CobbleStone Software vs Conga CLM: how they compare in 2026

The models are the engine of a core capability layered on a product that would still function without them, which is the B band and is the vendor's own description of the architecture. VISDOM is presented as a native intelligence layer inside Contract Insight, using the same data model and clause library, and as something that attaches to an existing workflow rather than being a destination. Underneath it sits a full contract lifecycle management platform that predates the AI by decades: repository, version control, template and clause authoring, workflow automation, alerts, reporting, electronic signature, and separately licensed vendor management, e-procurement, e-sourcing, purchase order, requisition and OFAC modules. Remove VISDOM and a working CLM and procurement suite remains, and the vendor sells the AI as a priced add-on with its own tiers rather than as the platform itself. That is the distinction from the records in this lane that carry A. Recorded on the other side: the 2026 releases push the AI further into the platform, with VISDOM embedded at platform level in the native online editor and described as operating autonomously there, and the vendor's own framing has moved from a feature to an agentic layer. It has not moved far enough to make the platform unsaleable without it. Verified 12 September 2026.

The models are the engine of a core capability layered on a product that would function without them, which is B and is the vendor's own architecture. AiMe is described as a shared AI layer running across the whole commercial suite, connecting workflow data across CPQ, CLM, price optimisation and document automation and suggesting next steps, rather than as the CLM itself. Underneath sits a full contract lifecycle platform that long predates it: template and clause-library generation, approval routing, negotiation, electronic signature through Conga Sign, a searchable repository, obligation and renewal tracking, and reporting. Strip AiMe out and a working CLM remains, which is precisely what the Salesforce-based edition was for years. What is recorded on the other side, because it is moving: the June 2026 platform release is described as AI-enhanced throughout, bulk import and extraction is presented as the way contracts enter the system at all, and the March 2026 AiMe release adds agents that act inside quoting and contracting workflows. The direction is toward the models becoming the product, and the record says so, but the platform is still sold and priced as a contract system with intelligence on top. Verified 12 September 2026.

Accuracy is asserted without measurement and grounding is claimed without a described method, which is the C band. The grounding claim is real in the product's own idiom and worth stating: VISDOM works from the customer's own clause library, playbook and repository, using the same data model as the platform, and clause suggestions are described as generated based on precedence, so the output has an identifiable source inside the customer's own material. The accuracy claim is unquantified, the strongest version being an assertion of consistent system-wide accuracy in a February 2026 release announcement. Nothing published gives an accuracy figure, a test set, an error rate, a benchmark or a described retrieval method, and no evaluation of extraction or clause-matching precision was located anywhere on the estate. R40 governs the floor and the D limb does not fire, because the position is not a bare no-hallucination claim: the Master Subscription Agreement disclaims warranties as to the quality, accuracy or validity of information residing on or passing through the system, and section 9.3(b) states that information available from the software may not be complete or accurate and that the customer assumes responsibility for its review and use. The product cites no legal authority, so the authority-grounding and citation-status limbs do not apply under R15 and are not counted against it. Verified 12 September 2026.

Grounding is real and documented, short of any accuracy figure an outsider could test, which is B. R15 governs the inapplicable limbs: the product cites no legal authority, so authority grounding and citation-status checking do not bite and are not counted against it. What does bite is grounding and measurement, and the grounding disclosure is stronger than most in this lane. The pipeline is named component by component on the trust centre: Google Cloud Vision for optical character recognition, Amazon Textract for table detection, Zuva for provision extraction and Azure OpenAI for language processing, which tells a reader how a clause becomes an assertion. Output is grounded in the customer's own repository, playbook and clause library, extraction is described as requiring no model training by the customer, and the vendor states that AiMe surfaces how every recommendation is generated with the reasoning visible to the user and a confidence score shown wherever it makes a suggestion. Accuracy is addressed only as a disclaimer: the Artificial Intelligence Addendum states that outputs may be inaccurate, incomplete or misleading and disclaims all warranty as to accuracy or completeness. No figure, test set, error rate or published benchmark result was located; third-party models are said to be benchmarked before release and no results are published. Verified 12 September 2026.

