Contract Logix vs Gatekeeper: how they compare in 2026

The Contract Intelligence Engine works after signature: AI Contract Analysis detects which key terms and clauses a contract contains, and AI Data Extraction (AIDE) pulls chosen terms into the platform as data, with 92 standard fields, custom fields driven by extraction prompts, line item detail through Custom Data Objects, and reprocessing of a whole portfolio against a new setup without reloading documents. Contract Logix Review works before signature, giving first pass redlines against the company's own standards in Word or Google Docs. Underneath is a full contract lifecycle platform, sold before the AI existed and working without it: intake, authoring, negotiation workflow, repository, permissions and tracking of obligations, renewals and milestones.

The models drive a core capability on a product that works without them. Gatekeeper sold vendor and contract lifecycle software well before LuminIQ, which the vendor calls an intelligence layer added in March 2025, starting with an agent for workflow approvals. Underneath is a complete platform: repository, authoring, the Kanban workflow engine with set approval paths, electronic signature, vendor and employee portals, spend, risk register and scorecards. The pricing page lists Gatekeeper Agents and the AI Suite as features within plans whose quota counts third party records, not AI use. The vendor now leads with agentic AI, claims more than fifty agents, and calls them a digital workforce that reads, reasons and acts. Without them, the platform still runs the lifecycle.

AIDE is stated to reach about 95 percent or better on standard extraction fields, rising to about 99 percent with human validation, so the system is wrong on roughly one field in twenty unaided. No test set, document count, field types or languages are described, no failure modes are named, and no independent validation is published. The product extracts from the customer's own contracts and cites no outside authority.

Accuracy is addressed only by disclaimer, and grounding is claimed without a described method. The product cites no legal authority, so citation questions do not apply. The agents work on the customer's own contracts and vendor records, summarizing agreements, matching clauses against approved language and extracting obligations, and the vendor says agents explain every decision they make. Nothing says what an explanation contains, what is retrieved, or how a proposed clause traces back to the source text. No figure, test set, error rate or benchmark was found. AI Terms clause 6.3 says neither Gatekeeper nor any AI Provider warrants the accuracy, availability, suitability, reliability or content of Output, clause 9 excludes all warranties on the AI, and clause 6.6 requires the customer to check Output and not rely on Gatekeeper to do it.

The accuracy claim, about 95 percent or better unaided rising to about 99 percent with human validation, puts a figure on what skipping review costs. Review's output is described as first pass redlines, for a person to finish. No threshold at which the system defers or escalates, confidence signal on an individual extraction or list of fields or clauses it will not attempt is published, and nothing covers what happens after an extraction is found wrong beyond reprocessing a portfolio.

The agreement commits that people make the decisions, with real review tools, but sets no threshold for when agents act alone. AI Terms clause 6.5 says Output is a suggestion and does not replace a person deciding its suitability before it is published, used or relied on. Clause 6.6 requires the customer to check its accuracy, and clause 7.4 bars automated decisions that may harm individual rights without appropriate human supervision. Review comes through the workflow engine's set approval paths and thresholds, an audit trail across the lifecycle, and the claim that agents explain every decision. The same vendor markets agents as a digital workforce that reads, reasons and acts, handling contract management and compliance checks autonomously, with no stated line between that and the rule that people decide. No threshold, confidence level, type of work or operating mode is published.

More than 60,000 legal, procurement, finance and sales professionals use the platform across hundreds of brands. The Director of Contracts at Soar Technology says a question that took three days now takes five minutes. It is a single example, undated, and nothing explains what the question was or how the old process worked.

Real deployment evidence is published, without methods. CompSource Mutual Insurance is named with figures in a January 2026 article: a 95 percent cut in executive review time per contract, 636 hours saved a year, described as 17 weeks of capacity, executives reading ten line AI summaries instead of thirteen page contracts, and less back and forth between legal, finance and procurement. Krupa Patel, Global Head of Procurement at Funding Circle, describes terminating contracts worth $1.3 million. A Legal Operations Manager at BlaBlaCar, a Paralegal at Hakkasan Group and an Associate Corporate Counsel at Cricut are quoted without figures, and a customer story library is published. No method is given for any figure. Unattributed headline claims elsewhere, an average $1.3 million vendor cost reduction in year one, 75 percent shorter cycle times and 400 hours saved per audit, read as marketing.

