CobbleStone Software vs Conga CLM: how they compare in 2026
CobbleStone Software and Conga CLM are both enterprise contract lifecycle suites sold to legal, procurement and sales, each with an AI layer, VISDOM and AiMe, running over a platform that long predates it. Conga is stronger on published governance and data handling. Its AI addendum records a governance committee anchored to the NIST AI Risk Management Framework. It also publishes a subprocessor list with fifteen days' notice of changes, breach notice within 48 hours, and each AI provider named by function under a zero retention arrangement. The same addendum permits training on a customer's data, into models used only for that customer's tenant. CobbleStone's counterweight is price and control over where it runs. It publishes its AI tiers from $3,995 a year by words processed, names OpenAI in its agreement with notice before any change, and sells an installed edition the customer runs on its own servers. Conga prices through a quote form. Both disclaim liability for what their AI produces.
Which one fits
Choose CobbleStone Software if
- You need the contract system on your own servers. CobbleStone sells an Enterprise Installed Edition that runs on your own Windows and SQL Server infrastructure, with a single production instance in the United States or any country the software can be exported to, alongside a hosted edition on Google Cloud.
- You want to price the AI before a sales call. CobbleStone publishes VISDOM at no cost up to 100,000 words a month, then $3,995, $6,995 and $29,995 a year for 500,000, one million and five million words, counted in and out and shared across users; the platform license itself is quoted.
- You need the model provider named in the contract. CobbleStone's agreement names OpenAI as its AI processor with advance notice before any change, its pricing page names GPT-4 and GPT-4o, and the agreement bars using its AI for decisions with legal effects unless a person makes the final call.
Choose Conga CLM if
- Your AI risk review wants a governance structure in writing. Conga's AI addendum records a cross functional AI Governance Committee, policies on training data oversight and bias mitigation, and alignment with the NIST AI Risk Management Framework, and its trust center classifies its products under the EU AI Act.
- You need breach notice and subprocessor control on a clock. Conga's data processing addendum commits to notice within 48 hours of a breach, fifteen days' notice before a new subprocessor with a right to object and a refund remedy, per tenant encryption keys, and return or deletion at your election after the contract ends.
- You want suggestions whose reasoning you can see, inside Salesforce. Conga's AiMe shows how each recommendation is generated with a confidence score and states that it never acts autonomously on high stakes decisions, and Conga CLM runs natively on Salesforce or as a standalone platform beside any CRM.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
VISDOM is a native intelligence layer inside Contract Insight, using the same data model and clause library, attached to existing workflows. Underneath is a full contract lifecycle management platform that predates the AI by decades: repository, version control, authoring, workflow, alerts, reporting, electronic signature, and separately licensed procurement and vendor modules. Without VISDOM, a working contract and procurement suite remains, and the AI is sold as a priced add on with its own tiers. The 2026 releases push the AI further in, embedding VISDOM in the native editor, where it is described as operating autonomously, and the vendor now frames it as an agentic layer.
AiMe is a shared AI layer across the commercial suite. It connects workflow data across CPQ, CLM, price optimization and document automation and suggests next steps, rather than being the CLM itself. Underneath sits a full contract lifecycle platform that long predates it, with template and clause library generation, approval routing, negotiation, electronic signature through Conga Sign, a searchable repository, obligation and renewal tracking, and reporting. The models drive core features on top of that platform. Without AiMe a working CLM remains, as the edition built on Salesforce was for years. Recent releases push AI further in. The June 2026 release extends AI across the platform, including bulk import and extraction for incoming contracts. The March 2026 AiMe release adds agents that act inside quoting and contracting workflows. Conga still sells and prices the platform as a contract system with intelligence on top.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
VISDOM works from the customer's own clause library, playbook and repository, and clause suggestions are described as based on precedence, so output has a source in the customer's material. The strongest accuracy claim, consistent system wide accuracy, comes from a February 2026 release announcement and is unquantified. No accuracy figure, test set, error rate, benchmark or retrieval method is published, and no evaluation of extraction or clause matching is published. The agreement disclaims warranties on the quality, accuracy or validity of information in the system, and section 9.3(b) says output may not be complete or accurate and makes the customer responsible for reviewing it. The product cites no legal authority.
The AI pipeline divides document processing among specialized providers. Google Cloud Vision handles optical character recognition, Amazon Textract table detection, Zuva provision extraction and Azure OpenAI language processing. Output is grounded in the customer's own repository, playbook and clause library, and extraction needs no model training by the customer. AiMe shows how every recommendation is generated, with the reasoning visible and confidence scores wherever it makes a suggestion. The Artificial Intelligence Addendum addresses accuracy only through a disclaimer. It states that outputs may be inaccurate, incomplete or misleading and disclaims any warranty of accuracy or completeness. No accuracy figure, test set, error rate or benchmark result is available. Third party models undergo benchmarking before release, without disclosed results. The product cites no legal authority, so grounding in authority and citator checks do not apply.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Section 7.2 of the Master Subscription Agreement bars using any AI Tool in automated decisions with legal effects unless a human makes the final decision, and bars using it to give advice normally given by a licensed professional. Review tools include tracked edits, inline comments and coauthoring in the editor, high risk clause flags that trigger auditable reviews, and deviation reports against the playbook before signature. The vendor also describes AI operating autonomously in the editor, agents that analyze, flag and review without complex setup, and an assistant that runs compliance checks. No threshold, confidence level or type of work is published at which the system stops and hands back.