A written commitment that the models work alongside a human decision-maker, with real review surfaces, short of the threshold at which the system acts alone. The commitment is unusually strong for this corpus because it is contractual rather than marketing: Master Subscription Agreement section 7.2 prohibits the customer from using any AI Tool as part of an automated decision-making process with legal effects unless the final decision is made by a human being, and from using it to provide advice that would normally be provided by a licensed professional. That is a published constraint on what the system may be allowed to decide, drafted into the instrument that governs the product. The review surfaces are real: tracked edits, inline comments and co-authoring in the native online editor, high-risk clause flagging that triggers auditable reviews, and deviation reporting against the playbook before signature. R37 rule 2 identifies what is missing. The same estate describes AI operating autonomously within the editor, agents that analyse, flag and review without complex user configuration, and an assistant that runs compliance checks, and those cannot all sit alongside a human-decides rule without a stated boundary. No threshold, confidence level or class of work is published at which the system stops and hands back. The note carries both so a reader can weigh them. Verified 12 September 2026.

Modes, constraints, review surfaces and the route back to human judgement are all published, which is the A band, and most of it is contractual rather than marketing. What the system runs alone is stated as a boundary: AiMe never acts autonomously on high-stakes decisions. What constrains it is named as three specific mechanisms, agent guardrails, approval thresholds, and human-in-the-loop confirmation, each of which can be built into a workflow, which is the threshold limb answered in the product's own idiom rather than dodged. The review surfaces are real and are the strongest part: the vendor states that AiMe surfaces how every recommendation is generated, that users see the reasoning behind AI-driven actions, and that a confidence score is shown wherever AiMe makes a suggestion, alongside redlines a user accepts or rejects and a complete audit trail of every action and approval. The route back to human judgement is contractual: the Artificial Intelligence Addendum makes the customer solely responsible for evaluating and validating outputs, states that the customer shall not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact, requires appropriate human review and independent judgment, places authorising and supervising agent actions on the customer, and records that the features are intended to support and not replace human decision-making. One limit is recorded rather than credited: the guardrails and thresholds are described as configurable rather than as defaults, and the same document states that Conga does not monitor or review AI-generated outputs. Verified 12 September 2026.

Named customers without figures, which is the B band's stated shape almost exactly. Fourteen organisations are named in a published case-study library, each with the edition deployed and a one-line account of what changed: El Paso County, Marion County, the County of San Diego Health and Human Services Agency, SUNY Upstate Medical University, Chiesi, Intarcia Therapeutics, Soquel Creek Water District, Regional Water Authority, Brownsville Public Utilities Board, NewFields, Rapattoni Corporation, CentroMotion, Wound Care Advantage and Vertical Screen. The spread across government, healthcare, pharmaceuticals, utilities, manufacturing and software is itself evidence of production use rather than a pilot estate. What is absent is measurement attached to any of those names: not one carries a figure for cycle time, cost or volume on the index page read. The figures the vendor does publish are unattributed and sit at company level, being 95 per cent customer satisfaction according to its most recent survey, more than 5,000 organisations worldwide, a claim that digitised agreement workflows can drive up to 26 per cent efficiency gains, and a 1.8 times revenue velocity figure on the VISDOM page. None states a basis. Analyst placement with Gartner, Forrester, IDC and QKS is recorded rather than credited, since analyst recognition is not deployment evidence. Individual case studies were not opened. Verified 12 September 2026.

A named customer without figures, which is the B band's stated shape. The published customer-story library carries dated, named accounts, and one of the three surfaced on the index page is on this product: Cotality, formerly CoreLogic, described as elevating its client service capabilities with Conga CLM, dated 5 September 2024. The other two dated stories name DigiKey on price management, dated 27 April 2026, and Kalixia at 160 times faster document generation, dated 19 March 2025, and neither is the contracting product, so they are recorded rather than credited here. Around that sit customer logos on the product and pricing pages, Southwest Airlines, LinkedIn, AXA, Peloton, Cotality, T-Mobile, Adobe, Box and Kraft Heinz, which under the C band would stand in for evidence if they were all there was. What keeps the row off A is measurement and attribution together. The CLM story carries no figure. The figures that are published sit apart from any named customer: a 9 per cent revenue increase claimed beside the logo strip with no basis stated, an AI-assisted review claim of 50 per cent less review time on the features page, and three headline counters on the product page that render as zeros. Analyst placement, G2 Leader recognition across five grids with first rankings for enterprise usability and relationships, is recorded and not credited, since analyst placement is not deployment evidence. Verified 12 September 2026.

