Coheso vs Tonkean LegalWorks: how they compare in 2026
Coheso and Tonkean LegalWorks, one of three solutions from Tonkean, both give in house legal teams a front door that takes requests from Slack, Teams or email and answers simple ones with AI. Coheso is stronger on evidence about its answers. Its AI Assist cites the passage in the legal team's own documents behind each answer. A dated Taskrabbit study reports 297 requests in about three and a half months, 86 of them resolved by AI. Tonkean's counterweight is a published contract layer. Its data processing addendum names Azure, OpenAI and Google as AI subprocessors a customer must opt into, requires notice before any new one, and commits to challenge government demands. It publishes its pricing unit and offers dedicated or self hosted deployment. Its customer terms date from May 2019 and cap liability at three months of fees.
Which one fits
Choose Coheso if
- You want business users' questions answered from your own approved material. Coheso's AI Assist answers from the contracts, policies and guidance the legal team curates, cites the source passages, and routes topics the team has flagged through legal validation first.
- You want evidence from a legal team like yours. Coheso's dated Taskrabbit case study reports 297 interactions through Slack in about three and a half months, with 211 escalated to legal and 86 resolved by AI, and its Narvar study describes a migration of more than 10,000 contracts.
- You need to know which model reads requests and where data sits. Coheso names OpenAI GPT models on the Azure OpenAI Service, states that nothing is stored with the model provider, stores documents on Amazon Web Services, and offers data residency in the US, EU or UAE.
Choose Tonkean LegalWorks if
- Your legal work spans Ironclad, TeamConnect, SimpleLegal and DocuSign. LegalWorks orchestrates matters across named systems, syncing contracts from lifecycle management to electronic signature, routing approvals through chat and email, and pulling data from billing and outside counsel platforms.
- You need a dedicated or self hosted deployment. LegalWorks is offered on a shared cloud, a single tenant dedicated cloud, or in your own AWS, Azure or Google Cloud environment, with retention set by your team down to the field level.
- You want the AI supply chain and government demands handled in a published contract. Tonkean's data processing addendum names its AI subprocessors, which a customer must opt into, gives seven days to object to a new one, and commits to challenge government demands and report yearly on those received.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Coheso's AI triages each incoming request and decides whether it can be answered from source documents or needs a lawyer, answers business users' questions from the legal team's approved content, generates first drafts from the team's templates, and runs agents that apply the team's playbooks to recurring reviews. Intake forms, routing rules, shared boards, status tracking and dashboards are conventional work management that functions without the models.
AI Front Door reads plain language requests, LegalGPT sorts and classifies unstructured requests, and packaged agents handle NDA generation and contract work. Underneath is a process orchestration platform built without code, with forms, rules, approval chains, dashboards and integrations, sold in the same form to procurement and IT. The published subprocessor table lists Microsoft Azure for AI LLM engine services, OpenAI for AI and machine learning features and Google Cloud for OCR, and marks all three opt in, so a customer that does not opt in gets an orchestration platform with no model behind it.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
The AI Assist page says answers for business users draw from the contracts, policies and guidance documents the legal team curates, with citations linking to the source passages, and the ROI page says each response from the assistant for the legal team cites every individual assertion with footnotes hyperlinked to the passage relied on. Coheso's home page adds a report of which documents the AI leans on most and which questions it cannot yet answer. No accuracy figures, test set or error rate are published.
The AI Front Door trawls the data sources the customer has given it access to and generates a document if one does not already exist, and agents draw on connected enterprise systems. The LegalWorks page, the security page, the pricing page, the DPA and the customer terms publish no accuracy figure, test set, evaluation, error rate or method description, and no output is presented with a traceable citation to the source record it came from. The agreement says Tonkean does not warrant that the Platform will meet the customer's requirements or expectations, including with respect to any actions or outcomes of use of Tonkean's A.I. Bot. Nothing on those pages addresses hallucination. Tonkean also publishes product documentation at docs.tonkean.com and an AI handbook.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Legal teams write response rules defining what Coheso's AI can and cannot answer directly, and validation workflows route sensitive answers through legal before they reach business users. The AI escalates questions that need a lawyer, and every AI interaction is logged and reviewable by legal. Agents handle repeat requests from the team's playbooks and leave judgment calls and exceptions with the lawyers. Coheso states no limit of its own on what the AI may answer unreviewed, no threshold at which it stops, and nothing on what happens after a wrong answer reaches a business user.
