Claren vs Summize: how they compare in 2026

The artificial intelligence is the product and there is nothing underneath it. Every function Claren sells is a model output: redlining a contract in seconds with wording edited to the team's stated position, extracting key terms, and answering questions about a document with citations. There is no repository, no workflow engine, no matter system and no document management layer that would survive the models being removed; the terms of service describe the thing being licensed as a software solution utilising artificial intelligence, and the product page markets an AI editor that goes from upload to redline with no setup and no plugins. Even the tier structure is model-shaped, with Pro capped by chat and file upload volume and higher tiers adding AI playbook generation and custom term extraction. Remove the models and a buyer is left with an upload form. Reported here with its located evidence per the standing discipline on A rows. Checked 4 September 2026.

The models are the engine of a core capability layered on a product that stands without them. Summize publishes its own three-layer architecture and only the third is AI: a Knowledge Layer holding playbooks and policies, a Contract Operations Layer running the lifecycle from first request to signature inside existing tools, and an agentic AI layer, SIA, described as surfacing that knowledge as instant answers. Remove SIA and a working contract request, repository and operations system remains, embedded in Outlook, Teams, Slack and Salesforce. The vendor's own framing of the layers as distinct, each one powering the next, is what settles this. Checked 4 September 2026.

Limitations are disclosed with unusual candour and accuracy is never measured. Clause 3.4 of the terms is the most forthcoming accuracy statement located in this pull: the solution may contain outdated or inaccurate information, is trained on historical data with specific knowledge cutoff dates, may not reflect recent legal developments or changes in statute or case law, and its outputs may contain errors, omissions or misinterpretations of legal concepts requiring correction by qualified professionals. Clause 3.4.3 disclaims any representation as to accuracy, completeness or adequacy. Against that, the marketing asserts what the agreement declines to warrant, describing the product as built on trusted legal sources and understanding contracts like a lawyer does, and offering answers with citations. No accuracy figure, test set, evaluation, error rate or retrieval method appears anywhere, and the trusted legal sources are never named, so a reader cannot tell what the citations resolve to beyond the customer's own uploaded document. Grounding is claimed, limitations are published, and nothing is testable.

Accuracy is asserted without measurement. SIA is described as providing instant, reliable answers grounded in the customer's own knowledge and standards, which identifies the grounding source as the Knowledge Layer of playbooks and policies but describes no retrieval method behind it. The security page states that on a consistent basis Summize evaluates the effectiveness, quality and security of its AI models, which is an assessment practice asserted with no published result, no test set, no cadence and no scope. No accuracy figure appears anywhere. No failure mode is named on any surface: hallucination is not discussed, and the published performance figures are all speed and volume rather than correctness. Searched the home page, the security page, the AI layer page, the website terms and the SaaS terms on 4 September 2026.

The requirement for a lawyer to review sits in the contract rather than in a disclaimer, and the control structure around it is not described. Clause 3.3.1 provides that all information, documents, analyses and other outputs must be reviewed by qualified legal counsel before being relied on, implemented or used as the basis for any decision or action, and clause 3.3.3 has the customer acknowledge that Claren has expressly informed it of that requirement. Clause 5.2.10 goes further for one category, prohibiting submission of Claren-generated documents to courts in criminal proceedings without independent attorney review. The product design supports it, with the model producing a redline the lawyer accepts, rejects or edits rather than writing to anything itself. What is absent is the structure: no threshold at which the system acts alone, no confidence or certainty signal surfaced against an individual suggested edit, no abstention state, and no description of what a reviewer sees to distinguish a high-confidence extraction from a marginal one.

Oversight is asserted as a slogan rather than described as a mechanism. The positioning is explicit that the business becomes more self-sufficient while legal remains in full control, and that queries which used to reach legal's inbox are answered instantly by the people who needed them. Nothing published says what SIA answers alone versus what a lawyer approves, no threshold is stated, no review surface is described, and nothing addresses what happens when an answer is wrong. The phrase legal remains in full control is the whole of the oversight position, which is the case this band describes. Searched the home page, the AI layer page, the security page and the SaaS terms on 4 September 2026.