Substantive published commitments on confidentiality, readable before signing, short of the full picture, which is B. What is published and contractual: Master Subscription Agreement section 8.1 defines Confidential Information to include Customer Data expressly, section 8.2 requires each party to hold it in strict confidence, to use no less than a reasonable degree of care, and not to disclose it except as approved in writing or as legally required, and those obligations survive termination without a time limit. Tenant separation is stated as architecture on the VISDOM page, and the installed edition goes further by putting the whole application on the customer's own server under Exhibit A. The model-provider position is partly explicit and better than most of this corpus: section 7.1 names OpenAI as the AI Processor, states it may act as data subprocessor for information input into an AI Tool, and commits the vendor to reasonable advance notice before changing it. Three A limbs fail. Privilege and work product are addressed nowhere, and R33 makes that limb decisive on its own. There is no contractual prohibition on training: section 8.3 reserves the right to collect and analyse data including information concerning Customer Data and to use it to improve and enhance the Services, and the no-training statements sit on product pages rather than in the agreement. And while the model provider is named, nothing states what OpenAI may retain of what is sent to it. Retention and deletion are not addressed in the agreement at all. Verified 12 September 2026.

Four of the five A limbs are met contractually and one is absent, and R33 makes the absent one decisive. Training use is addressed in the Artificial Intelligence Addendum rather than on a policy page: Conga shall not use AI Inputs or AI Outputs to train or improve any AI or machine learning model beyond the limited licence to provide, maintain or improve the Services for that customer's benefit; Customer Data shall not be used to train global or foundational models serving multiple customers; and no third party may use Customer Data or AI Output to train, fine-tune, validate, test or otherwise develop any model. Segregation at the level an in-house buyer needs is documented: tenant environments are logically separated with dedicated encryption keys per tenant. Retention and deletion are stated in the Data Processing Addendum, which limits retention to the duration absolutely necessary and requires return and deletion at the customer's election after the agreement ends. The position on third-party model providers is explicit and unusually detailed: prompts, completions, embeddings and training data sent to Azure OpenAI are not available to OpenAI, are not used to improve OpenAI models and are not used to improve Microsoft or third-party products, and a zero-retention arrangement is stated with each document-processing provider. The limb that fails is privilege and work product, which is addressed nowhere on any surface read. On a product sold to legal departments to hold their agreements, that silence is the whole distance to A. Verified 12 September 2026.

A real published position on advice versus tooling, contractual rather than a website notice, short of the supervision and competence dimension. Two provisions carry it. Master Subscription Agreement section 7.2(ii) bars the customer from using any AI Tool to provide advice that would normally be provided by a licensed professional, naming legal advice expressly, which is a restriction on use rather than a disclaimer of status and is therefore addressed to the risk this axis exists for. Section 9.3(b) adds the status statement plainly, that CobbleStone does not provide legal advice for the customer, alongside an allocation of responsibility for reviewing and using output. Section 7.2(i) reinforces both by requiring a human being to make the final decision wherever an AI Tool feeds a decision with legal effects. C does not fire: this is not boilerplate in the terms contradicted by marketing that speaks in advice terms, and the audience is named rather than left ambiguous. What is missing for A is everything about the lawyer's own duties. Nothing addresses how a supervising lawyer discharges competence or oversight obligations over AI-generated redlines, nothing states which of the four named buyer groups may operate which capability, and no jurisdictional limit is named anywhere. The product is sold to procurement, sales and IT alongside legal, and nothing published addresses what that means for the review of legal positions. Verified 12 September 2026.

