Contractzy vs Sirion: how they compare in 2026

CORA AI powers contract risk analysis, summarization, metadata extraction, and obligation management inside a broader contract lifecycle platform. Review starts with company guidebooks, while extraction turns scanned PDFs, images, and Word files into searchable information. Obligation management creates owners, milestones, deadlines, and renewal alerts from agreements. Templates, clause libraries, approvals, signatures, version history, and the repository remain useful without model inference. Essentials and Professional also separate conventional contracting functions from the fuller AI package in Enterprise. The models therefore run substantial review and analysis functions, while established workflow and storage features remain a separate part of the product.

Sirion's contract lifecycle platform came before its AI, and the company has traded since 2012. The product is organized as Store, Create and Manage, covering repository, drafting, approval, negotiation, obligation tracking and performance management. Without the agents and agentOS, a working enterprise CLM remains, and Gartner classifies it as one. The models drive the capability Sirion now sells on top of it. Agents are described as extracting and normalizing contracts, assembling first drafts from a playbook, proposing redlines on the other side's paper and monitoring obligations. Customers can also build and deploy their own agents in agentOS.

Risk analysis highlights ambiguous clauses and departures from company guidebooks, then lets reviewers inspect changes through tracked redlines. CORA AI also extracts parties, dates, monetary terms, and obligations from uploaded agreements. Accuracy claims include 98% for risk detection, 95% or more for metadata extraction, and up to 99% in the pricing FAQ, without a defined evaluation set or error breakdown. The contract text supplies context, but a retrieval method with linked primary legal authority and citation treatment is unspecified. Severity labels describe contractual risk rather than confidence in an answer. Critical decisions still call for human review under the pricing guidance.

AskSirion answers questions within one agreement or across the enterprise contract corpus, combining relevant clauses with related obligations, service levels, and counterparty records. Each answer links back to its underlying source, and the interface explains how it interpreted the user's request. Follow-up questions preserve context, while summaries, financial calculations, and date calculations draw on the same contract information. This establishes a traceable retrieval workflow for the customer's agreements. An externally reproducible accuracy evaluation, error breakdown, or legal citator is not specified. References to an agreement establish the source of a commercial term, rather than verifying that an external legal authority remains current.

Reviewers upload a Word or PDF guidebook or generate one with AI, scan an agreement, and inspect highlighted risks and tracked revisions. Editable guidebooks encode company requirements, and alerts identify departures or high risk clauses. Contracts failing mandatory criteria are prevented from advancing until compliance is ensured. Legal teams retain control over precise edits, with approval routing and version history supporting review before execution. The pricing guidance recommends human review for critical decisions. The remaining uncertainty is the control path after an incorrect classification: the criteria configuration, override permissions, and escalation route for an AI error are not specified.

AskSirion interprets a request and orchestrates agents for drafting, redlining, extraction, obligation tracking, and invoice reconciliation. Custom agent setup uses ordinary language to define the task, accessible data, connected systems, and when to escalate to the user. Agents can be tested with real scenarios and refined after launch. Recommendations include explanations and source links that allow review against the underlying contract. This gives administrators an escalation mechanism beyond a general promise of human control. Default stop conditions, the approval interface for consequential actions, and recovery after an incorrect action remain unspecified. The launch sequence permits an agent to go live before subsequent scenario testing.

Legal leaders at Bajaj Markets, Bridgestone, and Easebuzz describe actual use of the platform. Manish Jain emphasizes responsive support; Reni Verghese describes managing contracts against timelines; Nitin Bhuwania describes reducing administrative effort and retrieving executed agreements after digitization. These accounts identify customers and concrete activities, although they do not supply dated before and after measurements. Separate CORA AI claims include an internal study of faster summarization and improved extraction, without a disclosed sample or method. Implementation generally takes two weeks to one month depending on integrations, customization, and migration. That estimate describes rollout effort rather than a measured customer outcome.

Three customer representatives speak on the record with their roles and employers. Edzard Janssen is Chief Procurement Officer at RBI. Reinhard Plaza-Bartsch is Head of Digital Supply Chain and Operations at Vodafone. Angella Dikmic is Manager of IT Vendor Management at GTAA. All three quotes are qualitative, and all three people work in procurement or vendor management rather than legal. The five percentage claims name no customer and read as product capabilities, so named customers and published figures are never paired. About 25 enterprise logos appear, including Citi, GE, Coca-Cola, Chevron, PayPal, Bayer, Rolls-Royce, Aramco, Yamaha, DP World and Zalando. Customers are in more than 70 countries, with more than $450 billion of contract value under management. Sirion also publishes a case study library.

