Candle AI vs Vesence: how they compare in 2026

Triage, drafting in the lawyer's voice and the Candle Work agents that propose record updates and filings are model work. Surfacing the client, matter and deadlines from the case management system, email templates and logging time are integration features that function without the models. Candle Work, announced on 19 August 2026, also connects other systems through MCP and is in early access for a limited number of firms.

There is no conventional product underneath. The four Office add-ins have no non-model function at all: what they do is draft, redline, reformat, cross-check and quality-check, and each of those is model work. The web workspace holds files, chats and drafts in a project, but it exists to give the agent context rather than to be a document management system, and the vendor describes the whole thing as one agent across five products. The systems of record stay where they are, in Word, Outlook, Excel, PowerPoint and the firm's own files. Annex 1 to the data processing agreement puts it plainly from the other direction, describing the processing as machine learning algorithms processing collected text to generate responses and insights. Remove the models and nothing remains to sell.

Drafts are described as grounded in the matter file and based on the matter information attached to the email, but no citation back to the source record appears in a draft, nothing describes how the draft is assembled, and no accuracy figures are published. The Terms of Service warn that output might not be accurate, comprehensive or current and should not be relied on as a source of truth, and provide all results to customers as is, with no warranty of accuracy.

Accuracy is acknowledged candidly but never measured. Clause 3.6 of the general terms says that, because AI is probabilistic, the services may sometimes produce inaccurate output or suggestions, and that this is not a Defect. Putting that acknowledgment in the operative agreement, rather than a footer disclaimer, is the opposite of claiming there are no hallucinations. No accuracy figure, test set, benchmark or evaluation is published. The product's answer is checking rather than grounding: a one click check described as reviewing hundreds of errors across documents and inboxes, and cross checking spreadsheet data against source documents. Neither is a described retrieval method, and the product does not ground answers in primary law.

The Security page states that a user at the firm must explicitly approve anything sent or filed, and the product FAQ says: "Nothing is sent, saved, or filed until a user at your firm explicitly approves it." Drafts are prepared for review and never sent automatically. Candle Work shows exactly what it would change, such as record fields, a document filed to a matter or an activity logged, and holds the result with nothing saved until a user approves; its launch post says "You review, adjust, and approve before anything consequential happens." Triage, context retrieval and the capture of time and activity run without approval.

The review step is strong, but nothing says what the agent does on its own. Every edit an agent makes lands as a tracked change in Word, Excel, PowerPoint and Outlook, with accept and reject controls. The human check is the normal review mode of the application the work already lives in, not a separate approval screen. The duty to use it is in the contract. Clause 4.2 requires the customer to assess the accuracy and quality of input and output for its intended use, including through human review, and clause 10.5 repeats it. What is not published is what the agent does unattended. Nothing says which steps finish without a person, what the agent does when uncertain, or what happens when it is wrong. The Outlook feature is described as drafting rather than sending, but that limit is not stated.

Candle's home page says more than 60 law firms use the product and shows firms including Saiontz & Kirk; Minami Tamaki; Siskind Susser; Garfinkel Immigration Law Firm; Katie L. Lewis, P.C.; Childers, Schlueter & Smith; Chun Fruto Law; and Farris Riley & Pitt. It quotes C. Jason Baab of Graham-Hurd & Associates on discovering lost billable time, and Gary M. Singer: "I was at least an hour higher than I expected to be." The figures, an hour saved per person per day, 70 percent faster drafting, 75 percent faster client responses and 80 percent faster retrieval of matter data, carry no customer, date or method, and neither do the 200 or more emails per person per day and four or more hours a day in the inbox. Partnership posts claim one to two hours a day saved and up to 75 percent faster client response, with no basis given. Candle was runner up in the ABA TECHSHOW 2026 Startup Alley on 25 March 2026 and appeared in the ILTACON 2026 Startup Hub on 27 August 2026.

Four law firms are named with their own case studies: Cederquist, Snellman, Andulf and Kanter, all Nordic, covering M&A, fund formation and full service practice. One carries a figure tied to a named person: Maja Wettergren, Managing Partner at Cederquist, is quoted as reaching 90 percent weekly usage across the firm. Several case studies are dated, with the Snellman piece dated 25 June 2026. On the customer index and home page, that figure is the only one, an adoption rate showing how many lawyers used the product rather than what changed in the work, and no method or basis is given.

