Candle AI vs Vesence: how they compare in 2026
Candle AI and Vesence both put AI inside the Office tools lawyers use and are not usually weighed against each other, but one grid shows how differently they document it. Candle AI is an email assistant tied to a US firm's case management system; Vesence drafts and checks documents across Office for Nordic firms. Vesence sits in the top two bands on thirteen of fifteen axes and Candle AI on ten of fifteen, identical on seven. Vesence publishes its contract in full. It names its models, including GPT-5.6 Sol and Opus 5, and processes only in the EU, with a region given for each route. It stores nothing by default, and its terms cap liability at half the fees invoiced each contract year, alongside an intellectual property indemnity. Candle AI names no model provider. Its counterweight is a firm approval gate: nothing is sent, saved or filed until a user at the firm approves it. Both warn in their terms that AI output may be inaccurate, and neither measures how often.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The AI does the headline work on top of an integration layer that would still run without it. Triage, drafting in the lawyer's voice and the Candle Work agents that propose record updates and filings are model work. Surfacing the client, matter and deadlines from the case management system, email templates and logging time are integration features that function without the models. Verified 22 September 2026.
There is no conventional product underneath. The four Office add-ins have no non-model function at all: what they do is draft, redline, reformat, cross-check and quality-check, and each of those is model work. The web workspace holds files, chats and drafts in a project, but it exists to give the agent context rather than to be a document management system, and the vendor describes the whole thing as one agent across five products. The systems of record stay where they are, in Word, Outlook, Excel, PowerPoint and the firm's own files. Annex 1 to the data processing agreement puts it plainly from the other direction, describing the processing as machine learning algorithms processing collected text to generate responses and insights. Remove the models and nothing remains to sell. Verified 2 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is asserted rather than shown. Drafts are described as grounded in the matter file and based on the matter information attached to the email, but no citation back to the source record appears in a draft, nothing describes how the draft is assembled, and no accuracy figures are published. The Terms of Service warn that output might not be accurate, comprehensive or current and should not be relied on as a source of truth. Verified 22 September 2026.
Accuracy is addressed candidly and never measured. Clause 3.6 of the general terms states that due to the inherent probabilistic nature of artificial intelligence the services may occasionally produce inaccurate output or suggestions, and that this does not constitute a Defect. Putting a hallucination acknowledgement in the operative agreement rather than a disclaimer footer is rare in this pull, and it is the opposite of the bare no-hallucination claim the D limb is written for, so D does not fire. What is absent is any measurement. No accuracy figure, test set, benchmark or published evaluation appears anywhere. The product-side answer is checking rather than grounding: a one-click check described as reviewing hundreds of errors across documents and inboxes, and cross-checking spreadsheet data against source documents. Neither is a described retrieval method, and the product does not ground to primary authority, so the B limbs do not bite. Verified 2 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
A categorical approval gate on the actions that matter. The Security page states that a user at the firm must explicitly approve anything sent or filed, and that nothing is sent or filed without that approval; drafts are prepared for review and never sent automatically; and Candle Work shows exactly what it would change, such as record fields, a document filed to a matter or an activity logged, and holds the result with nothing saved until a user approves. What runs without approval is also stated: triage, context retrieval and the capture of time and activity. Verified 22 September 2026.
The review surface is the strongest located in this pull and the threshold is missing. Every edit an agent makes lands as a tracked change across Word, Excel, PowerPoint and Outlook, with accept and reject controls, so the human checkpoint is the native review mode of the application the work already lives in rather than a bespoke approval screen. The obligation to use it is contractual, not aspirational: clause 4.2 requires the customer to assess the accuracy and quality of both input and output for its intended use, including conducting human reviews, and clause 10.5 repeats it. What is not published is what the agent does unattended. Nothing states which steps complete without a human, what an agent does when uncertain, or what happens after it is wrong, and the Outlook capability is described as drafting rather than sending without the boundary being stated. That unstated threshold is what the B band names. Verified 2 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Named customers and figures, kept apart. The home page says more than 60 law firms use the product and shows firms including Saiontz & Kirk, Minami Tamaki, Siskind Susser and Garfinkel Immigration Law Firm, and quotes C. Jason Baab of Graham-Hurd & Associates on discovering lost billable time. The figures, an hour saved per person per day, 70 per cent faster drafting, 75 per cent faster client responses and 80 per cent faster retrieval of matter data, carry no customer, date or method. Verified 22 September 2026.
