Contractbook vs Oneflow: how they compare in 2026
Contractbook is a fit for a company that wants to organize signed agreements, verify imported metadata and keep HubSpot connected to contract information. Oneflow gives more emphasis to the editable agreement before signature, with Salesforce CPQ data, collaborative changes and workspace playbook review. Both can extract contract details, but the work surrounding extraction differs. Contractbook links imported values to their origin for verification; Oneflow combines editable metadata with separate clause findings and portfolio risk views. In that division between repository organization and live negotiation, AI Legal Index identifies the main product choice. Contractbook's training position uses consent, whereas Oneflow has an express contractual ban with a separate generative AI confidentiality exception. A buyer prioritizing legal review before signature will have different reasons to choose Oneflow than a buyer consolidating signed agreements around HubSpot.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AI Import reads existing contracts, extracts structured fields and helps turn a collection of files into a usable agreement database. The Contract Assistant adds plain language questions, summaries, risk identification and clause revisions. Both operate inside a wider application with template drafting, collaboration, electronic signatures and ongoing contract management. Templates and configured workflows still handle repeat agreements independently of the assistant. Customers can combine the extracted dates and obligations with reminders, while CRM data populates new agreements. Essential includes the assistant; higher plans add broader data extraction, custom fields, automation and team administration around these AI functions.
AI supports several substantial contract tasks within Oneflow's wider platform. Write with AI drafts, edits and translates text inside an agreement; AI Extract imports participants, dates and duration into editable metadata. AI Review compares terms with a workspace playbook, and AI Insights aggregates the resulting risks across the portfolio. The premium package adds custom rules, dashboard widgets and a report for negotiation follow up. Electronic signatures, editable HTML agreements, permissions, approvals and renewal reminders continue to work without these models. Customers can disable AI, and several review capabilities remain in beta. AI therefore changes how users analyze contracts without replacing the underlying contract system.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
AI Import connects extracted data to the text it came from. Selecting a purple field in the sidebar moves the reader to its exact location in the original agreement and highlights the passage. Users can inspect individual values or verify all fields together, and the repository marks completed verification. Import first processes the uploaded files and extracts their contract data, with OCR included for relevant files. This is source based verification of customer agreements, rather than a legal citator. No test set, measured accuracy result or explicit unsupported answer behavior accompanies the Contract Assistant's broader clause recommendations.
Review findings connect to highlighted passages in the agreement, with controls for moving between them. Each finding carries the relevant playbook concept, configured feedback and example clause text. A separate view identifies required clauses that the review did not find, while portfolio charts open the corresponding contract list. This lets the reviewer compare a proposed concern with the actual wording and the organization's rule. Oneflow warns that generated text can misstate facts, numbers and law and recommends human correction. No reproducible accuracy study, error rate or jurisdiction specific evaluation accompanies these features. The contract highlighting supports source verification, not validation of legal authority.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
An AI import can be canceled during upload, OCR or extraction, and the canceled file is discarded. After processing, a reviewer checks the proposed data against highlighted source text and marks the fields verified. That verification can become the trigger for a reminder or a move into a shared space. Users need the relevant company permissions to import files and manage custom contract types. Template workflows also support approval steps before signing. These controls give teams review and cancellation surfaces, but the assistant has no stated confidence cutoff or defined escalation path for an answer that cannot be supported.
Administrators enable AI Review for a workspace and configure its playbook, including which clauses matter, which findings count as risks or issues, and what feedback appears. Role permissions separately control access to individual reviews and the Insights dashboard. Sent contracts receive continuing analysis; draft contracts require a manual review action. A person can inspect highlighted text, edit the playbook and use example wording when revising an agreement. The AI appendix advises human review before relying on output. No confidence cutoff, mandatory lawyer approval after an AI finding, or correction route for an already approved mistake is specified. Risk colors classify findings rather than stop execution.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Bizzkit's compliance officer describes saving 15 to 20 hours extracting data from about 50 legacy data processing agreements. That is a named example of AI extraction in use, with the time estimate supplied by the customer. Lenus separately describes reducing contract preparation from 15 minutes to five through templates and integrations with Salesforce, Greenhouse and HiBob. Those automation results are not presented as a measurement of the newer Contract Assistant. GANNI and Pave also discuss repository and extraction benefits. No dated comparative study isolates the assistant's effects on review quality or legal outcomes.
