HyperStart CLM vs SpotDraft: how they compare in 2026
HyperStart CLM and SpotDraft are both contract lifecycle platforms built by Bangalore companies and sold to legal teams and the business teams around them, and the agreements each publishes are governed by Indian law. The difference is in what each puts in writing. HyperStart's Terms of Service and India data processing addendum are specific about data: client data is used only to provide the service, deleted within 30 days of the end of a subscription, kept logically separate from other clients and covered by a security incident clause with a 48 hour window. Its subprocessor list names OpenAI for AI and Microsoft Azure for OCR, with hosting in the US or India. SpotDraft is more specific about the product and the profession: per contract encryption keys, personal data held in a region across the US, the EU, India and the Middle East, and named ethics guidance from the California State Bar and the ABA. HyperStart caps liability at a year of fees with an indemnity for misuse of client data; SpotDraft's published terms cap it at one hundred rupees. Neither publishes a price.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
HyperStart CLM is a contract workflow and repository product: templates and intake forms, conditional approvals, negotiation with version history and an audit trail, eSignature, storage, reminders and an InFlight dashboard of contracts in progress. AI drives several of its core functions. The repository is searched with AI filters that HyperStart says retrieve a contract in two seconds. AI extracts metadata such as parties, dates, renewal terms and clauses like liability and indemnity when contracts are imported, so legacy contracts can be bulk loaded and tagged in one step. AI Smart Assist produces a first pass redline and contract summaries during review. The workflow, signing and repository functions would still run without the models. HyperStart says its AI is built on HyperVerge's document technology, and its subprocessor list names OpenAI for artificial intelligence and Microsoft Azure for optical character recognition.
SpotDraft is a full contract lifecycle system first: templates, conditional workflows and approvals, a shared editor, built in eSignature meeting ESIGN, eIDAS and ECA, a repository, reporting and analytics. Without SpotDraft AI, VerifAI, Intake and Sidebar, a working CLM with signature and workflow remains, with its own market. The AI covers review inside Word, automatic extraction of more than a thousand metadata types, and agents that track regulatory change. SpotDraft now calls itself context aware, AI native CLM, but the platform predates that framing.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
HyperStart says its AI is built on HyperVerge technology that has processed more than a billion documents in over 70 countries at more than 95 percent accuracy. The figure describes HyperVerge's document processing across its business, and no test set, document type or method is published for contract extraction or AI redlining. The other published figures measure speed: a first cut review of a 40 page master services agreement highlighting about 20 critical items in under a minute, according to LeadSquared's head of legal, and 75 percent faster closures on the AI review page. Clause 3.5 of the Terms of Service says AI results may vary with the quality of the client's data and may not always be fully accurate, complete or suitable, and recommends that the client apply its own judgment and validation. Nothing published describes how a redline suggestion or a summary points back to the clause or playbook position behind it.
SpotDraft publishes nothing on accuracy or grounding. There is no accuracy figure, error or hallucination rate, benchmark, test set or evaluation on the home, pricing or security pages. Nothing describes how AI output is grounded in the customer's documents or whether a user can trace a statement back to its source. The figures SpotDraft publishes measure speed and cost: contracts reviewed 15 times faster with VerifAI, closings twice as fast, 65 percent lower cost and 70 percent less review time. The nearest thing to an accuracy claim is that the AI works in the customer's own context and follows its rules, which describes setup, not correctness.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
AI redlines arrive as suggestions in the negotiation view, where users can suggest, roll back and comment with every internal and external change visible, and approvals run through no code workflows with conditional logic that legal configures. Version control and an audit trail record each change. Clause 3.5 of the Terms of Service recommends that the client exercise appropriate judgment and validation where necessary and says HyperStart accepts no liability for decisions made on AI outputs. Nothing published states that a person must review AI output before it is sent, sets a point at which the AI stops or hands back, or says what the AI may change on its own. HyperStart markets self serve contracting for business teams, with legal setting the guardrails.