The Terms of Service, effective 5 June 2026, commit that Candle will not use attorney client privileged information in user data as input to any AI tool other than Candle's, or to train any AI model other than Candle's. The Security page adds that a firm's emails, matter details and client information are never used to train Candle's own models or models for another customer, and describes encryption, access controls and audit logging. The terms define Confidential Information broadly without naming User Data, and the duty to return or destroy it is subject to Candle's perpetual license to Aggregated Statistics. The terms also give Candle an irrevocable right to compile anonymous aggregated statistics from user data and to make them public, and nothing addresses separation between matters or users within a firm.

The agreement settles training and retention, but not matter separation or privilege. Clause 7.1 says Vesence will not use Customer Data to train AI models and will not let its subcontractors do so. Annex 1 to the data processing agreement sets out retention in detail, with instantaneous processing and no storage by default. The position on model providers is detailed. Inference entities are named per route. Microsoft has approved Modified Abuse Monitoring, so prompts and completions are not stored on any production Azure OpenAI account, and OpenAI routing is limited to zero data retention endpoints. Two gaps remain. Separation is stated at tenant level, with all customer data logically isolated per tenant, but nothing addresses separation between matters or teams within a firm. And nothing addresses privilege or work product directly.

The Terms of Service state that "The provision of the Platform does not constitute the practice of law and is not intended to be a substitute for professional legal advice," that output should not be relied on as a source of truth or used for decisions with legal consequences, and that users must be at least 18. Every draft needs a lawyer's approval before it is sent. The product also records email work as billable time automatically, and markets that time previously lost is now billed, but nothing published addresses the lawyer's duty to bill only for time actually spent when entries are logged by machine.

Vesence states fully in its agreement that its output is not advice. Clause 10.5 says output and materials from the services are not professional advice of any kind, naming legal, tax, accounting, financial and investment advice. It says Vesence is not an advisory firm, does not know the full context in which output will be used, and is not responsible for decisions, actions, omissions or reliance based on it. Clause 4.2 adds the customer's duty to conduct human reviews, which addresses supervision. Two things are missing. No jurisdiction limits are stated, and no bar or ethics guidance is engaged. Vesence is Swedish and engages the EU Artificial Intelligence Act at clause 3.2 instead, which binds the supplier rather than the lawyers using it.

No AI governance framework, accountable owner, testing before release or bias disclosure is published; the Content Policy governs what users may post, not how the models are governed.

One real governance commitment exists, in the contract rather than on a web page. Clause 3.2 of the general terms requires the services to comply with laws including the EU Artificial Intelligence Act. That is a named obligation the customer can enforce, and more than a principles page. Nothing else is published. There is no governance framework, no person or team accountable for model behavior, no testing regime before release, no ISO 42001 or similar certification, and nothing on uneven output across matter types, counterparties or groups of people. The third party audits on the security page are security assessments, a different subject.

The Security page describes encryption in transit and at rest, access controls and audit logging around systems that process firm data, and hosting in the United States. The trust center at trycandleai.trust.site, powered by Sprinto, publishes control status, a subprocessor list with the service each provides and its hosting region (Google Workspace, AWS and Google Cloud Identity, all in the USA), and a managed process for requesting security documents. Under the Terms of Service, Candle keeps User Data for 30 days after termination and may then delete it; the Privacy Policy, effective 4 June 2026, keeps personal information as long as reasonably necessary, with no period. No retention period during the term and no incident notification commitment are published.

All five elements are published, current and specific. Retention is set out in Annex 1 to the data processing agreement: processing is instantaneous and no personal data is stored by default, with the sole exceptions of prompts inside customer-created agents, retained until the customer deletes them, and an optional Cloud agents feature, off unless the customer switches it on, which persists conversations and files until deleted or deactivated. Deletion runs on customer instruction at clause 9.3, with copies destroyed unless law requires retention. Access control covers Microsoft Entra ID with token-based authentication, role-based access with least privilege, enforced multi-factor authentication, audit logging and automated session management, with customer-side administrator control of users at clause 4.5. The subprocessor list is dated 20 May 2026 and names each legal entity, its headquarters, role, processing regions and whether it is required or optional. Incident practice is set out at clause 5 of the DPA: notice without undue delay, root cause investigation, description of the breach and affected data, and coordination on public statements and regulator notices. The one thing not published on a public page is a fixed breach notification deadline in hours.