Puzzel's Sales Operations Manager, Anette Johnsen, describes generating offers and contracts from Salesforce opportunities with items from related CPQ quotes. She identifies a concrete benefit of the HTML format: participants revise one agreement instead of uploading successive files before signature. Other named users include Systembolaget's Head of Indirect Sourcing, Tor Myhrman, and Hedin Bil's HR Business Partner, Elin Skoglund, who describe handling agreements and maintaining oversight. These accounts establish operational use across sales, procurement and HR. They do not isolate AI review performance or supply a measured error reduction, evaluation period and sample for Oneflow's current AI packages.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Section 9.12 of the service terms bars AI model training on retained platform data unless the customer gives consent in writing or through the application. Confidential information is limited to service delivery and remains protected after termination. AI imports start in the user's private contract view, while sharing depends on the application's space permissions. Google Cloud hosts platform data and Azure hosts the language model, both with EU locations in the processor list. Privilege and work product handling are not addressed directly, and the terms do not specify what the model provider retains from individual prompts or responses.
The AI appendix expressly prohibits Oneflow from training any AI model on customer data and takes precedence over conflicting general terms for AI features. Ordinary service confidentiality continues while information remains confidential, with restrictions on compelled disclosure. There is a consequential exception: the generative AI section excludes Oneflow's contractual confidentiality obligations along with liability, indemnities and service levels. Review, Insights and Extract have a separate processing section tied to the DPA. Workspace permissions and optional provider controls support access management, but attorney client privilege and work product receive no specific undertaking. The contract therefore requires attention to the exact AI functionality being enabled.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The service is restricted to business activity and is not offered to consumers. Section 8 describes the supplied templates as drafting inspiration rather than legal advice, and the company profile makes the same tooling distinction for the product. Legal teams can control templates, approvals and shared spaces while other employees generate routine agreements. The customer remains responsible for using suitable agreements and deciding whether electronic signatures are appropriate. No jurisdiction specific competence guidance or named professional supervision standard accompanies the assistant. Its explanation and rewriting features therefore sit inside the customer's own legal review and contracting responsibilities.
Oneflow's AI appendix says output is not legal advice, legal conclusions, recommendations about legal rights or an application of law to a customer's circumstances. It advises human review because generated content can misstate law as well as facts. A separate UK article maps solicitor responsibilities to SRA standards, confidentiality, client communication and supervision, and describes practical review and pilot controls. North American terms also prohibit treating the platform as a substitute for an attorney. The product nevertheless serves sales, HR and other users without legal qualifications. No comprehensive jurisdiction by jurisdiction set of product restrictions or lawyer competence program is supplied.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Contractbook's trust center describes security policies, change management and an incident response program. Management reviews that security program at least annually, and production data is restricted in development and testing environments. The AI features separately support source highlights, user verification and consent for model training. None of these materials sets out an AI release evaluation process, a responsible AI framework or results showing uneven performance across contract types or user groups. The page titled AI Policy Page is a company and product profile for automated readers, rather than a policy assigning accountability for the behavior of the language model.
Oneflow promotes human accountability and warns against automation bias in its guidance for UK legal teams. It recommends evaluating missed issues, overrides and review quality rather than relying only on speed, and says its AI performs best in English and Swedish. These are useful limits and principles for customers designing a pilot. The public material does not identify an accountable AI governance owner, publish a model release evaluation, or report bias and performance differences across languages, contract types or populations. General ISO security controls and a list of security policies concern operational protection; they do not describe a separate AI testing and governance program.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Customers can remove or archive their own data through the application and request removal at termination. Signature verification information has separate retention rules and generally requires all signers' consent before deletion. The privacy policy gives a general service data retention period with legal exceptions, while the processor list identifies providers, roles and locations. Space permissions, encrypted storage, logging and a trust center incident plan add operational controls. Confidentiality breaches require prompt notice under the terms. A specific retention window for assistant prompts and outputs, together with a deletion schedule at the model host, is not stated.
Contract data is encrypted with AES 256 at rest and TLS 1.2 in transit. Customers configure permissions and retention policies; administrators can disable optional providers or AI features. Global DPA terms require breach notification without undue delay, while the North American DPA specifies 48 hours. Daily database snapshots last seven days, and system and authentication logs last 90 days. The DPA permits limited residual backups after deletion without fixing that period. Generative AI history can follow provider terms, while the product page promises removal of temporary review and import data. That leaves no single, specific retention schedule for every prompt and output.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The service agreement limits liability to fees paid in the 12 months before the first claim arose. It excludes lost profit, business opportunity, third party liabilities, data loss and several other categories of loss, and supplies the service as is. Death or personal injury caused by negligence, fraud and fraudulent misrepresentation are outside the stated limitations. The customer, rather than the vendor, gives the agreement's indemnity. Contractbook promises customary insurance without naming its amount or scope. These provisions do not provide a specific warranty or recovery route for a mistaken AI clause explanation, extraction or revision.
