ContractWorks vs SpotDraft: how they compare in 2026
ContractWorks and SpotDraft sit at different points in contract management. ContractWorks, sold by Onit, is a secure repository first: drag and drop upload, AI tagging of dates, parties and renewal terms, OCR search, alerts, reports and built in eSignature, with unlimited users on every plan and drafting, redlining and approvals on its Premium tier. SpotDraft is a full contract lifecycle platform for in house legal teams, with conditional approvals, negotiation in Word and Slack, AI review in Word, Sidebar agents and intake. The paperwork differs too. ContractWorks runs under Onit's published services agreement, data processing addendum and dated subprocessor list, which names OpenAI as the AI provider and lets customers object to new subprocessors. SpotDraft publishes residency by region, per contract encryption and named ethics guidance, alongside terms that cap its liability at one hundred rupees. Neither shows a plan price, and neither publishes an accuracy measure for its AI.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
ContractWorks is a secure contract repository with search, tagging, alerts, reports and eSignature, and on Premium, drafting, redlining and approval workflows. AI is a layer on that base. Smart Document Tagging adds tags such as effective date, renewal date and termination date on upload, Smart Contract Generation identifies agreement type, parties, effective dates, renewal terms and notice windows, search is described as AI powered, and Premium's feature list includes a GPT-3 AI Clause Creator. The repository, folders, custom tags, OCR search, highlights, date alerts, reporting and signatures all work without the models, and ContractWorks also sells a contract tagging service performed by its legal engineers and licensed attorneys. The product pages describe it as a secure, AI powered repository for teams that need simple, effective contract management.
SpotDraft is a full contract lifecycle system first: templates, conditional workflows and approvals, a shared editor, built in eSignature meeting ESIGN, eIDAS and ECA, a repository, reporting and analytics. Without SpotDraft AI, VerifAI, Intake and Sidebar, a working CLM with signature and workflow remains, with its own market. The AI covers review inside Word, automatic extraction of more than a thousand metadata types, and agents that track regulatory change. SpotDraft now calls itself context aware, AI native CLM, but the platform predates that framing.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
ContractWorks publishes no accuracy figure, error rate or evaluation for its AI tagging, extraction, search or clause creation. Snippet View lets a reviewer see tagged information in context across several agreements at once, which lets a person check a tag against the contract text, and drafting is marketed as producing compliant, error free contracts without any measure behind it. Section 12.3 of Onit's Subscription and Services Agreement, last revised 19 August 2026, says AI output is machine generated and may be incomplete, inaccurate, biased or unsuited to the customer's purpose, and makes the customer solely responsible for review and reliance. The GPT-3 clause creator names a model generation that OpenAI has since replaced, and nothing says whether the feature now runs on a newer model.
SpotDraft publishes nothing on accuracy or grounding. There is no accuracy figure, error or hallucination rate, benchmark, test set or evaluation on the home, pricing or security pages. Nothing describes how AI output is grounded in the customer's documents or whether a user can trace a statement back to its source. The figures SpotDraft publishes measure speed and cost: contracts reviewed 15 times faster with VerifAI, closings twice as fast, 65 percent lower cost and 70 percent less review time. The nearest thing to an accuracy claim is that the AI works in the customer's own context and follows its rules, which describes setup, not correctness.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Section 12.3 of Onit's services agreement makes the customer solely responsible for review of and reliance on AI output, including obtaining legal or other professional advice as appropriate, and says Onit is not liable for decisions taken on it. In the product, AI tags are added automatically on upload and can be reviewed in Snippet View, and Premium approval workflows route contracts under automated conditional flows. Administrators alone invite users and set each person's permissions, and an audit trail records every click. Nothing published says whether AI tags are applied without review, whether a person confirms an AI drafted clause before it enters a contract, or what happens when a tag or alert date is wrong. Section 12.8 says no service levels apply to AI features unless an order says so.
