Contract Logix vs Gatekeeper: how they compare in 2026

The models are the engine of core capabilities layered on a product that would function without them, which is the B band. Two AI capabilities are named, each with its own page and its own place in the lifecycle. The Contract Intelligence Engine is described as the AI extraction layer inside Contract Logix and runs post-execution: AI Contract Analysis detects which key terms and clauses are present in contract language, and AI Data Extraction, branded AIDE, pulls chosen properties into the platform as structured data. The supporting detail is more concrete than most in this lane: 92 pre-built standard fields, customer-defined fields driven by extraction prompts, Custom Data Objects for line-item detail with calculated fields and row-level dates, and portfolio-wide reprocessing against a new configuration without re-loading documents. Contract Logix Review runs pre-signature and delivers first-pass redlines against the organisation's own standards inside Microsoft Word or Google Docs, and the vendor states expressly that the two share a platform but are not stages in a sequence. What keeps this off A is that the product underneath is a full contract lifecycle management platform. Remove the models and the request intake, authoring, negotiation workflow, repository, permissions and automated tracking of obligations, renewals and milestones all remain, and those are what the company sold for years before either AI capability existed. The extraction layer converts what was manual data entry into an automated read of the signed portfolio, which is a large improvement to a system that stands without it. Verified 13 September 2026.

The models are the engine of a core capability layered on a product that would function without them, which is B. Gatekeeper has sold vendor and contract lifecycle management since well before the AI arrived, and LuminIQ is described by the vendor as an intelligence layer added to that platform, launched in March 2025 with a first agent for workflow approvals and agents added since. Underneath sits a complete platform that does not depend on it: repository, template and clause authoring, the Kanban workflow engine with mandated approval paths, integrated eSignature compliant with ESIGN, UETA and eIDAS, vendor and employee portals, spend module, risk register and balanced scorecards. The pricing page shows the same structure, listing Gatekeeper Agents and the AI Suite as capabilities within plans whose quota is measured in third-party records rather than in AI usage. What is recorded on the other side is direction rather than present state: the vendor now leads with agentic AI throughout, claims more than fifty agents, and describes them as a digital workforce that reads, reasons and acts. Remove them and the platform still runs the lifecycle, which is what keeps this off A. Verified 12 September 2026.

An accuracy figure is published without the test set or the failure modes, which lands in the B band, and the shape of the disclosure is worth recording because it is rare. The product page states that AIDE delivers approximately 95 per cent or better accuracy on the standard extraction fields, rising to roughly 99 per cent with human validation in the loop. Publishing the delta is the notable part: it tells a buyer that the system is wrong on the order of one field in twenty unaided, which is closer to naming an error rate than anything else located in this lane, and it prices the human review step rather than assuming it away. Three things hold it at B rather than A. The A band asks for measured accuracy with the test set described and the failure modes named, and neither is published: nothing states what corpus the figure was measured on, how many documents or fields, of what type, or in which languages, and no failure mode is named, so a buyer cannot tell whether the missing five per cent is spread evenly or concentrated in particular field types. The qualifiers do real work in the vendor's favour, since approximately and roughly are not figures an outsider can test. And no independent validation of either number exists. R15 governs the remaining limbs and they are recorded as inapplicable rather than counted against the record: the grounding and linked-primary-source limbs do not bite on a system extracting from the customer's own executed contracts, because there is no external authority being cited whose existence could be fabricated. Verified 13 September 2026.

Accuracy is addressed only by disclaimer and grounding is claimed without a described method, which is C. R15 governs the inapplicable limbs: the product cites no legal authority, so authority grounding and citation-status checking do not bite. What bites is grounding and measurement. The grounding claim is real in outline, the agents working on the customer's own contracts and vendor records inside the platform, generating plain-language summaries from the uploaded agreement, matching clauses against approved language and extracting obligations, and the vendor states that agents explain every decision they make. That explainability claim is the strongest thing here and it is asserted rather than described: nothing published sets out what an explanation contains, what is retrieved, or how a proposed clause is traced back to the source text. Measurement is absent entirely, and the agreement makes the position explicit rather than leaving it implied. AI Terms clause 6.3 states that neither Gatekeeper nor any AI Provider makes any representation or warranty as to the accuracy, availability, suitability, reliability or content of Output, clause 9 excludes all warranties in relation to AI Functionality, and clause 6.6 requires the customer to check and evaluate the accuracy of any Output and not to rely on Gatekeeper to do it. No figure, test set, error rate or benchmark was located. Verified 12 September 2026.