Simple requests such as NDAs and statements of work are handled automatically, and urgency is identified on every incoming request. Complex matters, including conflict waivers, intellectual property questions and outside counsel engagements, are routed to the right person or practice group. Approval paths and risk tiers follow the department's policy, intake forms adapt to risk level and matter type, and every action and approval is logged. The thresholds are set by the customer, and no default is published. No confidence signal, abstention state or behavior on a misclassified request is described.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
At Taskrabbit, the legal team logged 297 interactions through Slack within about three and a half months of launch, 211 escalated to legal and 86 resolved by AI, according to Coheso's case study of 30 April 2026. The deployment ran on eight intake forms, and the study quotes the company's Principal Counsel on adoption. The Narvar study of 26 November 2025 describes a migration of more than 10,000 contracts with the data extracted for legal, finance and the deal desk. The M42 study of September 2025 describes CLM templates completed automatically from intake forms. The headline figures on the home page, up to 75 percent faster responses and more than eight hours saved per attorney each week, carry no customer or method.
The LegalWorks page shows twenty enterprise logos, including Google, Lenovo, AbbVie, Workday, Cisco and Intuit, under the heading trusted by enterprises like; it is the same strip used across the site, not a LegalWorks customer list. The headline figures have no attribution or basis: 50 percent shorter cycle times, 99 percent of customers reporting higher adoption, 30 employee hours saved weekly, 7.7 billion steps automated a year. Two of three attributed quotes come from procurement. The Head of Global Procurement at Semrush gives the only hard figure, a cycle time falling from 19 days to 10, and the other is from the Head of Procurement at Cockroach Labs. The legal quote, from Mary O'Carroll, described as former President of CLOC and Head of Legal Operations at Google, concerns Tonkean in general rather than LegalWorks. Tonkean also publishes a customer showcase.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
No data is stored with any language model provider used for processing, where it is processed and immediately discarded, Coheso's security page says, alongside residency options in the US, EU and UAE, SAML SSO, IP allow lists and audit logs. The AI Assist page describes permissions at document level separating content for business users from internal legal content. No customer agreement is published, so none of this is a contract term, and nothing addresses whether Coheso itself trains on customer content, how privileged material is treated, or how long Coheso keeps documents. The Privacy Notice, last modified 8 December 2025, reserves use of information to improve the Service and to analyze its accuracy.
The LegalWorks governance section offers an audit trail of all actions and approvals, presented as helping preserve attorney client privilege, plus role based access control, ethical walls, item level retention and legal holds. The customer terms say User Content is not information acquired by Tonkean, which takes customer content out of the contractual confidentiality duty and refers it to the Security section, where Tonkean says it cannot fully ensure or warrant the security and privacy of User Content or personal information. Tonkean has no right in User Content beyond the minimum needed to run the Platform and may not use it for any other purpose, and the DPA bars Tonkean from deriving rights or benefits from Personal Information.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Nothing states that answers given to business users are not legal advice, who may rely on them, or how the product supports the legal team's professional supervision duties. No customer terms are published where such a statement would usually sit. The product gives employees who are not lawyers answers to legal and compliance questions. The legal team's controls over those answers are product settings rather than a position on the advice line.