SpotDraft's approval routing is conditional, with thresholds shown, for example approvals going to the Head of Finance below a deal value and to the CFO and CEO above it. Audit logs trace changes at contract level by both the customer and the counterparty, every draft keeps its version history, and permissions are scoped by contract type, entity and department. Nothing describes control over the AI itself: what SpotDraft AI, VerifAI or the Sidebar agents do unattended, when a person must review model output, what agents can change without approval, or what happens when an output is wrong. Saying the AI follows the customer's rules implies limits without describing any.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
ContractWorks lists named case studies for Esquire Deposition Solutions, BNP Paribas, Walmart Canada, DNA Payments, Slack, Sandoz, Carlsberg, OLX Group, Louis Dreyfus Company and GreenShield Canada. Named testimonials quote Louis Belzil, General Counsel of Tier 1 Energy Solutions, Lynn Towler, Senior Contracts Manager at Shift4 Payments, Nicole Dunn, Contracts Administrator at the Chesapeake Bay Foundation, and Adrienne Foster, Contract Manager at Xeris Pharmaceuticals, who reports loading more than 1,200 contracts in the year to date. The workflow page claims 80 percent faster contract workflows, at least 100 hours saved, at least $9,000 in value and a two week rollout, with no customer or method behind the figures. The case study titles give no deployment dates, and the outcomes quoted concern ease of use, price and repository setup rather than the AI features.
SpotDraft names in house lawyers with roles and employers: Anna Claveria Brannan, Deputy General Counsel at IPSY; Susan Koenig, formerly Senior Legal Operations Manager at Abnormal Security; Micah Nessan, formerly General Counsel at Guideline; Reason Abajuo, VP of Legal and Corporate Affairs at Chaberton Energy; Lizzy Gagan, Senior Legal Counsel at Beamery; Arzu Hasanova, Legal Counsel at Circularise; Aditi Kapoor, Director of Legal at Gameskraft; and Natasha Wilson, Head of Legal at SUN Mobility. Every quote is qualitative. The quantified claims carry no customer at all: two times faster closings, 65 percent lower cost, 70 percent less review time, and contracts reviewed 15 times faster. Two of the referees are identified as former employees of the companies named.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Onit's Subscription and Services Agreement, last revised 19 August 2026, leaves the customer owning its data (5.1) and treats it as confidential, with reasonable advance notice before a compelled disclosure where law permits (8.5). Section 5.2 lets Onit use customer data, once aggregated and anonymized, for product improvement, analysis and benchmarking, section 12.1 lets it use deidentified usage data to improve its AI, and the same section bars third party model providers from training on input for others' benefit except in deidentified or aggregated form needed to run the service. Nothing states whether Onit trains its own models on customer contracts. The ContractWorks security page says ContractWorks never has backend access to customer data, and adds watermarks and view only access. Privilege and work product are not addressed.
SpotDraft's security page says customer data is logically separated within shared, multitenant infrastructure. Each contract has its own encryption key in HashiCorp Vault backed by Google Cloud KMS, with AES-256 at rest and FIPS 140 certified encryption. Data is classified as public, company confidential, customer confidential or personal, and access follows least privilege with unique IDs. Third party vendors handling scoped data must follow confidentiality, audit and incident response rules. Nothing published says whether customer contracts are used to train any model, by SpotDraft or a model provider, and no retention period for prompts or outputs is published. Privilege and work product are not addressed.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Section 4.14 of Onit's services agreement, headed No Legal Advice, states that Onit is not a law firm and does not offer legal advice, recommendations, opinions, representation, referrals or counseling, and takes no responsibility for the quality or compliance of documents the customer generates. Section 12.3 tells customers to obtain legal or other professional advice as appropriate when relying on AI output, and section 12.7 bars using the AI features for decisions with a material legal or similarly significant effect on an individual. ContractWorks is sold to HR, sales, finance and nonprofit teams as well as legal, and its contract tagging service is run by legal engineers and licensed attorneys. Nothing addresses how the product supports a lawyer's competence and supervision duties or any limit by jurisdiction.
SpotDraft's home page says its AI features are designed with attention to the California State Bar's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, November 2023. It also names the American Bar Association's Formal Opinion 512 on generative AI, July 2024. Both are named with their issuer and date, on the home page rather than in a policy. Nothing addresses a lawyer's own competence and supervision duties or any limit on use by jurisdiction. The claim is attention to principles, not a mapping of product behavior to specific duties, so which principle each control meets is not shown.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Neither ContractWorks nor Onit publishes an AI governance position: there is no responsible AI page, named owner for model behavior, release testing process or result, and no AI management certification. The AI terms in Onit's services agreement allocate risk rather than describe governance. Section 12.3 warns that output may be biased, section 12.4 lets Onit improve, replace or deprecate models or prompts without materially reducing core functionality, and section 12.7 restricts the customer's own uses. The SOC 2 Type 2 report covers security, availability and confidentiality of systems rather than model behavior, and nothing addresses whether tagging performs differently across contract types or languages.