Attribution is unusually complete and measurement is entirely absent. Eight customer logos are published and five testimonials carry a full name, a role and an organisation: Alan Owens, Head of Legal at H&M V Engineering; Arvinder Mangat, General Counsel at Encompass; Carl Dunton, General Counsel at Peak Energy; Chantal Schofield, Knowledge Manager at Telecom Infrastructure Partners; and Jamie Todd, Commercial Counsel at ScreenCloud. Three of the five are the senior legal officer of the named company, which is stronger attribution than a logo strip and stronger than most records in this lane. The quotes are also substantive rather than generic, with one describing the product as helping spot what a reviewer might have missed when working at the edge of their knowledge, and another reporting a lawyer asking after one week that it never be taken away. What holds this at B is that not one figure attaches to any of them: nothing is dated, no cycle time, volume or cost is given, and the corporate claims run to unquantified language about hours saved and backlogs cleared. A case studies section and an ROI calculator exist and were not opened.

Real deployment evidence with substance, short of measurement tied to a named customer. Named customers carry attributed quotations and dedicated case study pages: Steven McGeagh at Huel on ease of adoption, Julia Trius at Edpuzzle on receiving agreements already in the required format, and Derek Ihnen at Boon Edam on reduced review time. Logos include Revolut, SeatGeek, Miami Heat, Matillion, Sigma Computing, CodeRabbit, KSE and IPC Systems. Figures are published and specific: three times faster contract creation, 40 per cent reduction in deal length, 50 per cent reduction in processing time, six times more contracts reviewed, and two minutes against two hours for an NDA. One figure carries an independent method, a 4,062 per cent ROI attributed to Nucleus Research, which is a named analyst firm rather than an internal claim. Held at B because none of the figures is tied to any of the named customers, none carries a date, and the case study pages were not opened in this pass, so they are credited for existing rather than for their contents.

Most limbs are met and the two that are not are both worth a buyer's attention. Training is prohibited in the agreement itself at clause 4.2.4, which is the strongest form this commitment takes. Segregation is documented rather than asserted: each user has a private and segregated data store on Neon, authentication and row-level security for organisation roles run through Clerk, and the security page states there is no cross-contamination between client matters or organisations. The model provider limb is answered squarely, with zero data retention agreements named as in place with OpenAI and Anthropic and each provider's own terms linked. Encryption is AES-256 at rest and TLS 1.2 or higher in transit. Two things hold it below the top band. Privilege is addressed only as data being treated with attorney-client privilege in mind, which is a posture rather than the express privilege and work product treatment the top band requires, and work product is never mentioned. And the contractual confidentiality obligation at clause 12.1 reaches only information clearly labelled or identified as confidential, which is a narrower net than uploaded matter material would ordinarily fall into.

Substantive published commitments, and the agreement is readable, which is why this sits above the assertion band. Clause 6.1 grants Summize a licence to store, transmit and process Customer Data solely as necessary to provide the services and states that nothing in the agreement grants any other rights in it. Clause 6.2 requires physical, technical and organisational measures aligned with good industry practice, clause 6.5 imposes confidentiality with named exceptions, clause 6.6 requires daily encrypted backups available to the customer on request, and clause 9.2 requires prompt deletion or return of all Customer Data at the customer's option on termination. The position on the model provider is explicit rather than inferred: customer prompts, completions, embeddings and training data are stated to be exclusive to each customer and not available to OpenAI or used to improve OpenAI models. Three limbs are unmet. Training is permitted rather than prohibited, because clause 6.4 reserves the right to use Customer Data in aggregated, anonymised form to improve the software through machine learning analysis. Segregation is asserted as siloed AI with no published detail on enforcement. And privilege and work product are not addressed anywhere, which is defensible for a product whose buyer is a corporate department rather than a firm but is still absent.