The customer terms state that the Service provides ideas, suggestions, analyses and other data for informational purposes only and not as advice, and disclaim responsibility for any information provided by the Service. The agreement carrying that sentence is drafted for a business management platform and was last updated May 2019, before LegalWorks and every agent now sold. The marketing describes agents that handle complex contract analysis and negotiation strategies, and an AI Front Door that answers employees' legal questions directly. The buyer is a corporate legal department and the requesters are its own employees, so there is no consumer surface. No rule of professional conduct or bar guidance is named, no jurisdiction limit is stated, and nothing covers how a legal team supervises an agent that answers a business question without a lawyer seeing it.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Response rules, validation workflows, audit trails for every AI interaction and usage analytics give the customer's legal team the means to watch and correct the AI, and a report shows which questions it cannot yet answer. No governance framework, accountable owner, testing regime before release or bias finding of Coheso's own is published.
Tonkean's agents act on simple requests without a lawyer involved. No responsible AI page, principles statement, named owner for model behavior or testing regime before release appears on the LegalWorks, security or pricing pages. Nothing addresses bias, including whether triage and classification perform evenly across request types, business units or languages, although the product's core job is deciding which requests are simple enough to resolve without a lawyer. The security page covers information security, not model governance. The navigation includes an AI handbook page headed with questions about what an agent is and when one counts as an enterprise agent.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Amazon Web Services S3 and RDS hold customer documents and logs, according to Coheso's Privacy Notice, which also names the other processors, including the Azure OpenAI Service for language model features and Adobe's PDF viewer. The security page adds zero retention at the model provider, SAML SSO, IP allow lists, audit logs and residency options in the US, EU and UAE, and the trust center carries a subprocessors section and offers a SOC 2 report and a penetration test report on request. No retention period is stated, since the notice keeps information for as long as the Service is used and a reasonable time after, and no incident or breach notification practice is stated.
The customer controls retention in detail, setting item level policies down to individual fields so data is kept only as long as a process needs. The DPA adds that within 60 days of termination Tonkean will delete or return all Personal Data at the customer's choice and delete existing copies, keeping one copy only where law requires. Access control is described as comprehensive and role based across data access and process creation, and encryption is AES-256 at rest and in transit. Audit logs that cannot be repudiated record all edits and processed transactions. The subprocessor list is published, naming each provider, its function and its country. Tonkean commits to notify without undue delay after becoming aware of a Data Incident, with no stated deadline, and the same clause bars the customer from publishing anything identifying Tonkean about an incident without prior written approval unless legally compelled.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
No customer agreement, terms of service or subscription terms are published, so nothing states who bears the loss when an AI answer or draft is wrong: no indemnity, cap, warranty or remedy is published. The Privacy Notice disclaims liability for disclosure of information through transmission errors, third party access or causes beyond the company's control, which concerns data security rather than the product's output.
Total liability is capped at the fees actually paid in the three months before the claim arose. Excluded damages are broad, covering loss or corruption of data, lost profits and pure economic loss. No indemnity runs to the customer. The only intellectual property remedy is that Tonkean may, at its discretion, procure a license, modify the Platform or terminate and refund the remaining period, and the agreement says no other rights or remedies accrue. The indemnity that exists runs from customer to Tonkean. The warranty is to repair or replace material errors that prevent ordinary use, and expressly does not extend to any actions or outcomes of use of Tonkean's A.I. Bot. No insurance position is published. The agreement was last updated in May 2019, before the 2026 agentic product it governs, and mentions AI once, to disclaim it.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Requests come in from Slack, Microsoft Teams, Gmail and Outlook with their context, and legal's responses sync back to the original thread. Documents connect through Google Drive and SharePoint, Docusign and CLM connectors are listed, and the M42 case study describes intake form fields passing to the customer's CLM to generate standard agreements automatically. No integration documentation is published describing what each connector moves, in which direction, or what a team must configure.