SpotDraft's security page describes a formal risk governance policy approved by management that defines an Enterprise Risk Management program. Periodic operational risk assessments feed management reports, with each risk rated, assigned an owner and tracked to treatment or acceptance. Privacy risk is assessed through vendor due diligence, and an information security team led by the Chief Technology Officer oversees the process. None of it covers model behavior. Nothing describes testing before an AI release, there is no responsible AI framework, and nothing addresses bias or uneven output across contract types, counterparties or populations.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The ContractWorks security page describes TLS 1.2 with 256 bit encryption in transit, 256 bit AES at rest, salted and Bcrypt hashed passwords, hourly encrypted backups across data centers in the United States and the European Union, SAML single sign on, multifactor authentication by SMS or authenticator app, administrator controlled permissions, watermarks, view only access, and an audit trail of every click that can be exported or emailed daily. A security specification PDF is downloadable. Onit's subprocessor list, updated 17 August 2026, names the suppliers for the SecureDocs platform that runs ContractWorks, and customers can subscribe to change notices with 15 days to object under section 4.5 of the agreement. The pricing FAQ says records are deleted within 30 days after a customer leaves, and section 6.5 points to a retention policy that is not published. No breach notice period is stated.
SpotDraft's security page, last updated 17 October 2025, describes FIPS 140 certified encryption, AES-256 at rest, and a unique key per contract held in HashiCorp Vault backed by Google Cloud KMS. Primary and backup servers run on Google Cloud Platform in the Netherlands. Data is classified into four sensitivity tiers, and access follows least privilege, with unique IDs and enforced password rules. There is a documented business continuity and disaster recovery program, automated patching, ongoing tracking of known vulnerabilities in third party packages, regular threat modeling, independent penetration testers, and routine code analysis and vulnerability scans. A set incident response process is stated and refined through regular exercises. No subprocessor is named, though the page says fourth parties such as backup providers and subcontractors have no access to scoped systems or data, and no retention period for customer content is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Onit's Subscription and Services Agreement, last revised 19 August 2026, warrants that the subscription services operate substantially as documented and that material functionality will not decrease during the term (9.2). Onit defends and indemnifies the customer against claims that the services infringe intellectual property rights (11.1). Each party's liability is capped at fees paid or payable in the 12 months before the event (10.2), with listed claims, including indemnities, outside the cap (10.3). For AI, section 12.5 provides the AI features and output as is, with all warranties disclaimed, section 12.3 says Onit is not liable for decisions taken on output, and section 12.8 excludes AI features from service levels unless an order says otherwise. No insurance is published.
The SpotDraft Terms of Use on its Legal Hub at legal.spotdraft.com, version 2.3, last updated 21 February 2024, are published with five prior versions downloadable from the same page. Clause 8.3 caps SpotDraft's total liability, in contract or tort, at one hundred Indian rupees, roughly one US dollar. Clause 8.2 excludes consequential, indirect and special damages, including loss of data and profits. Clauses 5.2 and 5.3 disclaim fitness for purpose and error free or uninterrupted use, and expressly waive the warranty of noninfringement. Clause 9 is an indemnity from the customer to SpotDraft only, and the document contains no vendor indemnity. Clause 5.5 disclaims liability for consequences of using the Platform, and 5.4 says SpotDraft gives no legal advice. Indian law governs, with exclusive jurisdiction in the courts at Bangalore. The contracting entity is Draftspotting Technologies Private Limited, with affiliates including Draftspotting Inc. These are the Terms of Use reached from the signup path. Clause 11.8 contemplates added terms for other services, so an enterprise customer may sign a negotiated master agreement that is not published.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
ContractWorks lists integrations as features in its plan table: a Salesforce integration, Fujitsu ScanSnap scanning, uploading contracts by email, SAML 2.0 single sign on, and on Premium, integration with public registers and databases. The security page names Microsoft Active Directory, OneLogin and Okta as identity providers for single sign on. Premium drafting works in a Word compatible editor, and the AXDRAFT platform that runs Premium lists DocuSign as its signing API. No integration page describes what the Salesforce connection syncs, in which direction or what an administrator configures, no API is documented, and no document management system used by law firms is listed. Onit's subprocessor list names Workato as an integration platform across Onit products.