AiMe never acts autonomously on high stakes decisions, Conga states. Three mechanisms constrain it, agent guardrails, approval thresholds and human in the loop confirmation, and each can be built into a workflow. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions. Confidence scores appear wherever it makes a suggestion, users accept or reject redlines, and every action and approval is kept in an audit trail. Much of the oversight model is written into the contract. The Artificial Intelligence Addendum makes the customer solely responsible for evaluating and validating outputs. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact. It also requires human review and independent judgment, and puts authorizing and supervising agent actions on the customer. The guardrails and thresholds are described as configurable rather than as defaults, and the same document states that Conga does not monitor or review AI generated outputs.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
A case study library names fourteen organizations, each with the edition deployed and a line on what changed: El Paso County, Marion County, the County of San Diego Health and Human Services Agency, SUNY Upstate Medical University, Chiesi, Intarcia Therapeutics, Soquel Creek Water District, Regional Water Authority, Brownsville Public Utilities Board, NewFields, Rapattoni Corporation, CentroMotion, Wound Care Advantage and Vertical Screen. None carries a figure for cycle time, cost or volume on the listing page. Company level figures are unattributed and unexplained: 95 percent customer satisfaction in its latest survey, more than 5,000 organizations worldwide, up to 26 percent efficiency gains from digitized agreement workflows, and 1.8 times revenue velocity on the VISDOM page. Analyst recognition comes from Gartner, Forrester, IDC and QKS.
Cotality, formerly CoreLogic, describes improving client service with Conga CLM in a September 2024 customer story without a quantified outcome. Two other dated stories, DigiKey on price management and Kalixia at 160 times faster document generation, concern other Conga products. Other named customers include Southwest Airlines, LinkedIn, AXA, Peloton, Cotality, T-Mobile, Adobe, Box and Kraft Heinz. The headline improvement figures are separate from those named customers. A 9 percent revenue increase appears beside the logo strip with no stated basis, and Conga claims 50 percent less review time with AI. Conga also cites G2 Leader recognition across five grids.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Section 8.1 of the Master Subscription Agreement includes Customer Data in Confidential Information, and section 8.2 requires each party to hold it in strict confidence with at least reasonable care and disclose it only with written approval or as legally required, with no time limit after termination. Tenant separation is stated on the VISDOM page, and the installed edition puts the whole application on the customer's own server. Section 7.1 names OpenAI as AI Processor and possible data subprocessor, with advance notice of change. Privilege and work product are not addressed. No contractual training prohibition exists: section 8.3 reserves the right to analyze data, including information concerning Customer Data, to improve the Services, and the statements against training sit on product pages. Nothing says what OpenAI may retain. Retention and deletion are not addressed in the agreement.
Under the Artificial Intelligence Addendum, Conga will not use AI Inputs or AI Outputs to train or improve any model beyond a limited license to provide, maintain or improve the Services for that customer. Customer Data will not train global or foundational models serving multiple customers, and no third party may use Customer Data or AI Output to train, fine tune, validate, test or develop any model. Tenants are logically separated with dedicated encryption keys. The Data Processing Addendum limits retention to the time absolutely necessary and requires return and deletion at the customer's election after the agreement ends. Prompts, completions, embeddings and training data sent to Azure OpenAI are not available to OpenAI and are not used to improve OpenAI, Microsoft or third party products. Each document processing provider works under a zero retention arrangement. Conga sells the product to legal departments to hold their agreements, and its addenda, trust center and product pages do not address attorney client privilege or work product. Separate contractual conditions sit in Conga's Master Services Agreement.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Section 7.2(ii) of the Master Subscription Agreement bars using any AI Tool to give advice normally given by a licensed professional, naming legal advice, which restricts use rather than only disclaiming status. Section 9.3(b) says CobbleStone does not provide legal advice and puts review and use of output on the customer. Section 7.2(i) requires a human to make the final decision wherever an AI Tool feeds a decision with legal effects. The audience is named. Nothing addresses how a supervising lawyer meets competence or oversight duties over AI redlines, which buyer groups may use which features, or any jurisdictional limit. The product is sold to procurement, sales and IT alongside legal, and nothing addresses what that means for review of legal positions.