The legal connections are Ironclad for contract lifecycle management, TeamConnect for matter management and SimpleLegal for legal spend, plus DocuSign and Adobe Sign for signatures and SharePoint for documents. The wider set includes Salesforce, ServiceNow, JIRA, Slack, Microsoft Teams, email, Coupa and SAP, and the product is designed as an orchestration layer across them rather than a system to migrate into. Contracts sync from CLM to electronic signature, approvals run through email and chat, data is pulled from billing systems, and work is coordinated with outside counsel platforms. The LegalWorks page does not say what a legal team must set up, which fields map, or what an integration requires. Tonkean also publishes an integration library and developer documentation.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Residency options cover the US, EU and UAE on Coheso's security page, and its trust center lists an architecture diagram for each region, available on request. The Privacy Notice says customer documents and logs are stored on Amazon Web Services and that language model features run on the Azure OpenAI Service, without stating which region processes a customer's prompts. It separately says information collected through the Service is stored and processed in the United States, which the regional options qualify without resolving. The tenancy model is not stated.
Three options are described: a multi tenant public cloud on AWS managed by Tonkean, a single tenant dedicated cloud on AWS also managed by Tonkean, and self hosting in the customer's own AWS, Azure or Google Cloud environment. The pricing page says multi tenant is included, while dedicated, customer cloud and on premise options are on the enterprise plan at extra cost. The DPA lists every subprocessor in the United States except Tonkean Israel Ltd., and Schedule 2 incorporates the 2021 Standard Contractual Clauses with UK and Swiss addenda for transfers out of the EEA. No region choice is published for the managed offering, and no page says where data is stored as distinct from processed.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Coheso's security page states SOC 2 Type II, with annual independent audits over a full year observation period, and independent penetration testing of the web application and infrastructure. Coheso's trust center lists a SOC 2 Type II report, a penetration test report and regional architecture diagrams behind an access request, with the privacy policy open to view. The auditor, the report period and the scope are not published.
The security page states SOC 2 Type 2 compliance, independently audited under the AICPA Trust Services Criteria for security, availability and confidentiality. ISO/IEC 27001:2022 is stated as achieved, and a HIPAA compliance page sits alongside. No auditor is named and no audit period or report date is given for either. The reports are limited to existing customers, who are invited to ask the team for the latest one, and there is no trust portal. The badges shown are the certification marks themselves.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Coheso's Privacy Notice says language model features use OpenAI's GPT models hosted on the Azure OpenAI Service, and the security page says no data is stored with any model provider used. The specific models and versions are not named, where the Azure processing runs is not stated, and no commitment to notify customers of a model change is published.
Schedule 1 of the published DPA lists each subprocessor with its service and country: Microsoft Azure for AI LLM engine services, OpenAI, LLC for AI and machine learning features, and Google Cloud Platform for OCR, all in the United States and each marked opt in. It also lists AWS for cloud storage, Elastic.co for the hosted index database, SendGrid for email and Tonkean Israel Ltd. as an affiliate. Tonkean must give notice before authorizing a new subprocessor, the customer has seven days to object, and an unresolved objection allows termination of the affected services. Azure and OpenAI are providers, not models, and no model or version is named.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No price, tier, unit of charge or package structure is published; the ROI calculator estimates the value of time saved without stating what the product costs, and every route to a figure is a demo request.
Charging is per Monthly Tracked User, defined precisely: a unique person who in a calendar month submits a form, opens a workspace app, submits or replies to an item in Slack or Teams, sends or replies to a Tonkean email, or clicks a button or updates an item. Tonkean says these are not named seats or a count of records, that a counted person's actions that month are unlimited, and that billing uses the average across the subscription year so busy months even out. A quote has three parts: the platform with unlimited workflows and connectors, the user volume, and optional deployment and services. Hosting and support tiers are itemized. No price, band, minimum or term is published, and every route ends in a scheduled call.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Buyers are in house legal and compliance teams, across industries Coheso names, including healthcare, technology, finance, chemicals, cybersecurity, beauty and wellness, and manufacturing. The work covered is clear from the product and case study pages: intake and triage of business requests, NDAs, MSAs, DPAs, vendor and marketing reviews, employment questions, contract generation and contract data migration. What the product does not cover is not stated, and nothing addresses team size or use outside in house legal.