SpotDraft states more than 30 integrations and gives each its own page, with Salesforce, HubSpot, Slack, Microsoft Word for desktop, Google Drive, DocuSign, Greenhouse, Google Forms, Jira and Zapier all linked directly from the pricing page. VerifAI runs review inside Microsoft Word, negotiation and redlining are described as working in Word, Slack or SpotDraft itself, and one named customer credits the Word desktop editor with driving adoption. Single sign on covers Office 365, Google Workspace, Okta, Active Directory and custom SAML with zero touch provisioning. No document management integration such as iManage or NetDocuments appears, consistent with an in house rather than law firm product.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Onit's subprocessor list, updated 17 August 2026, says ContractWorks runs on the SecureDocs platform on Amazon Web Services, with the customer choosing hosting in the United States or Ireland and backups in Germany. ContractWorks Premium runs on the AXDRAFT platform, where AWS hosting can be in the European Union, Canada or the United States and Google Cloud in the EU is the primary infrastructure. OpenAI is listed for all Onit platforms, with its locations given as the United States and worldwide. The security page says data is stored in multiple data centers in the United States and the European Union. No tenancy model, private deployment or on premises option is described.
SpotDraft's customer data is logically separated within shared, multitenant infrastructure. Residency is a customer choice with a clear limit: personal data is stored in selected regions covering the US, EU, India and the Middle East, and is not sent outside them. Primary and backup servers are on Google Cloud Platform in the Netherlands, and Google Cloud Platform runs processing throughout. Encryption keys are held per contract in HashiCorp Vault backed by Google Cloud KMS, which shows where keys are held as well as where data rests. Which region applies by default, and whether contract content follows the same rule as personal data, are not stated; the regional commitment is written for personal data.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
ContractWorks states a SOC 2 Type 2 report from an independent auditor covering security, availability and confidentiality, and makes a security specification PDF available for download. The ISO 27001 certification and SOC 1, 2 and 3 reports named on the security page belong to the AWS data centers it uses, not to ContractWorks itself. No auditor, report period or route to request the SOC 2 report before signing is published, and no trust center is linked. Onit's data processing addendum lets customers rely on recent SSAE 18 reports in place of an on site audit.
Four compliance marks appear on SpotDraft's home, pricing and security pages: ISO, GDPR, HIPAA and AICPA SOC 2. SpotDraft's home page lists them as ISO 27001, SOC 2 Type II, GDPR and HIPAA. The footer on every page says SpotDraft is ISO/IEC 27001:2013 certified, but 27001:2013 was replaced by the 2022 revision, so the site claims a current certification while naming a retired version. A separate trust center at trustcenter.spotdraft.com is linked. No auditor, coverage period or report date for the SOC 2, or scope, is published outside the trust center. Independent penetration testers are said to be used, but none is named and no summary is published.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Onit's subprocessor list names OpenAI, in the United States and worldwide, as the AI provider used across all Onit platforms, and ContractWorks Premium's feature list names a GPT-3 AI Clause Creator. Onit's contract products listed separately use Anthropic and Google Gemini, but neither is listed for ContractWorks. Customers can subscribe to email notice of subprocessor changes and object within 15 days under section 4.5 of the services agreement, while section 12.4 lets Onit replace models or prompts without notice if core functionality is not materially reduced. Nothing says which ContractWorks features use OpenAI or which model version runs the tagging and search.
SpotDraft publishes nothing about the AI models a customer relies on. No model provider, model or version is named. The only description is that the AI is built into SpotDraft and works in the customer's own context. There is no subprocessor list and no commitment to notify customers of changes. The security page is otherwise detailed, naming HashiCorp Vault, Google Cloud KMS, JAMF, FileVault and BitLocker among its tools.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
ContractWorks publishes three plans with their limits but leaves the price fields blank. Standard includes unlimited users, 2,500 documents and five electronic signature licenses; Professional includes 10,000 documents and ten licenses; Premium adds drafting, redlining and workflows with unlimited documents. All are billed annually. Additional signature licenses cost $1,200 a year for a pack of five, a nonprofit discount is offered, and a 14 day trial converts to the Standard license. The pricing FAQ says template automation and onboarding are part of a paid implementation, while the workflow page says ContractWorks handles the rollout at no extra cost. The FAQ also uses older plan names, Essential, Standard and Enterprise, for the signature allowances. Orders are signed electronically and paid by card, ACH or wire.