Four law firms are named with their own case studies: Cederquist, Snellman, Andulf and Kanter, all Nordic, covering M&A, fund formation and full-service practice. One carries a figure attached to a named individual, with Maja Wettergren, Managing Partner at Cederquist, quoted as reaching 90 per cent weekly usage across the firm. Several case studies are dated, with the Snellman piece carrying 25 June 2026. That is dated, attributed deployment evidence, which is more than most records manage. It stops short of A on measurement. The one figure is an adoption rate rather than an outcome, so it reports how many lawyers opened the product rather than what changed in the work, and no method or basis is given for it. The individual case studies were not opened this pass, so this note credits only the customer index and home page. Verified 2 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Privilege is named in the agreement, and training is addressed on the security page. The Terms of Service, effective 5 June 2026, commit that Candle will not use attorney-client privileged information in user data as input to any non-Candle AI tool or to train any non-Candle model; the Security page adds that a firm's emails, matter details and client information are never used to train Candle's own models or models for another customer, and describes encryption, access controls and audit logging. Short of the full picture: the terms also give Candle an irrevocable right to compile anonymous aggregated statistics from user data and to make them public, and nothing addresses separation between matters or users within a firm. Verified 22 September 2026.
Three of the five limbs are met, two in the agreement itself. Clause 7.1 provides that Vesence will not use Customer Data to train AI models and will not permit its subcontractors to do so, which settles training contractually rather than by policy. Retention and deletion are set out in Annex 1 to the data processing agreement in unusual detail, with instantaneous processing and no storage by default. The position on third party model providers is the most complete in this pull: named inference entities per route, Microsoft Modified Abuse Monitoring approval waiving prompt and completion storage on all production Azure OpenAI accounts, and OpenAI routing constrained to zero data retention endpoints. Two limbs fail. Segregation is stated at tenant level, that all customer data is logically isolated per tenant, and this vendor sells to law firms, where the band asks for matter level walls; nothing addresses separation between matters or teams inside one firm. And nothing anywhere addresses privilege or work product treatment directly, which the top band requires as its own limb. Verified 2 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The advice question is addressed; the billing question the product raises is not. The Terms of Service state that material on the platform is not a substitute for professional legal advice and that output should not be relied on as a source of truth or used for decisions with legal consequences, and every draft needs a lawyer's approval before it is sent. The product also records email work as billable time automatically, and markets that time previously lost is now billed, but nothing published addresses the lawyer's duty to bill only for time actually spent when entries are machine-logged. Verified 22 September 2026.
The advice line is stated in the operative agreement and stated fully. Clause 10.5 provides that output and any materials made available through the services are not to be viewed as professional advice of any kind, listing legal, tax, accounting, financial and investment advice by name, that Vesence is not an advisory firm, that it does not know the full context in which output will be used, and that it does not bear responsibility for decisions, actions, omissions or reliance based on it. Clause 4.2 adds the customer's obligation to conduct human reviews, which reaches the supervision dimension that most records in this pull leave untouched. Two things hold it at B. No jurisdiction limits are stated anywhere, and no bar or ethics guidance is engaged: the vendor is Swedish and engages the EU Artificial Intelligence Act at clause 3.2 instead, which binds the supplier rather than the lawyers using it. Verified 2 September 2026.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Checked the home, Product and Security pages, the Terms of Service, the Privacy Policy, the Content Policy and the trust centre on 22 September 2026. No AI governance framework, accountable owner, testing before release or bias disclosure was located; the Content Policy governs what users may post, not how the models are governed. Verified 22 September 2026.