Conga's position on advice versus tooling sits in the Artificial Intelligence Addendum. The Addendum states that AI generated outputs may be inaccurate, incomplete or misleading, disclaims any warranty of fitness, and makes the customer solely responsible for validating outputs before use. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact, and that human review and independent judgment should be exercised. It applies the same rule to agents, making the customer responsible for deciding whether agent actions are appropriate and for authorizing and supervising them. Legal, sales and procurement teams use the application as a contracting tool. The service does not specify how a supervising lawyer meets competence or oversight duties over AI drafted contract language. Neither capability restrictions by buyer group nor jurisdictional limits appear in the terms. The product is marketed to sales and procurement users who generate contract positions in the same tenant as legal.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Section 7 of the Master Subscription Agreement is a dedicated AI article: it names the third party AI Processor, says CobbleStone is not a data controller for information processed through an AI Tool, leaves control of uploads with the customer's users, restricts how AI Tools may be used, and reserves the right to change or withdraw VISDOM+ on reasonable notice. Product pages add a guardrails claim and an inference only architecture. There is no responsible AI page, framework or certification such as ISO 42001, no one named as accountable for AI, nothing on evaluation before model changes, and nothing on uneven output across contract types, counterparty drafting styles or the seven languages extraction claims to support. Sentiment and negotiating tone analysis is described with no account of how tone is judged or tested.
Conga's AI governance framework sits in the Artificial Intelligence Addendum rather than on a principles page. The Addendum records a cross functional AI Governance Committee responsible for oversight of AI within the Services. The committee focuses on risk management, accountability and compliance, and periodically reviews AI risks, controls and mitigations. Conga commits to internal policies on responsible AI covering oversight of training data, bias mitigation and human interpretability, to staff training, and to full cooperation with a customer's own AI impact assessments. Governance is tied to the NIST AI Risk Management Framework and its four functions, Govern, Map, Measure and Manage. The vendor classifies its products as minimal or limited risk AI systems under the EU AI Act. It states that third party models are tested, audited for bias and benchmarked before release, with rollback to any prior model version within hours. Results from that testing, bias audit findings, evaluation outputs and model cards are not available, including performance differences across contract types.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The privacy policy addresses retention and deletion: personal information is kept as needed for contracts and legal duties until deleted by the vendor or at the data owner's request, with deletion available on request at any time. Access control is documented: encryption at rest and in transit, tenant isolation, named and concurrent user licenses with session timeouts in the agreement, and audit trails across AI chats, contracts and other key areas. Section 7.1 of the agreement names OpenAI as the AI Processor and a possible data subprocessor, with reasonable advance notice of any change. There is no subprocessor list, so hosting, support and infrastructure processors are unnamed, with Google Cloud Platform appearing only on the attestations page. No incident duty runs to the customer: the agreement requires the customer to notify the vendor within 24 hours of a suspected compromise, but says nothing about the vendor notifying the customer of a breach.
The Data Processing Addendum says retention of personal data should generally not be required and is limited to the time absolutely necessary to perform the Services. Daily backups are kept for thirty days, and each third party document processing provider works under a stated zero retention arrangement. Data is returned or deleted at the customer's election within a reasonable period after the agreement ends, and the CCPA attachment requires prompt compliance with deletion requests. Access controls include role based authorization, least privilege, quarterly access reviews, multifactor authentication, encryption at rest, TLS of 256 bits or stronger in transit, and per tenant encryption keys. The subprocessor terms provide fifteen days' notice before additions, a right to object with termination and refund, and Conga's responsibility for provider acts. Incident notice comes within 48 hours of Conga becoming aware, backed by a response plan with root cause analysis and a 24/7 security team.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Section 11.1 caps total liability at license fees paid in the twelve months before the claim, excludes lost profits and indirect, incidental, consequential, special, exemplary and punitive damages, and makes adjustment, repair or replacement the sole remedy for breach of warranty. Section 11.2 preserves liability for death or personal injury from negligence, for fraud and under the indemnity. Section 12.6 requires claims within one year. Section 10.1 indemnifies only against third party US patent, trademark or copyright infringement, and section 10.3 removes that where damages relate to the customer's data. Section 9.2(b) warrants that the software will materially conform to its documentation, with correction or refund within ninety business days. Nothing covers wrong AI output: section 9.3(a) disclaims all warranties of accuracy or validity, section 9.3(b) puts review and use on the customer, and no insurance position or data breach indemnity is published.
The Artificial Intelligence Addendum states that Conga makes no warranty, express or implied, on the accuracy, completeness, noninfringement or fitness for purpose of AI generated output. The customer is solely responsible for evaluating and validating that output. To the maximum extent permitted by law, Conga is not liable for any losses, damages or claims arising from the customer's use of or reliance on AI output or on actions by agentic AI features. That includes third party claims. One allocation runs the other way. The Data Processing Addendum makes Conga liable for its subprocessors' acts and omissions as if it had performed the services itself, and much of the AI pipeline sits with those third parties. The addenda do not state a general liability cap, an indemnity scope or an insurance position. Conga's Master Services Agreement is a separate document.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The vendor names Word and Outlook add-ins carrying VISDOM, plus Salesforce, Microsoft Dynamics 365, Oracle, DocuSign, Adobe Acrobat Sign, Twilio and Unanet, and an API at the Elite tier for high volume pipelines. A support article adds native integrations, connectors to Zapier and Microsoft Power Automate, and a plugin environment with two described uses: pushing a Word or PDF file into the platform from a contract record or intake form, and returning a prepared redline without leaving the browser. That round trip is the only flow described in detail. No field mapping, sync direction or configuration is published for the CRM and ERP connections, new connectors were invite only with requests by email to support, and API documentation is obtained the same way. A technical wiki runs at wiki.cobblestonesoftware.com.