SpotDraft's approval routing is conditional, with thresholds shown, for example approvals going to the Head of Finance below a deal value and to the CFO and CEO above it. Audit logs trace changes at contract level by both the customer and the counterparty, every draft keeps its version history, and permissions are scoped by contract type, entity and department. Nothing describes control over the AI itself: what SpotDraft AI, VerifAI or the Sidebar agents do unattended, when a person must review model output, what agents can change without approval, or what happens when an output is wrong. Saying the AI follows the customer's rules implies limits without describing any.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Four case studies name customers: LeadSquared, Qapita, Rentomojo and Lumelight. LeadSquared, a sales software company with four legal counsel and a general counsel handling 180 to 250 contracts a month, reports more than six hours saved on contract review with AI, a 60 percent cut in contract creation time and 92 percent faster contract reporting, quoted by Om Prakash Pandey, its head of legal, who says HyperStart was chosen from about five vendors against 22 criteria. Qapita, an equity management platform with a one person contract team serving more than 2,400 clients, describes migrating its contracts in minutes with AI extracted metadata, quoted by Mayuri Jaltare, Company Secretary. Site wide figures, such as 80 percent less contract admin time, five times faster review and $20 saved per contract, carry no named customer. No case study gives a deployment date or a measurement method.
SpotDraft names in house lawyers with roles and employers: Anna Claveria Brannan, Deputy General Counsel at IPSY; Susan Koenig, formerly Senior Legal Operations Manager at Abnormal Security; Micah Nessan, formerly General Counsel at Guideline; Reason Abajuo, VP of Legal and Corporate Affairs at Chaberton Energy; Lizzy Gagan, Senior Legal Counsel at Beamery; Arzu Hasanova, Legal Counsel at Circularise; Aditi Kapoor, Director of Legal at Gameskraft; and Natasha Wilson, Head of Legal at SUN Mobility. Every quote is qualitative. The quantified claims carry no customer at all: two times faster closings, 65 percent lower cost, 70 percent less review time, and contracts reviewed 15 times faster. Two of the referees are identified as former employees of the companies named.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The Terms of Service, version 2.0, effective for order forms from 20 August 2025, keep the client the sole owner of its data (2.6) and license HyperStart to process client data only during the term and only to provide the services (2.5). Clause 8.6 says client data is stored solely to provide the services, including debugging and support, and for no other purpose, and clause 8.3 limits HyperStart's own analytics to aggregated, anonymized usage data without reference to client data. Clause 6 binds both sides to confidentiality, with prior notice before any legally required disclosure, and clause 9.1 indemnifies the client against third party claims from unauthorized disclosure or misuse of its data caused by HyperStart's breach. The DPA commits to keeping each client's personal data logically separated from other clients' data (4.6). Training of models is not mentioned for client data, and privilege, work product and what OpenAI retains from a request are not addressed.
SpotDraft's security page says customer data is logically separated within shared, multitenant infrastructure. Each contract has its own encryption key in HashiCorp Vault backed by Google Cloud KMS, with AES-256 at rest and FIPS 140 certified encryption. Data is classified as public, company confidential, customer confidential or personal, and access follows least privilege with unique IDs. Third party vendors handling scoped data must follow confidentiality, audit and incident response rules. Nothing published says whether customer contracts are used to train any model, by SpotDraft or a model provider, and no retention period for prompts or outputs is published. Privilege and work product are not addressed.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Clause 3.4 of the Terms of Service states that the services are intended solely to enable technology based contract lifecycle management and do not constitute legal advice, and that HyperStart does not decide how long contracts must be kept under applicable law. Clause 3.5 adds that AI results may not always be accurate or suitable and recommends the client's own judgment and validation. The product is sold to sales, procurement, finance and HR users as well as lawyers, with a simple interface for both legal and nonlegal teams and self serve contracting inside guardrails legal sets. Nothing published addresses a lawyer's competence or supervision duties when AI redlines are used, who in a client should review AI output before it reaches a counterparty, or limits by jurisdiction.
SpotDraft's home page says its AI features are designed with attention to the California State Bar's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, November 2023. It also names the American Bar Association's Formal Opinion 512 on generative AI, July 2024. Both are named with their issuer and date, on the home page rather than in a policy. Nothing addresses a lawyer's own competence and supervision duties or any limit on use by jurisdiction. The claim is attention to principles, not a mapping of product behavior to specific duties, so which principle each control meets is not shown.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
HyperStart publishes no AI governance position. There is no responsible AI page, no statement of principles, no named owner for model behavior, no description of testing before an AI feature ships, and no AI management certification such as ISO/IEC 42001. The security material covers information security, ISO 27001 and SOC 2, which govern systems rather than model behavior. The only AI specific terms are commercial: clause 3.5 of the Terms of Service on the limits of AI output and clause 2.4, which bars the client from using the services to train or build an AI model. Nothing addresses whether extraction or redlining performs differently across contract types, languages or jurisdictions, although HyperStart sells across India, the United States and other markets.