A written commitment that the models work alongside a human reviewer with a real review surface, short of the full control structure, which is the B band. What lifts this above an assurance is that the human step is quantified rather than asserted. The published accuracy claim is expressed as approximately 95 per cent or better unaided rising to roughly 99 per cent with human validation in the loop, so the vendor has priced the review step into its own headline figure and, by implication, told the buyer what happens if the step is skipped. Very few records in this corpus put a number on the difference the human makes. The second AI capability is framed the same way: Review produces first-pass redlines against the organisation's standards, and first-pass is the vendor's own characterisation of what the output is, which sets an expectation that a person completes the work. What the A band requires is not published. No threshold is stated at which the system defers or escalates, no confidence signal is described on an individual extraction, nothing states which fields or clause types the system will not attempt, and nothing describes what happens after an extraction is found to be wrong beyond the general ability to reprocess a portfolio against a new configuration. R124(2) was applied to the first-pass framing and it does not qualify: it describes the maturity of the output rather than attaching a boundary to a named tier stating what that tier's output may not be used for, which is the test that distinguished Verbit. Verified 13 September 2026.

A written commitment that the models work alongside a human decision-maker, with real review surfaces, short of the threshold at which the system acts alone. The commitment is contractual and specific. AI Terms clause 6.5 states that Output is a suggestion designed to assist and does not replace the need for the customer to use a human being to decide upon its suitability before it is published, used or relied upon. Clause 6.6 requires the customer to check and evaluate accuracy before use. Clause 7.4 goes further and bars the customer from using the AI to make automated decisions that may have a detrimental impact on individual rights without appropriate human supervision. The review surfaces are the workflow engine's own: mandated approval paths and thresholds, an audit trail across the lifecycle, and the vendor's claim that agents explain every decision they make, giving transparency and auditability. R37 rule 2 identifies what is missing. The same estate markets agents as a digital workforce that reads, reasons and acts, autonomously handling contract management and compliance validation, and those claims sit against a human-decides rule with no published boundary between them. No threshold, confidence level or class of work is published at which an agent proceeds or stops, and no mode structure is described. Verified 12 September 2026.

Real deployment evidence with substance, short of the attribution and method the A band requires, which is the B band. Scale is published as a figure rather than a gesture: more than 60,000 legal, procurement, finance and sales professionals use the platform, across what the company describes as hundreds of brands. One testimonial does the work that most in this corpus do not, joining a named organisation to a named role and a concrete before-and-after: the Director of Contracts at Soar Technology describes a question that used to take three days being answered in five minutes. That is a named customer, an identified seat and a figure in a single artifact, which is more than the B band's own description of the common failure, being a named customer without figures or figures without the named customer. Three things keep it from A. It is one instance, so the evidence is an example rather than a body. Nothing is dated, so a reader cannot tell when the deployment happened or over what period the improvement was observed. And no method accompanies the figure, so the three-days-to-five-minutes comparison cannot be assessed: nothing states what the question was, what the old process involved, or whether the comparison is like for like. The named accuracy figures on the product page are measurements of the model rather than of a deployment and are graded on the citation accuracy row instead of being counted twice here. Verified 13 September 2026.

Real deployment evidence with substance, held at B on the method limb, and it sits at the top of the band. One account is named, figured and specific: CompSource Mutual Insurance, where the vendor reports a 95 per cent reduction in executive review time per contract, 636 hours saved annually described as the equivalent of 17 weeks of capacity, executives reviewing ten-line AI summaries instead of thirteen-page contracts, and the elimination of back-and-forth between legal, finance and procurement. That is attribution and measurement together, published in a dated January 2026 article. A second carries a figure and a named individual: Krupa Patel, Global Head of Procurement at Funding Circle, on terminating contracts worth $1.3 million. Three further named individuals with titles are quoted without figures, the Legal Operations Manager at BlaBlaCar, a Paralegal at Hakkasan Group and an Associate Corporate Counsel at Cricut, and a customer-story library is published. What holds it off A is the fourth limb: no method or basis is stated for any figure, so a reader cannot assess how 95 per cent or 636 hours was computed. Headline claims elsewhere are unattributed and should be read as marketing, including average vendor cost reduction of $1.3 million in year one, 75 per cent shorter cycle times and 400 hours saved per audit. Verified 12 September 2026.