The agreement limits personal data use to delivering, maintaining, securing, and improving the contracted services under customer instructions. It covers contract files, attachments, metadata, communications, approval records, and access logs, and rules out selling customer data or unrelated advertising uses. Subprocessors must accept protections at least as strong as the agreement. Role permissions restrict visibility to authorized departments and users, while production access follows least privilege. The improvement permission contains no explicit model training exclusion. Privilege preservation, work product treatment, matter isolation during retrieval, and foundation model retention commitments remain unspecified, so these provisions do not settle every confidentiality question for a law firm.

Vendor library articles say customer data stays within the customer environment and is not used to train external language models. Clause 4.2 of the SaaS Terms, version 6, modified 26 August 2026, says otherwise. It reserves a right for Sirion to have its automated systems review and process Customer Data to generally inform machine learning capabilities in the services. None of the published agreements offers an opt out, and the agreement, not the library articles, is what binds. The rest of the confidentiality framework is published and can be read before signing. The data processing addendum stores and processes all customer data in a Sirion application instance specific to the customer. It sets Article 32 technical and organizational measures, with AES-256 at rest and TLS 1.2 in transit. It imposes need to know and least privilege access with automatic logout, requires deletion within 30 days of termination, and commits to notifying the customer of a confirmed security incident within 72 hours. Section 5 of the SaaS Terms adds mutual confidentiality, with a duty to give prior notice of any authority or court demand so the other party can object. The published agreements and trust center do not address privilege or work product.

Legal departments use CORA AI to identify contractual risks, make edits, and manage approvals, while procurement, sales, finance, and HR users share the broader workflow. Human decision authority is explicit in the product positioning, and critical decisions are subject to a recommendation for human review. The CORA AI introduction also directs customers to consult their legal departments about regulatory implementation. Those operating instructions do not establish an advice versus software boundary, permitted legal jurisdictions, or a position on unauthorized practice. The software terms disclaim warranties generally without a specific legal advice disclosure. Nonlawyer participation is supported without a corresponding professional responsibility framework.

The platform is sold to procurement, sales and finance teams as well as in house legal, all working on the same contracts. The three customer referees Sirion features are procurement and vendor management leaders, not lawyers. The home page, the trust center index with its AI ethics, compliance and security sections, and the terms and policies index say nothing on where tooling ends and legal advice begins. There is no statement that Sirion does not give legal advice, no professional responsibility or ethics page, no named bar or ethics guidance, including ABA Formal Opinion 512, and no jurisdiction limits.

The CORA AI introduction describes pretrained language models refined through legal expert feedback, regular updates, and testing across legal scenarios. That establishes a quality aspiration but leaves release criteria, review ownership, evaluation sets, and results across contract types or jurisdictions unspecified. The model training description refers broadly to contracts, legal materials, and precedents rather than a traceable evaluation program. Prajot Borkar is the named data protection officer, responsible for privacy compliance; that role does not establish accountability for model behavior. Company guidebooks let customers impose their own contract policies, but they are distinct from governance of the vendor's models and training process.

The trust center has a section titled Artificial Intelligence Ethics and Governance, last modified 16 December 2025, and its whole content is three sentences. They say Sirion has set up an AI Governance Program called S-AIGP, which monitors and ensures compliance with the EU AI Act 2024/1689 and other AI regulations as they emerge. Readers are told to contact their Sirion Account Executive for more. Sirion publishes nothing on who owns model behavior, what is tested before release, how the program works, or bias and uneven output.

The May 2026 agreement identifies eight subprocessors and their functions, including AWS for hosting, Bedrock inference, and Textract processing. Controls include encryption, least privilege access, internal multifactor authentication, audit logs, restricted production access, monitoring, and backups. Incident procedures cover identification, investigation, management, and response. Customer notification follows a confirmed personal data breach without undue delay where legally required, rather than an unconditional fixed deadline. Data remains as long as needed for service, legal, dispute, or security purposes. Return or deletion follows a written request at termination within a commercially reasonable timeframe, with unspecified backup schedules and legal exceptions.

The data processing addendum, version 3, modified 2 July 2026, covers retention, access, subprocessors, incidents and encryption. Appendix B sets the retention period by the controller's contractual direction. Clause 8.1 requires deletion or return of all Customer Personal Data, including copies, within 30 days of termination. Any retention the law requires is limited to that purpose and stays under the agreement's protections, and the SaaS Terms add automatic deletion after 30 days as a backstop. Access runs on a need to know and least privilege basis, with automatic logout on inactivity. Subprocessors are named in a list published at its own URL. Sirion gives notice and an objection right for any addition or replacement, imposes equivalent terms on each, and is liable for their breaches. Clause 4.3 commits Sirion to notify the customer within 72 hours of establishing material impact from a confirmed Security Incident, and Appendix B says 48 to 72 hours, with updates until resolved. The definition expressly excludes unsuccessful attempts such as failed logins and denial of service attempts. Encryption is AES-256 at rest and TLS 1.2 in transit.