SpotDraft's security page describes a formal risk governance policy approved by management that defines an Enterprise Risk Management program. Periodic operational risk assessments feed management reports, with each risk rated, assigned an owner and tracked to treatment or acceptance. Privacy risk is assessed through vendor due diligence, and an information security team led by the Chief Technology Officer oversees the process. None of it covers model behavior. Nothing describes testing before an AI release, there is no responsible AI framework, and nothing addresses bias or uneven output across contract types, counterparties or populations.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
On termination, clause 4.3 of the Terms of Service returns the client's contracts as Word or PDF downloads and deletes all client data within 30 days, or sooner on written instruction. The Data Processing Addendum adds deletion of personal data on written request, with deletion procured from subprocessors and demonstrated to the client (7.1), and deletion by HyperStart and its subprocessors within 30 days of the order form ending (7.3). It commits to least privilege access with revocation when a role ends (4.5), logical separation from other clients' data (4.6), testing and audits at least once every 12 months (4.8), and notice of a security incident without undue delay with a 48 hour window from detection stated in clause 5.2. A subprocessor list updated 18 August 2025 names each supplier, its location and its role, separately for US and India hosting. The list carries no commitment to notify clients of changes, and nothing states what OpenAI keeps from a request.
SpotDraft's security page, last updated 17 October 2025, describes FIPS 140 certified encryption, AES-256 at rest, and a unique key per contract held in HashiCorp Vault backed by Google Cloud KMS. Primary and backup servers run on Google Cloud Platform in the Netherlands. Data is classified into four sensitivity tiers, and access follows least privilege, with unique IDs and enforced password rules. There is a documented business continuity and disaster recovery program, automated patching, ongoing tracking of known vulnerabilities in third party packages, regular threat modeling, independent penetration testers, and routine code analysis and vulnerability scans. A set incident response process is stated and refined through regular exercises. No subprocessor is named, though the page says fourth parties such as backup providers and subcontractors have no access to scoped systems or data, and no retention period for customer content is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Terms of Service warrant that the services will materially conform to the order form and terms, comply with applicable law, be performed with reasonable skill and care, and run with business continuity and disaster recovery in place (3.2). HyperStart defends and indemnifies the client against third party claims of intellectual property infringement, its own gross negligence, fraud or willful default, and unauthorized disclosure or misuse of client data caused by its breach (9.1). Each side's total liability is capped at subscription fees paid in the 12 months before the claim arose, and clause 10.2 carves nothing out of that cap, indemnities included. Indirect and consequential loss is excluded for both sides (10.1). Clause 3.5 says HyperStart accepts no liability for decisions made on AI outputs. Disputes go to arbitration seated in Bangalore under Indian law (11). No insurance is published.
The SpotDraft Terms of Use on its Legal Hub at legal.spotdraft.com, version 2.3, last updated 21 February 2024, are published with five prior versions downloadable from the same page. Clause 8.3 caps SpotDraft's total liability, in contract or tort, at one hundred Indian rupees, roughly one US dollar. Clause 8.2 excludes consequential, indirect and special damages, including loss of data and profits. Clauses 5.2 and 5.3 disclaim fitness for purpose and error free or uninterrupted use, and expressly waive the warranty of noninfringement. Clause 9 is an indemnity from the customer to SpotDraft only, and the document contains no vendor indemnity. Clause 5.5 disclaims liability for consequences of using the Platform, and 5.4 says SpotDraft gives no legal advice. Indian law governs, with exclusive jurisdiction in the courts at Bangalore. The contracting entity is Draftspotting Technologies Private Limited, with affiliates including Draftspotting Inc. These are the Terms of Use reached from the signup path. Clause 11.8 contemplates added terms for other services, so an enterprise customer may sign a negotiated master agreement that is not published.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
HyperStart's integrations page lists Salesforce, Pipedrive and HubSpot for working on contracts from the CRM; Gmail, Zoho Mail and Outlook for importing contracts from email; Google Drive, OneDrive, SharePoint and Dropbox for storage and import; Docusign, Zoho Sign and Adobe Acrobat Sign for signatures, with a native one time password option; Slack, Microsoft Teams and Google Calendar for notifications; and Microsoft Word as the editor for review and redlining. A Qapita customer quote describes sending and tracking counterparty emails from Outlook inside the tool, and LeadSquared's case study describes integrations with its order to cash module and SAP ERP. The pricing FAQ says some integrations are included and others are paid add ons. No API documentation, field mapping or sync direction is published, and no document management system used by law firms, such as iManage or NetDocuments, is listed.