The segment is corporate and government in house legal departments at enterprise scale, with material addressed separately to employees raising requests, the legal team, and colleagues in procurement, sales and IT. Coverage is expressed as request types rather than practice groups: NDAs, statements of work, contract review, conflict waivers, intellectual property questions, outside counsel engagement, legal mailroom, email triage and general matter intake. Customers are drawn from Fortune 500 and Fortune 200 enterprises. Nothing addresses use by law firms, no minimum department size is given, no jurisdiction or language coverage is published, and no request type is named as unsuitable for automated handling.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
No agreement that governs the product is published: no customer agreement, terms of service or subscription terms. The home page, security page, AI Assist page, ROI page, Privacy Notice and trust center listing state no position on whether Coheso trains on customer content. The security page says no data is stored with any language model provider, which concerns retention at the provider rather than training, and the Privacy Notice reserves use of information to improve the Service and analyze its accuracy without naming training.
No published material mentions training either way, and the agreement grants no right to improve anything using customer content. The customer terms say Tonkean has no right in User Content beyond the minimum needed to run the Platform and may not use it for any other purpose. The DPA adds that Tonkean may not have, derive or exercise any rights or benefits from Personal Information processed for the customer and may use it only for the purposes for which it was provided.
Both would exclude training by their terms, and neither names it. The DPA also lists making Personal Data fully anonymous among permitted processing purposes, without saying what may then be done with the result. The LLM subprocessors, Microsoft Azure and OpenAI, are marked opt in, so a customer that does not opt in has no model processing its content at all.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The security page says nothing is stored with any language model provider and that data is processed and immediately discarded there. Coheso itself keeps customer documents and logs on Amazon Web Services and logs every AI interaction for audit, and the Privacy Notice keeps information for as long as the Service is used and a reasonable time after. No retention period is stated for what a user submits to Coheso, and no customer setting to shorten it is described.
The security page says item level policies let a customer set retention periods down to individual fields, so sensitive data is kept only as long as each process needs. The DPA covers the end: within 60 days of termination Tonkean will delete or return all Personal Data at the customer's choice and delete existing copies, keeping one copy only where law authorizes or requires it for legal claims. No zero retention option is stated for prompts and model outputs, and nothing distinguishes keeping a request record from keeping the model exchange that resolved it. No default period is published for a customer that configures nothing.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The AI Assist page describes Coheso's own permission model over the knowledge base: access controls at document level keep content for business users and internal legal content separately scoped, and AI responses draw from the knowledge base with that access control applied. The legal team sets and maintains the permissions; nothing published maps them to matters, and no inheritance from a document management system's access model is described.
The LegalWorks governance section lists comprehensive role-based access control and ethical walls together as a single bullet, alongside full audit logs and item-level retention, and the security page describes RBAC in general terms as ensuring every permission from data access through process creation is secured. Neither states how a wall is defined, at what level it operates, whether it applies to matters, clients or business units, who administers it, or what a walled user sees.
Tenant separation is published, with a single-tenant dedicated cloud and a self-hosted option, and it separates customers from each other rather than matters within one legal department. Tonkean also publishes product documentation at docs.tonkean.com.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The Privacy Notice, last modified 8 December 2025, lists assisting law enforcement and responding to subpoenas among the uses of information, and says information may be disclosed to comply with law, to cooperate with government or law enforcement officials or private parties, and to respond to claims and legal process. Neither a commitment to notify the customer nor a reserved discretion to do so is published, and no customer agreement is published.
The DPA says that where law, a court or a government authority requires processing, Tonkean will tell the customer of the requirement first, unless prohibited on important grounds of public interest. Schedule 2 Part 4 goes further for transfers across borders. If a government authority seeks access, Tonkean will tell it the customer has not authorized disclosure and that demands should go to the customer. It will use commercially reasonable legal means to challenge the demand and notify the customer as soon as possible after any emergency access.
Once every twelve months, on written request, Tonkean will tell the customer what types of binding legal demands for personal data it has received, including national security orders and any process under section 702 of the US Foreign Intelligence Surveillance Act. Tonkean also commits to resist bulk surveillance requests. The reporting is available on request rather than published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The AI answers from the customer's own contracts, policies and guidance documents, and the home page, the AI Assist page and the security page identify no body of primary law behind its output.