Substantive published commitments on access and data handling, short of the full picture and silent on privilege, which is the B band. What is published is unusually detailed for a vendor with no published customer agreement, and it is operational rather than promotional. The security page describes role-based and feature-based permissions set by the customer's own administrator, a designated System Owner from the customer organisation who invites users and grants access in-application, mandatory email validation of every user, policy-driven passwords with complexity configurable by the customer, and single sign-on via SAML 2.0 against named identity providers. Personnel controls are described in more specificity than anywhere else in this lane, covering background screening and routine privacy, security and regulatory training. Data deletion and archiving is customer-set, with application and service-level controls supporting the customer's own policies and restore restricted to users holding the right role. The privacy policy is materially better drafted than several comparators because it covers privacy practices in connection with the services as well as the websites, so the platform is not carved out. Three limbs fail. Privilege and work product are not addressed anywhere located. No position is published on what any AI model provider may see or retain, because no provider is identified at all. And the substantive contractual commitments sit in an agreement that is not published, the website terms expressly carving out a separately executed customer agreement, so a buyer cannot read the confidentiality terms before entering a sales conversation. Verified 13 September 2026.

Four of the five A limbs are met on published instruments and the fifth is absent, and R33 makes the absent one decisive. Training use is the strongest limb and it is contractual: AI Terms clause 5 states that Input is not used to train or fine-tune any underlying machine learning model, whether proprietary or third-party, and that Gatekeeper prohibits AI Providers from retaining, accessing or using Input or Output to train their models; clause 12 repeats it and adds that no Content is retained by AI Providers beyond the session and no model training, fine-tuning or dataset enhancement is performed. Segregation is documented in the DPA's security schedule, customer data being stored in a way that logically separates it from other customer data, with a unique per-customer encryption key generated using a FIPS 140-2 compliant library and a master key released only through multi-level executive authorisation. Retention and deletion are stated: deletion or return at the customer's choice, all copies removed within 60 days of termination and from backups within a year. The third-party model provider position is explicit, the AI Providers being named sub-processors barred from retention and training. The limb that fails is privilege and work product, which is addressed nowhere. On a platform whose own legal-teams page invites counsel to hold their contracts in it, that silence is the whole distance to A. Verified 12 September 2026.

Nothing published on the advice line was located for a product that produces legal work and is sold to people who are not lawyers, which is the D band including its own parenthetical. The parenthetical fits directly. The stated audience is legal, procurement, finance and sales, and the platform carries solution pages by department, role, process and company size, so non-lawyers are an intended and named user group rather than an incidental one. What the AI produces for them is legal work on any ordinary description: Contract Logix Review delivers first-pass redlines against the organisation's standards inside Word or Google Docs, and the Intelligence Engine detects which key terms and clauses are present in an executed contract. Nothing published states whether that output is legal advice, whether a lawyer should review a redline before it reaches a counterparty, what a procurement or finance user may rely on it for, or who inside the customer is accountable when the extraction of a governing law or indemnity clause is wrong. The grade is recorded knowing the vendor addresses legal buyers seriously, which is why it is worth saying that this is not an audience-ambiguity problem. There is a dedicated Legal Department page naming General Counsel, Paralegal and Compliance Officer with a role page each, and a published Corporate Counsel's Guide to contract lifecycle management. The audience is clearly identified; it is the professional line through the middle of it that is unaddressed. No competence or supervision statement and no jurisdiction limit for the AI were located. Verified 13 September 2026.