Several of Conga CLM's integrations are structural. One edition runs natively on Salesforce and is listed on the Salesforce AppExchange. Authoring and review run inside Microsoft Word and Google Docs, and Microsoft Dynamics is named on the product page. The platform edition supports connections to CRM, ERP and procurement systems. Within Conga's own products, pricing, terms and configurations flow from CPQ into a contract. Documents are generated through Composer and signed through Conga Sign, and price optimization feeds contract pricing. Developer resources cover APIs and integrations. Conga does not document field mapping or sync direction for individual external connectors.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Two forms are published: a hosted edition, and an Enterprise Installed Edition the customer runs on its own infrastructure, specified down to operating system, database, processor, memory and disk in Exhibit A, with the customer handling backup and firewalls. For the installed edition, section 2.3 permits a single production instance in the United States and its territories or any country to which the software may legally be exported, so the customer chooses where data sits. Tenant isolation is stated for the hosted edition, which runs on Google Cloud Platform, though that appears only on the attestations page. No list of hosted regions is published, processing is not distinguished from storage, and content sent to the named third party AI Processor leaves the tenant with no statement of where it is processed.
The CLM has two delivery forms. One is the original application built on Salesforce. The other is a software as a service edition on the Conga Advantage Platform that gives buyers a CLM interface independent of Salesforce. The Data Processing Addendum treats them differently. It states that Conga does not back up customer data for services hosted on Salesforce and sets no recovery point objective for them. Elsewhere it keeps daily backups for thirty days, with a one hour recovery point objective and a twenty four hour recovery time objective. Infrastructure is named as Salesforce, Amazon Web Services and Azure, with data on servers managed by Salesforce and AWS. Each logical tenant boundary has its own encryption key. Availability is described as spanning the United States, the European Union and Asia Pacific with residency options included, which names continents rather than regions. Conga gives no region list, no method for choosing a tenant's region and no separate processing locations. Content reaches Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva, and Conga does not say where those services process it.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The Attestations page lists sixteen entries, including SOC 1 Type II, SOC 2 Type II, FISMA, HIPAA, GSA, NIST, CSA, eVerify, TX-RAMP, VPAT, the Data Privacy Framework and CMMC 2.0, none with an auditor, report period, certificate number, scope or report, and there is no trust portal or request route. Safe Harbor is listed as current, though that framework was invalidated in 2015. SSAE Type II is listed as a certification with a CSA STAR logo. ISO appears twice without a standard number, once as ISO for the Google Cloud Platform environment, which is Google's attestation, not the vendor's. FedRAMP is listed as compliance of the GCP environment, while the vendor's own press release says it has reached FedRAMP Ready status and is seeking a sponsor. The case studies page names ISO 27001 and GDPR compliance, which the Attestations page does not.
SOC 2 Type II covers the full platform under annual audits, according to Conga. The trust center also lists ISO 27001, ISO 27701 as its privacy extension, PCI DSS, HIPAA Security with annual audits, GDPR and CCPA. It adds alignment to the NIST AI Risk Management Framework and certification under the EU-U.S. Data Privacy Framework. The Data Processing Addendum links that certification to the Department of Commerce register. The security program includes annual third party penetration testing, application vulnerability assessment twice a year, continuous automated threat hunting and code analysis before release. It also covers a patching service level by severity, background checks, annual security training and a vulnerability disclosure program. Auditor names, report periods, observation windows and certificate numbers are not available alongside those claims, and reports require a request. The Data Processing Addendum makes reports available on a customer's request under confidentiality, so a prospective buyer cannot read the audit scope before signing.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Section 7.1 of the Master Subscription Agreement names OpenAI as the AI Processor as of the effective date, defines it as the third party processor for certain AI features, says it may act as data subprocessor for information input into an AI Tool, and commits to reasonable advance notice before changing it. The VISDOM pricing page says VISDOM may use up to GPT-4 and GPT-4o, with the vendor reserving the right to adjust model levels. Where the models run is not stated, though content leaves the tenant to reach them. The two documents conflict on notice: the pricing page reserves the right to change the AI without notice, while section 7.1 requires reasonable advance notice.