The most complete professional responsibility treatment located in this pull, and it sits in the agreement rather than a footer. Clause 3.1 states plainly that the solution provides information of a general nature, is not a substitute for licensed legal counsel, does not provide legal advice, and creates no attorney-client relationship. Clause 3.3 supplies the competence and supervision limb directly, requiring that all outputs be reviewed by qualified legal counsel before reliance and having the customer acknowledge it was expressly told so. Clause 3.3.2 does what almost no vendor does and names the doctrine: users who are not licensed attorneys are specifically cautioned that use may constitute unauthorised practice of law if used to provide legal advice to others. Clause 3.2 carves out an entire category, stating the product must not substitute for representation in criminal matters, active court proceedings or any matter where liberty is at stake, and will not draft court filings in criminal proceedings without independent attorney review. Clause 3.5 names jurisdictional limits explicitly, identifying variation between the United States and United Kingdom and among states, territories and localities, and placing compliance responsibility on the user. The product has no consumer-facing surface, being sold to in-house legal teams.

Nothing published addresses the advice line for a product explicitly sold to people who are not lawyers. Summize markets contract answers to sales, finance, HR and procurement teams, states that queries which used to find their way to legal's inbox are taken care of, and gives the example of a salesperson checking renewal terms and a CFO querying payment performance without involving legal. Against that, no statement anywhere says what the output is and is not, no disclaimer distinguishes information from legal advice, no competence or supervision language appears, and no jurisdiction limit is stated despite customers in both the UK and the US. This grade rests on a document that was read rather than on a gap that could not be tested: the SaaS terms and conditions were retrieved in full on 4 September 2026 and contain warranties, indemnities and liability caps but no advice-line provision at all. The website terms of use likewise disclaim only the website. The nearest thing to a position is the marketing line that legal remains in full control, which is about workflow rather than about advice.

No governance position was located for a product whose entire output is model-generated legal work. There is no responsible AI page, no principles statement, no named owner accountable for model behaviour, no pre-release evaluation or testing regime, no red-teaming description and nothing at all on bias, including nothing on whether redlining or risk flagging performs evenly across contract types, counterparty positions, languages or jurisdictions. That last gap has weight because the product is marketed as operating across multiple languages and jurisdictions. The security page is detailed and entirely about information security, which the axis definition treats as a separate subject and which is graded on the stewardship and certification rows rather than counted twice. Clause 3.4 of the terms discloses accuracy limitations frankly, but disclosing that a model may err is a product warning rather than a governance framework, and it is credited on the accuracy row instead. Searched the home page, the security page, the terms of service and the site navigation on 4 September 2026.

Principles are published without a mechanism a buyer could audit. The security page sets out four AI commitments: siloed AI practices, regular assessments of effectiveness, quality and security, ongoing updates to AI capabilities, and a customer feedback loop. Each is a sentence. No owner inside Summize is named as accountable for AI outcomes, no pre-release testing regime is described, no assessment result is published, and there is nothing whatever on bias or uneven output across contract types or counterparties. The company publishes an EU AI Act explainer written by its own General Counsel, which is regulatory commentary for the reader's benefit rather than a disclosure of Summize's own governance. ISO 27001 is an information security standard and does not answer this axis.

Substantive across most of the set, with the specifics thinning at the edges. Retention and deletion are stated in the agreement rather than in marketing: clause 11.6 commits to deleting all content of the customer and its users within 30 days of the contract expiring, and the security page adds that the terms and pilot agreements specify a right to delete data at any time. Access control is described concretely, with authentication and user management through Clerk, account-specific sessions, authenticated API endpoints, row-level security for organisation roles, multi-factor authentication available for administrative access, production access restricted on a need-to-know basis, background checks for staff with access to sensitive systems, and security awareness training at onboarding and ongoing. Suppliers are named rather than gestured at: Neon for data stores, Clerk for authentication, and OpenAI, Anthropic and Google for models. Incident practice exists and is the softest limb, with defined incident response procedures said to carry SLA targets for acknowledgement, escalation and resolution, but no target is published and no customer notification commitment or timeframe appears anywhere. No formal subprocessor register with locations exists; DPAs are available on request.