The Terms of Service cap Candle's liability at the amounts paid or payable in the preceding 12 months, provide all results as is and disclaim the accuracy of AI generated output. They include no indemnity from Candle, have the user indemnify Candle, and bar class actions. Delaware law governs, and disputes go to the courts of Delaware.

Clause 10.2 caps each party's total liability per contract year at fifty percent of the subscription fees invoiced that year and excludes indirect damages. Clause 10.3 lifts the cap for intent and gross negligence, clause 10.4 lists six exclusions, and clause 10.6 sets claim windows of three months from awareness and six months from occurrence. Clause 11.1 gives an intellectual property indemnity from Vesence to the customer. Clause 11.2 sets the remedies in order: get a license, replace, amend, or terminate and refund prepaid fees. Clause 11.3 makes this the sole and exclusive remedy. Clause 3.2 promises professional, workmanlike service that complies with law, including the EU AI Act, and clause 6.3 warrants noninfringement to the best of Vesence's knowledge. Vesence does not stand behind output: clause 3.6 says occasional inaccurate output is not a Defect. The fifty percent cap is lower than the common cap of a year's fees.

Candle runs inside Gmail and Outlook and connects to Clio, Filevine, MyCase, Docketwise, Mitratech INSZoom, Visalaw, Litify and Salesforce, reading client, matter, deadline and correspondence data into the inbox and, through Candle Work, writing record updates, filing documents to the matter and logging activity once a user approves. Partnership posts describe the direction for several: the MyCase post of 27 April 2026 says "Everything you do then syncs back to MyCase automatically"; Filevine (5 June 2026) and INSZoom (16 June 2026) log emails and time to the matter; DocketWise (19 June 2026) drafts emails, creates tasks and logs communications from Gmail or Outlook; and the Clio connection brings matter, contact and case details into Gmail or Outlook. Candle Work connects other systems through MCP. The Privacy Policy lists the Google access Candle requests: Gmail read, modify and metadata scopes, Pub/Sub and Drive read. Smokeball, Neostella, iManage and NetDocuments are listed as coming soon. No technical documentation describes what each connector syncs in detail or what a firm must configure.

The product lives inside the drafting environment rather than connecting to it, and each surface has its own page describing what it does: tracked-change generation and template filling in Word, house-style drafting and inbox-wide error checking in Outlook, spreadsheet review and cross-checking against source documents in Excel, and slide quality checks and firm formatting in PowerPoint, with distribution through Microsoft AppSource and a mobile continuation of the same workspace. That is real depth in the four applications a professional services firm actually drafts in. What is absent is the rest of the stack a law firm runs. No document management integration is named, and iManage and NetDocuments do not appear anywhere, which matters more here than for an in-house product because the firm's matter files live in a DMS. No API, developer documentation or implementation guide is published, and nothing describes what synchronizes or what a firm must configure beyond installing the add-ins.

The Security page says customer data is hosted in the United States and that the subprocessor list identifies each provider's hosting region; Candle's trust center lists Google Workspace, AWS and Google Cloud Identity, all in the USA. The product runs as a Chrome extension and an Outlook add-in on top of the firm's existing email. No residency option, private deployment or tenancy choice is offered, and the terms say the service is intended only for users in the United States.

Vesence publishes where data is processed in detail, and separates processing from storage throughout. The subprocessor list gives regions by route: Sweden Central as the main Azure region, West Europe for Static Web Apps, EU Azure OpenAI regions or DataZone deployments where Azure inference is used, and eu-central-1 in Frankfurt for the AWS Bedrock route. Annex 1 to the data processing agreement says processing happens only within the EU and EEA, and the security page repeats it. Tenancy is stated too: all customer data is logically isolated per tenant, within a Zero Trust architecture with redundant infrastructure, automatic failover and point in time recovery. The subprocessor page even says which deployment types should not be used for EU traffic. The flip side is one region policy with no option outside the EU, so a customer that must keep data in a country outside Europe is not served. That is a disclosed limit on availability, not a gap in disclosure.