SpotDraft states more than 30 integrations and gives each its own page, with Salesforce, HubSpot, Slack, Microsoft Word for desktop, Google Drive, DocuSign, Greenhouse, Google Forms, Jira and Zapier all linked directly from the pricing page. VerifAI runs review inside Microsoft Word, negotiation and redlining are described as working in Word, Slack or SpotDraft itself, and one named customer credits the Word desktop editor with driving adoption. Single sign on covers Office 365, Google Workspace, Okta, Active Directory and custom SAML with zero touch provisioning. No document management integration such as iManage or NetDocuments appears, consistent with an in house rather than law firm product.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
HyperStart publishes two hosting arrangements, chosen by client location. For US clients, or clients choosing US servers, the subprocessor list puts hosting and storage on Amazon Web Services in the US with the product database on MongoDB in the US. For Indian clients, or clients choosing Indian servers, hosting, storage and the database sit in India. Processing is listed separately from storage: in both arrangements optical character recognition runs on Microsoft Azure in the US and artificial intelligence on OpenAI in the US, so documents hosted in India are sent to the US for those steps. Clause 8.6 of the Terms of Service records the client's consent to storage and processing in India and the USA. The DPA describes a multitenant service with each client's personal data logically separated (4.6). No single tenant or on premises option is offered.
SpotDraft's customer data is logically separated within shared, multitenant infrastructure. Residency is a customer choice with a clear limit: personal data is stored in selected regions covering the US, EU, India and the Middle East, and is not sent outside them. Primary and backup servers are on Google Cloud Platform in the Netherlands, and Google Cloud Platform runs processing throughout. Encryption keys are held per contract in HashiCorp Vault backed by Google Cloud KMS, which shows where keys are held as well as where data rests. Which region applies by default, and whether contract content follows the same rule as personal data, are not stated; the regional commitment is written for personal data.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
HyperStart states ISO 27001:2013 certification and SOC 2 Type 2 certification on its home page, pricing page and privacy policy, and clause 8.1 of the Terms of Service states the ISO certification in the contract. Clause 4.2 of the Data Processing Addendum commits to make third party certifications and policies available on a client's written request. No trust center, auditor, certificate scope, report period or certificate number is published. The ISO standard named is the 2013 revision, which the 2022 revision replaced. A LeadSquared quote says HyperStart was the only one of about five CLM vendors it evaluated with SOC 2 compliance. The DPA also commits to assessments, audits or testing of systems at least once every 12 months (4.8).
Four compliance marks appear on SpotDraft's home, pricing and security pages: ISO, GDPR, HIPAA and AICPA SOC 2. SpotDraft's home page lists them as ISO 27001, SOC 2 Type II, GDPR and HIPAA. The footer on every page says SpotDraft is ISO/IEC 27001:2013 certified, but 27001:2013 was replaced by the 2022 revision, so the site claims a current certification while naming a retired version. A separate trust center at trustcenter.spotdraft.com is linked. No auditor, coverage period or report date for the SOC 2, or scope, is published outside the trust center. Independent penetration testers are said to be used, but none is named and no summary is published.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
HyperStart's subprocessor list, updated 18 August 2025, names OpenAI in the US for artificial intelligence and Microsoft Azure in the US for optical character recognition, for both US and India hosting. No model name or version is given, and nothing says which features use OpenAI, whether requests run through OpenAI directly or through Azure, or what OpenAI keeps. Marketing describes the AI as built on HyperVerge's own document technology, without saying which parts are HyperVerge models and which are OpenAI. The DPA lets HyperStart engage subprocessors as needed to provide the services and makes it liable for them (3.1, 3.4), and clause 8.8 of the Terms gives the client a right to ask about subprocessors. No commitment to notify clients before a model provider changes is published.
SpotDraft publishes nothing about the AI models a customer relies on. No model provider, model or version is named. The only description is that the AI is built into SpotDraft and works in the customer's own context. There is no subprocessor list and no commitment to notify customers of changes. The security page is otherwise detailed, naming HashiCorp Vault, Google Cloud KMS, JAMF, FileVault and BitLocker among its tools.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
HyperStart publishes no price figure. The pricing page asks for details and returns a quote tailored to team size and contract volume, and the home page FAQ refers to a starter plan and to plans with unlimited users. The page lists what every plan includes: workflows and approvals, migration of legacy contracts and workflow setup, and a named account manager with round the clock support. It says an annual plan saves on cost, that some integrations are included while others are paid add ons, and that a seven day free trial is available. Clause 7 of the Terms of Service makes fees prepaid and nonrefundable, suspends access 15 days after a missed renewal payment, and allows fee revisions at renewal with written notice.