A real published position on advice versus tooling, short of full treatment, and with an omission worth naming. The position is contractual: AI Terms clause 6.5 states that Output is a suggestion and does not replace the need for a human being to decide on its suitability, clause 6.6 puts checking and evaluating accuracy on the customer, and clause 6.6 adds an obligation this corpus has not seen before, that prior to publication or distribution of any Output the customer must add a disclosure notice that it was generated by AI tools. Clause 7.1 bars using the AI to mislead anyone that Output is human-generated. Clause 7.4 requires appropriate human supervision for automated decisions affecting individual rights. The omission is the interesting part and is recorded rather than inferred: clause 7 restricts the customer from using the AI to offer tailored financial advice without a qualified person reviewing it, and from providing health advice, and names no equivalent restriction for legal advice, on a platform sold to legal teams for clause review and redlining. No statement that Gatekeeper is not a law firm was located anywhere. What is also missing for A is the supervision and competence dimension, any statement of who may operate which agent, and any jurisdictional limit. Verified 12 September 2026.

Nothing published on AI governance was located, which is the D band. The page inventory was taken from the navigation and footer under R20 and covers the platform pages, the Contract Intelligence Engine, Review, Organize, security and data privacy, hosting on Azure, integrations, the solution pages by industry, department, role, process and company size, the company pages, the news section and the blog. No responsible AI page, AI policy, AI principles statement, acceptable use position or AI governance section exists anywhere in it. No framework is named, whether NIST, ISO 42001 or any other. No accountable owner for model behaviour is identified. No testing regime is described and no evaluation result is disclosed beyond the headline accuracy figures, which measure output quality rather than governance and are graded on the citation accuracy row. Bias is not addressed in any form. The absence is established rather than untested: the vendor publishes a detailed security page, a substantive privacy policy and a product page carrying a quantified accuracy claim, so this is an estate that documents itself carefully and has not extended that habit to how the models are governed. It is worth naming what that means for a buyer on this particular product. The Intelligence Engine's extractions populate the obligation and renewal tracking the platform is bought for, and Review's redlines are applied against the organisation's own standard positions, so uneven model behaviour across contract types, counterparties or languages would propagate silently into the record and nothing published would let a buyer test for it. Verified 13 September 2026.

Governance is expressed as contractual constraint rather than as a programme, with no mechanism, testing regime or accountable owner published, which is C. The substance that keeps it off D is real and unusually detailed for a terms document: the AI Terms define AI Functionality, bind the AI Providers as sub-processors subject to change notification, prohibit training on Input, and set out thirteen acceptable-use restrictions covering misleading users about machine authorship, unsupervised automated decisions affecting individual rights, activities with high risk of economic harm, unqualified financial advice, health advice, political campaigning and lobbying, and attempts to reverse engineer or replicate the models. That is a published position on what the AI may be used for. None of what the higher bands ask for is present. No responsible AI or AI governance page exists, no framework is named and no certification against one such as ISO 42001 is claimed, nobody inside the vendor is identified as accountable for AI, nothing is published about what is evaluated before an agent ships or how an agent's behaviour is tested, and nothing addresses uneven output across contract types, counterparty drafting or jurisdictions. An Executive Guide to AI Risk Management is published as a marketing download and concerns managing AI as a third-party risk in the reader's own supply chain rather than governance of this vendor's own AI. Verified 12 September 2026.

Substantive published policy covering most of the ground, short of the full set on subprocessors and incident practice, which is the B band and both of the gaps it names. Deletion and archiving are addressed with an approach that is genuinely customer-led rather than vendor-stated: application and service-level controls support the customer's own deletion and archiving policies, the customer sets its own requirements for how data should be deleted and archived, and restore is restricted to users holding the appropriate role. Access control is the strongest limb, with role-based and feature-based permissions administered by the customer, a designated System Owner, email validation of every user, configurable password policy and SAML 2.0 single sign-on against Azure Active Directory, ADFS, DUO, Okta and Ping. Personnel security is described in unusual detail, covering background screening and routine privacy, security and regulatory training including HIPAA. Hosting on Microsoft Azure has its own page. Two limbs are missing and they are the two the band anticipates. No subprocessor list exists: the privacy policy refers to service providers and states they may be located outside the United States, without naming one, so a buyer cannot establish who touches its contracts. And no incident practice is published, with no breach notification commitment, no notification window and no description of what a customer would be told or when. Nothing states a retention period for prompts or extraction outputs as distinct from stored contracts. Verified 13 September 2026.