Generative features run on Microsoft Azure OpenAI. The document processing agents also use Google Cloud Vision for optical character recognition, Amazon Textract for table detection and Zuva for provision extraction, each under a stated zero retention arrangement. The Azure OpenAI Service is described as fully controlled by Microsoft, hosted in Microsoft's own Azure environment and not interacting with any system operated by OpenAI. Prompts, completions, embeddings and training data are tokenized in transit, are not available to OpenAI, and are not used to improve OpenAI, Microsoft or third party models. Change notice is contractual. The AI providers are subprocessors, and the Data Processing Addendum gives fifteen days' notice before a new one is appointed, with its name, location and activity. It also gives a right to object, and termination with a refund if no workaround exists. No specific model is named. The Addendum refers to Azure OpenAI GPT, which is a family rather than a version, and nothing states which model writes a summary or a redline or when that changes.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Four VISDOM tiers carry figures and volumes: Basic free with up to 100,000 words a month and no overages, Starter at $3,995 a year with 500,000 words a month, Pro at $6,995 with 1,000,000, and Elite at $29,995 with 5,000,000, each with a monthly equivalent; above that, buyers contact sales. The unit is words processed in and out per iteration, shared across all users, not rolling over, with overage billed in 750 word increments, and the same unit appears in section 7.3 of the agreement. The agreement sets payment within thirty days, nonrefundable fees, interest at 1.50 percent monthly, annual increases capped at eight percent, automatic twelve month renewal with thirty days' notice to opt out, thirty days' notice to terminate for convenience, a thirty day evaluation with full license refund, and thirty days' notice of VISDOM+ price changes. Contract Insight licensing, sold by named or concurrent user, goes through a Request Pricing form with no figure.
Conga CLM uses custom quotes without a numeric starting rate, a defined billing unit or a plan table. The application combines drafting, negotiation, approvals, electronic signature, contract storage and obligation management, with AI review and extraction inside that workflow. Additional products connect CPQ, document generation and signing to the wider suite. An advanced CLM feature set includes clause libraries, version control and redlining, with no incremental charge given for it. Subscription duration, renewal provisions, price increase limits and implementation fees are not given with the quote request. The Master Services Agreement is separate from the AI and data processing addenda.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Four buyer groups have pages, Legal, Procurement, Sales and IT, with legal covered both as a team and as an industry. Seven industry pages cover healthcare, government, education, pharmaceuticals and life sciences, energy and utilities, financial services and legal, and the customer base matches: counties, a state university medical center, water districts, a public utility board and drug companies. A comparison page shows what differs between editions, and add on modules are listed. No practice area within a legal department is named as supported or unsupported, the seven extraction languages are not tied to any jurisdiction or drafting convention, nothing says which buyer groups may use which AI features, and nothing says what the product is not for. The design appears aimed at in house and public sector contract teams rather than law firms, though this is not stated.
Legal, procurement, sales, finance, IT, business operations and pricing teams use the suite. Their CLM tasks differ. Legal gets workflow, authoring, AI review and redlining, compliance and risk management. Procurement gets obligation management, AI extracted terms and pricing. Sales gets generation, AI assisted negotiation and renewals. Industry uses cover technology, financial services, healthcare, life sciences, manufacturing, transport and logistics, and distribution. Named customers span airlines, insurance, media, retail and property data. No practice area inside a legal department is named as supported or unsupported, and nothing states what the product is not for. Conga sets out no capability restrictions for users who are not lawyers inside a shared tenant. Nor does it draw jurisdiction or language coverage boundaries, although the product is localized into German and French.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The VISDOM page says proprietary contracts never train public models and that VISDOM uses inference only architecture for client data: documents are processed, not learned from, and model weights are not updated using client content that is not permitted. Its pricing page says documents are not used to train global AI models. Public and global models leave the vendor's own models unaddressed, and the wording implies an undefined category of permitted client content.
The Master Subscription Agreement has no matching prohibition. Section 8.3 reserves the right to analyze data on use of the Services, including information concerning Customer Data, to improve the Services and for development, and to disclose it in aggregate or deidentified form; it never names training. Section 7.1 sends AI Tool input to OpenAI as AI Processor, and nothing says what OpenAI may keep or train on.
The Artificial Intelligence Addendum expressly permits training on customer content, within written limits. Section (c) says Conga will not use Customer Data to train global or foundational models that serve multiple customers. Any training on Customer Data is limited to models specific to the customer's instance or tenant. Permitted training is limited to the customer's own data and a model only that customer uses, and neither the Addendum nor the trust center describes an opt out.
Conga does not use Customer Data to train third party foundational models, naming Azure OpenAI GPT as the example. Section (d) says Conga will not let any third party use Customer Data or AI Output to train, fine tune, validate, test or otherwise develop any AI model. Section (b) says that, beyond a limited license to provide, maintain or improve the Services for that customer, Conga will not use AI Inputs or AI Outputs to train or improve any model.
The trust center adds that models trained on one customer's data are never used for another. One carve out is reserved. Service Attributes, defined as anonymized and aggregated usage information, may be used to train and refine models and are stated not to be Customer Data.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The privacy policy says information is kept as needed to fulfill contracts, interact with users, meet regulations and support legal claims, only as long as the governing documents or law require, and until deleted by the vendor or at the data owner's request, with deletion available at any time. No number is attached, and the governing documents are the customer's own order form. The policy covers personal information across the website and software rather than contracts, prompts and output specifically, and the Master Subscription Agreement sets no retention period and no deletion or return duty on termination.
Audit trails across AI chats show that AI interactions are kept, without saying for how long. Nothing addresses retention by OpenAI as the named AI Processor.
The Data Processing Addendum lets the customer control retention by contractual instruction. Attachment A sets the default. Retention of personal data should generally not be required, and any retention is limited to the time absolutely necessary to perform the Services. Section 9.6 requires return and deletion at the customer's election within a reasonable period after the agreement ends, with the customer deleting within the Services and Conga helping where it cannot.