Substantive published policy covering most of the ground. Deletion is contractual and specific: clause 9.2 requires Summize to promptly delete or return all Customer Data at the customer's option on termination, with retention only where law requires and continuing confidentiality obligations over anything retained. Clause 6.6 requires backups no less frequently than daily, secure and encrypted, in a commonly used machine-readable format and available to the customer on request. Access control rests on ISO 27001 with DevSecOps practices and internal password, equipment and data confidentiality policies described, and clause 3.2 gives an annual audit right over user and password compliance. Regular third-party penetration testing is stated. Two elements of the set are missing: no retention period is stated for the term of the agreement, only for its end, and no subprocessor list is published, with Appendix 3 referenced in clause 8.4 as defining Sub-Processors but not rendered in the published document.

Liability is addressed through a limitation clause that disclaims precisely the exposure the product creates. Clause 10.1.2 caps total liability at the higher of 100 pounds or the fees paid in the twelve months preceding the claim, and the floor figure is worth naming: for a customer in its first months the ceiling on a claim may be a hundred pounds. Clause 10.1.1 excludes special damage, lost profits, lost savings, lost business opportunity, lost contracts, goodwill, corrupted data and wasted expenditure. Clauses 10.3, 10.4 and 10.5 then address output directly and disclaim it, stating that outcomes are for general information only, are not intended to meet professional requirements, carry no representation or warranty that they are accurate, complete or up to date, and that Claren has no liability for the accuracy of customer content. Clause 9 runs the indemnity one way only, from customer to Claren, and no vendor indemnity of any kind appears. Clause 10.2 preserves liability for death, personal injury caused by negligence and fraud. No insurance position was located. The whole picture is published, dated 11 April 2026 and readable before signing, which is what keeps it off the floor.

The strongest liability position located in this pull, and all of it readable before signing. Clause 7.2 gives the customer an intellectual property infringement indemnity covering claims, liabilities, losses, damages and reasonably incurred costs, with a single named carve-out at 7.3 for unapproved combinations, and 7.4 sets out the conduct-of-claim mechanics including that Summize may not settle without unconditionally releasing the customer. The caps are set as a floor rather than a ceiling, which is unusual and materially better for a smaller buyer: clause 8.3 caps general liability at the greater of 100,000 pounds or 150 per cent of total charges, and clause 8.2 sets a separate super-cap for breach of the security and data protection obligations at the greater of 500,000 pounds or 500 per cent of total charges. Clause 8.1 preserves liability for wilful misconduct and anything not excludable by law, and 8.4 makes Summize liable for its subcontractors and sub-processors as if their acts were its own. Warranties are real and invocable: clause 3.6 warrants the software will comply with its specification in all material respects and be free from material errors and defects, 3.5 requires reasonable skill, care, diligence and foresight, 3.8 warrants against malicious code on an ongoing basis, and 7.1 warrants Summize holds the rights needed to supply the service. No insurance position was located. Notably there is no disclaimer of output accuracy in this agreement, unlike several peers.

Two integrations are named with real contractual detail and the rest is a number. Slack and Microsoft Teams are named and their behaviour described in the agreement rather than in marketing: clause 2.4 states the solution is designed to be integrated into an organisation's internal communication and workflow system such as Slack or Teams, that Claren may require the customer to hold an active account with one, and that Claren may access the customer's Slack or Teams account and the channels it is instructed to access and deliver content or outcomes through those channels. That is direction of travel and required configuration stated plainly. Beyond it the disclosure stops: the Pro plan lists 15 or more data integrations without naming one, enterprise single sign-on and SAML appear at the tier above, and no document management system, contract lifecycle system, matter management platform or e-signature product is identified anywhere. For a contract review product the absence of any named DMS or CLM is the material gap, since that is where the agreements being reviewed already sit. No integrations page, API reference or developer documentation exists in the site navigation.