One real governance commitment exists and it sits in the contract rather than on a page. Clause 3.2 of the general terms requires the services to be provided in accordance with laws and regulations including but not limited to the EU Artificial Intelligence Act, which is a named instrument the customer can enforce, and it is materially more than a principles page. Everything the top bands ask for beyond that is absent. No governance framework is published, no individual or function is named as accountable for model behaviour, no pre-release testing regime is described, no certification such as ISO 42001 is claimed, and nothing at all is published about uneven output across matter types, counterparties or populations. The third party audits named on the security page are security assessments, which the axis treats as a different subject. Checked the home page, security page, general terms, data processing agreement, subprocessor list and about page on 2 September 2026. Verified 2 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Much of the ground is published. The Security page describes encryption in transit and at rest, access controls and audit logging around systems that process firm data, and hosting in the United States; the trust centre publishes control status, a subprocessor list with the service each provides and its hosting region, and a managed process for requesting security documents. No retention period for email or matter data and no incident notification commitment are published. Verified 22 September 2026.
All five elements are published, current and specific. Retention is set out in Annex 1 to the data processing agreement: processing is instantaneous and no personal data is stored by default, with the sole exceptions of prompts inside customer-created agents, retained until the customer deletes them, and an optional Cloud agents feature, off unless the customer switches it on, which persists conversations and files until deleted or deactivated. Deletion runs on customer instruction at clause 9.3, with copies destroyed unless law requires retention. Access control covers Microsoft Entra ID with token-based authentication, role-based access with least privilege, enforced multi-factor authentication, audit logging and automated session management, with customer-side administrator control of users at clause 4.5. The subprocessor list is dated 20 May 2026 and names each legal entity, its headquarters, role, processing regions and whether it is required or optional. Incident practice is set out at clause 5 of the DPA: notice without undue delay, root cause investigation, description of the breach and affected data, and coordination on public statements and regulator notices. The one thing not published on a public page is a fixed breach notification deadline in hours. Verified 2 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Only standard clauses. The Terms of Service cap Candle's liability at the amounts paid in the preceding 12 months, disclaim the accuracy of AI-generated output, and include no indemnity from Candle; disputes go to the courts of Delaware. Verified 22 September 2026.
A buyer can read the whole allocation of loss before signing, with figures. Clause 10.2 caps each party's total aggregate liability per contract year at fifty per cent of the subscription fees invoiced in that year and excludes indirect damages; clause 10.3 lifts the cap for intent and gross negligence; clause 10.4 lists six named exclusions; and clause 10.6 sets claim windows of three months from awareness and six months from occurrence. Clause 11.1 gives an intellectual property infringement indemnity running from Vesence to the customer, with the remedies at 11.2 set out in order, procure a licence, replace, amend, or terminate and refund prepaid fees, and 11.3 makes it the sole and exclusive remedy. Warranties are real: clause 3.2 promises professional and workmanlike provision in accordance with law including the EU AI Act, and clause 6.3 warrants non-infringement to the best of Vesence's knowledge. What the vendor does not stand behind is output, and it says so specifically: clause 3.6 provides that occasional inaccurate output is not a Defect. The fifty per cent cap is materially lower than the annual-fees norm and is recorded here because a buyer should price it. Verified 2 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Named integrations with the direction described. Candle runs inside Gmail and Outlook and connects to Clio, Filevine, MyCase, Docketwise, Mitratech INSZoom, Visalaw, Litify and Salesforce, reading client, matter, deadline and correspondence data into the inbox and, through Candle Work, writing record updates, filing documents to the matter and logging activity once a user approves. Smokeball, Neostella, iManage and NetDocuments are listed as coming soon. No integration documentation describes what each connector syncs or what a firm must configure. Verified 22 September 2026.