The security page describes role and feature based permissions set by the customer, a customer System Owner who invites users, email validation, configurable passwords and SAML 2.0 single sign on. Staff undergo background screening and regular privacy and security training. Deletion and archiving follow the customer's policies, with restore limited by role. The privacy policy covers the services as well as the websites. Privilege and work product are not addressed, no AI model provider is identified, and the confidentiality terms sit in an unpublished customer agreement.

Four of five elements are met in published documents, and privilege is missing. Training use is contractual: AI Terms clause 5 says Input is not used to train or fine tune any model, proprietary or third party, and that AI Providers may not keep, access or use Input or Output for training; clause 12 repeats it and adds that no Content is kept by AI Providers beyond the session. The DPA's security schedule logically separates each customer's data, with a unique per customer encryption key from a FIPS 140-2 compliant library and a master key released only with several levels of executive approval. Data is deleted or returned at the customer's choice, removed within 60 days of termination and from backups within a year. The AI Providers are named subprocessors barred from retention and training. Privilege and work product are not addressed anywhere, on a platform whose legal teams page invites counsel to keep their contracts in it.

The audience includes procurement, finance and sales, with pages by department, role and process, and Review produces first pass redlines while the Intelligence Engine identifies terms and clauses in signed contracts. Nothing says whether that output is legal advice, whether a lawyer should review a redline before it goes to a counterparty, what a procurement or finance user may rely on, or who is accountable when a governing law or indemnity clause is misread. The vendor addresses lawyers directly, with a Legal Department page and pages for General Counsel, Paralegal and Compliance Officer. No supervision statement or jurisdiction limit is published.

The agreement takes a position on advice versus tooling, with one notable gap. AI Terms clause 6.5 says Output is a suggestion and does not replace a person deciding its suitability, and clause 6.6 puts checking accuracy on the customer and requires a notice that Output was generated by AI tools before it is published or distributed. Clause 7.1 bars using the AI to pass Output off as human work, and clause 7.4 requires human supervision of automated decisions affecting individual rights. Clause 7 restricts tailored financial advice without a qualified reviewer and bars health advice, but names no equivalent restriction for legal advice, on a platform sold to legal teams for clause review and redlining. No statement that Gatekeeper is not a law firm was found. Nothing addresses supervision and competence, who may operate which agent, or any jurisdictional limit.

The navigation and footer, covering platform, product, security, privacy, hosting, integration, solution, company, news and blog pages, contain no responsible AI page, AI policy, principles, acceptable use position or governance section. No framework such as NIST or ISO 42001, accountable owner, testing regime or evaluation result beyond the headline accuracy figures is published, and bias is not addressed. Extractions feed the obligation and renewal tracking the platform is bought for, so uneven model behavior across contract types or languages would flow into the record.

Governance takes the form of contract terms, with no program, testing regime or accountable owner. The AI Terms define AI Functionality, bind the AI Providers as subprocessors subject to change notice, prohibit training on Input, and set thirteen use restrictions, covering misleading users about machine authorship, unsupervised automated decisions affecting individual rights, activities with high risk of economic harm, unqualified financial advice, health advice, political campaigning and lobbying, and attempts to copy the models. There is no responsible AI page, no named framework or certification such as ISO 42001, no one accountable for AI, nothing on testing agents before release, and nothing on uneven output across contract types, counterparty drafting or jurisdictions. The Executive Guide to AI Risk Management is marketing about managing AI risk among the reader's own suppliers, not about this vendor's AI.

Deletion and archiving follow the customer's own policies, supported by application and service controls, and only users with the right role can restore data. Access control covers role and feature based permissions set by the customer, a designated System Owner, email validation of every user, configurable password policy, and SAML 2.0 single sign on with Azure Active Directory, ADFS, DUO, Okta and Ping. Staff undergo background screening and regular privacy, security and regulatory training, including HIPAA. Hosting on Microsoft Azure has its own page. No subprocessor list is published (the privacy policy mentions service providers that may be outside the United States without naming any), and no breach notice practice or retention period for prompts or extraction outputs is stated.