Ordinary global service terms include an intellectual property defense obligation, a material performance warranty and a general cap based on 12 months of fees. Those protections do not carry through unchanged to AI. The appendix supplies AI output as is, disclaims warranties and excludes all liability and indemnification undertakings for generative AI functionality, together with confidentiality obligations and agreed service levels. It also permits specified AI suspensions or termination without reimbursing fees. North American terms contain the same generative AI exclusion. A wrong clause, inaccurate summary or reliance on generated advice has no specific affirmative AI remedy in these published terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The HubSpot integration moves deal and company data into contract templates and can synchronize negotiated values back after signing. Setup requires defined template fields, the appropriate Contractbook template or company permissions, and specified HubSpot CRM, product library and marketplace rights. The administrator connects the accounts through Integrations and accepts the requested permissions, then configures triggers and actions. HubSpot quotes can become attachments, and its widget displays contract status and activity. Disconnecting unpublishes related automations without deleting generated files. Salesforce, API access, Zapier and Make extend other workflows, with availability and charges varying by plan.
The Salesforce integration creates interactive contracts from opportunities and transfers contact, company and opportunity data into them. Its configurable sync sends data from Salesforce objects into Oneflow and returns contract values to Salesforce. Product tables can reflect price books or CPQ quotes, while workflows map contract stages back to pipeline stages. Engagement events and status changes appear in the Salesforce timeline, and returned contract data supports dashboards. Oneflow identifies separate setup guidance for older and newer integration versions and compatibility with Professional edition upward. HubSpot, Dynamics 365 and other CRM connections complement this workflow; Salesforce and Dynamics can require premium integration charges.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Contractbook runs as an online contract workspace with organization accounts, shared spaces and individual access rights. The subprocessor list places Google Cloud platform hosting and Azure language model hosting in the EU. It also identifies United States services for email, messaging, monitoring, traffic management and integrations, so the EU hosting entries do not describe every supporting data flow. The privacy policy permits transfers outside the EU and EEA with safeguards. No country selection, customer hosted installation or private tenancy option is specified, and the available material does not allocate storage and processing locations separately for each subscription plan.
Production infrastructure uses AWS availability zones in Ireland, with document replication and backups in Sweden. Oneflow's AI FAQ broadly describes data as remaining in the EU, and Insights Premium is described as running within Oneflow's own EU infrastructure. The published subprocessor table gives a more varied picture: optional Legly review operates in Germany, optional OpenAI extraction in the United States, and Postmark email processing also in the United States. Administrators can disable optional services. The public descriptions do not fully reconcile these routes or map every AI function to a processing region. No on premises deployment is offered in the published package descriptions.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The security page states SOC 2 compliance and describes recurring penetration tests, encrypted credentials, verified accounts and two factor signing. A Secureframe trust center offers a SOC 2 report through a request control and lists security policies covering access, change management, risk and incident response. Its public material does not identify the assessment period, report type, auditor or detailed system scope. The separate Openli profile could not be accessed, so any material there remains unknown. Customer signatures and identity controls support contract execution, while the SOC 2 claim addresses service controls rather than measured accuracy of the AI assistant.
A public certificate issued by Qvalify covers Oneflow AB's digital solution for contract automation under ISO 9001:2015, ISO 14001:2015 and ISO 27001:2022. It was issued on June 28, 2024 and remains valid through June 30, 2027, identifying the Stockholm organization and its registration number. A June 2026 statement of applicability lists the security controls and their implementation status. The security center separately identifies SOC 1 Type 1 and SOC 2 Type 1 reports issued by Grant Thornton, available under NDA. Those reports concern control design; neither is identified as a Type II examination of operating effectiveness over a stated period.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Microsoft Azure hosts the large language model used for the product's AI functions, with the processor list assigning that service an EU location. Google Cloud is separately responsible for storage and platform hosting. The application combines document import, OCR, field extraction and a conversational contract assistant, but the specific model name and version are not identified. The terms require customer consent before retained platform data is used for model training. A general notice rule for contractual updates does not provide a specific commitment to notify customers about model replacements or changes to the inference supply chain.