SpotDraft's pricing page says plans are priced either by users or by contract volume, framed as avoiding wasted spend. It also covers implementation: in house implementation is always included, covering workflow and integration setup and migration of old contracts, with no extra fees and no outsourcing. Every customer gets a dedicated customer success manager and support around the clock at no extra cost. A six week implementation timeline is published, week by week. No number appears: no rate, floor or currency, and every call to action is Get Pricing or a demo request.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
HyperStart has pages for legal, sales, procurement, finance and HR teams and for industries including construction, nonprofits, healthcare, real estate, government, freight, telecom, oil and gas, healthcare payers, education, utilities and suppliers, with a life sciences version for pharma, biotech and healthcare enterprises. It describes the product as handling legal, sales, vendor, finance and HR contracts, for startups through large enterprises. The legal page speaks to in house legal teams, and the AI review page addresses in house teams and law firms. The four named customers, LeadSquared, Qapita, Rentomojo and Lumelight, are all filed under business software on the case study page. Nothing published sets a minimum or maximum size, names contract types or languages the AI does not handle, or describes a law firm deployment.
SpotDraft gives five buying teams dedicated pages: legal, sales, finance, HR and procurement, with legal as the owner and the others as self serve users. Five industries have their own pages: SaaS, HR tech, edtech, healthtech and fintech. Its home page names its audience as high performing in house legal teams. No law firm segment is addressed, nothing covers government or public sector use, and no contract types or matters are named as unsupported. Coverage is described by industry and internal function rather than by area of law.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Clause 2.5 of the Terms of Service, version 2.0, licenses HyperStart to process client data only during the term and only to provide the services, and clause 8.6 says client data is stored solely to provide the services, including debugging and support, and for no other purpose. Clause 8.3 limits HyperStart's own analysis to aggregated, anonymized usage data without reference to client data, and the Data Processing Addendum limits processing of personal data to providing the services (2.5).
No page names training of models on client data in either direction, including the privacy policy and the AI review page. The only training clause, 2.4, bars the client from using the services to train an AI model. OpenAI is the listed AI subprocessor, and nothing published states OpenAI's own terms on training for these requests.
Nothing on SpotDraft's home, pricing or security pages, including the security page's data security, infrastructure security, product security and risk governance sections and its five question FAQ, addresses whether customer contracts, prompts or outputs are used to train any model, by SpotDraft or by an underlying model provider. The nearest statements are that the AI is embedded in SpotDraft, operates in a context specific to the customer and follows the customer's rules, and that the platform is risk free AI on the customer's terms, none of which is a commitment about training.
No model provider is named. The trust center was not available to read, so the silence is an absence on the published pages with a retrieval limit on the trust center.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Client data stays on the platform for the subscription term. On termination, clause 4.3 of the Terms of Service returns contracts as Word or PDF downloads and deletes all client data within 30 days, or earlier on the client's written instruction. Clause 7.1 of the Data Processing Addendum lets the client have personal data deleted at any time on written request, with deletion procured from subprocessors and demonstrated to the client, and clause 7.3 sets the same 30 day deletion for subprocessors when the order form ends.
The privacy policy, last updated 8 August 2025, keeps personal data as long as its stated purposes need and keeps a limited audit trail of requests and consent, and when consent is revoked it deletes personal data as soon as practicable and no later than 30 days after the request, unless the law requires it to be kept. No separate retention period is stated for prompts, AI redlines or summaries, and nothing states how long OpenAI, the listed AI subprocessor, keeps a request.
No retention period for contracts, prompts or generated outputs is published on SpotDraft's home, pricing or security pages. Retention appears only as a heading within the security page's data handling practices, where data classification and retention are named together and the text describes classification into public, company confidential, customer confidential and personal tiers without stating how long anything is kept.
Secure data disposal is listed among the data center measures without a period attached. No retention setting the customer can configure is described.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Clause 4.6 of the Data Processing Addendum commits HyperStart to keep each client's personal data logically separated from data it holds for other clients, and clause 4.5 commits to least privilege access inside HyperStart. Within a client account, HyperStart's FAQ describes role based access control, and a customer case study describes granular controls over approval workflows and templates. No published material sets out the roles, the permission levels, how access to a contract or folder is granted, or whether AI search and summaries respect those permissions.
