the same footing as uploads. Word is in place rather than sync, chatting with the open document and generating edits as tracked changes in review mode, with firm playbooks applied. Outlook covers search across the mailbox, thread summarization and reply drafting. The limitation worth naming is that all of this lives on a marketing page: no developer index, help center or implementer documentation exists anywhere in the site navigation, footer or legal hub, and iManage and NetDocuments, the two document management systems most large firms run, are not among the named connections.

The product lives inside the drafting environment rather than connecting to it, and each surface has its own page describing what it does: tracked-change generation and template filling in Word, house-style drafting and inbox-wide error checking in Outlook, spreadsheet review and cross-checking against source documents in Excel, and slide quality checks and firm formatting in PowerPoint, with distribution through Microsoft AppSource and a mobile continuation of the same workspace. That is real depth in the four applications a professional services firm actually drafts in. What is absent is the rest of the stack a law firm runs. No document management integration is named, and iManage and NetDocuments do not appear anywhere, which matters more here than for an in-house product because the firm's matter files live in a DMS. No API, developer documentation or implementation guide is published, and nothing describes what synchronizes or what a firm must configure beyond installing the add-ins.

Section 2 of the Security Addendum states that customer data and content reside in data centers matching the geographic region specified in the order form. A customer may request storage in a separate region, which August will use commercially reasonable efforts to accommodate where its cloud providers support it. The subprocessor list names the regions in play: United States, European Union, Switzerland and Australia. The home page advertises hosting in the region of the buyer's choice and EU and US options. Two things are absent. The tenancy model is never stated, so a buyer cannot tell whether the deployment is multi tenant, single tenant or private, and the subdomain per firm shown in product images is not described as a separation boundary. Processing location is not addressed as distinct from storage location, since section 2 speaks only to where data reside.

Vesence publishes where data is processed in detail, and separates processing from storage throughout. The subprocessor list gives regions by route: Sweden Central as the main Azure region, West Europe for Static Web Apps, EU Azure OpenAI regions or DataZone deployments where Azure inference is used, and eu-central-1 in Frankfurt for the AWS Bedrock route. Annex 1 to the data processing agreement says processing happens only within the EU and EEA, and the security page repeats it. Tenancy is stated too: all customer data is logically isolated per tenant, within a Zero Trust architecture with redundant infrastructure, automatic failover and point in time recovery. The subprocessor page even says which deployment types should not be used for EU traffic. The flip side is one region policy with no option outside the EU, so a customer that must keep data in a country outside Europe is not served. That is a disclosed limit on availability, not a gap in disclosure.

Section 1 of the Security Addendum states that August's information security management system undergoes annual assessment by independent third party auditors. It says the company maintains SOC 2 Type II and ISO 27001 and will adopt an equivalent recognized framework if either is discontinued. Section 4 adds annual third party penetration testing and web application assessment against OWASP. Section 10 gives customers, at no cost, access to SOC 2 Type II reports, penetration test summaries and ISO 27001 certifications, plus up to 100 security questions a year. No auditor is named, no coverage period or report date is published, and the report route in section 10 runs to contracted customers rather than to a prospect. A trust center exists at trust.august.law, named in Terms of Service 12.5 as where the Business Associate Addendum sits. It blocked automated access on 2 September 2026 and may say more.

SOC 2 Type II is claimed with its scope named, but little else is published. The security page describes independently audited controls for security, availability and confidentiality. It states regular third party security audits and vulnerability assessments, and invites IT and compliance teams to ask for the report. Missing: no auditor is named, no coverage period or report date is published, no penetration test summary is offered, and there is no trust center or portal. The route to the report is an email to support, and what is needed to get it could not be established. Clause 6 of the data processing agreement gives the customer, or an auditor it appoints, a right to inspect. That helps a signed customer but gives a prospect nothing to read.