The CCPA attachment adds a duty to follow any customer deletion instruction promptly. Daily backups are kept for thirty days, except for services hosted on Salesforce, which Conga does not back up. At the model layer, Conga states a zero retention policy with each third party document processing provider. Documents sent to Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva are therefore processed in real time and not stored. No zero retention setting is offered to the customer inside the Services.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Separation between customers is architectural: the VISDOM page claims complete tenant isolation, CobbleStone's pricing page says data stays in the customer's own CobbleStone environment, and the installed edition runs on the customer's own server under Exhibit A. Inside a deployment, the agreement defines named and concurrent user licenses with session timeouts, marketing describes robust security options, and section 6.1 makes the customer responsible for administering the system.
Retrieval is not shown to follow an outside document system's access model. Nothing describes a wall between one business unit's contracts and another's within a deployment; legal, procurement, sales and IT share one instance, and the assistant answers across the whole repository.
Conga CLM has its own permission model, which the customer administers. Between customers, separation is built into the architecture. Tenant environments are logically separated, each with its own encryption keys, and models trained on one customer's data are never used for another customer's recommendations or scores. Inside a tenant, the Data Processing Addendum's security attachment requires role based authorization, least privilege, quarterly access reviews, multifactor authentication and the customer's ability to limit access to authorized personnel.
Rules based access controls, audit logs and admin tools help the customer configure and manage AiMe, which leaves the alignment work with the customer. The product does not apply an outside document management system's access model at query time. The addenda and trust center do not address segregation between matters or business units inside one tenant. The platform is sold to legal, procurement, sales, finance and IT in the same instance, and the assistant answers questions across the whole contract repository.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 8.2 of the Master Subscription Agreement requires each party to keep the other's Confidential Information in strict confidence and disclose it only with written approval or as legally required, and section 8.1 includes Customer Data in that definition. So customer data can leave on legal compulsion. No clause commits the vendor to notify the customer of a subpoena, court order, warrant or law enforcement request, reserves discretion over notice, commits to seeking a protective order or redirecting the request, or sets any time period.
The privacy policy covers onward transfers and the Data Privacy Framework but not notice. No transparency report is published.
Section 4 of the Data Processing Addendum's security attachment is headed Disclosure by Law. If Conga is required by law to disclose customer data, it will notify the customer as soon as practical where the law permits. It will also take all steps to give the customer an opportunity to prevent or limit the disclosure, an obligation to help and not only to inform. The CCPA attachment adds a slightly stronger commitment for personal information.
For a legally required disclosure unrelated to the contracted business purpose, Conga must first tell the customer and give it a chance to object or challenge the requirement, unless the law prohibits notice. Conga will also redirect a misdirected data subject request to the customer and will not respond without the customer's prior written consent unless legally required. No transparency report, aggregate demand count or reporting cadence is available.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The main source is the customer's own: VISDOM uses the platform's data model and clause library, drafts clause language based on precedence, matches against the approved clause library and enforces a playbook the customer defines. The generative layer is also identified, the agreement naming OpenAI as AI Processor and the pricing page naming GPT-4 and GPT-4o, though what those models were trained on is not described.
Sections 8.3 and 2.6 grant the vendor rights over Customer Data but say nothing about the provenance or licensing of what the models bring. The compliance question and answer feature maps contract language to GDPR and HIPAA obligations, with no source, edition or update schedule published for those frameworks.
Conga CLM works from the customer's own material. That means contracts imported in bulk, including third party, legacy and acquired agreements, plus the customer's clause library, negotiation playbook and approved templates. The vendor states that precise models are built from the customer's own documents without the customer having to train them. The generative layer is named too. Azure OpenAI handles language processing, with Google Cloud Vision, Amazon Textract and Zuva for optical character recognition, table detection and provision extraction.
Conga states no rights basis for any of these sources and does not describe what the underlying foundation models were trained on. Zuva's extraction models are trained on contract collections rather than on the customer's documents, and they are named without any account of what sits behind them. On the customer's side, the Artificial Intelligence Addendum leaves the customer with all right, title and interest in its AI Inputs and AI Outputs and grants Conga only a limited license.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product cites no cases, statutes or regulations, and nothing published addresses checking authority for later history. It works on the customer's own contracts, matching clauses against a playbook and approved library, extracting obligations and dates, and drafting language from the customer's precedents. The one feature touching outside law is compliance question and answer, described as mapping contract language to frameworks such as GDPR and HIPAA in real time, and nothing says how those frameworks are kept current, which edition is used, or what happens when a regulation changes.
The product cites no cases, statutes or regulations, so checking authority for later history does not arise in its usual form. It works on the customer's own agreements, comparing drafts to a negotiation playbook, matching against an approved clause library, extracting obligations and dates, summarizing, and answering questions about the repository. Nothing it produces is a statement about the law that a lawyer would check for later treatment.