The software terms cap the operator's and suppliers' liability at the amount the client actually paid. Service comes as is and as available, with broad exclusions for warranties, fitness, noninfringement, accuracy of performance, and correction of errors. The agreement does not attach an indemnity, insurance commitment, or enforceable accuracy warranty to CORA AI output. It also excludes responsibility for incomplete or corrupt backups and places independent backup responsibility on the client. India is the defined country for governing law, with informal dispute resolution first. These terms allocate general software risk without promising a remedy for an incorrect contractual recommendation.

Sirion publishes its SaaS terms and a separate end user agreement, so both can be read before signing. Clause 7.1 commits Sirion to indemnify and defend the customer against third party claims that use of the services infringes intellectual property. Clause 7.2 sets four exclusions, namely combination with materials Sirion did not provide, unapproved changes, unauthorized use, and use inconsistent with the documentation. Clause 7.3 gives the remedies of securing the right to continue, replacing or modifying the services, or terminating with a pro rata refund of prepaid fees, as Sirion's sole and exclusive liability. Clause 7.4 has the customer indemnify Sirion over customer data. Clause 8.1 caps each party's total liability, across the whole term, at the fees paid for the subscription in the twelve months before the first event giving rise to a claim. Clause 8.2 excludes lost profits, lost or damaged data and consequential loss, and under clause 8.3 the cap does not apply to fees owed, breach of confidentiality or the indemnities. Clause 6.2 warrants that the services perform materially in line with the documentation, with a pro rata refund if Sirion cannot correct a nonconformity reported within ten days. Separate Sirion AI Services terms extend the intellectual property indemnity to the AI features, but exclude claims that come from the customer failing to review or validate output. Section 5.1 of those terms disclaims any warranty that output is accurate or free from hallucinations. No insurance position is published.

Salesforce users can create, approve, and sign contracts within their CRM, while HubSpot data can generate agreements and feed approval and signature steps. Oracle supports contract creation and management, and Jira tickets initiate creation and approvals. Slack brings contract updates and actions into team conversations; Gmail supports workflows from the inbox. DocuSign, Adobe Sign, and UAE Pass provide signature connections, with Zoho also supporting contract generation and tracking. Custom APIs and integrations are available. Field mappings, authentication setup, synchronization conflicts, and permission propagation are not described, so the connection list does not establish a complete implementation specification for each workflow.

Nine named connectors are documented, each with its direction of travel, in the Non-Native Integrations article in Sirion University, last updated 24 February 2026. Four SAP Ariba accelerators cover procurement, bids, awards and contract workspaces. An executed contract request in Sirion creates a purchase requisition in Ariba, and the resulting purchase order is written back. Ariba sourcing events and RFPs become Contract Draft Requests on set triggers, one per bidding supplier with line items mapped, and supplier redlines move into Sirion for legal review. Awarded RFx events create a draft request with awarded line items synced. Contracts finalized in Sirion copy into Ariba Contract Workspaces with metadata, documents, line items and status. Three more connectors cover supplier master data from Ariba, SAP S/4HANA Business Partners on scheduled transfers, and Oracle ERP with logging, error handling and sync status. The Microsoft Dynamics connector runs both ways in auto or manual mode. The article describes configuration through triggers, modes and scheduling rather than as a full guide, and the wider Sirion University catalog needs a login. Sirion's public pages do not document the Word add in or the Salesforce connector to this depth. No document management connector such as iManage or NetDocuments appears on them.

AWS cloud hosting is the standard delivery route, with an additional single tenant cloud option and deployment on customer premises. Implementation scope depends on integrations, migration, and customization, and Enterprise includes custom integration and deployment options. The agreement identifies AWS operations as global, including India, Singapore, and the United States, while other processors operate in additional global locations. Cross-border safeguards may include applicable standard contractual clauses. These locations describe the processor network rather than selectable customer residency regions. The division between contract storage, model inference, OCR processing, and backup locations is not specified for each deployment option or subscription tier.

Sirion's application is SaaS hosted by a cloud provider, according to the data processing addendum, and all customer data is stored and processed in a Sirion application instance specific to that customer. That isolation commitment sits in a contract rather than in marketing. Four underlying providers appear in the trust center, namely AWS, Azure, Oracle and IBM, which suggests customer choice without offering it as an option. Sirion's published documents make no residency commitment and give no region list or jurisdiction option. Nothing separates where processing happens from where data is stored. A Sirion library article describes the platform's multitenant scalability, which sits awkwardly beside the addendum's customer specific instance, and nothing published reconciles the two.