The product lives inside the drafting environment rather than connecting to it, and each surface has its own page describing what it does: tracked-change generation and template filling in Word, house-style drafting and inbox-wide error checking in Outlook, spreadsheet review and cross-checking against source documents in Excel, and slide quality checks and firm formatting in PowerPoint, with distribution through Microsoft AppSource and a mobile continuation of the same workspace. That is real depth in the four applications a professional services firm actually drafts in. What is absent is the rest of the stack a law firm runs. No document management integration is named, and iManage and NetDocuments do not appear anywhere, which matters more here than for an in-house product because the firm's matter files live in a DMS. No API, developer documentation or implementation guide was located, and nothing describes what synchronises or what a firm must configure beyond installing the add-ins. Verified 2 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Cloud, with the region stated. The Security page says customer data is hosted in the United States and that the subprocessor list identifies each provider's hosting region; the product runs as a Chrome extension and an Outlook add-in on top of the firm's existing email. No residency option, private deployment or tenancy choice is offered, and the terms say the service is intended only for users in the United States. Verified 22 September 2026.
Residency is published to a level of specificity nothing else in this pull approaches, and processing is separated from storage throughout. The subprocessor list gives regions per route: Sweden Central as the primary Azure region, West Europe for Static Web Apps, EU Azure OpenAI regions or DataZone deployments where Azure inference is used, and eu-central-1 in Frankfurt for the AWS Bedrock route. Annex 1 to the data processing agreement states that processing is performed exclusively within the EU and EEA, and the security page repeats it. The tenancy position is stated too, that all customer data is logically isolated per tenant, alongside a Zero Trust architecture and redundant infrastructure with automatic failover and point-in-time recovery. The subprocessor page even addresses which deployment types should not be used for EU traffic. The limitation a buyer should weigh is the flip side of that precision: there is one region policy and no non-EU option, so a customer with a data localisation requirement outside Europe is not served. That is a restriction on availability, disclosed, rather than an absence of disclosure. Verified 2 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A named attestation with a request route. The Security page states that Candle has completed a SOC 2 Type II examination and maintains HIPAA compliance, and the trust centre shows both as complete, publishes control status and offers supporting documents through a managed request process. No auditor, report period or scope is stated. Verified 22 September 2026.
SOC 2 Type II is claimed with its scope named, described as independently audited controls for security, availability and confidentiality, which is more than the bare standard name most records offer. Regular third-party security audits and vulnerability assessments are stated, and the security page invites IT and compliance teams to ask for the report. What the top band asks for is missing on every remaining count. No auditor is named, no coverage period or report date is published, no penetration test summary is offered, and there is no trust centre or portal of any kind, so the route to the report is an email to support and its tier could not be established from what the page states. Clause 6 of the data processing agreement adds a contractual audit right, allowing the customer or its mandated third-party auditor to inspect, which is a real entitlement for a signed customer rather than accessible evidence for a prospect. Verified 2 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The models are referred to, not identified. The Security page speaks of Candle's models, and no model, model provider or processing location is named; the subprocessor entries shown in the trust centre, AWS, Google Workspace and Google Cloud Identity, include no AI model provider. No commitment to notify customers of model changes is published. Verified 22 September 2026.
This is the most complete supply chain disclosure located in the pull. The models are named on the product pages, including GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.5, Opus 5, Opus 4.8 and Gemini 3.7 Flash. The providers are named as legal entities rather than brands on a dated subprocessor list: Microsoft Ireland Operations Limited, Amazon Web Services EMEA SARL and OpenAI Ireland Ltd, each with headquarters, role and status. Where they run is given per route, from Sweden Central to Frankfurt. The routing itself is explained, so a reader can see that Claude models reached through Bedrock make AWS the subprocessor while OpenAI models reached through Azure make Microsoft the subprocessor, and the customer chooses which provider routes are enabled. Change is committed at clause 7.2 of the DPA: the list is updated before any new subprocessor is authorised, with a ten business day objection right at 7.3. Two limitations belong on the record. Notification is pull rather than push, since the DPA asks the customer to monitor the page with a URL tracking service. And the home page states that Vesence switches to a better model as soon as it ships, so model version changes within an authorised provider are not notified. Verified 2 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
An entry price is published on a marketplace, not on the company's own site. Candle's listing in the Clio App Directory, where Candle is the seller, states pricing starting at $49 per month in US dollars. The listing's link to view all plans now leads to a demo request, the company's own site publishes no pricing, and the unit of charge and higher tiers are not stated. Verified 22 September 2026.
