Leah vs Luminance: how they compare in 2026

The models are the engine of the capability being sold, layered on a contract lifecycle platform that would function without them. The vendor argues the opposite, stating that other vendors bolted AI onto systems built for manual workflows while Leah was designed from scratch with orchestration as the foundation. The published record does not support that reading. ContractPod Technologies has sold contract lifecycle management since 2012; Leah launched in March 2023 as an AI services hub within that platform, went standalone in May 2023, and Leah Intelligence followed in October 2024. Strip out the agents and what remains is a working CLM with guided intake, approval routing, DocuSign and Adobe Sign execution, and a contract repository, which is a product with its own market and its own Gartner category placement. The orchestration layer is real and is genuinely model-driven, which is why this is a B rather than lower.

The artificial intelligence is the product, and the vendor owns more of the stack than almost anyone on this index. Founded by mathematicians in 2015, it runs a multi model architecture it calls a Panel of Judges combining foundation, fine tuned and proprietary models, and ships its own legal intelligence model, Luna Crescent, trained in house and deployed in its own environment. Remove the models and there is no product.

Accuracy is asserted repeatedly, and at one point claimed to be benchmarked, without a single figure attached. The AI governance page states that every action is measured against benchmarks for accuracy, bias and outcome, and the product material describes a legal helpdesk that answers contract questions with sources attached, which is a grounding claim a reader could in principle check inside the product. Searched the home page and the AI governance page in full on 31 Aug 2026 and located no accuracy figure, no error or hallucination rate, no description of any benchmark or test set, and no published evaluation. The benchmark claim is the sharpest version of the problem this axis exists to catch: a vendor asserting measurement without publishing the measurement. Nothing addresses what the system does when the customer's own contract set does not support a position.

Substantive disclosure with a real gap. The vendor publishes ContractIQ Bench, a proprietary benchmark of 189,000 manually annotated and reviewed data points assessing interpretation of named provision types including liability caps, termination for convenience and confidentiality obligations, tested on held out documents and concepts excluded from training, with blind evaluations by legal experts alongside. It publishes a result, 5 percent higher accuracy than leading general purpose models on contract understanding, and a speed figure of 200 to 400 tokens per second. It also states a design principle directly relevant to this axis: the model is trained to prioritise faithful extraction and to identify absence rather than invent an answer. Two gaps keep it off an A. The published figure is a relative delta with no absolute accuracy rate and no named comparator models, so a reader cannot tell what 5 percent higher is 5 percent higher than. And the benchmark is proprietary, with no sample tasks or rubric published, so an outsider cannot inspect or re run it.

The control structure is published in full and is the thing the vendor sells on. A dedicated AI governance page sets out a three-stage loop. Policy in: the customer defines which agents may act, on which data, within which thresholds, and where escalation is required, with those policies held as configuration rather than code. Execution governed: every agent action runs through those policies in real time, with approvals, escalations and rejections applied automatically and the orchestrator enforcing guardrails at each step. Audit out: every decision is logged with the rationale, what the agent did, why, under which policy, on what data and to what outcome, in records described as tamper-resistant and immutable. That covers the thresholds, the review surfaces and the route back to human judgement, and the home page states the position plainly, that the workflow runs itself while the judgment stays human. What is still missing is what happens after an output is found to be wrong, and default modes are not described because the guardrails are customer-configured rather than shipped.

A real published commitment with a described control mechanism, short of the full structure. The Panel of Judges architecture is itself an oversight design and is documented: multiple models analyse each clause independently and reach consensus, which the vendor states reduces hallucination risk. Outputs are described as traceable, and Traffic Light Analysis ranks deviation risk visually so a reviewer sees where to look. The vendor publishes a position piece arguing that human in the loop alone is insufficient and that systems must be designed for accuracy and transparency, which is a real stated philosophy rather than a slogan. Not located as of 29 Aug 2026: where the review point sits when the product negotiates with a counterparty directly, the threshold at which it escalates to a lawyer, and what the vendor commits to when an output is wrong. That first gap matters here more than for most, because the product sends agreements to counterparties and negotiates on the customer's behalf.