The subprocessor list identifies Legly AB for contract review in Germany and OpenAI for extraction in the United States, alongside AWS infrastructure in Ireland and Sweden. Both AI suppliers are optional and controlled through account settings. The AI appendix directs customers to their Data Management page for the current generative model suppliers and their terms. It does not publish model versions or a complete function to model map. DPA provisions require reasonable advance notice of subprocessor changes to the customer's designated email address and allow a 14 day objection. That process concerns suppliers, without promising notice of every underlying model change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Essential, Centralize and Accelerate include one, five and ten users, with annual signed contract allowances of 100, 350 and 500. Template limits are five, 15 and 25. The current pricing page shows no base subscription amount; a company profile updated in March 2026 gives a starting rate of €89 per month. The pricing FAQ lists five extra users at €50 per month, or €600 annually. Automation and provisioning are optional for Centralize and included in Accelerate, while several integrations cost extra. Custom setup uses a quote, and the terms provide for upgrades or additional charges when usage limits are exceeded.
Business starts at $292 a month, billed annually, including five users; Enterprise has ten users and a custom quote. Business includes writing, extraction and summary features. Standard AI Review and Insights have conflicting public treatment: the pricing page marks paid beta additions, while September help guidance says they are included in Enterprise during beta. Insights Premium is explicitly a paid addition for Business and Enterprise. SMS, identity verification, premium integrations and enhanced support can cost more. A 14 day trial needs no card. Implementation has no published amount, and global annual renewals can increase by the greater of 5 percent or Swedish CPI.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Small and midsize sales, legal, HR and operations teams use the platform for standard recurring agreements such as NDAs, sales contracts and employment agreements. The Lenus case describes legal counsel setting templates and boundaries for colleagues across several markets. Bizzkit uses extraction for legacy data processing agreements, while GANNI and Pave describe contract visibility and renewal work. The company focuses on European markets and also offers industry pages for government, healthcare, construction and procurement. Its own profile excludes legal advice and simple one off signing as its intended role, without supplying a jurisdiction by jurisdiction support matrix.
Legal, procurement, sales, finance and HR teams can create and manage agreements in Oneflow. Legal users configure review rules and approve terms; business teams use reusable templates and CRM data for offers, sales agreements and employment documents. Named customers span telecoms, retail, recruitment and public sector purchasing. UK guidance also addresses solicitors using AI for commercial contract review, bringing professional duties into the intended audience. AI is optimized for English and Swedish, with variable results in other languages. The product does not supply a jurisdiction specific research corpus, and its coverage statements do not define supported litigation work or every category of legal agreement.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 9.12 prohibits use of retained platform data for AI model training unless the customer consents in writing or through the platform. Section 9.1 separately refers to anonymized development data where consent has been given. The general service processing license covers delivery, maintenance, fixes, security and legal obligations. It does not override the express training consent requirement, and no default training permission is stated for a new customer.
The AI appendix forbids Oneflow from using customer data to train any AI models and overrides conflicting general terms for AI issues. Inputs and attributable outputs fall within the customer data definition. The general service license permits improvement and anonymized analysis, and AI feedback may improve accuracy, but those clauses do not remove the express training ban. The product FAQ also says underlying models do not train on customer data.
Separate provider processing, retained history and the generative AI confidentiality exclusion remain relevant to handling client material.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Customers may remove or archive their data at any time through the platform under section 9.4, and may request removal of their own data when the agreement ends. Signature verification information follows a separate rule requiring signer consent. The privacy policy supplies a broader service data retention period with legal exceptions. No explicit zero retention setting or separate fixed period for assistant prompts and answers is specified.
Oneflow permits customers to set retention policies for stored contracts, and its AI page says temporary import, review and Insights data is removed after use. Generative AI has a different contractual provision: input questions and output responses may remain as history under the model supplier's current terms. No uniform period covers that history or every provider copy. Daily database snapshots last seven days, system logs last 90 days, and residual backups after termination have no precise DPA deadline. Contract deletion therefore cannot be treated as an immediate purge of all AI processing records.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
AI imports are private in the importing user's contract view until shared directly or moved to a shared space. Space access separates viewing, contract management and space management, while external collaborators receive view rights only. Company user groups can also receive access, with direct permissions surviving removal from a group. This is Contractbook's own access model, without an identified connection that inherits a firm's document system ethical walls.