Separation is documented at two levels. Between customers, SpotDraft's security page states that customer data is logically separated within a secure multitenant infrastructure, and adds that each contract is protected with a unique encryption key held in HashiCorp Vault backed by Google Cloud KMS, a finer control than isolation at tenant level alone. Within a customer, roles and permissions are described as fully customizable and scoped by contract type, organizational entity and department, with permissions at contract level ensuring documents are visible only to authorized personnel without manual sharing.
How retrieval and the AI features apply those permissions at query time is not published, so whether a model answering a question respects the same boundaries is not stated. The buyer is an in house department, so separation at tenant and entity level is the relevant test.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Clause 6.2 of the Terms of Service requires prior notice to the other party before any disclosure of its confidential information that law requires, unless legal or administrative process forbids it. Clause 2.6 of the Data Processing Addendum adds prompt notice of any request by a government agency or law enforcement authority for personal data, unless the law or the request forbids it, and reasonable help if the client wants to contest it.
The privacy policy separately says personal data may be shared with authorities when the law requires. No transparency report is published.
Nothing on SpotDraft's home, pricing or security pages addresses what happens if a third party, law enforcement agency or court requests customer data, and no commitment to notify the customer is published. No transparency report exists. The security page states that third party vendors handling scoped data are bound by confidentiality, audit and incident response protocols, and that fourth parties such as backup providers and subcontractors have no access to scoped systems or data, but neither addresses compelled disclosure.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
HyperStart works on the client's own contracts, templates and playbooks and does not retrieve case law or legislation. Nothing published identifies what the extraction or redlining models were trained on. HyperStart describes its AI as built on HyperVerge technology that has processed more than a billion documents, without saying what those documents were or on what basis they were used, and its subprocessor list names OpenAI for artificial intelligence without describing OpenAI's training data.
The working corpus is the customer's own contract set and is identified as such: SpotDraft's repository is described as centralizing all of a customer's contracts and automatically pulling over a thousand types of contract metadata using AI, and the AI is described as operating in a context specific to the customer and following the customer's rules. No external legal corpus is claimed and the product does not retrieve primary law, so the usual jurisdiction and coverage questions do not arise. No training corpus for the models themselves is described, no source is named and no license or rights basis is given.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
HyperStart manages a client's own contracts and does not cite case law or legislation, so a citator is not part of the product. Nothing on the home, AI review, legal, pricing or integrations pages, or in the Terms of Service, addresses checking authority for later history. Template language and playbook positions are maintained by the client, and nothing describes how the product flags a clause that a change in law has made out of date.
Nothing on SpotDraft's home, pricing or security pages addresses whether legal authority is checked for later history, and no citator, treatment signal or currency check is published. The platform manages a customer's own contracts rather than retrieving case law or legislation, so a citator is not part of what it sells. Sidebar is described as helping users stay ahead of regulatory change with AI agents, which concerns the currency of regulation rather than the standing of cited authority, and no source or verification method is published for it.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No path for declining to answer is documented, and no confidence score is shown for AI extraction, redlines or summaries. Clause 3.5 of the Terms of Service says AI results may not always be fully accurate, complete or suitable and recommends the client's own validation, which describes the limits of the output rather than what the product does when it is unsure. Nothing says whether a metadata field the AI cannot read is left blank or flagged, which matters because extracted renewal and obligation dates drive the reminders.
No path for declining to answer is documented on SpotDraft's home, pricing or security pages, no confidence or grounding score is published, and nothing states what the product does when the customer's contract set or playbook does not cover the question put to it. Published material addresses configuration rather than uncertainty, describing AI that operates in the customer's context and follows the customer's rules.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming HyperStart or HyperVerge. This is a statement about the public record rather than a finding about the product, and it covers fabricated content only. HyperStart manages commercial contracts rather than producing court filings, so its output does not ordinarily reach a brief.
The AI Hallucination Cases database maintained by Damien Charlotin, which tracks decisions worldwide where a court addressed hallucinated AI content and records the tool implicated where known, together with 2026 sanctions trackers and trade press summaries, records no court order, opinion or disciplinary record naming SpotDraft. This is a statement about the public record rather than a clearance, bounded by what that database covers.
The product manages commercial contracts for in house teams rather than producing court filings, so its output does not ordinarily reach a brief.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Clause 3.4 of the Terms of Service says the services are intended solely to enable technology based contract lifecycle management and do not constitute legal advice. No bar opinion, ethics rule or professional conduct guidance is named on the product, legal or AI review pages, in the Terms of Service or in the Data Processing Addendum, and nothing connects the AI features to a lawyer's duties when reviewing AI redlines.