SpotDraft's pricing page says plans are priced either by users or by contract volume, framed as avoiding wasted spend. It also covers implementation: in house implementation is always included, covering workflow and integration setup and migration of old contracts, with no extra fees and no outsourcing. Every customer gets a dedicated customer success manager and support around the clock at no extra cost. A six week implementation timeline is published, week by week. No number appears: no rate, floor or currency, and every call to action is Get Pricing or a demo request.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
ContractWorks has solution pages for HR, sales, healthcare, SaaS, construction and engineering, government, nonprofit and hospitality teams, and describes itself as built for teams that need simple, effective contract management, with unlimited users on every plan. Its case studies span retail, banking, payments, software, pharmaceuticals, consumer goods, commodities and legal services, and testimonials come from a general counsel, contracts managers and a contracts administrator. Premium is positioned for companies scaling to a full CLM. Clients outside the United States subscribe and pay in US dollars. Nothing published names contract types or languages the AI tagging does not handle, sets a size limit or addresses law firm use.
SpotDraft gives five buying teams dedicated pages: legal, sales, finance, HR and procurement, with legal as the owner and the others as self serve users. Five industries have their own pages: SaaS, HR tech, edtech, healthtech and fintech. Its home page names its audience as high performing in house legal teams. No law firm segment is addressed, nothing covers government or public sector use, and no contract types or matters are named as unsupported. Coverage is described by industry and internal function rather than by area of law.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Onit's Subscription and Services Agreement, last revised 19 August 2026, which governs ContractWorks, bars third party model providers from using input to train their models for the benefit of others, except in deidentified or aggregated form necessary to operate the service (12.1). The same section lets Onit use deidentified, aggregated usage data to operate and improve its AI services, and section 5.2 lets it use customer data, once aggregated and anonymized, for product improvement, analysis and benchmarking.
No opt out is described, and nothing states whether Onit trains its own models on customer contracts. The ContractWorks pages say nothing about training.
Nothing on SpotDraft's home, pricing or security pages, including the security page's data security, infrastructure security, product security and risk governance sections and its five question FAQ, addresses whether customer contracts, prompts or outputs are used to train any model, by SpotDraft or by an underlying model provider. The nearest statements are that the AI is embedded in SpotDraft, operates in a context specific to the customer and follows the customer's rules, and that the platform is risk free AI on the customer's terms, none of which is a commitment about training.
No model provider is named. The trust center was not available to read, so the silence is an absence on the published pages with a retrieval limit on the trust center.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 6.5 of Onit's services agreement gives the customer 30 days after termination to export its data and then deletes it under Onit's current retention policy, which is not published. The ContractWorks pricing FAQ says all records are deleted within 30 days once a departing customer confirms it is off the system, and customers can bulk download their documents at any time. The security page describes hourly encrypted backups across data centers in the United States and the European Union.
Section 12.2 says Onit has no duty to retain or recreate AI output unless the service expressly provides retention and it is enabled. No period is stated for AI tags, clause suggestions or search queries during the term, or for what OpenAI keeps.
No retention period for contracts, prompts or generated outputs is published on SpotDraft's home, pricing or security pages. Retention appears only as a heading within the security page's data handling practices, where data classification and retention are named together and the text describes classification into public, company confidential, customer confidential and personal tiers without stating how long anything is kept.
Secure data disposal is listed among the data center measures without a period attached. No retention setting the customer can configure is described.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
ContractWorks keeps its own permission model. Only administrators can invite users to the repository, and they choose permission settings for each person, with access controlled by folder and document, permission based user roles in every plan, view only access that disables printing, and personally identifiable watermarks. Sign in can run through SAML single sign on with Microsoft Active Directory, OneLogin or Okta, with multifactor authentication by SMS or authenticator app.
An audit trail records every click with user, date, time and action and can be emailed to administrators daily. The security page says ContractWorks never has backend access to customer data. Nothing published says how AI search and tagging apply folder permissions when they run, or how customers are separated from one another on the platform.
Separation is documented at two levels. Between customers, SpotDraft's security page states that customer data is logically separated within a secure multitenant infrastructure, and adds that each contract is protected with a unique encryption key held in HashiCorp Vault backed by Google Cloud KMS, a finer control than isolation at tenant level alone. Within a customer, roles and permissions are described as fully customizable and scoped by contract type, organizational entity and department, with permissions at contract level ensuring documents are visible only to authorized personnel without manual sharing.