The material the models read is the customer's own. The AI Front Door searches the data sources the customer gives it access to, and agents draw on connected systems including contract lifecycle management, billing, document stores and chat. The product retrieves no primary law, published precedent or licensed third party data, and none is named on the LegalWorks page, the platform navigation, the security page, the pricing page, the DPA or the customer terms.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Answers cite the customer's own documents, and nothing on the home page, the AI Assist page or the security page addresses checking legal authority for later history.
LegalWorks routes and resolves internal legal requests and generates operational documents such as NDAs and statements of work. No case, statute or regulation is surfaced to a user at any point in the published workflow, and nothing addresses checking authority for subsequent history.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Coheso's home page says the AI decides for each request whether it can be answered from source documents or needs escalation, and the AI Assist page says it escalates automatically when a question requires legal review, routes answers on topics the legal team has flagged through legal validation first, and reports which questions it cannot yet answer so the team can fill the gap. No published evaluation shows how often it declines or escalates.
The product resolves simple requests on its own and routes complex ones, naming conflict waivers, intellectual property and outside counsel engagements, to the right workflow, person or practice group, and it flags the urgency of every request. The routing sorts by request complexity as the customer configures it, not by the model's confidence in its answer. Nothing describes what happens when the model cannot classify a request, misreads one, or drafts something it lacks grounds for.
No confidence score, abstention state or no answer condition is shown to the requester or the legal team. Requesters are business employees, not lawyers.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin records no case naming Coheso, and no court order, opinion or disciplinary record naming the product appears in the public record. This is a statement about the public record rather than a finding about the product.
The AI Hallucination Cases database kept by Damien Charlotin holds no entry naming LegalWorks or Tonkean. LegalWorks routes internal requests and generates operational documents rather than legal citations.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No material on the home page, the AI Assist, security, ROI and privacy pages or in the Taskrabbit case study refers to lawyers' professional or ethical obligations or names any ethics opinion.
The LegalWorks page, the security page, the pricing page, the DPA and the customer terms name no bar authority, regulator, conduct rule or ethics opinion, and map no jurisdiction-specific guidance. The customer terms state that the Service provides analyses for informational purposes only and not as advice. The LegalWorks page frames its audit trail as helping preserve attorney-client privilege, a professional responsibility concept, and cites no source for that standard.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product is bought by in house legal teams whose work bills no client, so no fee between a lawyer and a client is touched. The savings Coheso claims are aimed at the buyer's own cost: responses up to 75 percent faster, more than eight hours saved per attorney each week, and an ROI calculator estimating hours recovered and reduced outside counsel spend.
Efficiency claims are prominent and unattributed: 50 percent shorter cycle times, 30 employee hours saved each week, and a named legal operations endorsement mentioning millions of dollars saved. Nothing addresses what happens to a bill when work gets faster, and no record of AI assisted work by matter is described for that purpose. The buyer is an in house legal department, which pays outside counsel rather than billing a client.
The product coordinates outside counsel engagement and pulls data from billing systems, and nothing connects automated handling of a matter to what the department is billed for it.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The Privacy Notice names the processors that handle customer material, including Amazon Web Services for documents and logs, the Azure OpenAI Service for features built on GPT, Adobe's PDF viewer, Frontegg for user management, and Vercel and Render for analytics, and the trust center carries a subprocessors section beside a SOC 2 report and penetration test report available on request. No disclosure pack on AI use for clients is published.
The Data Processing Addendum is public and ungated, and Schedule 1 lists every subprocessor with its service and country. The AI entries are Microsoft Azure for AI LLM engine services, OpenAI, LLC for AI and machine learning features and Google Cloud Platform for OCR, all in the United States and all marked opt in. The DPA can be forwarded to a counterparty and incorporates the 2021 Standard Contractual Clauses with UK and Swiss addenda.