A real published position on advice versus tooling, short of the supervision and competence dimension, which is B. The position is contractual and specific rather than a website disclaimer: the Artificial Intelligence Addendum states that AI-generated outputs may be inaccurate, incomplete or misleading, disclaims any warranty of fitness, makes the customer solely responsible for evaluating and validating outputs before use, and then draws the line that matters here, that the customer shall not rely on AI-generated outputs as the sole basis for any decision that may have legal, financial, regulatory or other material impact, and that appropriate human review and independent judgment should be exercised. It extends the same allocation to agentic behaviour, making the customer responsible for determining whether agent actions are appropriate and for authorising and supervising them. C does not fire: the audience is named across published function pages, the marketing does not describe the product in advice terms, and the clause is not boilerplate. What is missing for A is the lawyer's own side. Nothing published addresses how a supervising lawyer discharges competence or oversight duties over AI-drafted contract language, nothing states which of the named buyer groups may use which capability, and no jurisdictional limit appears anywhere. That last gap is sharper than usual on a product marketed to sales and procurement users generating contract positions in the same tenant as legal. Verified 12 September 2026.

No governance framework, testing regime or accountable owner is published, which is C. What exists is governance by contract rather than by programme, and it is recorded because it is real: Master Subscription Agreement section 7 is a dedicated Artificial Intelligence article that names the third-party AI Processor, states that CobbleStone is not a data controller of information processed through an AI Tool, places control of what is uploaded with the customer's users, restricts the uses to which AI Tools may be put, and reserves the right to alter or withdraw VISDOM+ on reasonable advance notice. The product pages add a guardrails claim and an inference-only architecture statement. None of that is what the higher bands ask for. There is no responsible AI or AI governance page, no framework and no certification against one such as ISO 42001, no person or function inside the vendor is named as accountable for AI, nothing is published about what is evaluated before a model change ships, and there is no published position on uneven output across contract types, counterparty drafting styles or the seven languages the extraction engine claims to support. The one place a bias question is directly raised by the product, sentiment and negotiating-tone analysis, is described as a capability with no accompanying account of how tone is judged or tested. Verified 12 September 2026.

A published governance framework with real substance, short of testing results, which is B, and it sits at the top of that band. The substance is documented and contractual, not a principles page. The Artificial Intelligence Addendum records a cross-functional AI Governance Committee responsible for oversight of AI within the Services with a focus on risk management, accountability and compliance, which periodically reviews AI-related risks, controls and mitigation measures including data protection, security and appropriate human oversight. It commits Conga to internal policies for the ethical and responsible use of AI covering oversight of training data, bias mitigation and human interpretability, to personnel training on responsible development and deployment, and to full cooperation with a customer's own AI impact assessments and transparency obligations. Governance is anchored to a named external framework, the NIST AI Risk Management Framework, by its four core functions of Govern, Map, Measure and Manage. The vendor also publishes its own regulatory classification, stating that its products qualify as minimal or limited risk AI systems under the EU AI Act, and states that third-party models undergo testing, bias auditing and benchmarking before release with rollback to any prior model version available within hours. What holds it off A is the limb the band names: no results are published. No bias audit finding, evaluation output, model card or statement about uneven performance across contract types or drafting conventions was located anywhere. Verified 12 September 2026.

Substantive published policy across most of the ground, short of the full set, which is B. Retention and deletion are addressed in the privacy policy rather than left blank: personal information is kept as necessary to fulfil contracts and legal obligations and is retained until deleted by the vendor or as requested by the data owner, with deletion available on request at any time. Access control is documented across several surfaces: encryption at rest and in transit, tenant isolation, named and concurrent user licence models with server session timeouts defined in the agreement, and audit trails across AI chats, contracts and other key areas. The subprocessor limb is partly met in an unusual way, through the agreement rather than a register: section 7.1 names OpenAI as the AI Processor and as a possible data subprocessor, with reasonable advance notice of change, so a customer can identify the third party that sees content sent to an AI Tool. Two gaps hold it at B, and they are the two the band names. There is no subprocessor list, so the hosting, support and infrastructure processors behind the platform are unidentified, with Google Cloud Platform surfacing only as an environment on the attestations page. And no incident practice runs to the customer: the agreement obliges the customer to notify the vendor within 24 hours of a suspected compromise and says nothing about the vendor notifying the customer of a breach. Verified 12 September 2026.