How retrieval and the AI features apply those permissions at query time is not published, so whether a model answering a question respects the same boundaries is not stated. The buyer is an in house department, so separation at tenant and entity level is the relevant test.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 8.5 of Onit's Subscription and Services Agreement, last revised 19 August 2026, which covers ContractWorks customer data as confidential information, commits to reasonable advance notice of a disclosure required by law, where law permits, and reasonable cooperation, at the customer's expense, in seeking confidential treatment, and says the disclosed information stays confidential between the parties afterward.
Onit's data processing addendum commits to notify the customer promptly of government requests about its processing unless prohibited. The ContractWorks security page adds that ContractWorks never has backend access to customer data. No transparency report is published.
Nothing on SpotDraft's home, pricing or security pages addresses what happens if a third party, law enforcement agency or court requests customer data, and no commitment to notify the customer is published. No transparency report exists. The security page states that third party vendors handling scoped data are bound by confidentiality, audit and incident response protocols, and that fourth parties such as backup providers and subcontractors have no access to scoped systems or data, but neither addresses compelled disclosure.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
ContractWorks' AI reads the contracts a customer uploads to tag dates, parties and terms, builds an outline from section headings after OCR, and supports search across the repository. It does not retrieve case law or legislation. Nothing published identifies what the tagging models were trained on or what sources the GPT-3 clause creator draws on, and Onit's subprocessor list names OpenAI as the AI provider without describing its training data.
For customers who want tags applied by people, ContractWorks sells a contract tagging service run by its legal engineers and licensed attorneys.
The working corpus is the customer's own contract set and is identified as such: SpotDraft's repository is described as centralizing all of a customer's contracts and automatically pulling over a thousand types of contract metadata using AI, and the AI is described as operating in a context specific to the customer and following the customer's rules. No external legal corpus is claimed and the product does not retrieve primary law, so the usual jurisdiction and coverage questions do not arise. No training corpus for the models themselves is described, no source is named and no license or rights basis is given.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
ContractWorks stores and tags a customer's own contracts and does not cite case law or legislation, so a citator is not part of the product. Nothing on the ContractWorks pages or in Onit's agreement addresses checking authority for later history, and the Premium clause library is maintained by the customer with nothing describing how outdated language is flagged.
Nothing on SpotDraft's home, pricing or security pages addresses whether legal authority is checked for later history, and no citator, treatment signal or currency check is published. The platform manages a customer's own contracts rather than retrieving case law or legislation, so a citator is not part of what it sells. Sidebar is described as helping users stay ahead of regulatory change with AI agents, which concerns the currency of regulation rather than the standing of cited authority, and no source or verification method is published for it.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No path for declining to answer is documented, and no confidence score is shown for AI tags, search results or clause suggestions. Section 12.3 of Onit's services agreement says output may be incomplete, inaccurate or biased and leaves review to the customer, and section 12.4 lets Onit change models or prompts without notice. Snippet View shows tagged values in context across agreements so a person can check them. Nothing says what tagging does with a date it cannot find or a clause it cannot classify, which matters because tagged renewal and termination dates drive the date alerts.
No path for declining to answer is documented on SpotDraft's home, pricing or security pages, no confidence or grounding score is published, and nothing states what the product does when the customer's contract set or playbook does not cover the question put to it. Published material addresses configuration rather than uncertainty, describing AI that operates in the customer's context and follows the customer's rules.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming ContractWorks, SecureDocs or Onit. This is a statement about the public record rather than a finding about the product, and it covers fabricated content only. ContractWorks stores and tags contracts rather than producing court filings, so its output does not ordinarily reach a brief.
The AI Hallucination Cases database maintained by Damien Charlotin, which tracks decisions worldwide where a court addressed hallucinated AI content and records the tool implicated where known, together with 2026 sanctions trackers and trade press summaries, records no court order, opinion or disciplinary record naming SpotDraft. This is a statement about the public record rather than a clearance, bounded by what that database covers.
The product manages commercial contracts for in house teams rather than producing court filings, so its output does not ordinarily reach a brief.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 4.14 of Onit's services agreement states that Onit is not a law firm and does not offer legal advice, recommendations, opinions, representation, referrals or counseling, and section 12.3 tells customers to obtain legal or other professional advice as appropriate when relying on AI output. No bar opinion, ethics rule or professional conduct guidance is named on the ContractWorks pages or in Onit's agreements, and nothing connects the product to a lawyer's duties when using AI tags or clauses.