The integration set is the product's central claim and it is documented rather than listed. Named targets are Outlook, Microsoft Teams, Slack, Gmail, Microsoft Word, Salesforce, HubSpot and Jira, plus Summize Sign for e-signature and a Claude integration, each with its own dedicated page. What each integration surfaces is described concretely rather than as a logo: a salesperson checking renewal terms inside Salesforce, a CFO querying payment performance across the supplier base, contract context and assistance available in the tool without a new login to manage. The positioning is explicit that there is no separate platform to adopt, which is a statement about direction of travel between systems. Configuration effort is published too: implementation runs in sprints of three to four weeks under a named HERO methodology with in-house implementation staff, typically fully rolled out within twelve weeks. The individual integration pages were not opened, so the grade rests on the named set, the described in-tool behaviour and the published implementation model rather than on their contents.

Region options are published and the processing half is not. The security page states that cloud infrastructure is hosted in United States, United Kingdom or European Union data centres, with data residency options for enterprise customers, and adds that all data including read replicas can be stored in a data centre located in a specific region on request. That is a genuine three-region choice with the tier it attaches to identified, which is more than most records in this lane offer. Tenancy is described functionally through the data layer, with each user given a private and segregated data store on Neon and row-level security for organisation roles, though the platform is never characterised as single or multi-tenant in terms. What is missing is where processing happens as distinct from where data sits: models are called through the OpenAI, Anthropic and Google APIs and no location is stated for any of them, so a customer selecting European Union residency cannot establish from published material that the inference leg stays in region.

Neither limb is stated for the platform. The only hosting location published anywhere is in the website terms of use, which state that the Website is hosted on servers located in the United Kingdom; that governs the marketing site rather than the software, and a website term does not grade the platform. For the platform itself the home page says data never leaves your environment and the FAQ says it is built on Azure enterprise-grade infrastructure, which names the infrastructure provider without naming a region and without stating where customer contract data is stored. Tenancy is not addressed: siloed AI describes the handling of prompts and embeddings rather than a tenancy model, and no material states whether the platform is single or multi-tenant. Searched the home page, the security page, the website terms and the SaaS terms on 4 September 2026.

No independent attestation is held, and the site contradicts itself about that. The security page states that Claren is currently pursuing SOC 2 Type II and ISO 27001 certification, expected Q2 2026, and separately that Claren uses SOC-2 compliant vendors and third party software providers. Both sentences are careful and both say the same thing: the certifications belong to suppliers and to the future, not to Claren. The home page says something different, listing SOC 2 compliant among the reasons to choose the product with no qualification. Those cannot both be right, and the specific statement governs the general one. Two further facts belong on the record. The expected certification date, Q2 2026, had passed by the date of this check with no published update either way. And the supplier certification that is evidenced is Clerk's, with SOC 2 Type II and ISO 27001 and a link to its trust page; under the standing rule a supplier's attestation does not travel to the vendor without a scope connector, and none exists. A trust centre is said to be available on request and no report, auditor, scope or period is published.

Certification is real and stated, and better identified than most records in this band: the ISO 27001 badge names ISOQAR as the certification body and UKAS as the accrediting body, so a buyer can in principle verify the claim against a third party's register rather than take the vendor's word for it. That is the limb most records on this axis miss. What is missing is the rest of the accessible evidence: no certificate number, no scope or statement of applicability, no issue or expiry date, no trust portal, and no route to obtain a report. Penetration testing is described as regular and third-party with no firm named and no dates. A security whitepaper authored by named CTO Richard Somerfield is offered behind an on-page form, which is a request flow rather than open publication. One point stated plainly because the page states it plainly: **SOC 2 is not held.** Summize says it audits infrastructure in line with standards including SOC II and that it intends to investigate and work towards SOC II accreditation in the future, which is intent and is credited to nothing.