Substantial evidence on both halves of the question, never joined together. Named individuals speak on the record with roles and employers: Noelle Perkins, EVP and Chief Legal Officer at Cushman and Wakefield; Lidia Kamleh, Chief Legal Officer at Dubai Future Foundation; Frances Bain-Cumberbatch, Chief Legal and External Affairs Officer at Ansa McAL; and Zillia Knight, Senior Legal Officer at Terumo Europe. Every one of those quotes is qualitative. Separately, three figures are published with the customer anonymised: a 91 per cent cut in contract review time at a major US logistics company, more than 18 million dollars of revenue protected at a global manufacturer, and more than 2 million dollars of tracked savings at a US retail REIT. Roughly 54 enterprise logos appear, including Philips, MUFG, Sandoz, Pernod Ricard, Alaska Airlines and Wood PLC. A buyer should read that logo strip carefully: PwC and KPMG appear in it, and PwC entered a commercial alliance in March 2024, while Epiq resells Leah inside its Service Cloud, Integreon is quoted as an early adopter reselling onward, and Pinsent Masons adopted it for managed legal services in July 2025. Channel partners and customers are presented together without distinction, and a Chief Product Officer of Execo, another services partner, appears in the testimonial carousel.

Real deployment evidence with substance, short of attribution and method. Named customers appear in vendor and trade material including Hitachi, AMD, BBC Studios, Yokogawa and Koch, alongside a stated base of more than 700 organisations across 70 plus countries and all four of the Big Four consultancies. A customers page is published. The recurring figure, negotiation time reduced by up to 90 percent, is a vendor claim carrying a hedge and is not tied to any named customer, dated, or accompanied by a method. Searched the site, the customers page, the press releases and the resources index on 29 Aug 2026 and located no case study pairing a named organisation with figures and a date.

Specific published commitments on the questions that matter most, with two real gaps. The vendor states that customer contract data is never used to train models, and the AI governance page frames data leaking into models the customer does not own as a failure it engineered out, stating that zero data retention is the only acceptable answer and that it enforces zero retention with OpenAI and Anthropic so that data is processed but never stored by the providers. Encryption is AES-256 at rest and TLS in transit with keys held in Azure Key Vault, rotated and reachable only through controlled service accounts. Role-based access control is stated to be enforced at every layer, and single-tenant deployment is offered for customers with strict isolation requirements. Two gaps. Privilege and work product are not addressed anywhere on the surfaces read on 31 Aug 2026, on a platform sold into Fortune 500 legal departments. And none of it could be checked against an agreement: the legal and privacy pages are linked from every footer but neither could be retrieved, so every commitment recorded here sits on a marketing or governance surface rather than in a contract.

Substantive published commitments, short of the full picture. Segregation is the strongest element and is documented precisely: each customer receives a dedicated single tenant instance with complete isolation and no co mingling of data, which exceeds the level this buyer segment requires under the amended band. Access control is documented at an unusual depth, including that vendor staff cannot view customer documents without explicit authorisation given through the user interface, with all access tracked and audited. Encryption is specified to the key management service, cipher and rotation practice. Two gaps hold this off an A. No training prohibition on customer content was located anywhere in vendor material, which is a conspicuous absence for a vendor that trains its own models and publishes a corpus figure of 220 million legal documents. Attorney client privilege and work product handling is not addressed directly.

Nothing published on the advice line was located. Section 8 places this evidence in footers, disclaimers, terms and any ethics page; three of those four were checked on 31 Aug 2026, across the complete footers of the home page and the AI governance page and the full navigation and footer sitemap covering platform, solutions, resources and company. No disclaimer of any kind appears, there is no ethics or professional responsibility page, no bar or ethics guidance is named including ABA Formal Opinion 512, and no statement was found on the line between a tool and legal advice. The exposure is not trivial: the platform is sold to run legal work end to end across legal, procurement and finance teams, and its own framing is that agents execute multi-step commercial work without routing every decision through a person. The fourth home, the terms page at the site's legal link, could not be retrieved, so this grade is rebuttable on that document alone.

A boilerplate structure sits in the terms while the product is sold well beyond lawyers. Dedicated solution pages target compliance, executive, sales, procurement, finance, human resources and marketing teams alongside legal, and the product negotiates contracts on a customer's behalf. Searched the site, the solution pages, the published terms and conditions, the privacy policy and the resources index on 29 Aug 2026 and located no position on advice versus tooling, no treatment of competence or supervision duties, and no statement of jurisdiction limits, despite operation in more than 70 countries. This is the widest version of the non lawyer distribution question on the index so far, since the tool is marketed to marketing and HR departments.