Workspace roles control access to contracts, and Oneflow provides distinct permissions for AI Review and the Insights dashboard. Administrators enable review for selected workspaces and can disable AI features or optional suppliers. These controls can support departmental separation and limit who sees review results. The descriptions do not specify how retrieval enforces every contract permission within a workspace, how restrictions propagate to generated summaries, or how a law firm's matter wall follows an AI request. Permission controls alone do not establish a complete ethical wall mechanism for confidential client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 9.8 requires written notice before legally compelled disclosure whenever possible. The confidentiality clauses also permit information to be supplied to other signers of an agreement completed through the platform. The privacy policy covers legal obligations and requests from authorities. No transparency report accompanies these commitments. The separate Disclosure Policy concerns security vulnerability reporting and does not describe the handling of subpoenas or other demands for customer contracts.
Global confidentiality terms require reasonable prior notice when disclosure is legally compelled, unless notice is prohibited, and reasonable assistance at the customer's expense in seeking protection. That gives the customer an opportunity to contest or narrow a request involving ordinary confidential service data. The AI appendix expressly removes contractual confidentiality obligations for generative AI functionality, so the same protection should not be assumed across every AI route.
No transparency report accompanies the commitment. North American and global agreements need to be matched to the contracting entity and enabled services.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
AI Import processes the customer's legacy agreements and points extracted fields back to text in those files. The contract assistant also works with the selected agreement, while customers can create templates or use the vendor's template library. No licensed case law or statute collection is identified for those functions. The supplied templates are drafting material, and the agreement expressly distinguishes them from legal advice for the customer's situation.
Oneflow's review and portfolio analysis work with the customer's agreements and configured playbook concepts. Example clauses come from the organization's rule setup, and drafting can use selected text as input. No catalog of legislation, reported decisions or licensed legal commentary is supplied for these features. Naming a model provider does not identify the legal sources in its training data or their licensing terms.
The UK educational articles link professional guidance, but those links do not constitute a legal research corpus inside the product.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The platform's verification feature checks extracted information against the source contract, with highlighted passages and a completed verification marker. It does not track judicial treatment of cases or statutory amendments. The assistant can explain and rewrite clauses, but no connection to a legal citator or warning that an authority has been overturned is specified. Renewal reminders and signature status concern the agreement's lifecycle, rather than the legal status of an authority.
Highlighted review passages let a user inspect contract language, not whether a judicial decision remains authoritative. Oneflow has no published citator connection, treatment history service or automated check of legislation's current status. Teams maintain their own playbooks, including preferred and fallback clauses, so changing a rule after a legal development remains an organizational responsibility. The appendix warns that AI can generate incorrect law and recommends human review. A portfolio risk chart or missing clause flag does not establish that the underlying legal proposition remains valid.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Reviewers can inspect AI extracted fields beside highlighted source passages and verify them individually or together. They can also cancel an import during processing, which discards the file. These controls let a person check the extraction, but no explicit unsupported answer response or confidence indicator is described for the conversational assistant. The option to stop an upload is a user action, not a model refusal when information is insufficient.
The AI Review interface separates findings from a missing clauses view. That view identifies playbook concepts absent from the agreement, giving the reviewer an explicit negative result instead of merely omitting a match. Red and yellow labels distinguish issues from risks; they are not numerical confidence estimates. Oneflow warns that generated facts and law can be wrong, but does not publish a general abstention rule for drafting or summaries. Missing clause handling is described for review, without promising that every unsupported question will be refused.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order or disciplinary record concerning fabricated legal citations from Contractbook appears in the AI Hallucination Cases database. The product extracts data from customer agreements and offers questions, summaries and clause revisions within its contract workspace. That database result does not measure extraction or drafting accuracy. Its source highlights support a user's review of contract data, without constituting a check of every legal assertion produced by the assistant.
Damien Charlotin's AI Hallucination Cases database contained no entry naming Oneflow as of October 16, 2026. The result covers the database's reported court incidents, not every private use of the product or every inaccurate contract response. Oneflow itself discusses court examples involving generic AI tools in educational material; those examples do not identify Oneflow as the tool involved. Contract drafting and risk analysis can still produce incorrect law, which the AI appendix expressly warns about. The absence of a named incident provides no accuracy guarantee.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
The service terms limit the platform to business users and explain that the template library does not provide legal advice. Legal departments can control templates, permissions and review steps for other employees. No named bar opinion, jurisdiction specific competence requirement or product mapping to professional ethics guidance accompanies these controls. The statement that the service is a business tool does not specify how a lawyer should record supervision of its AI functions.