The providers are named, evidenced and linked, and the models are not identified. The security page states that Claren uses OpenAI, Anthropic and Google's models through their APIs, and the latest open source models on request, and it does not stop at naming them: each provider's own no-training position is cited with a link, to OpenAI's enterprise privacy policy, Google's Gemini API additional terms and Anthropic's privacy terms, and OpenAI's abuse-monitoring retention of up to 30 days is disclosed. Claren adds that it has established zero data retention agreements with OpenAI and Anthropic. That is a fuller account of who touches customer content, and on what terms, than most records in this corpus manage. Three limbs fail. No model or version is named, only the provider, so a buyer cannot establish which model performs a redline. Where inference runs is never stated. And no commitment to notify customers if a provider, model or arrangement changes was located, which matters given the open source option is offered on request.

Providers are named without change notification, which is this band's first limb. OpenAI is identified explicitly and in a form that tells a buyer something useful: customer prompts, completions, embeddings and training data are stated not to be available to OpenAI or used to improve OpenAI models, which both names the provider and states what it may not do. The FAQ adds that SIA is built on Azure enterprise-grade infrastructure, which locates the deployment. What is absent is the rest: no specific model or model version is named, no commitment to notify customers when a model or provider changes was located, and no subprocessor register is published, with Appendix 3 referenced in the agreement as defining Sub-Processors but not rendered in the published text.

The shape is visible and the number is not. Three plans are published with names and contents: Pro carries unlimited chats, 100 chat file uploads, 100 data room uploads, AI-powered redlines, a legal-tuned prompt library, 15 or more data integrations and a Slack community; Scale-Up adds enterprise single sign-on and SAML, a dedicated support manager, AI playbook generation, custom contract term extraction and data partitions; Enterprise adds biweekly AI training sessions, enterprise permission and access controls, managed onboarding, direct access to the AI team and priority input on the roadmap. No figure appears at any tier and every call to action is a demand for a demo. The unit of charge is gestured at rather than defined, with a closing note that plans are based on average document usage and that final packages and pricing vary by workflow and document volume, which tells a buyer that volume drives the bill without saying what a unit costs or how many are included beyond the upload caps. An ROI calculator is published and was not opened.

The unit and structure are stated without the figure, and unusually the evidence sits in the published agreement rather than on a pricing page, because there is no pricing page anywhere in the navigation or footer. The SaaS terms define the Order Form as setting out user numbers and type of software licence, which publishes the unit of charge as per-user by licence type. The term structure is published: an initial term with automatic renewal for successive twelve-month periods and 90 days written notice to prevent renewal. So is the escalation: clause 2.2(b) caps any renewal increase at 10 per cent over the preceding twelve-month term for the same plan, tier and package unless a higher cap is agreed, which is a real commercial protection a buyer can read before contracting. Payment terms are 30 days from a valid invoice, fees are exclusive of VAT and sales tax but inclusive of other taxes, and expenses require prior written approval. No figure, band, tier name or feature split is published anywhere.

The work is described with substance and one boundary is drawn sharply while others are left open. What is supported is clear: contract review, redlining, key term extraction and document question and answer for in-house legal teams, across multiple languages and jurisdictions, with named customers spanning energy, telecommunications, retail, technology and drinks. The exclusions are unusually explicit for this axis and come from the agreement rather than marketing: clause 3.2 places criminal matters, active court proceedings and any matter where liberty is at stake outside the product entirely, and clause 3.5 states that the product may not account for specific jurisdictional requirements or recent changes in local law, naming the United States and United Kingdom and variation among states and localities. What is missing is the rest of the picture. No firm segment or size is stated, law firm use as against in-house is never addressed, government legal is not mentioned, and no contract type is identified as unsuitable, so a buyer knows what the product will not touch in criminal work and not where else it stops.

Segment coverage is described with substance and the boundary is left open. Five buying teams each carry a dedicated page: Legal, Sales, Finance, HR and Procurement. Eight sectors each carry their own page: Software, Sports, Finance, Manufacturing, Business Services, Media and Internet, Retail and Telecommunications. Four use cases are published as request, review, repository and analytics, and NDAs are named as a specific contract type with a stated handling time. The buyer is a corporate in-house function rather than a law firm, and law firms are neither claimed nor excluded. What is missing is the edge: no organisation size is stated, no contract types beyond NDAs are enumerated as supported, government use is not addressed, and nothing says where the product stops.