The most substantial governance framework published by any vendor in this pull, short of a named owner and any disclosed result. A dedicated AI governance page names six failure modes the vendor says it engineered out, including black-box decisions that cannot be defended to a regulator or board, and compliance frameworks retrofitted after the fact. Against those it sets three pillars and the policy-execution-audit loop, with per-action logging of rationale and governing policy described as tamper-resistant and immutable, which is a mechanism a buyer could audit rather than a principle. It also makes a claim no other vendor in either pull has made: that every action is measured against benchmarks for accuracy, bias and outcome, with the page stating that accountability is structural rather than aspirational. That is why this is not lower. It is not higher because none of the substance behind the claim is published. No individual or role inside the vendor is named as accountable for model behaviour, no pre-release testing regime is described, no benchmark method or cadence is given, and no result of any bias measurement has been disclosed.

Principles and architecture are published without a governance mechanism a buyer could audit. What exists is real and substantial: a published white paper on how the AI is built, a named Director of AI who authors technical material under his own name, a Cambridge based research team, a described validation regime through ContractIQ Bench, and a security advisory board of named external experts. But the security advisory board governs security rather than model behaviour, and no equivalent exists for AI governance. Not located as of 29 Aug 2026: a named owner of model governance, a pre release testing gate as distinct from benchmark results, an AI management certification such as ISO 42001, and anything on uneven output across matter types, parties or populations.

Substantive published controls with two specific absences. The AI governance page publishes real operational detail: TLS for data in transit and AES-256 at rest, encryption keys managed through Azure Key Vault, rotated regularly and accessible only through strictly controlled service accounts, multi-factor authentication, secure API gateways, network segmentation, real-time monitoring, and a fully documented incident response plan. Audit logs are described as comprehensive, tamper-resistant and immutable. Assurance is external rather than self-asserted: the vendor states it is audited annually by an independent Managed Security Service Provider and penetration tested regularly. What is absent, checked 31 Aug 2026: no subprocessor list of any kind, with OpenAI and Anthropic named as model providers but no other processor identified, and no breach notification practice or timeline anywhere despite the incident response plan being referenced twice. No retention period for customer content was located either, which is recorded separately in the signals.

Substantive published policy covering most of the ground, at an unusual level of specificity. Published in the security FAQ: AWS Key Management Service encryption at S3 and EC2 level with AES-256 keys rotated regularly, TLS 1.2 or higher in transit, dedicated single tenant instances, role based and division level permissions configured by the customer under least privilege, configurable password and session timeout policy, mandatory staff security training, named threat detection through Darktrace's Enterprise Immune System and Juniper firewalls, and a described incident management process covering detection, mitigation and communication. Backups are stated precisely: nightly to a secondary AWS data centre in the same region, encrypted, retained a minimum of 14 days. Not located as of 29 Aug 2026: a retention period or deletion control for customer documents in normal operation as distinct from backups, and a named subprocessor list.

Row completed 2 September 2026 under R26, from the ContractPodAi Master Terms and Annexes v3.0c dated 29 August 2024, read in full. The whole allocation of loss is published with figures and it is tiered, which almost nothing else in this corpus manages. Section 16.5 sets a General Cap of amounts paid or payable in the twelve months before the first incident, then an Enhanced Cap of three times that figure which applies specifically to the provider's breach of the security clause or either party's breach of the data processing addendum. Uncapped Claims are enumerated: indemnification obligations, intellectual property infringement or misappropriation, breach of confidentiality, and anything that cannot be limited by law. Section 17.1 gives the customer a real indemnity, with the provider defending third-party claims that the service infringes intellectual property rights, remedies ordered at 17.5 as procure, replace or modify, or terminate and refund. Section 8.2 warrants that the service will perform materially as documented and that functionality will not materially decrease during a term, with a concrete remedy at 8.3 of correction within a thirty day fix period failing which the customer terminates and is refunded. Annex A adds published uptime tiers of 99.00, 99.5 and 99.9 per cent by support plan, with termination and refund if missed in three consecutive or four of six months. Three limits belong on the record and none is hidden. The uncapped confidentiality limb expressly excludes breaches related to Customer Data, so the confidentiality failure that would matter most to a contract platform is capped rather than uncapped, mitigated only by the Enhanced Cap where the security clause is also breached. There is no AI-specific or output indemnity: nothing addresses inaccurate output, hallucination, or training data provenance, and the indemnity at 17.7 is the exclusive remedy for intellectual property claims. And section 9.2 requires the customer not to submit Sensitive Data, defined to include GDPR Article 9 special categories, government identifiers and financial account numbers, with the provider disclaiming liability for such use, which is a meaningful allocation for a platform used on live matters. Trials and betas carry no warranty, indemnity, service level or support and are capped at one thousand US dollars under section 21. Version note: v3.0c is the version published and readable; the current v4.0 dated 4 January 2026 sits behind a viewer neither the operator nor this reader could render, and the vendor's own change note states the only modification is the update to the new trading name.