The unit and the structure are published without the figure. Clause 5.1 puts subscription fees in an Order Form; clause 5.4 caps annual indexation at five per cent; clause 5.2 allows fee changes only in proportion to documented changes in third party costs such as Microsoft Azure; clause 12.1.3 sets twelve month automatic renewals terminable on sixty days notice; clause 12.1.2 gives a right to exit within the first three months of the initial term; and section 13 provides that a Pilot is free of charge unless the Order Form says otherwise. The usage-based unit is named rather than gestured at, with Annex 1 to the DPA describing Vesence Credits and consumption tracked at user, matter and day level. A free trial is offered from the home page. What is absent is everything above that: no pricing page, no tier names, no feature splits and no figure anywhere, and the structure sits in the agreement rather than on a commercial surface. Verified 2 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
The buyer is law firms, across practice areas, with the customer list and integrations showing a particular base in immigration and personal injury work. The terms say the service is intended only for users in the United States. Firm size limits and practice areas the product does not suit are not stated. Verified 22 September 2026.
Practice coverage is documented better than by any other record in this pull. Seven areas each have their own page describing what the product does there: corporate, banking and finance, fund formation, dispute resolution, compliance, family law and business support, with the corporate page describing diligence across a data room and keeping defined terms and cross-references consistent from term sheet to signing. What is left open is the boundary and the segment. No firm size band is named, nothing distinguishes what the product supports for a large firm from a small one, and no jurisdiction is stated even though the named customers are Nordic and the agreement is governed by Swedish law with Stockholm arbitration. The buyer is also deliberately broader than legal: the vendor addresses law firms, banks, investment funds and enterprises together and describes itself as made for professional services, so a reader cannot tell where legal-specific capability ends and general document work begins. Nothing states what the product does not support. Verified 2 September 2026.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The Security page states that a firm's emails, matter details and client information are never used to train Candle's models or models for another customer. The Terms of Service, effective 5 June 2026, contain a narrower covenant, that privileged information in user data will not be used as input to or to train any non-Candle AI model, and reserve Candle an irrevocable right to compile anonymous aggregated statistics from user data, which it may make public.
The prohibition is in the operative agreement at clause 7.1 and extends outward in the same sentence, which adds that Vesence will not permit its subcontractors to train on Customer Data either. It carries one proviso, unless explicitly agreed in writing, which is a variation clause rather than a product setting: nothing describes a configuration in which training is switched on. Annex 1 to the data processing agreement confirms the prohibition applies to the optional Cloud agents feature as well.
Two adjacent permissions are disclosed and neither reaches content. Clause 7.2 allows Vesence to collect and disclose quantitative data derived from use of the services, described as statistics about which features were used, in anonymous and aggregated form. That clause names feature usage rather than machine learning, so it does not qualify the prohibition.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Checked the Security page, the Terms of Service, the Privacy Policy and the trust center on 22 September 2026. No retention period, deletion commitment or customer control over how long email content, drafts or matter data are kept is published.
Zero retention is the default rather than an option the customer has to find. Annex 1 to the data processing agreement states that each processing is instantaneous and no personal data is stored, and the security page adds that documents are processed in memory and never persisted beyond the session. Persistence exists but the customer switches it on: prompts inside customer-created agents are retained until the customer deletes them, and a Cloud agents feature stores conversations and uploaded files between sessions, described expressly as optional and not activated by default.
Where a customer does enable it, retention runs until the customer deletes the data, deactivates Cloud agents, stops using the service or requests removal, with storage in Vesence's Azure environment under the same no-training and tenant isolation terms. Usage data for Vesence Credits, where usage-based pricing is enabled, is retained for the term or until the customer asks for deletion.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Checked the Security page, the Product page and the terms on 22 September 2026. Access controls are mentioned generally, but nothing addresses whether Candle respects ethical walls or matter permissions set in the connected case management systems when it surfaces context or drafts.