Oneflow's UK contract review guidance maps SRA standards and conduct duties to human supervision, confidentiality, client transparency and practical controls. It also discusses insurance, data protection and the legal team's responsibility for final judgment. This is a jurisdiction specific mapping with suggested review steps, rather than a generic statement that lawyers remain responsible. It is vendor guidance, not regulator approval or an independent finding of compliance. The mapping does not establish equivalent coverage for every jurisdiction in which Oneflow sells its platform.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The stated buyers are business teams managing their own sales, employment, supplier and compliance agreements. Named legal customers include internal counsel at Lenus, GANNI and Pave, and the product describes savings in their contract administration. Bizzkit reports less manual extraction work on legacy agreements. No law firm client billing workflow is identified in the current buyer materials, and those savings relate to the organization's own time and contracting costs.
The vendor's UK AI review material addresses solicitors as well as internal legal departments and promotes faster review with retained professional judgment. Its product pages also describe reducing routine contract work and administrative effort. No accompanying procedure explains how a firm records AI time, adjusts a client invoice, discloses savings or passes through Oneflow charges. Subscription pricing is the buyer's software cost rather than a client billing policy.
Because the audience includes lawyers serving clients, the time savings claims cannot be treated solely as an organization's internal operating expense.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The processor register names Google Cloud for platform hosting and Azure for the language model, both in the EU, alongside supporting providers and their locations. Customer terms set a training consent requirement and confidentiality duties. The data processing agreement is generated through a workflow that requests customer details and acceptance of terms. No separate client consent pack or exact model version inventory accompanies the public processor register.
Oneflow supplies a public DPA, global and North American service terms, an AI appendix and a subprocessor table with functions and processing locations. Optional AI suppliers include Legly and OpenAI, and administrators can control optional services. A public ISO certificate and statement of applicability support security diligence; SOC reports require an NDA. These materials help counsel explain data handling to a client.
They do not form a dedicated client AI disclosure package, and the generative AI confidentiality exclusion and conflicting regional descriptions require specific attention in any outside counsel approval process.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Imported agreements retain extracted fields, highlighted source passages and a verification state that users can inspect in the contract view. The application also tracks versions, collaboration and signature activity. These elements provide part of the record of a user's review, without a specified export connecting each AI response to its model version and a named human verifier. No court specific certification form or complete AI disclosure bundle is described.
AI Insights supports an export of portfolio analysis, and reviewers can inspect the contract passages associated with a playbook finding. Insights Premium adds an action report for internal discussion and negotiation. Enterprise also includes an account audit log, while signing workflows maintain transaction records. The published export instructions do not establish a complete record of model identity, prompt, output and human edits for each AI action.
These are useful contract administration records, but no court disclosure template or complete model provenance export is described for a later filing.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
Which one fits
Choose Contractbook if
- Your project begins with consolidating signed contracts and their metadata.
- HubSpot is the central system for commercial contract information.
- Users need to verify imported values against the source agreement.
Choose Oneflow if
- The contract must remain jointly editable before signing.
- Salesforce CPQ tables and pipeline stages are important to the workflow.
- Legal users want workspace playbooks and a missing clauses view.
In summary
Contractbook
Contractbook organizes agreements and extracted metadata, with linked source verification and HubSpot synchronization. The Copenhagen business became part of Scrive in 2025 and continues to offer its contract workspace.
Oneflow
Oneflow keeps the agreement editable through negotiation and connects it to CRM records. Playbook review highlights departures and missing language, with aggregated risk analysis across enabled workspaces.
Questions buyers ask
Which platform is more directly connected to the negotiation document?
Oneflow's web agreement remains editable during the shared process before signature. Contractbook also supports contract work, but its extraction and repository workflow is particularly relevant when bringing existing agreements under management. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
How can users verify imported contract values?
Contractbook's AI Import provides linked source context for verification. Oneflow's extraction creates editable metadata, and its separate AI Review interface highlights the clauses behind review findings. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Does Scrive's ownership make Contractbook the same product as Oneflow?
No. Contractbook joined Scrive in 2025, while Oneflow remains a separate Stockholm company with its own agreement platform and terms. Ownership does not establish identical AI handling or CRM behavior. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Which distinction matters for a HubSpot centered team?
For a company organizing signed agreements around HubSpot, AI Legal Index highlights Contractbook's metadata and synchronization workflow. Oneflow's comparative strength lies in the editable agreement, Salesforce detail and workspace review before and after signature.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Contractbook's Scrive ownership does not replace its published product and data handling terms.