SpotDraft's home page names two ethics guidance documents from two jurisdictions. One is the California State Bar's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, dated November 2023. The other is the American Bar Association's Formal Opinion 512 on generative AI, dated July 2024. Both are given with issuer and date. SpotDraft says its AI features are designed with attention to the principles in each, for responsible and secure use across contracting workflows.
What is published is a statement of attention to principles, not a mapping of which duty each product control meets, and no other jurisdiction's guidance is addressed.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
HyperStart is bought by companies to run their own contracting across legal, sales, procurement, finance and HR, and every named customer is a company rather than a law firm, so no client bill sits in the loop. The savings claims are aimed at the buyer's own time and cost: 90 percent less contracting time and $20 saved per contract on the legal page, 80 percent less contract admin time, and five times faster review. The AI review page mentions law firms as users, and nothing published addresses fee treatment of AI assisted work for a firm that bills a client.
SpotDraft's public materials are framed around speed and cost removed: two times faster closings, 65 percent lower cost, 70 percent less review time, and contracts reviewed 15 times faster with VerifAI. No record of AI assisted work for each matter intended for fee purposes, and no guidance on billing, fee or disclosure treatment, is published on the home, pricing or security pages. The contract level audit logging SpotDraft describes, which traces changes by both the creator and the counterparty and retains every version, could support such a record, but nothing presents it for that purpose.
The buyer is an in house department rather than a firm billing a client, so the question lands on internal cost, and it is not addressed.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
HyperStart publishes a subprocessor list, updated 18 August 2025, with separate tables for US and India hosting. It names Amazon Web Services, MongoDB, OpenAI for artificial intelligence, Microsoft Azure for optical character recognition, Auth0, Twilio SendGrid, MailModo, TinyMCE, Zoho, SignDesk for electronic stamping in India, Sentry, Bugsnag and Heap, each with a location and role. The Terms of Service and the India Data Processing Addendum are published.
Certifications and security policies are available on written request under clause 4.2 of the DPA, and no client facing AI disclosure material is published.
No subprocessor list is published and no model provider is named on SpotDraft's home, pricing or security pages, so which third parties see contract content is not stated. No consent or notification material for clients is published. Assurances about third parties stand in for identifying them: vendors handling scoped data are said to be bound by confidentiality, audit and incident response protocols, and fourth parties such as backup providers and subcontractors are stated to have no access to scoped systems or data.
A trust center is linked at trustcenter.spotdraft.com, and a request route for security documentation appears on the security page.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
HyperStart keeps version control and an audit trail of internal and external changes in negotiation, so the history of a contract can be reconstructed, and its InFlight dashboard reports process metrics for each contract in progress, such as status, time taken to review and number of turns. Clause 6.5 of the Terms of Service lets HyperStart keep confidential information needed for audit trails after termination. Nothing published says whether an AI redline or summary is marked as machine generated in that history, or which model produced it.
No export or template for disclosing AI involvement is published. HyperStart's output is a contract or a report rather than a court filing, so the likely audience for such a record is a counterparty or an auditor.
SpotDraft's security page says audit logging traces user actions at contract level. It captures signing and creation events and the trail of changes by both the creator and the counterparty, and every version of a contract is kept, which covers what changed, by whom and when. No model is named, so which system produced a passage cannot be established, and nothing in the log, as described, separates an AI change from a human one. No export built for a court disclosure or AI use certification is published.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Refusal and Uncertainty Behavior
Which one fits
Choose HyperStart CLM if
- You want the data terms in the contract. HyperStart's Terms of Service, version 2.0, license client data only to provide the service, store it for no other purpose, return contracts as Word or PDF files on termination and delete everything within 30 days. Its data processing addendum adds notice of a security incident within 48 hours of detection.
- You need India hosting with the AI processing stated. HyperStart's subprocessor list hosts Indian clients on AWS and MongoDB in India and US clients in the US, and shows OCR on Microsoft Azure and AI on OpenAI running in the US for both. Clause 8.6 of the Terms of Service records the client's consent to storage and processing in India and the US.
- You want migration and setup included and a trial first. HyperStart includes legacy contract migration, workflow setup and a named account manager in every plan, and offers a seven day trial before purchase. Its FAQ puts implementation at four to six weeks, and eSignature runs through Docusign, Adobe Acrobat Sign, Zoho Sign or a native one time password option.