Retention, deletion, access control, subprocessors and incident practice are all published, current and specific enough to hold the vendor to, which is the A band, and all five rest on the ungated Data Processing Agreement rather than on a marketing page. Retention is bounded in three layers: AI Content is processed transiently and not retained by AI Providers beyond the session under the AI Terms; personal data is retained for the duration of the agreement; and a published data classification scheme drives a retention policy under which deleted records are permanently evicted from active databases. Deletion is specific: delete or return at the customer's choice, all copies removed from systems within 60 days of termination and from backups within one year, with export and permanent erase tools built into the product. Access control is documented in detail: least privilege and need-to-know roles, two-factor VPN for production access, unique per-customer encryption keys from a FIPS 140-2 compliant library with master-key release requiring multiple levels of executive authorisation, AES-256 at rest, TLS in transit, SIEM logging and alerting, and STIG-based configuration management. Subprocessors are named individually with purpose and location in Exhibits C, with 30 days' notice of change, ten business days to object and a right to terminate. Incident practice is contractual: notification without undue delay and in any event within 72 hours of discovering a personal data breach. Verified 12 September 2026.

No published position on liability for AI output was located, which is the D band, and the cause is a choice rather than a retrieval limit. The footer Terms and Conditions are website terms on their face: they govern use of the Site and apply to visitors, users and others who access the Site. Their entire-agreement clause expressly carves out any current mutually executed written agreement between the customer and Contract Logix, which establishes two things at once. A customer agreement exists, so the silence is not because the vendor has nothing; and it is not published, so a buyer cannot read the allocation of risk before entering a sales process. That distinction matters for how this D is read: this is not a vendor that failed to draft the terms, it is one that declines to publish them. Consequently nothing is established on any limb the axis tests. No warranty of any kind attaches to the extraction output, notwithstanding that the vendor publishes an approximately 95 per cent accuracy figure and therefore acknowledges a material error rate. No liability cap is stated. No indemnity in either direction is published. No service level, no uptime commitment and no insurance position were located. Nothing addresses who bears the loss when a mis-extracted renewal date or liability cap propagates into the obligation tracking the platform is bought to run. What the website terms do settle is jurisdiction: Massachusetts law, non-exclusive. R85 does not apply, because nothing was blocked. Verified 13 September 2026.

Liability for what the AI produces is addressed only by disclaiming it, and here the disclaimer is more complete than most, which is C. AI Terms clause 9 excludes all warranties in relation to AI Functionality and states that no warranty is given for the accuracy, availability, suitability or reliability of Content. Clause 6.4 states that Gatekeeper has no liability or responsibility resulting from the use of or reliance upon any Output, or for any errors or omissions in it. Clause 10.1 extends that to any damages arising in connection with use of, or inability to use, the AI Functionality, regardless of the form of action and expressly including negligence. Clause 11 runs the indemnity the other way, the customer defending Gatekeeper and the AI Providers against third-party claims relating to Content. Two provisions run in the buyer's favour and are recorded rather than credited, because neither answers what happens when the output is wrong: the DPA makes Gatekeeper liable for breaches caused by its sub-processors to the same extent as if it performed their services directly, and the vendor publishes an insurance position, worldwide cover at an A rated standard including cyber cover extended to IT forensics, legal advice, notification costs and credit monitoring. That is breach cover, not output cover. The Master Subscription Agreement's general cap was not read and is named as unestablished on this row. Verified 12 September 2026.

Real integrations exist and named connections are documented, short of the depth the A band describes, which is the B band. The strongest evidence is that one of the two AI capabilities runs inside the applications the work already happens in: Contract Logix Review delivers its first-pass redlines inside Microsoft Word or Google Docs, so a negotiator does not leave the drafting surface to use it. That is integration into a system legal work lives in rather than a connector list. Identity integration is documented with named counterparties rather than described generically, single sign-on running over SAML 2.0 against Azure Active Directory, ADFS, DUO, Okta and Ping, which is enough detail for an implementer to know whether their estate is covered. A dedicated Integrations page exists in the platform navigation and hosting on Microsoft Azure has its own page. What the A band asks for and was not established is depth: what each connection moves, in which direction, and what a customer must configure. No practice management, document management, matter management or e-signature system is named as supported on the surfaces read, and no ERP or procurement suite is named, which matters because procurement and finance are two of the four stated buyer groups and those buyers would be integrating with systems of record. The Integrations page itself was not opened; under R25 it corroborates a grade that stands on the Word and Google Docs hosting and the named identity providers, and it is what would move this row. Verified 13 September 2026.