SpotDraft's home page names two ethics guidance documents from two jurisdictions. One is the California State Bar's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, dated November 2023. The other is the American Bar Association's Formal Opinion 512 on generative AI, dated July 2024. Both are given with issuer and date. SpotDraft says its AI features are designed with attention to the principles in each, for responsible and secure use across contracting workflows.
What is published is a statement of attention to principles, not a mapping of which duty each product control meets, and no other jurisdiction's guidance is addressed.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
ContractWorks is bought by organizations to manage their own contracts across legal, HR, sales, finance and nonprofit teams, and its named customers are companies and a nonprofit rather than law firms, so no client bill sits in the loop. Its savings claims are aimed at the buyer's own time, such as 80 percent faster contract workflows and at least 100 hours saved. Its contract tagging service, run by legal engineers and licensed attorneys, is a service sold to the customer. Nothing published addresses fee treatment of AI assisted work for a firm that bills a client.
SpotDraft's public materials are framed around speed and cost removed: two times faster closings, 65 percent lower cost, 70 percent less review time, and contracts reviewed 15 times faster with VerifAI. No record of AI assisted work for each matter intended for fee purposes, and no guidance on billing, fee or disclosure treatment, is published on the home, pricing or security pages. The contract level audit logging SpotDraft describes, which traces changes by both the creator and the counterparty and retains every version, could support such a record, but nothing presents it for that purpose.
The buyer is an in house department rather than a firm billing a client, so the question lands on internal cost, and it is not addressed.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Onit publishes a dated subprocessor list, updated 17 August 2026, with a table for the SecureDocs platform that runs ContractWorks and a table for the AXDRAFT platform that runs ContractWorks Premium, and names OpenAI as the AI provider across all platforms with its locations. Customers can subscribe to email change notices. The services agreement and data processing addendum are published, and the addendum lets customers rely on recent SSAE 18 reports in place of an on site audit.
ContractWorks offers a downloadable security specification PDF. A customer can forward these to its own clients without an agreement in place.
No subprocessor list is published and no model provider is named on SpotDraft's home, pricing or security pages, so which third parties see contract content is not stated. No consent or notification material for clients is published. Assurances about third parties stand in for identifying them: vendors handling scoped data are said to be bound by confidentiality, audit and incident response protocols, and fourth parties such as backup providers and subcontractors are stated to have no access to scoped systems or data.
A trust center is linked at trustcenter.spotdraft.com, and a request route for security documentation appears on the security page.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
ContractWorks records every click in an audit trail with user, date, time and action, which administrators can export to Excel or have emailed daily, and Premium keeps version control across redlines with third parties invited to collaborate without signing in. Nothing published says whether a tag or clause added by AI is marked as machine generated in that trail, or which model produced it, and section 12.2 of Onit's agreement says Onit has no duty to retain AI output unless the service provides retention and it is enabled.
No export or template for disclosing AI use is published. ContractWorks output is a contract repository and reports rather than court filings.
SpotDraft's security page says audit logging traces user actions at contract level. It captures signing and creation events and the trail of changes by both the creator and the counterparty, and every version of a contract is kept, which covers what changed, by whom and when. No model is named, so which system produced a passage cannot be established, and nothing in the log, as described, separates an AI change from a human one. No export built for a court disclosure or AI use certification is published.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Refusal and Uncertainty Behavior
Which one fits
Choose ContractWorks if
- You mainly need contracts stored, tagged and tracked. ContractWorks tags dates, parties and renewal terms on upload, sends date alerts and scheduled reports, and includes unlimited users with 2,500 documents on Standard and 10,000 on Professional. Snippet View shows tagged values in context across agreements so a person can check them.
- You want the agreements and subprocessors in writing before signing. Onit publishes its services agreement, data processing addendum and a subprocessor list updated 17 August 2026, with email notice of changes and 15 days to object. The agreement states that Onit is not a law firm and warrants that the service performs substantially as documented.
- You need tight access control on sensitive contracts. Only administrators invite users and set each person's permissions, view only access disables printing, watermarks identify the viewer, and an audit trail of every click can be emailed daily. ContractWorks says it has no backend access to customer data.