Choose SpotDraft if
- Your data has to stay in a region beyond the US and India. SpotDraft holds personal data in a customer selected region across the US, the EU, India and the Middle East, and gives each contract its own encryption key. Primary and backup servers run on Google Cloud in the Netherlands, with keys held in HashiCorp Vault backed by Google Cloud KMS.
- Your general counsel wants the ethics guidance named. SpotDraft says its AI features follow the California State Bar's November 2023 guidance on generative AI and ABA Formal Opinion 512 of July 2024. HyperStart's terms state that the service is not legal advice and name no ethics guidance.
- You need integrations beyond CRM and storage. SpotDraft publishes pages for more than 30 integrations, including Greenhouse, Jira and Zapier alongside Salesforce, HubSpot, Slack, Word and DocuSign, and runs AI review inside Word with VerifAI. Single sign on covers Office 365, Google Workspace, Okta, Active Directory and custom SAML.
In summary
HyperStart CLM
HyperStart CLM is contract lifecycle management software from HyperVerge, covering drafting from templates and intake forms, no code approvals, AI redlining, eSignature, a repository with AI search filters and AI extraction for renewals and obligations. According to the AI Legal Index, its most specific published material is contractual: its Terms of Service limit use of client data to providing the service and delete it within 30 days of termination, and its India data processing addendum commits to least privilege access, logical separation and annual testing. Its subprocessor list names OpenAI for AI and Microsoft Azure for OCR, both in the US, with hosting in the US or India. No price, AI governance material or accuracy method is published.
SpotDraft
SpotDraft is a contract lifecycle platform for in house legal teams, covering creation from templates, conditional approval workflows, negotiation and redlining in Word, Slack or the browser, and built in eSignature. Its repository extracts more than a thousand metadata types, VerifAI reviews contracts in Word, and Sidebar agents answer questions and track regulatory change. According to the AI Legal Index, SpotDraft's clearest published positions are on residency and professional guidance: personal data stays in a customer selected region across the US, the EU, India and the Middle East, each contract has its own encryption key, and its AI features cite the California State Bar's guidance and ABA Formal Opinion 512. It names no model provider and publishes no training position or price.
Questions buyers ask
HyperStart vs SpotDraft: which CLM is better for a mid market legal team?
Both serve legal teams alongside sales, procurement, finance and HR, and both keep version history and an audit trail through negotiation. HyperStart puts more of its data handling in its contract, includes migration and setup in every plan, and offers a seven day trial. SpotDraft adds residency across the US, the EU, India and the Middle East, per contract encryption keys, more integrations and named ethics guidance. Neither publishes a price. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Does HyperStart use client contracts to train AI?
HyperStart's Terms of Service license client data only to provide the service and say it is stored for no other purpose, and its own analytics are limited to aggregated, anonymized usage data. No page names training in either direction, and the one training clause bars the client from using the service to train an AI model. Its subprocessor list names OpenAI as the AI provider. SpotDraft publishes nothing on training. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Where are HyperStart and SpotDraft hosted?
HyperStart hosts on AWS in the US or in India by client location, and runs OCR on Microsoft Azure and AI on OpenAI in the US for both. SpotDraft runs on Google Cloud in the Netherlands and stores personal data in a region the customer chooses across the US, the EU, India and the Middle East. Both describe a multitenant service with each customer's data logically separated. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
What do HyperStart's and SpotDraft's terms say about liability?
HyperStart's Terms of Service cap each side's liability at subscription fees paid in the 12 months before a claim, with nothing carved out of the cap, and indemnify the client against infringement, gross negligence, fraud and misuse of client data. SpotDraft's published Terms of Use cap its liability at one hundred Indian rupees and carry an indemnity from the customer only. Both are governed by Indian law, with disputes resolved in Bangalore. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
What do HyperStart and SpotDraft both leave unpublished?
Neither publishes a price, a measured accuracy figure for its own contract AI, a model name or version, or anything on legal privilege and work product. Neither publishes an AI governance framework. HyperStart's 95 percent accuracy figure describes HyperVerge's document processing across its business, and SpotDraft's published figures measure speed and cost rather than accuracy. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Both vendors publish agreements governed by Indian law, with disputes resolved in Bangalore. HyperStart's Terms of Service, version 2.0, cap liability at a year of fees and carve nothing out of the cap, and its published data processing addendum is the India version, written to the Digital Personal Data Protection Act. SpotDraft's published Terms of Use, version 2.3 of 21 February 2024, cap liability at one hundred Indian rupees and contemplate other terms for enterprise services that are not published. HyperStart's 95 percent accuracy figure describes HyperVerge's document processing across its business. Neither vendor reviewed this page.