Real integrations, named and documented, short of the depth an implementer could work from, which is B. The named connections are substantial. Gatekeeper is a NetSuite SuiteApp, described as the only Built for NetSuite application for contract and third-party management and as NetSuite Partner of the Year 2024, and the marketplace listing describes sales teams working entirely within Salesforce while legal works in Gatekeeper. Identity integration is specific: SAML 2.0 and OAuth 2.0, Google and Microsoft 365 single sign-on, official partnerships with Okta and OneLogin, and SCIM 2.0 user provisioning on higher plans. A RESTful API into any Gatekeeper data point is published as a plan feature, an integration product called Gatekeeper Interconnect is offered as no-code, Workato appears as an integration sub-processor in the DPA, and a Model Context Protocol connector is listed as a plan feature for connecting LuminIQ to the customer's own tools. Two things hold it off A. What actually syncs, in which direction, and what a customer must configure is described only for the NetSuite path, at the level of vendor, contract and spend data. And the count of supported third-party solutions is inconsistent across the estate, given as over 220 on the platform page and over 4,000 on another, which is recorded rather than resolved. Verified 12 September 2026.

Cloud delivery is named without either the tenancy model or the region, which under R38 is the C band because tenancy and region are co-equal limbs and neither is published. What is published is the hosting arrangement: Microsoft Azure-based cloud products, with a dedicated page for it, and the security page describes Azure-supported infrastructure controls. Under ground rules section 3 and R16 that is the infrastructure provider's arrangement rather than a residency commitment, and it is recorded as such rather than credited as one. Naming the hyperscaler tells a buyer whose data centres are involved and nothing about where its own contracts sit. Region is unaddressed. No data centre location, country or region is stated anywhere located, no regional election is offered to customers, and no data residency page exists. The one statement bearing on location runs the other way and is recorded because a buyer with cross-border obligations needs it: the privacy policy states that the company's service providers may be located outside the United States, without naming them or the countries involved. Tenancy is equally unaddressed. Nothing states whether a customer's contract repository sits in a shared or isolated environment, no separation model is described, and no single-tenant, private cloud or on-premises option is offered or refused. Nothing states where the extraction models run relative to where documents are stored. The absences are established rather than untested, the estate carrying a dedicated hosting page and a detailed security page that address neither. Verified 13 September 2026.

Deployment options and residency are published to a level no other record in this lane reaches, which carries the A band. Four hosting regions are named individually and the customer chooses: the DPA's infrastructure sub-processor table lists Amazon Web Services for data hosting in the USA, Ireland, Australia and Canada, and the enterprise page states that a customer may select any region to support its data sovereignty requirements. A second deployment option is published alongside the shared cloud, a Gatekeeper private cloud for bespoke requirements. Where processing happens is stated as distinct from where data is stored, and stated per processor rather than in the abstract: the group companies that provide support and development are listed individually with their locations, Jersey, the United Kingdom, the United States and Canada, each with its transfer mechanism, EU adequacy for the first two and Standard Contractual Clauses with encryption for the others, and the AI providers carry their own locations, Amazon Bedrock across the same four regions and Anthropic in the United States only. Resilience detail is published too: data stored in triplicate across two data centres with two separate cross connections and stateless applications recreatable in other regions. The one soft limb, recorded rather than hidden: what the private cloud changes relative to the standard tiers is not described. Verified 12 September 2026.

No independent security attestation was located, which is the D band. No SOC 1, SOC 2, ISO 27001 or equivalent certification is claimed anywhere on the estate, no penetration test summary or third-party assessment is referenced, and there is no trust centre, compliance page or security portal. What exists in place of attestation is a self-description: a detailed security page setting out the vendor's own controls, covering permissions, single sign-on, password policy, employee background screening, training including HIPAA, customer-set deletion and archiving, and Azure-based hosting. Those are the vendor's statements about itself and the axis asks for something a third party has checked. One certification claim exists and is expressly not credited, on the standard pull 7 set for this record. The privacy policy claims certification under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. DPF, names BBB National Programs as the independent recourse mechanism, and acknowledges FTC investigatory jurisdiction. Two things follow. First, the DPF is a self-certification programme administered by the Department of Commerce rather than an independent audit, so even verified it would not answer what this axis asks. Second, it could not be verified: dataprivacyframework.gov is a client-side search application and no participant record was reached, on this pass or in pull 7. Under R85 and rule 6.6 that is a retrieval limit recorded as such, it is not evidence the certification is absent, and nothing adverse is inferred from it. It is simply not credited unverified. Verified 13 September 2026.