The subprocessor list of January 2026 names four AI providers under its own heading for model providers and infrastructure: Microsoft, OpenAI, Google Cloud Platform and Amazon Web Services, each with its processing regions. Data Processing Addendum 3.2 commits to 30 days advance notice before any new subprocessor begins processing, with a 15 day objection right. Providers, location and change notification are therefore published. The models themselves are not named. The home page describes August as model agnostic across Anthropic, private OpenAI endpoints and Llama, which mixes two providers and one model family rather than listing models. It also sits awkwardly against the subprocessor list, where Anthropic does not appear. Three further subprocessors that touch content are identified only by function, as web browsing, knowledge source and email subprocessors.

Vesence names its models, providers and regions, and commits to notice of new providers. The product pages name models including GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.5, Opus 5, Opus 4.8 and Gemini 3.7 Flash. A dated subprocessor list names providers as legal entities: Microsoft Ireland Operations Limited, Amazon Web Services EMEA SARL and OpenAI Ireland Ltd, each with headquarters, role and status. Regions are given per route, from Sweden Central to Frankfurt. The routing is explained. Claude models reached through Bedrock make AWS the subprocessor, OpenAI models reached through Azure make Microsoft the subprocessor, and the customer chooses which routes are enabled. Clause 7.2 of the DPA commits to updating the list before any new subprocessor is authorized, with a ten business day objection right at 7.3. Two limits. Customers must check for changes themselves, since the DPA asks them to monitor the page with a URL tracking service. And the home page says Vesence switches to a better model as soon as one ships, so version changes within an approved provider are not notified.

No pricing page appears in the site's own navigation or footer, and no figure, unit of charge or tier structure is published on any page that loads. The routes offered a buyer are Book a Demo and a self serve sign in at app.august.law, alongside a seven day free trial named in the home page metadata and an offer to build a live workflow free within a week. A pricing page at august.law/start-now remains in search results carrying tier names, a feature split and a monthly figure. It returned a 404 on both the www and non www forms of the URL, so nothing on it could be confirmed against a page the vendor serves. The only other figures located are in January 2026 trade press, and they disagree with the indexed page, so neither is recorded here.

The unit and the structure are published without the figure. Clause 5.1 puts subscription fees in an Order Form; clause 5.4 caps annual indexation at five percent; clause 5.2 allows fee changes only in proportion to documented changes in third party costs such as Microsoft Azure; clause 12.1.3 sets twelve month automatic renewals terminable on sixty days notice; clause 12.1.2 gives a right to exit within the first three months of the initial term; and section 13 provides that a Pilot is free of charge unless the Order Form says otherwise. The usage-based unit is named rather than gestured at, with Annex 1 to the DPA describing Vesence Credits and consumption tracked at user, matter and day level. A free trial is offered from the home page. What is absent is everything above that: no pricing page, no tier names, no feature splits and no figure anywhere, and the structure sits in the agreement rather than on a commercial surface.

Coverage is described with substance on both dimensions. Seven practice areas are named on the home page with a time saved figure attached to each: Corporate and M&A, Litigation, Disputes, Real Estate, Capital Markets, Regulatory and ESG, and Healthcare. Segment reach is evidenced by the customer roster rather than only claimed, running from a twenty lawyer firm through midsize firms such as Hicksons and Harrison Drury to the Am Law 150, and including in house teams at Mission Australia, Outside GC and DevRev. Geography is specific: the About section names expansion into England, Australia, Colombia, the Middle East and India, and dedicated India and Australia pages exist. What is left open is the boundary. Nothing states which practice areas or firm types the product is not built for, and the founding story's emphasis on midsize firms sits unreconciled with an Am Law 150 firmwide deployment.

Practice coverage is laid out in detail, but not where it stops. Seven areas each have their own page: corporate, banking and finance, fund formation, dispute resolution, compliance, family law and business support. The corporate page, for example, describes diligence across a data room and keeping defined terms and cross references consistent from term sheet to signing. What is left open is the boundary and the segment. No firm size is named, and nothing separates what a large firm gets from a small one. No jurisdiction is stated, though the named customers are Nordic and the agreement is governed by Swedish law with Stockholm arbitration. The buyer is also broader than legal. Vesence addresses law firms, banks, investment funds and enterprises together and calls itself made for professional services. A reader cannot tell where legal capability ends and general document work begins. Nothing says what the product does not support.