Retention, deletion, access control, subprocessors and incident practice are all published, current and specific enough to hold the vendor to, which is the A band, and every limb rests on a document a buyer can read before signing. Retention: the Data Processing Addendum states that retention of personal data should generally not be required and that any retention is limited to the duration absolutely necessary to perform the Services, with daily backups retained for thirty days, and a zero-retention arrangement stated with each third-party document-processing provider. Deletion: return and deletion at the customer's election within a reasonable period after the agreement ends, with the customer able to delete within the Services and assistance where it cannot, and a prompt-compliance obligation on deletion requests under the CCPA attachment. Access control is documented control by control: role-based authorisation, least privilege, quarterly access reviews, joiner-mover-leaver revocation, VP-level approval for access escalation, multi-factor authentication, managed firewalls, host-based intrusion detection, encryption at rest and TLS at 256-bit or stronger in transit, per-tenant encryption keys, and no customer data on laptops or removable media. Subprocessors: a published list, fifteen days' notice before appointing a new one, a right to object with a termination and refund remedy, flow-down obligations, and Conga liable for subprocessor acts as if performing them itself. Incident practice: notification within 48 hours of becoming aware under the DPA, a documented response plan with root-cause analysis, and a 24/7 security team. Verified 12 September 2026.

Liability is addressed through a limitation clause that disclaims the exposure the product creates, which is C, and as with the other records graded here today the grade turns on scope rather than on drafting quality. What is published is specific: section 11.1 caps total liability at the licence fees paid in the twelve months before the claim, excludes lost profits and indirect, incidental, consequential, special, exemplary and punitive damages, and makes adjustment, repair or replacement the customer's sole remedy for breach of warranty; section 11.2 preserves liability for death or personal injury caused by negligence, for fraud, and under the indemnity; section 12.6 requires any action to be brought within one year. Section 10.1 is a genuine indemnity but runs only to third-party United States patent, trademark or copyright infringement, and section 10.3 removes it wherever the damages relate to the content of the customer's data. There is more warranty here than most records at this grade carry, section 9.2(b) warranting that the software will materially conform to the documentation with a correct-or-refund remedy inside ninety business days, and that is recorded. It does not reach the question the axis asks. Nothing stands behind wrong AI output: section 9.3(a) disclaims all warranties as to accuracy or validity, section 9.3(b) puts review and use on the customer, and no insurance position or indemnity was located. Verified 12 September 2026.

Liability for what the AI produces is addressed only by disclaiming it, which is the C band, and here the disclaimer is unusually explicit rather than buried in a general limitation. The Artificial Intelligence Addendum states that Conga makes no warranty, express or implied, regarding the accuracy, completeness, non-infringement or fitness for a particular purpose of any AI-generated output, that the customer is solely responsible for evaluating and validating outputs, and then that, to the maximum extent permitted by applicable law, Conga shall not be liable for any losses, damages or claims, including third-party claims, arising from the customer's use of, reliance on, or actions taken based on AI-generated outputs or actions performed by agentic AI capabilities. That is the question this axis asks, answered in the negative and in terms. One genuine allocation runs the other way and is recorded: the Data Processing Addendum makes Conga liable for the acts and omissions of its subprocessors to the same extent as if it had performed the services directly, which matters given how much of the AI pipeline sits with third parties. A limit on this reading is stated plainly: the Master Services Agreement itself was not opened, so the general liability cap, indemnity scope and any insurance position are not established, and a reading of it could move this row. It would have to reverse the Addendum to do so, and the Addendum is the instrument that governs the AI question. Verified 12 September 2026.

Real integrations, named and documented, short of a description of what they move, which is B. Named on the vendor's own surfaces: Microsoft Word and Microsoft Outlook add-ins carrying VISDOM into the drafting and mail surfaces, Salesforce, Microsoft Dynamics 365, Oracle, DocuSign, Adobe Acrobat Sign, Twilio and Unanet on the integration strip, plus an API described as available at the Elite tier for high-volume pipelines. A published support-portal article adds native CLM integrations, connectors to Zapier and Microsoft Power Automate reaching thousands of applications, and a plugin environment for contract lifecycle systems with two described use cases, pushing a Word or PDF file into the platform from a contract record or intake form and round-tripping a prepared redline back without leaving the browser. That round trip is the one place depth is genuinely described. Elsewhere it is not. No field-level mapping, sync direction or configuration requirement is published for the CRM and ERP connections, the connector article notes that new connectors were invite-only and directs the reader to email support, and API documentation is obtained the same way rather than published. A technical wiki exists at wiki.cobblestonesoftware.com and was not opened; under R25 it corroborates rather than carries. Verified 12 September 2026.