The company identifies itself as ISO 27001:2022 certified and describes encryption, AWS hosting, role permissions, and restricted production access. Its agreement adds TLS 1.2 or later, internal multifactor authentication, continuous monitoring, security alerts, and backup and recovery measures. On a reasonable written request, the company may provide existing compliance material, certifications, or third-party audit reports instead of a disruptive audit. A current certificate scope, validity period, and directly accessible report are not supplied with these statements. Generic security language and a badge do not establish the scope of a separate SOC 2 examination or an AI-specific assurance program.

Appendix B of the data processing addendum names ISO 27001 as a held certification and describes the review process around it. Under clause 7.1, unless agreed otherwise, Sirion will give a copy of its latest security attestation report on the customer's written request, no more than once a year. Clause 7.2 adds a customer audit right, with scope, timing and controls agreed in advance and a reasonable fee. Appendix B also says Sirion reviews its cloud providers' SOC 1, SOC 2 and ISO 27001 reports as part of a shared responsibility model. That is oversight of the infrastructure rather than an attestation over the application. The report route is open to existing customers, so a prospective customer cannot get the report before signing. The addendum names no auditor, coverage period or scope statement for the ISO certificate. Sirion's trust center states ISO 27001:2022 certification. Its SOC 1 Type II and SOC 2 Type II sections explain what those reports cover, and its security page attributes SOC 1 and SOC 2 to the cloud providers Sirion runs on.

Amazon Bedrock supplies AI and machine learning processing, and Amazon Textract handles OCR and document processing within the AWS subprocessor role. CORA AI uses an array of pretrained language models and a training process involving legal contracts, materials, precedents, and expert feedback. This identifies infrastructure and broad architecture, while leaving the foundation model families, versions, routing rules, and fine-tuning arrangements unnamed. Subprocessors may change as technical or operational needs evolve. The agreement does not commit to advance model change notices or identify which model handles a particular risk review, summary, or obligation extraction. Provider locations likewise do not assign inference to a particular region.

A combination of more than ten large language models and more than 1,200 proprietary small language models powers the contract agents. A routing framework selects a model according to the task, while company content, policies, and risk preferences can refine agent behavior. The same architecture supports extraction, drafting, redlines, obligations, and invoice reconciliation through agentOS. Provider names, model families and versions, and processing locations for individual inference tasks are not identified. There is also no model change notification commitment attached to this architecture description. The disclosure explains how different model types are combined without identifying every external model a customer inherits.

Essentials supports up to three users and 50 contracts each month; Professional allows up to ten users and 200 contracts; Enterprise starts above ten users with 500 monthly contracts. Each base subscription requires a quote. The pricing matrix lists Professional AI risk analysis at $40 per user per month, with up to 100 analyses monthly, while Enterprise includes 20 free reviews. Unlimited storage and distinct signature allowances accompany the plans. Reviewers need no additional license. Integrations, customization, migration, and deployment affect implementation scope, but their charges are not stated. The AI add-on figure therefore does not represent the total cost of running the platform.

No pricing is published at any level, including the unit of charge. Sirion's site has no pricing page, no tier structure, no unit per seat, per contract or per agent, no volume banding and no statement of what implementation adds. Every call to action is a demo request. No published figure lets a prospective customer estimate cost before a sales process, even though Sirion publishes its SaaS terms, end user agreement and data processing addendum in full.

The primary audience is corporate legal operations alongside procurement, finance, sales, HR, compliance, and operational teams. Legal workflows include drafting, negotiation, risk review, approval, execution, repository retrieval, and ongoing obligations. Sector offerings include fintech, automotive, manufacturing, healthcare, software, real estate, logistics, and other commercial industries. Templates and guidebooks adapt review to company policies, while repository filters include jurisdiction, expiry, and contract value. Regional offerings span Europe, the Americas, Asia, and the Middle East, but a jurisdiction and language support matrix is unspecified. Litigation research, court filing, and consumer legal representation are not established parts of the contracting service.

Eight industries have their own pages. Financial services is split into procurement and into capital markets and lending. Insurance has a separate solution for triaging underwriting submissions. The others are automotive, IT services, healthcare, pharmaceuticals and life sciences, telecom, and oil and gas. Five departments have their own pages, covering in house legal, legal operations, procurement, sales and finance. Customers are in more than 70 countries, and the site is in English, German and French. Sirion does not say where the product stops. It excludes no contract or matter types, does not address law firms, government or public sector use, and describes coverage by industry and department rather than area of law.