Certification is real and stated, short of accessible evidence, which is B. The standards are named and the estate is broad: ISO 27001, ISO 9001, SOC 2 Type II completed and announced in January 2026, and SOC 1 Type 2. One commitment is stronger than a badge and is contractual, appearing in both the Terms of Service and the DPA's security schedule: Gatekeeper shall maintain its ISO 27001 certification, or an equivalent, throughout the term of the agreement, and will not use third-party data centres that do not hold equivalent certification. The DPA sets out the audit regime, an external audit performed at least annually to ISO 27001 standards by independent third-party security professionals at Gatekeeper's expense, alongside a statement elsewhere that all global hosting locations are independently audited quarterly by two security specialist firms. What holds it off A is access to the evidence. The resulting Report is designated Gatekeeper's confidential information and is provided only on written request, no more than once in any twelve months, and subject to the confidentiality terms; no auditor is named, no report period or certificate number is published, and no scope statement accompanies any standard. A Security Center exists at trust.gatekeeperhq.com and is Vanta-hosted; it returned page metadata with no body to this index's fetcher on 12 September 2026, which is a limit on the reader under R20 and not a finding about the vendor. Verified 12 September 2026.

Nothing published about the model supply chain a customer inherits was located, which is the D band. The product pages describe what the AI does in real detail, covering 92 pre-built extraction fields, extraction prompts, Custom Data Objects, portfolio reprocessing and an accuracy figure with a human-validation delta, and say nothing whatever about what performs the work. No model is named, no version is given, no provider is identified, no distinction is drawn between proprietary and third-party models, and no architecture is described beyond the branding of the Intelligence Engine and AIDE. Nothing states whether Review's redlining and the Engine's extraction run on the same models. Recorded and expressly not credited under ground rules section 3 and R16, because it is the obvious candidate for a misread: Microsoft Azure is named as the hosting platform and has its own page, and single sign-on runs against Azure Active Directory among others. Naming the cloud a system runs on is infrastructure disclosure, not model disclosure, and it does not tell a buyer whether an Azure-hosted service, an Azure OpenAI deployment, a third-party API or an in-house model reads its contracts. Nothing addresses what any provider may retain of a document sent for extraction, and no commitment to notify customers of a change is published. The absence is established rather than untested: the vendor publishes a subprocessor-shaped statement in its privacy policy referring to service providers who may sit outside the United States, and names none of them. Verified 13 September 2026.

The supply chain is partly disclosed and stops one limb short of A, which is B under R34. Providers are identified by name in an ungated contractual document rather than referenced in the abstract: the Data Processing Agreement's sub-processor table names Amazon Bedrock as an AI Provider operating in the USA, Ireland, Australia and Canada, and Anthropic, PBC, described as providing AI language model services powering internal workflow automation, in the United States. Where they run is therefore stated per provider. Change notification is contractual and specific: 30 days' prior notice by email of any change to the sub-processor list, a ten business day window to object, and a right to terminate the affected services if no alternative can be provided. The AI Terms bind the providers further, permitting them to use Input only to create Output and prohibiting retention or training. The limb that fails is the first. No model is named anywhere, and Amazon Bedrock is a hosting service for models rather than a model, so a reader learns the route customer text travels without learning what generates the answer. Two cross-reference defects are recorded rather than resolved: the AI Terms define AI Providers as those set out in clause 3, and clause 3 does not set them out but points to the sub-processor list; and the DPA's Exhibit A refers to a sub-processor list published in Exhibit D, while the document's tables appear at Exhibit C. Verified 12 September 2026.