Vesence operates its own permission model rather than inheriting one, and documents it at the level of the tenant. The security page states logical isolation per tenant alongside role-based access control on least-privilege principles, Microsoft Entra ID token-based authentication, enforced multi-factor authentication and a Zero Trust architecture verifying every request. Clause 4.5 of the general terms puts user administration in the customer's hands, giving nominated personnel administrative privileges to manage users and access logging, which is the alignment burden this value describes.
The gap matters for this buyer in particular. Vesence sells to law firms, where the question is whether one matter team can reach another's material, and nothing published addresses separation between matters, teams or users inside a single tenant. Tenant isolation answers the question between customers, not within one.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The Privacy Policy, effective 4 June 2026, reserves disclosure to comply with legal obligations, including to respond to a subpoena, warrant, court order or other legal process, or a formal or informal request from law enforcement or a government authority. No commitment or reservation regarding notice to the customer is located.
Clause 4.1(a) of the data processing agreement commits Vesence to notice before it acts. Where EU or member state law requires processing without the customer's instructions, Vesence undertakes to inform the customer of that requirement prior to processing, with the single exception of a legal prohibition on giving that information on important grounds of public interest. Notice before rather than after is a stronger formulation than most.
It is not the top value because no transparency report was located: nothing published records how many requests have been received or how they were answered. Clause 8.3(e) of the general terms separately carves legally compelled disclosure out of the confidentiality obligation without addressing notice, and the two provisions read together are what the record rests on.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Checked the home and Product pages on 22 September 2026. The product works on the firm's own email and case management data, and no body of primary law behind its output is identified.
Checked the home page, the five platform pages, the practice area pages, the security page, the general terms and the data processing agreement on 2 September 2026. No public material identifies a corpus and none is claimed. Annex 1 to the DPA describes the material as the text the user provides, being documents, agreements, questions, answers and conversations, so the product works on the firm's own files and the counterparty documents in front of it rather than on a published body of primary law. The coverage and title risks this signal tracks do not arise in that shape.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Checked the home and Product pages on 22 September 2026. The product drafts correspondence from matter data rather than citing legal authority, and nothing addresses checking authority for subsequent history.
Checked the home page, the five platform pages, the practice area pages and the general terms on 2 September 2026. No public material addresses subsequent history, treatment flags or citator coverage, and none is claimed. The product drafts and checks documents rather than retrieving authority, so no good law check is offered; the dispute resolution practice page describes searching and structuring case material supplied by the firm rather than researching reported decisions. The honest value is that the question is not addressed rather than that a weaker form of checking exists.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Checked the home, Product and Security pages on 22 September 2026. Every draft and proposed action waits for approval, but no confidence indicator or path in which the system declines to draft when the matter data is insufficient is described.
Checked the home page, the five platform pages, the security page, the general terms and the data processing agreement on 2 September 2026. Nothing describes what the product does when it cannot ground an answer. Clause 3.6 of the general terms comes closer than most vendors manage by acknowledging that the services may occasionally produce inaccurate output because of the probabilistic nature of artificial intelligence, but that is a disclosure that errors occur rather than an account of abstention.
No no-answer path is documented and no confidence or grounding score is exposed, so the weaker values are false of this record as well. The one-click check feature reviews output for errors after generation, which is correction rather than refusal.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Searched the AI Hallucination Cases database maintained by Damien Charlotin on 22 September 2026 for Candle, and no recorded case was returned. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product.
Searched the AI Hallucination Cases database maintained by Damien Charlotin, and reporting drawing on it, on 2 September 2026 on the product and corporate name Vesence and Vesence AB. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product. Two things bound it: the vendor is Swedish with a Nordic customer base, and the database is heavily weighted to United States filings, so a European product is less likely to surface even where an incident occurred; and the product drafts and reviews documents rather than retrieving authority, so the fabricated citation exposure is structurally lower than for a research tool.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
The Terms of Service state that material on the platform is not intended to substitute for professional legal advice and that output should not be relied on as a source of truth or as a substitute for professional or legal advice. No bar or ethics opinion is named.