A completed SOC 2 Type II examination and maintained HIPAA compliance are stated on Candle's Security page. The trust center, powered by Sprinto, marks SOC 2 and HIPAA as Compliant, publishes control status and offers supporting documents through a managed request process. No auditor, report period or scope is stated.

The security page claims SOC 2 Type II and describes independently audited controls for security, availability and confidentiality. It states regular third party security audits and vulnerability assessments, and invites IT and compliance teams to ask for the report, by email to support. No auditor is named, no coverage period or report date is published, no penetration test summary is offered, and there is no trust center or portal. Clause 6 of the data processing agreement gives the customer, or an auditor it appoints, a right to inspect once the agreement is signed.

Mention of Candle's models on the Security page comes with no named model, model provider or processing location. The Privacy Policy lists AI model inference providers among its vendors without naming any, and the subprocessors in the trust center, AWS, Google Workspace and Google Cloud Identity, include no AI model provider. No commitment to notify customers of model changes is published.

Vesence names its models, providers and regions, and commits to notice of new providers. The product pages name models including GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.5, Opus 5, Opus 4.8 and Gemini 3.7 Flash. A dated subprocessor list names providers as legal entities: Microsoft Ireland Operations Limited, Amazon Web Services EMEA SARL and OpenAI Ireland Ltd, each with headquarters, role and status. Regions are given per route, from Sweden Central to Frankfurt. The routing is explained. Claude models reached through Bedrock make AWS the subprocessor, OpenAI models reached through Azure make Microsoft the subprocessor, and the customer chooses which routes are enabled. Clause 7.2 of the DPA commits to updating the list before any new subprocessor is authorized, with a ten business day objection right at 7.3. Two limits. Customers must check for changes themselves, since the DPA asks them to monitor the page with a URL tracking service. And the home page says Vesence switches to a better model as soon as one ships, so version changes within an approved provider are not notified.

The product FAQ says: "Candle is priced per user, per month, with plans based on team size and an annual Candle Work task pool included in every plan. Each plan starts with a free trial against your firm's real inbox. Book a demo for current pricing." Candle's listing in the Clio App Directory, where Candle is the seller, states pricing starting at $49 per month in US dollars, and its link to view all plans leads to a demo request. Capterra lists a Starter plan at $59.00 per user per month, not confirmed by the vendor. The Terms of Service renew subscriptions monthly unless canceled and allow price changes on 30 days' notice. The company's own site publishes no figure, and higher tiers are not stated.

The unit and the structure are published without the figure. Clause 5.1 puts subscription fees in an Order Form; clause 5.4 caps annual indexation at five percent; clause 5.2 allows fee changes only in proportion to documented changes in third party costs such as Microsoft Azure; clause 12.1.3 sets twelve month automatic renewals terminable on sixty days notice; clause 12.1.2 gives a right to exit within the first three months of the initial term; and section 13 provides that a Pilot is free of charge unless the Order Form says otherwise. The usage-based unit is named rather than gestured at, with Annex 1 to the DPA describing Vesence Credits and consumption tracked at user, matter and day level. A free trial is offered from the home page. What is absent is everything above that: no pricing page, no tier names, no feature splits and no figure anywhere, and the structure sits in the agreement rather than on a commercial surface.

The buyer is law firms, across practice areas, with the customer list and integrations showing a particular base in immigration and personal injury work. At ABA TECHSHOW 2026, Candle was described as an "email intelligence layer built specifically for small and mid-sized law firms". The terms say the service is intended only for users in the United States. Firm size limits beyond that description and practice areas the product does not suit are not stated.

Practice coverage is laid out in detail, but not where it stops. Seven areas each have their own page: corporate, banking and finance, fund formation, dispute resolution, compliance, family law and business support. The corporate page, for example, describes diligence across a data room and keeping defined terms and cross references consistent from term sheet to signing. What is left open is the boundary and the segment. No firm size is named, and nothing separates what a large firm gets from a small one. No jurisdiction is stated, though the named customers are Nordic and the agreement is governed by Swedish law with Stockholm arbitration. The buyer is also broader than legal. Vesence addresses law firms, banks, investment funds and enterprises together and calls itself made for professional services. A reader cannot tell where legal capability ends and general document work begins. Nothing says what the product does not support.