The nearest point is obligation and renewal tracking, where the question is whether a contractual date or duty is still live, and alerts and dashboards handle that. No feature checks legal authority for subsequent history.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Nothing on the product pages, the pricing page or FAQ, or in the agreement says what the product does when it cannot ground an answer. The vendor says guardrails keep the assistant aligned with the customer's process and data, which describes a constraint, not a behavior, and high risk clauses are flagged for auditable review, which is detection, not abstention. Nothing says the system declines to answer, marks an answer as unsupported, reports that a clause could not be matched, or shows a confidence score.
Section 9.3(b) puts review of output on the customer and section 7.2 requires a human to make final decisions with legal effects, which allocate the consequences without describing the system's behavior.
Conga commits that AiMe shows how every recommendation is generated, that users see the reasoning behind AI driven actions, and that confidence scores appear wherever AiMe makes a suggestion. That gives a reviewer a signal for each suggestion. Conga does not describe what the system does when it cannot ground an answer. It names no explicit refusal response or unsupported extraction marker. Nor does it say what happens when a clause cannot be matched to the playbook or a question cannot be answered from the repository.
No evaluation results for that behavior are available. The Artificial Intelligence Addendum allocates the consequences instead. It says outputs may be inaccurate, incomplete or misleading, makes the customer solely responsible for validating them, and states that Conga does not monitor or review AI generated outputs. How the guardrails behave in practice is left unexplained.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin records no case naming CobbleStone or VISDOM, and two independent sanctions trackers record none either. This is a statement about the public record rather than a finding about the product.
The AI Hallucination Cases database maintained by Damien Charlotin tracks decisions worldwide where a court addressed hallucinated AI content, and records the tool implicated where known. It records no court order, opinion or disciplinary record naming Conga CLM or Conga. Two independent sanctions trackers of decisions on AI generated fabricated citations do not name them either. Conga CLM works on contracts and cites no legal authority, so its output does not ordinarily reach a court filing.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 7.2 of the Master Subscription Agreement bars using any AI Tool to give advice normally given by a licensed professional, naming legal advice, and bars its use in automated decisions with legal effects unless a human makes the final decision. That refers to professional licensing and is addressed to the customer's conduct. Section 9.3(b) separately says the vendor gives no legal advice. No bar or ethics opinion is cited, ABA Formal Opinion 512 does not appear, no state guidance on generative AI is referenced, and nothing maps any capability to a jurisdiction's conduct rules. The platform is sold to procurement, sales and IT alongside legal, with the same AI features available to all.
No bar or ethics guidance is named for the service. ABA Formal Opinion 512 does not appear, no state guidance on generative AI in legal practice is referenced, and nothing maps a capability to a jurisdiction's rules of professional conduct. Conga does cite outside frameworks, but none of them is professional responsibility guidance. The Artificial Intelligence Addendum ties governance to the NIST AI Risk Management Framework, and the trust center classifies the products as minimal or limited risk AI systems under the EU AI Act.
Both are addressed to the vendor as an AI provider. The nearest thing to a professional responsibility statement is the Addendum's requirement that the customer not rely on AI outputs as the sole basis for a decision with legal impact. It also requires the customer to exercise independent judgment. It names no guidance.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It is bought by legal, procurement, sales and IT departments for their own contracts, and the customer base leans to counties, public utilities, a state university medical center, health and human services agencies and drug companies, none billing a client for contract review. The efficiency claims, 26 percent gains from digitized agreement workflows and 1.8 times revenue velocity, target the buyer's own cost and cycle time.
The AI is metered by words in and out per iteration, shared across users, with overage billed in 750 word increments. Nothing addresses disclosure of AI use or cost in billing.
The product serves corporate teams managing their own commercial agreements. The named audiences are in house functions, legal, procurement, sales, finance, IT and business operations, each with its own page. The named customers are corporate, among them an airline, an insurer, a property data business, a consumer fitness company and a professional network. Nothing is addressed to a law firm billing a client. Conga's efficiency claims include a 9 percent revenue increase, 50 percent less review time with AI, faster deal cycles and lower supplier costs.
All of them concern the buyer's own cost, cycle time or revenue, and none reaches a client bill. The platform also runs quoting, pricing and billing, but that is the customer billing its own customers rather than a lawyer billing a client. No client fee disclosure workflow for AI assistance is specified.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Section 7.1 of the published Master Subscription Agreement defines the AI Processor as the third party processor for certain AI features, names OpenAI as of the effective date, says it may act as data subprocessor for information input into an AI Tool, and commits to reasonable advance notice before a change. So which third party sees content sent to the AI is on the public record. There is no wider subprocessor list, so hosting, support and infrastructure processors are unnamed, with Google Cloud Platform appearing only on the attestations page, and there is no client disclosure pack, consent notice or forwardable annex. The legal hub mentions data processing addenda, and no DPA is published elsewhere.
Customer counsel can use the AI and data processing addenda to address a counterparty's AI clause. Conga's trust center names Google Cloud Vision for optical character recognition, Amazon Textract for table detection, Zuva for provision extraction and Azure OpenAI for language processing. It states a zero retention arrangement with each and explains what Azure OpenAI does and does not do with prompts and completions.