Checked the home page, platform and practice area pages, security page, general terms, data processing agreement, subprocessor list and about page on 2 September 2026. No public material engages with ABA Formal Opinion 512, any state bar opinion, or any national bar or law society guidance in the Nordic markets where the named customers sit. The vendor does engage a named instrument, committing at clause 3.2 of the general terms to provide the services in accordance with the EU Artificial Intelligence Act, but that regulates the supplier rather than the professional obligations of the lawyers using the product, which is what this signal records.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product logs every email read, drafted and sent as billable time and activity automatically, and the company markets it as turning time that used to be lost into time that is billed, with an hour saved per person per day. Nothing addresses how machine-logged time should be reviewed before it reaches a client's invoice, or what the client is told; the time log is a record of work, not a record of which output the AI produced.
A per matter record of AI assisted work exists and is described in the agreement rather than inferred. Annex 1 to the data processing agreement states that where usage-based pricing is enabled, Vesence Credit consumption data is collected at user, matter and day level in order to display that consumption to the customer through the services. Credits are consumed by AI work, so a firm running usage-based pricing can see which matters the AI worked on, by whom and when, which is the record this signal asks for.
Two limits keep it off the top value. The record exists only where usage-based pricing is enabled rather than for every customer, and no fee guidance of any kind is published: nothing addresses how AI assisted time should be billed to a client, disclosed, or reconciled against an hourly rate.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The Security page says a current public subprocessor list, with each provider's service and hosting region, is kept in the trust center, and the trust center shows entries for AWS, Google Workspace and Google Cloud Identity. No AI model provider appears among the entries shown, and no client-facing disclosure pack on AI use is published.
All three artifacts are published and reachable without an agreement. The subprocessor list, dated 20 May 2026, names each legal entity with its headquarters, role, processing regions and required or optional status, and it separates the core hosting subprocessor from the AI inference providers, so a firm can tell a client exactly which entities may see its content and where. The model provider position is set out route by route, including that Anthropic is not listed separately where Claude is reached through Bedrock and why.
The data processing agreement is published in full and is drafted to be forwarded, with clause 7.2 committing to update the list before authorizing any new subprocessor and clause 7.3 giving a ten business day objection right. One practical limitation belongs on the record: notification is pull rather than push, since clause 7.2 asks the customer to monitor the page using a URL tracking service.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Checked the home, Product and Security pages on 22 September 2026. No record of AI involvement in a filed document, export of that record or disclosure guidance is described.
Checked the home page, the five platform pages, the practice area pages, the security page, the general terms and the data processing agreement on 2 September 2026. Nothing addresses judicial standing orders, AI use disclosure or verification certification, and no exportable per document record of model used, sources retrieved and human verification is described. The product does leave an unusually good trail in the document itself, since every agent edit lands as a tracked change that a person accepted or rejected, and Vesence Credit consumption is recorded per matter where usage-based pricing is on. Neither records which model produced which passage, so neither answers the question this signal asks.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
- Refusal and Uncertainty Behavior
- Court Disclosure Support
Which one fits
Choose Candle AI if
- Your lawyers lose hours to email about matters. Candle AI sorts and prioritizes incoming email inside Gmail and Outlook, attaches the client, matter, deadlines and prior correspondence from the case management system, and drafts replies in the lawyer's voice for approval.
- You want AI that proposes changes to your case records but never makes them alone. Candle Work proposes record updates, document filing and activity logging, shows exactly what would change, and saves nothing until a user at the firm approves.
- Your firm runs Clio, Filevine, MyCase, Docketwise or Litify. Candle AI reads client, matter and deadline data from those systems into the inbox and writes approved updates back, with Mitratech INSZoom, Visalaw and Salesforce also connected.
Choose Vesence if
- Your lawyers draft and check in Word, Excel and PowerPoint as well as Outlook. Vesence runs one agent across all four and a web workspace, filling templates, redlining in Word format, checking spreadsheets against source documents and applying house style, with every edit landing as a tracked change.