Real integrations, named and documented, short of the depth an implementer could work from, which is B. The named connections are substantial and several are structural rather than bolt-on. The product exists in two forms, one of which runs natively on the Salesforce platform and is listed on the Salesforce AppExchange, which is about as deep as a CRM integration gets. Authoring and review run inside Microsoft Word and Google Docs, Microsoft Dynamics is named on the product page, and the vendor states the platform edition connects to any CRM, ERP or procure-to-pay system. Inside Conga's own estate the connections are described functionally: pricing, terms and configurations from CPQ flow automatically into a contract, documents are generated through Composer and signed through Conga Sign, and price optimisation feeds contract pricing. Supporting surfaces exist and are named, a product documentation site at documentation.conga.com and a developer hub at developer.conga.com. What is not established is depth. Neither the integrations page nor the developer hub was opened, no field-level mapping or sync direction is published on the surfaces read, and the recurring claim of connecting to any CRM or ERP describes reach without describing what moves. Under R25 those two surfaces would corroborate and could lift this row; they are named here as published and unread. Verified 12 September 2026.

Deployment model is stated clearly with partial residency detail, which is B, and the deployment side of this record is stronger than most. Two delivery forms are published and genuinely distinct: a hosted edition, and an Enterprise Installed Edition that the customer runs on its own infrastructure, specified down to the operating system, database, processor, memory and disk in Exhibit A of the agreement, with the customer responsible for backup and firewalling. For the installed edition residency is answered by construction and the agreement addresses it directly, section 2.3 permitting a single production instance located in the United States and its territories or any other country to which the software is legally exported, so the customer chooses where the data sits. Tenant isolation is stated for the hosted side, and the hosting environment is identified as Google Cloud Platform, though only in passing on the attestations page rather than on any product or security surface. What is missing for A: no region menu or list of available regions is published for the hosted edition, nothing distinguishes where processing happens from where data is stored, and the AI path is the sharpest gap, since content sent to the named third-party AI Processor leaves the tenant and no surface states where that processing occurs. Verified 12 September 2026.

Deployment model is stated clearly with partial residency detail, which is B, and the model side is fully answered. Two delivery forms are published and distinguished: the original Salesforce-based application, and a full software-as-a-service edition on the Conga Advantage Platform introduced to give buyers a CLM interface independent of Salesforce. What changes between them is published and material rather than cosmetic, and it is in the agreement: the Data Processing Addendum states that for services hosted on the Salesforce platform Conga does not back up customer data and there is no recovery point objective, against daily backups retained thirty days and a one-hour recovery point objective with a twenty-four hour recovery time objective elsewhere. Infrastructure is named, Salesforce, Amazon Web Services and Azure, with data stored on servers managed by Salesforce and AWS, and tenant environments logically separated with dedicated encryption keys. Residency is where it falls short of A. Availability is described as multi-region across the United States, the European Union and Asia-Pacific with residency options included, which names continents rather than regions; no region list or menu is published, nothing states which region a given tenant lands in or how a buyer chooses, and where processing happens is not distinguished from where data is stored. The AI path is the sharpest instance: content reaches Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva, and no surface states where any of that runs. Verified 12 September 2026.

Badges appear with no scope, no date and no report available, which is the C band, and the page is a clear example of it. The Attestations page lists sixteen entries, including SOC 1 Type II, SOC 2 Type II, FISMA, HIPAA, GSA, NIST, CSA, eVerify, TX-RAMP, VPAT, the Data Privacy Framework and CMMC 2.0. Not one carries an auditor, a report period, a certificate number, a scope statement or a downloadable report, and there is no trust portal or request route on the page at all. Several entries do not survive reading. Safe Harbor is listed as a current attestation although that framework was invalidated in 2015. SSAE Type II is listed as if it were a certification, and is illustrated with a CSA STAR logo. ISO appears twice with no standard number, once as a bare entry and once as ISO for the Google Cloud Platform environment, which is Google's attestation rather than this vendor's and does not travel to the product without a scope connector under R16. FedRAMP is listed the same way, as compliance of the GCP environment, while the vendor's own press release on the same site says it has achieved FedRAMP Ready status and is seeking a sponsor, which is a materially different claim. A separate certification strip on the case-studies page names ISO 27001 and GDPR compliance, which the Attestations page does not. Recorded rather than resolved. Verified 12 September 2026.