The subprocessor register identifies the supporting services. The Data Processing Addendum applies Clause 9(a) Option 2 of the Standard Contractual Clauses to that list, with fifteen days' notice, a right to object and termination with a refund. The Data Processing Addendum includes the standard contractual clauses and their UK and Swiss adaptations, alongside the separate Artificial Intelligence Addendum.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The vendor publishes audit trails across AI chats, contracts and other key areas, so assistant interactions are logged. Around that sit version control, tracked edits and inline comments, approval and workflow history, and deviation reports showing where a draft departed from the playbook, which together show who changed what and when. Nothing says any export identifies which model produced a passage, and the vendor reserves the right to switch between GPT-4 and GPT-4o. Nothing marks machine text against human edits in an export, and no disclosure template, certification form or court guidance is published.
The platform keeps a complete audit trail of every action, approval and signature across the contract lifecycle, which the vendor describes as supporting legal or internal reviews. It also keeps version control, tracked edits and inline comments. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions, and confidence scores accompany each suggestion, so the basis of a proposed clause is visible at review.
No described report or extract identifies which model produced a passage, and Conga names the model only by family. Conga describes no document level export, no marking of machine generated text against human edited text in a form a party could give a court, and no disclosure template, certification form or court guidance.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
Product updates
The latest logged changes from each vendor, newest first, each linked to its source.
CobbleStone Software
-
Product / capability
CobbleStone released Contract Insight 26.1.0, a platform update with a redesigned responsive interface, enterprise wide search across records and document content, draft saving, and Contract Insights dashboards for renewals, financials, approvals and cycle times.
Source
Conga CLM
-
Integration / interoperability
The Oct '26 release of Conga CLM for Salesforce adds the CLM AI Library, a package that opens agreement lifecycle actions to Agentforce and Claude through Conga's Model Context Protocol capability.
Source -
Product / capability
Conga CLM for Advantage Platform release 202609.1.0, published to Preview on 22 September 2026, adds Supplier Sanctions Screening, which checks one or many suppliers against the OFAC SDN List and the UN Consolidated Sanctions List and emails per supplier PDF reports.
Source
In summary
CobbleStone Software
CobbleStone Software, the trading name of CobbleStone Systems Corp. of Princeton, New Jersey, sells Contract Insight, a contract lifecycle platform in the market since the mid 1990s with modules for vendor management, procurement and sourcing. Its proprietary AI layer, VISDOM, extracts clauses, checks drafts against a playbook, proposes language and answers questions, with generative features on OpenAI models. According to the AI Legal Index, CobbleStone publishes VISDOM prices by words processed, names OpenAI in its agreement, and offers hosted and customer installed editions. Named users include El Paso County and SUNY Upstate Medical University. Its Contract Insight platform license is quoted by named or concurrent user.
Conga CLM
Conga CLM is the contract lifecycle product of Conga Corporation of Broomfield, Colorado. It is sold on Salesforce or as standalone software beside any CRM or ERP, with authoring in Word or Google Docs and links to Conga's quoting, document and billing products. Its AI, AiMe, imports legacy contracts as structured data, checks drafts against a playbook, proposes redlines and answers repository questions, on Azure OpenAI with named document processing providers. According to the AI Legal Index, AiMe shows how each recommendation is generated with a confidence score, and Conga commits to breach notice within 48 hours. It publishes an AI addendum and a data processing addendum and names Southwest Airlines and LinkedIn among customers.
Questions buyers ask
CobbleStone vs Conga CLM: which is better for enterprise contract management?
Conga publishes more on AI governance, data handling and breach notice. CobbleStone publishes AI prices, names its model provider in the contract and offers an edition installed on your own servers. Public sector buyers who need on premises deployment have more to read from CobbleStone. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Does Conga CLM train AI on customer contracts?
On the customer's own data, for that customer only. Conga's AI addendum permits model training using customer data but limits it to models specific to the customer's tenant, bars training global or foundation models that serve multiple customers, and bars any third party from using customer data or outputs to train or develop a model. Anonymized, aggregated usage data may be used to refine models. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Does CobbleStone train AI on customer contracts?
CobbleStone's VISDOM page says proprietary contracts never train public models and that client data is processed by inference only, without updating model weights. Its master subscription agreement contains no training prohibition and reserves use of data concerning customer data to improve its services, without naming training. Content sent to its AI tools goes to OpenAI as its named AI processor. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
How much do CobbleStone and Conga CLM cost?
CobbleStone publishes its AI tiers. VISDOM Basic is free up to 100,000 words a month, and paid tiers cost $3,995, $6,995 and $29,995 a year for 500,000, one million and five million words. The Contract Insight platform license is quoted, by named or concurrent user. Conga publishes no price, unit or tier for Conga CLM, and its pricing page leads to a quote form. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Three points stand out. Conga's AI addendum permits training on a customer's own data into models limited to that customer's tenant, while barring global models and any third party from training on it. That is a published term. CobbleStone's attestations page lists sixteen badges without auditors, dates or reports. They include Safe Harbor, a framework invalidated in 2015, and FedRAMP described as compliance while its own release says FedRAMP Ready. Conga's general liability cap sits in its master services agreement. Neither vendor reviewed this page.