Retention, deletion, access control, subprocessors and incident practice are all published and specific, in the ungated Data Processing Agreement. Under the AI Terms, AI Content is processed transiently and not kept by AI Providers beyond the session; personal data is kept for the term of the agreement; and a data classification scheme drives a policy under which deleted records are permanently removed from active databases. On termination, data is deleted or returned at the customer's choice, removed from systems within 60 days and from backups within one year, with export and erase tools in the product. Access controls include least privilege and need to know roles, two factor VPN for production, unique per customer encryption keys from a FIPS 140-2 compliant library with master key release needing several levels of executive approval, AES-256 at rest, TLS in transit, SIEM logging and STIG based configuration. Subprocessors are named with purpose and location in Exhibit C, with 30 days' notice of change, ten business days to object and a right to terminate. Breaches are notified without undue delay and within 72 hours.

No position on liability for AI output is published, because the customer agreement is not published. The footer terms govern website use, and their entire agreement clause carves out any separately executed customer agreement. No warranty on extraction output, liability cap, indemnity, service level, uptime commitment or insurance position is published, against a stated 95 percent accuracy figure, and nothing says who bears the loss when a wrong renewal date or liability cap flows into obligation tracking. The website terms set Massachusetts law, non exclusive.

AI Terms clause 9 excludes all warranties on AI Functionality, including the accuracy, availability, suitability and reliability of Content. Clause 6.4 says Gatekeeper has no liability for use of or reliance on Output or for errors in it, and clause 10.1 extends that to any damages from using or being unable to use the AI, including negligence. Clause 11 makes the customer indemnify Gatekeeper and the AI Providers against third party claims relating to Content. Two provisions favor the buyer without covering wrong output: the DPA makes Gatekeeper liable for its subprocessors' breaches as if they were its own, and the vendor publishes worldwide insurance at an A rated standard, including cyber cover for IT forensics, legal advice, notification costs and credit monitoring. The general terms sit in a separate Master Subscription Agreement.

Review delivers its redlines inside Microsoft Word or Google Docs, so negotiators stay in the drafting tool. Single sign on runs over SAML 2.0 with Azure Active Directory, ADFS, DUO, Okta and Ping. An Integrations page exists, and Azure hosting has its own page. The product and platform pages do not describe what each connection moves, in which direction, or what setup it needs, and name no practice, document or matter management, e-signature, ERP or procurement system, though procurement and finance are buyer groups.

Real integrations are named, short of depth an implementer could use. Gatekeeper is a NetSuite SuiteApp, described as Built for NetSuite and as NetSuite Partner of the Year 2024, and the marketplace listing describes sales teams working in Salesforce while legal works in Gatekeeper. Identity support includes SAML 2.0, OAuth 2.0, Google and Microsoft 365 single sign on, Okta and OneLogin partnerships, and SCIM 2.0 provisioning on higher plans. A REST API is a plan feature, Gatekeeper Interconnect is offered as a no code integration product, Workato appears as an integration subprocessor in the DPA, and a Model Context Protocol connector links LuminIQ to the customer's tools. Only the NetSuite path describes what syncs and in which direction, at the level of vendor, contract and spend data. The count of supported third party solutions differs across the site, over 220 on one page and over 4,000 on another.

Microsoft Azure is the named host, with a dedicated page, and the security page describes Azure supported controls; that names whose data centers are used, not where a customer's contracts sit. No data center location, country, region or regional choice is stated. The privacy policy says service providers may be outside the United States, without naming them or the countries. Nothing states whether a customer's repository is shared or isolated, no single tenant, private cloud or on premises option is offered or refused, and nothing says where the extraction models run.

Deployment options and residency are published in detail. The DPA's infrastructure table lists Amazon Web Services hosting in the USA, Ireland, Australia and Canada, and the enterprise page says customers can choose any region for data sovereignty. A Gatekeeper private cloud is offered for bespoke needs. Processing is distinguished from storage per processor: the group companies providing support and development are listed with their locations, Jersey, the UK, the US and Canada, and their transfer mechanisms, EU adequacy for the first two and Standard Contractual Clauses with encryption for the others. AI providers have their own locations: Amazon Bedrock in the same four regions and Anthropic in the US only. Data is stored in triplicate across two data centers with separate cross connections, and stateless applications can be recreated in other regions. What the private cloud changes compared with the standard plans is not described.