Certification is real, named and scoped, and the evidence behind it is not reachable without a customer relationship, which is B at the top of the band. A genuine trust centre exists, is ungated and is linked from the site navigation. The standards are named individually rather than displayed as a badge wall: SOC 2 Type II with a stated scope of full platform coverage and audited annually, ISO 27001, ISO 27701 described as the privacy extension to it, PCI DSS, HIPAA Security with annual audits, GDPR, CCPA, alignment to the NIST AI Risk Management Framework, and certification under the EU-US Data Privacy Framework, which is the one item a reader can independently verify because the Data Processing Addendum points to the public Department of Commerce list. The programme behind them is documented: annual third-party penetration testing, biannual application vulnerability assessment, continuous automated threat hunting, static and dynamic code analysis before release, a severity-based patching service level, background checks, annual security training, and a published vulnerability disclosure programme. Two things hold it off A. No auditor is named, no report period, observation window or certificate number is published for any standard, and no report is carried on the trust centre itself. The route to the evidence is the Data Processing Addendum, which makes reports available on the customer's request subject to confidentiality, so a prospective buyer cannot read the scope of what was audited before contracting. Verified 12 September 2026.

The supply chain is partly disclosed, which is B, and this is the strongest row on the record and among the better disclosures in this lane. Two of the four A limbs are met and both are met in the agreement rather than in marketing. The provider is identified: Master Subscription Agreement section 7.1 states that the AI Processor as of the effective date is OpenAI, defines the AI Processor as the third-party data processor used to provide certain AI features, and states that it may act as data subprocessor for information input into an AI Tool. Change notification is committed in the same clause, the vendor undertaking to change the AI Processor only with reasonable advance notice to the customer. The models are partly named, which is rarer still: the VISDOM pricing page states that VISDOM may use up to GPT-4 and GPT-4o with the vendor reserving the right to adjust model levels. Two things hold it off A. Where the models run is not stated anywhere, which matters because content leaves the tenant to reach them. And the two disclosures contradict each other on notice: the pricing page says the vendor reserves the right to alter the AI without notice, while section 7.1 requires reasonable advance notice. R37 rule 1 governs and the agreement wins, but the contradiction is the finding and belongs on the record. Verified 12 September 2026.

The supply chain is disclosed further than anything else in this lane and stops one limb short of A, which is B under R34. Providers are identified individually and by function, not gestured at: generative features run on Microsoft Azure OpenAI, and the document-processing agents additionally use Google Cloud Vision for optical character recognition, Amazon Textract for table detection and Zuva for provision extraction, each named with what it does and each under a stated zero-data-retention arrangement. Where the models run is stated, which few records manage: the Azure OpenAI Service is described as fully controlled by Microsoft, with Microsoft hosting the models in its own Azure environment and the service not interacting with any system operated by OpenAI, and the consequences are spelt out, that prompts, completions, embeddings and training data are tokenised in transit, are not available to OpenAI, and are not used to improve OpenAI, Microsoft or third-party models. Change notification is contractual and specific: the AI providers are subprocessors, and the Data Processing Addendum gives fifteen days' notice before any new subprocessor is appointed, with the name, location and activity disclosed, a right to object, and termination with a refund if no workaround is available. The limb that fails is the first one. No model is named. The addendum's closest approach is a parenthetical reference to Azure OpenAI GPT, which is a family rather than a version, and no surface states which model generates a summary or a redline or when that changes. Verified 12 September 2026.