No pricing information is published at any level, including the unit of charge, which is the D band. The page inventory taken from the navigation and footer under R20 carries platform pages, product pages, solution pages by industry, department, role, process and company size, company pages, news and a blog, and a demo request route. There is no pricing page. No rate, band, per-seat figure, minimum commitment, term length or implementation charge appears anywhere on the estate, and the website Terms and Conditions govern use of the site rather than any subscription, with the commercial terms sitting in the separately executed customer agreement that is not published. So a buyer cannot establish even the shape of the commercial model from first-party material: not whether the platform is charged per user, per contract, per seat tier or by volume, and not what implementation adds. Under R10's closing discipline no structure means no row, and a page that only invites a sales conversation is an absence belonging in this note alone, so no VendorPricing row is written for this record. Recorded because it bears on how the D is read and because R41 excludes it from the grade: third-party aggregator listings describe a subscription model varying by user count, contract volume and feature tier, name Submitter, Read-Only and Full-User subscription levels, and state that implementation is charged separately. None of that is first-party, none of it is credited, and one such listing gives the starting price simply as contact vendor, which corroborates that nothing is published rather than that anything was missed. Verified 13 September 2026.

Pricing is gated behind a demo while tier names and feature splits are published, so the shape is visible and the number is not, which is the C band in its exact terms. What is published is more than most gated pages carry. Three tiers are named, Pro, Enterprise and Enterprise Plus, and the unit of charge is stated plainly rather than implied: the quota is the number of third parties managed, banded at up to 250, up to 750 and more than 750, with archived third parties excluded from the count. A feature matrix of roughly twenty rows sets out what differs, and several entries are notable for being unlimited on every tier, including users, live and archived contracts, eSignature licences and senders, and Gatekeeper Agents. Where the tiers diverge is published too: two best-practice AI-enabled workflows on the lower tiers against more above, one custom workflow rising to two and then more, and API access, Model Context Protocol connectivity, SCIM provisioning, remote backup and granular sensitive-data controls positioned as higher-tier capabilities. One item carries its own unit, MarketIQ Full being marked usage based. No figure, band, term, minimum or implementation cost appears anywhere, and the only route to a number is a demonstration request. Commercial terms were not read: the Master Subscription Agreement was not opened. Verified 12 September 2026.

Segment coverage is described with real substance and the boundaries are left open, which is the B band. The legal buyer is addressed on a dedicated page rather than inferred from a list, which is what settled 5.4 on route A for this record: a Legal Department page opening on the people who run Legal's contracts every day, with three legal seats named and given a page each, being General Counsel, framed around governing the contract portfolio with visibility, control and standard positions, Paralegal, and Compliance Officer, supported by a published Corporate Counsel's Guide to contract lifecycle management. Beyond legal, coverage is organised along four axes at once, with solution pages by industry, by department, by role, by process and by company size. Named industries include healthcare, manufacturing, pharmaceutical, and oil, gas and energy, which is a coherent regulated-and-heavy-industry cluster rather than a scatter. Scale is published at more than 60,000 professionals across hundreds of brands. What is left open is the boundary in both directions. No contract type or agreement family is named as well or poorly handled by the extraction models, and the 92 standard fields are counted without being enumerated or scoped, so a buyer cannot tell whether its own agreement types are covered. No language coverage is stated. No customer size floor or ceiling is given despite company size being a published navigation axis. And the record should be read knowing legal is one of four stated buyer groups alongside procurement, finance and sales, which is a real difference from the specialist tools in this lane. Verified 13 September 2026.

Segment coverage is described with substance and the boundaries are left open, which is B. The buyer groups are named consistently and legal is one of three, addressed on a page of its own at /legal-teams that speaks to counsel directly about clause deviations, missed approvals, policy enforcement and being brought in too late to prevent risk, alongside procurement and finance, with the CFO named as a fourth audience on the AI page. That page answers the seed's concern that this is a procurement product with legal attached. Coverage is also described by task rather than only by audience, through six published use-case pages spanning contract creation and execution, renewals and amendments, vendor onboarding, vendor performance, third-party compliance monitoring and vendor consolidation, each with its own claimed outcome. Named users support the spread across functions, from a Legal Operations Manager and a Paralegal to a Global Head of Procurement. What is left open holds it off A. No practice area within a legal department is identified as supported or unsupported, no industry pages were located, nothing states what the product is not for, and no jurisdictional coverage statement appears despite four hosting regions and group companies on three continents. Verified 12 September 2026.