Change notice is contractual: notice before any new subprocessor is authorized, a seven day objection window and a right to terminate. On an in house product the buyer is the client rather than the firm.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Every AI interaction is logged with its cited sources and can be reviewed by legal, and responses are logged and searchable. No export of a record for each document covering the model used, the sources and the human check is described, and no disclosure guidance is published.
The security page describes logs that cannot be repudiated, recording all edits to solutions and components and all processed transactions in test and production. The LegalWorks governance section commits to an audit trail of all actions and approvals, framed as supporting audit readiness and the preservation of attorney client privilege. Nothing says the log shows which requests an agent resolved on its own rather than a person, no model or version is attached to a generated document such as an NDA, and the LegalWorks and security pages describe no export route for the audit trail for a regulator, an auditor or a court. Tonkean also publishes product documentation.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
- Bar Guidance Alignment
Product updates
The latest logged changes from each vendor, newest first, each linked to its source.
Coheso
-
Product / capability
Coheso launched Memory, which reviews matters as they are resolved, picks out decisions worth repeating and proposes them as positions with the reasoning, conditions, exceptions and prior matters behind each one.
Source
In summary
Coheso
Coheso, from Coheso, Inc. of New York, is an AI front door and work management platform for in house legal and compliance teams. Requests arrive through Slack, Microsoft Teams, Gmail, Outlook or intake forms, and AI triages and routes them. AI Assist answers business users from a knowledge base the legal team curates, with citations to the source passages, and agents built on the team's playbooks handle recurring reviews and first drafts. According to the AI Legal Index, Coheso publishes a dated Taskrabbit study reporting 297 requests in about three and a half months, 86 of them resolved by AI. It names OpenAI models on Azure and offers US, EU or UAE data residency.
Tonkean LegalWorks
Tonkean LegalWorks, one of three solutions from Tonkean Inc. of Palo Alto, is matter lifecycle management for in house legal departments. It meets employees in Slack, Microsoft Teams, email or a portal. Its AI Front Door answers simple requests and routes the rest into adaptive intake, and packaged agents handle NDAs, contract work, conflict checks and legal mailroom triage, all configured with no code tools. According to the AI Legal Index, Tonkean publishes a data processing addendum naming its AI subprocessors, offers shared, dedicated or self hosted deployment, and prices on monthly tracked users.
Questions buyers ask
Coheso vs Tonkean LegalWorks: which is better for a legal front door?
The two are close. Coheso shows its sources and names legal customers with dated results. LegalWorks publishes deeper contract terms on subprocessors and government demands, more deployment options and its pricing unit. Large enterprises needing self hosting have more to read from Tonkean. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Which AI models do Coheso and Tonkean LegalWorks use?
Coheso's privacy notice names OpenAI GPT models hosted on the Azure OpenAI Service, and its security page says no data is stored with the model provider. Tonkean's data processing addendum names Microsoft Azure for language model services, OpenAI for AI features and Google Cloud for OCR, each marked as something a customer opts into. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
How is Tonkean LegalWorks priced?
By monthly tracked users, a published unit: a unique person who in a month submits a form, opens a workspace app, replies in Slack or Teams, answers a Tonkean email or clicks to approve something. Once counted, their use that month is unlimited, and billing rests on the yearly average. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
What does Tonkean do if a government demands customer data?
Its data processing addendum commits Tonkean to tell the customer before complying with a legal requirement unless barred, to tell an authority seeking access that demands should go to the customer, to challenge demands through commercially reasonable legal means, and to report yearly on request the types of demands received, including national security orders. Coheso's privacy notice allows disclosure to respond to subpoenas with no notice commitment. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Three points stand out. Tonkean's customer terms were last updated in May 2019, before LegalWorks existed. They cap liability at three months of fees, exclude outcomes of its AI from the warranty, and exclude customer content from the confidentiality clause, while its data processing addendum is more protective. Coheso publishes no customer agreement, so its commitments sit on product and security pages. Tonkean's logo wall and figures cover its whole platform rather than LegalWorks alone. Neither vendor reviewed this page.