Real pricing is published for part of the range with the rest withheld, which is B, and the published part is the AI. Four VISDOM tiers carry figures and volumes: Basic free with up to 100,000 words a month and no overages, Starter at $3,995 billed annually with 500,000 words a month, Pro at $6,995 with 1,000,000, and Elite at $29,995 with 5,000,000, each shown with a monthly equivalent, above which the buyer is directed to sales. The unit of charge is defined rather than gestured at: words processed in and out per iteration, shared and consumed across all users, not rolling over month to month, with overage invoiced in 750-word increments, and the same unit is written into Master Subscription Agreement section 7.3. Commercial terms sit in the agreement and are specific: payment within thirty days, non-refundable fees, interest at 1.50 per cent monthly, annual increases capped at eight per cent, automatic twelve-month renewal with thirty days' notice not to renew, thirty days' notice to terminate for convenience, a thirty-day evaluation period with a full refund of licence fees, and thirty days' notice for VISDOM+ price changes. What holds it off A is the platform itself. Contract Insight licensing is quoted through a Request Pricing form, no figure or band is published for it, and the licence model is named and concurrent user seats, so a buyer can price the AI precisely and cannot price the thing the AI runs inside. Verified 12 September 2026.

No pricing information is published at any level, including the unit of charge, which is the D band and is the plainest instance of it in this lane. The pricing page exists, is linked from the top-level navigation, and carries no price, no band, no term, no tier table, no feature-by-tier comparison, no unit of charge, no minimum, no statement of whether the product is licensed per user, per contract or per platform, and no indication of what implementation adds. What it does carry is a heading, a paragraph saying that every business is unique and that the vendor provides clear details about product options and associated costs, a list of six things the pricing is said to prioritise, one of which is Transparency, two customer logo strips, and a quote request form. That is a page which invites a sales conversation and nothing else, which R10 identifies as an absence rather than as structure, and it is why no VendorPricing row is written for this record. The nearest thing to a published tier anywhere on the estate is a line on the platform page inviting the buyer to add CLM Advanced features such as a clause library, version control and redlining, which names one upgrade and three features on a product page; it is recorded here for completeness and is not pricing information. Commercial terms are not published either: the Master Services Agreement was not opened, so payment terms, renewal, uplift caps and termination rights are not established from any surface read. Verified 12 September 2026.

Segment and practice coverage is described with substance and the boundaries are left open, which is B. Buyer coverage is published as its own navigation tier with four named audiences, Legal, Procurement, Sales and IT, each with a page, and the legal audience is addressed twice, once as a team and once as an industry. Sector coverage is enumerated across seven industry pages, healthcare, government, education, pharmaceuticals and life sciences, energy and utilities, financial services and legal, and the published customer base bears that out across counties, a state university medical centre, water districts, a public utility board and pharmaceutical companies, spanning public and private sector. Product coverage is described edition by edition, with a comparison page setting out what differs between CLM editions and an add-on module list a buyer can read before speaking to anyone. What is left open holds it off A. No practice area inside a legal department is identified as supported or unsupported, the seven languages named for extraction are not tied to any statement about jurisdictional or drafting-convention coverage, nothing states which of the four named audiences may use which AI capability, and there is no published statement of what the product is not for. The only firm-shaped datum located is that the design is aimed at in-house and public-sector contract functions rather than at law firms, and that is inferred from the estate rather than stated. Verified 12 September 2026.

Segment coverage is described with real substance and the boundaries are left open, which is B. Who the product serves is published as its own navigation tier with seven named functions, Legal, Procurement, Sales, Finance, IT, Business Operations and Pricing, each with a page of its own, and the CLM material addresses legal, sales and procurement side by side with a different task list for each: legal gets workflow, authoring, AI reviewing and redlining, contract compliance and risk management, procurement gets obligation management, AI-extracted terms and pricing, and sales gets generation, AI-assisted negotiation and renewals. Industry coverage is enumerated across seven pages, technology, financial services, healthcare, life sciences, manufacturing, transport and logistics, and distribution, and a process tier organises the same estate by contracting stage. The published customer base bears the breadth out across airlines, insurance, media, retail and property data. What is left open holds it off A. No practice area inside a legal department is named as supported or unsupported, no statement of what the product is not for appears anywhere, nothing distinguishes which capabilities are available to a non-lawyer user in a shared tenant, and there is no jurisdictional or language coverage statement despite the product being sold and localised into German and French. Verified 12 September 2026.