No SOC 1, SOC 2, ISO 27001 or similar certification, penetration test summary, third party assessment or trust center is published. The security page describes the vendor's own controls, from permissions and single sign on to staff screening, HIPAA training, customer set deletion and Azure hosting. The privacy policy claims certification under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. framework, with BBB National Programs for recourse; that framework is self certification, not an audit.

Named standards are ISO 27001, ISO 9001, SOC 2 Type II, completed and announced in January 2026, and SOC 1 Type 2. Both the Terms of Service and the DPA's security schedule commit Gatekeeper to keep ISO 27001 or equivalent certification for the term and not to use third party data centers without equivalent certification. The DPA provides an annual external audit to ISO 27001 standards by independent security professionals at Gatekeeper's expense, and another statement says all hosting locations are audited quarterly by two security firms. The resulting report is confidential and provided only on written request, at most once a year, under confidentiality terms. Outside the Security Center at trust.gatekeeperhq.com, hosted on Vanta, no auditor, report period, certificate number or scope is published.

The product pages detail what the AI does, from 92 extraction fields to reprocessing and accuracy, and name no model, version or provider, no split between own and third party models, and nothing on whether Review and extraction share models. Microsoft Azure is named as host and Azure Active Directory for sign on, which does not say whether Azure OpenAI, another API or an in house model reads contracts. Nothing covers what a provider may keep of a document sent for extraction, and no change notice is promised.

Providers are named, and the models are not. The Data Processing Agreement's subprocessor table names Amazon Bedrock as an AI Provider in the USA, Ireland, Australia and Canada, and Anthropic, PBC as providing AI language model services for internal workflow automation in the United States. Changes require 30 days' notice by email, with ten business days to object and a right to terminate if no alternative exists. The AI Terms let providers use Input only to create Output and prohibit retention or training. No model is named, and Bedrock hosts models rather than being one, so a reader learns the route but not what generates the answer. Two cross references are faulty: the AI Terms say providers are set out in clause 3, which instead points to the subprocessor list, and DPA Exhibit A refers to a list in Exhibit D, while the tables are in Exhibit C.

No pricing is published at any level, including the unit of charge. There is no pricing page; the site offers a demo request. No rate, per seat figure, minimum, term or implementation charge appears, and the website terms do not cover subscriptions, which sit in the unpublished customer agreement. Third party listings describe pricing by user count, contract volume and feature tier, with Submitter, Read Only and Full User levels and separate implementation fees, and one listing gives the starting price as contact vendor; none of these is the vendor's own.

Three tiers are named, Pro, Enterprise and Enterprise Plus, and the unit of charge is stated: the number of third parties managed, up to 250, up to 750 and more than 750, with archived third parties not counted. A feature matrix of about twenty rows shows the differences. Users, live and archived contracts, eSignature licenses and senders, and Gatekeeper Agents are unlimited on every tier. Higher tiers add more prebuilt and custom AI workflows, API access, Model Context Protocol connections, SCIM provisioning, remote backup and sensitive data controls. MarketIQ Full is marked as usage based. The pricing page gives no figure, band, term, minimum or implementation cost, and the only route to a number is a demo request. Commercial terms also sit in a separate Master Subscription Agreement.

A Legal Department page names General Counsel, Paralegal and Compliance Officer, each with its own page, alongside a Corporate Counsel's Guide to contract lifecycle management. Solution pages cover industries (including healthcare, manufacturing, pharmaceutical and energy), departments, roles, processes and company sizes, and more than 60,000 professionals across hundreds of brands use it. No contract types are named as handled well or poorly, the 92 standard fields are counted but not listed, no languages are stated, and no company size range is given. Legal is one of four buyer groups, with procurement, finance and sales.

Segment coverage is described in detail, with boundaries left open. Legal is one of three named buyer groups, with its own page at /legal-teams addressing clause deviations, missed approvals, policy enforcement and counsel being brought in too late, alongside procurement and finance, with the CFO named as a fourth audience on the AI page. Six use case pages cover contract creation and execution, renewals and amendments, vendor onboarding, vendor performance, third party compliance monitoring and vendor consolidation. Named users range from a Legal Operations Manager and a Paralegal to a Global Head of Procurement. No practice area within a legal department is named as supported or unsupported, no industry pages were found, nothing says what the product is not for, and no jurisdictional coverage is stated despite four hosting regions and group companies on three continents.