Choose SpotDraft if
- You need the full lifecycle in one place now. SpotDraft runs templates, approvals routed by deal value, negotiation in Word, Slack or the browser, eSignature, intake and Sidebar agents in one platform. Approvals can go to named roles, such as the Head of Finance below a deal value and the CFO and CEO above it.
- Your data has to stay in a region you choose. SpotDraft stores personal data in the customer's selected region across the US, the EU, India and the Middle East and gives each contract its own encryption key. Primary and backup servers run on Google Cloud in the Netherlands.
- Your general counsel wants the ethics guidance named. SpotDraft says its AI features follow the California State Bar's November 2023 guidance on generative AI and ABA Formal Opinion 512 of July 2024. Onit's agreement states that it is not a law firm and names no ethics guidance.
In summary
ContractWorks
ContractWorks is a contract repository sold by Onit for teams that need simple contract management. AI tags each uploaded contract with details such as agreement type, parties, effective date, renewal terms and notice windows, and the product adds AI search, OCR, alerts, scheduled reports and built in eSignature, with drafting, redlining and approvals on Premium. According to the AI Legal Index, ContractWorks runs under Onit's published agreement, which states that Onit is not a law firm, warrants performance, indemnifies against infringement and lets Onit use aggregated, anonymized customer data for product improvement. Its plans publish document limits and signature licenses but not prices, and no AI governance material is published.
SpotDraft
SpotDraft is a contract lifecycle platform for in house legal teams, covering creation from templates, conditional approval workflows, negotiation and redlining in Word, Slack or the browser, and built in eSignature. Its repository extracts more than a thousand metadata types, VerifAI reviews contracts in Word, and Sidebar agents answer questions and track regulatory change. According to the AI Legal Index, SpotDraft's clearest published positions are on residency and professional guidance: personal data stays in a customer selected region across the US, the EU, India and the Middle East, each contract has its own encryption key, and its AI features cite the California State Bar's guidance and ABA Formal Opinion 512. It names no model provider and publishes no training position or price.
Questions buyers ask
ContractWorks vs SpotDraft: which is better for a small legal team?
ContractWorks suits a team whose first need is a secure, searchable repository with alerts, unlimited users and tight viewing controls, with drafting, redlining and approvals available on Premium. SpotDraft suits a legal team that wants the whole contract lifecycle, from intake to negotiation, signature and agents, in one platform. Both include eSignature, and neither shows a price. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
How much do ContractWorks and SpotDraft cost?
Neither shows a plan price. ContractWorks publishes plan limits, such as 2,500 documents and five signature licenses on Standard, charges $1,200 a year for each extra pack of five signature licenses, and offers a 14 day trial and a nonprofit discount. SpotDraft prices by users or by contract volume and includes implementation. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Do ContractWorks or SpotDraft train AI on customer contracts?
Onit's services agreement, which governs ContractWorks, lets Onit use aggregated, anonymized customer data for product improvement and bars third party model providers from training on input except in deidentified or aggregated form needed to run the service. Section 12.1 also lets Onit use deidentified, aggregated usage data to improve its AI services, and nothing states whether Onit trains its own models on customer contracts. SpotDraft publishes no position on training. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Where do ContractWorks and SpotDraft host data?
ContractWorks runs on the SecureDocs platform on AWS, with hosting in the United States or Ireland and backups in Germany, while Premium runs on Onit's AXDRAFT platform, with Google Cloud in the EU as its primary infrastructure and AWS hosting in the EU, Canada or the US. Onit lists OpenAI for AI processing in the US and worldwide. SpotDraft runs on Google Cloud in the Netherlands and keeps personal data in a region the customer chooses across the US, the EU, India and the Middle East. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
What do ContractWorks and SpotDraft both leave unpublished?
Neither publishes a plan price, an accuracy measure for its AI, a current model version, an AI governance framework, or anything on legal privilege and work product. Neither says whether its audit trail marks a change made by AI. ContractWorks Premium names a GPT-3 clause creator, and SpotDraft names no model. Both publish a statement that they do not give legal advice. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
ContractWorks is one of several Onit contract products; its Premium tier runs on Onit's AXDRAFT platform, and its feature list names a GPT-3 AI Clause Creator. The ContractWorks pricing page lists plan contents with the price fields left blank, and its FAQ uses older plan names. SpotDraft's published Terms of Use cap liability at one hundred Indian rupees and contemplate enterprise terms that are not published. Neither vendor reviewed this page.