- Your data must stay in the EU. Vesence processes exclusively within the EU and EEA on Microsoft Azure in Sweden Central, with the AWS Bedrock route in Frankfurt, lets customers choose which model providers are enabled, and stores nothing by default.
- You want the liability terms in figures before you sign. Vesence's general terms cap each party's liability at half the fees invoiced in a contract year, lift the cap for intent and gross negligence, and give an intellectual property indemnity with set remedies.
In summary
Candle AI
Candle AI, from Candle AI, Inc. of Austin, Texas, is an AI email assistant for law firms that runs inside Gmail and Outlook, sorting incoming email, attaching the client, matter and deadlines from the firm's case management system, drafting replies in the lawyer's voice and logging email work as time. Its Candle Work agents propose record updates and filings for a user to approve. The AI Legal Index grades it in the top two bands on ten of fifteen capability axes, with an A on autonomy and oversight. It connects to Clio, Filevine, MyCase and Litify, states SOC 2 Type II, and lists pricing from $49 a month on the Clio App Directory. As of 22 September 2026 the index located no named model provider or retention period.
Vesence
Vesence, from Vesence AB of Sweden, is an agentic AI platform for law firms and other professional services businesses that runs one agent across Word, Outlook, Excel and PowerPoint and a web workspace, drafting, redlining, checking and applying house style, with every edit landing as a tracked change. The AI Legal Index grades it in the top two bands on thirteen of fifteen capability axes, with A grades on AI centrality, data stewardship, liability, deployment and model supply chain disclosure. It publishes its terms, data processing agreement and a dated subprocessor list, names its models, and processes only in the EU. It names Cederquist, Snellman, Andulf and Kanter as customers. As of 2 September 2026 the index located no published price or accuracy measure.
Questions buyers ask
Are Candle AI and Vesence the same kind of product?
Not quite. Both put AI inside Microsoft Office, but Candle AI works on email in Gmail and Outlook and connects to a firm's case management system, while Vesence drafts and checks documents across Word, Excel, PowerPoint and Outlook. On the AI Legal Index Vesence sits in the top two bands on thirteen of fifteen capability axes and Candle AI on ten of fifteen.
Does Candle AI send emails without a lawyer's approval?
No, on its own published statement. Candle AI's security page states that a user at the firm must explicitly approve anything sent or filed, that drafts are never sent automatically, and that Candle Work holds proposed record changes, filings and activity logs until a user approves them. Triage, context retrieval and time capture run without approval. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
Which AI models does Vesence use?
Vesence's product pages name models including GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.5, Opus 5, Opus 4.8 and Gemini 3.7 Flash, and its subprocessor list names Microsoft, Amazon Web Services and OpenAI as legal entities with the region each route runs in. Customers choose which provider routes are enabled. Candle AI names no model or model provider. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
Do Candle AI and Vesence train AI on client data?
Vesence's general terms bar it and its subcontractors from training AI models on customer data. Candle AI's security page says a firm's emails, matter details and client information never train its models, while its terms carry a narrower promise covering privileged information and models other than its own, and reserve anonymous aggregated statistics. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
What do Candle AI and Vesence both leave unpublished?
Any measure of accuracy and any treatment of matter walls. Both warn that AI output may be inaccurate without measuring how often, and neither describes how its AI respects ethical walls or permissions between matters inside a firm. Neither names bar or ethics guidance for the lawyers using it, and neither publishes a price on its own website. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
Three readings to weigh. Candle AI logs email work as billable time automatically, and nothing it publishes addresses how a lawyer should review machine logged time before it reaches a client's invoice. Candle's only published price appears on its Clio App Directory listing rather than its own site. Vesence states it switches to newer models as they ship, so model versions within an approved provider can change without notice. Candle AI was verified on 22 September 2026 and Vesence on 2 September 2026. Neither vendor reviewed this page.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything above comes from public material on the dates shown. How the index grades.