Liability is addressed only through published terms carrying a standard structure. Terms and conditions are published openly alongside a privacy policy, cookie policy and anti slavery statement, so a buyer can read the allocation of loss before entering a sales process, which keeps this above a pure absence. Searched those documents, the security page and the security standards white paper entry point on 29 Aug 2026 and located no indemnity running to the customer for third party claims arising from output, no warranty on output, no stated liability cap figure and no insurance position. Worth noting the product negotiates with counterparties on a customer's behalf, which raises the recourse question more sharply than a review only tool.

Real integrations into enterprise systems, named and functionally described, short of implementer documentation. The named set is the right one for this buyer and unusually broad for the category: ERP platforms including SAP and NetSuite, source-to-pay and procurement systems including Coupa, financial systems, identity providers including Okta, and existing contract lifecycle tools, alongside DocuSign and Adobe Sign built in for execution and a Microsoft Word add-in for redlining. The vendor describes the integration model rather than just listing logos, stating that integration is connect-and-execute, that Leah does not replicate data passively, and that it executes work across connected systems through the orchestration layer, which is a meaningful architectural claim. What was not reached on 31 Aug 2026 is depth: the dedicated integrations page was not opened, and nothing read states what syncs in which direction or what a customer must configure. No document management integration such as iManage or NetDocuments appears, consistent with an in-house rather than law firm product.

Integrations are asserted at platform level with no documentation an implementer could use. The vendor describes connecting intake, negotiation, workflow and repository intelligence in one platform, and a Collaborate product exists for working with counterparties, and third party sources reference Microsoft Word and Outlook working surfaces. What was not located on the vendor's own property as of 29 Aug 2026, after checking the platform pages, the technology page, the security page and the resources index, is any integrations page, any named connector for document management, contract lifecycle, e signature, CRM or ERP, and any description of what an integration moves or what an administrator configures. For an enterprise platform sold to procurement and finance functions, that absence is notable.

The tenancy model is addressed directly and the regions are not. Single-tenant deployment is stated to be available for customers with strict data isolation requirements, and beyond that the vendor offers what it calls a dedicated zero-trust private environment within Azure OpenAI Studio, described as ensuring complete data isolation from all other customers, which tells a buyer both that the default is shared and that a separated option exists. The infrastructure is identified as Azure, with encryption keys held in Azure Key Vault. Two things hold this at B, checked 31 Aug 2026. Data residency is addressed only in the abstract, with the vendor saying it supports the residency and regulatory requirements typical of large multinational enterprises and naming no region, no jurisdiction and no customer-selectable option. And nothing states where processing happens as distinct from where data is stored, which matters on a platform that routes work dynamically across multiple model providers.

Deployment model is stated clearly with partial residency detail. Three things are published and specific: a dedicated single tenant AWS instance per customer with complete isolation, deployment within the customer's own environment as an alternative to the hosted option, and backup to a secondary AWS data centre within the same region, which confirms data stays in region. The vendor states AWS global infrastructure provides a solution tailored to geographic requirements. What is missing is the list: no named available regions, no statement of which regions a customer may select, and no statement of where processing happens as distinct from where data is stored. The single tenant and on premises options are genuinely stronger than most of this index.

A long list of frameworks with no scope, no date, no auditor and no report, and the property contradicts itself on what is held. The AI governance page claims SOC 1 Type I and II, SOC 2 Type I and II, GDPR compliant, CCPA compliant, HIPAA ready and ISO 27001 aligned. The home page FAQ, on the same property, says only that Leah is SOC 2 Type II certified. Credit where it is due: the hedged wording is honest, since the page says aligned and ready rather than certified for ISO 27001 and HIPAA, and most vendors blur exactly that line. But the substance an attestation is judged on is missing entirely. The auditor is identified only as an independent Managed Security Service Provider, which is a category rather than a name; no coverage period or report date is given; no audit scope is described; penetration testing is said to be regular with no partner named and no summary published; and no trust centre or portal exists anywhere on the property, so there is no route to request a report either. Checked 31 Aug 2026.

Certification is real and stated with correct nouns, short of accessible evidence. ISO 27001:2022 is named with its version and described as certification, and the SOC 2 Type 2 language is precise: the vendor says successful completion of a SOC 2 Type 2 examination assessing controls related to security, availability and confidentiality, which is the correct noun for SOC 2 and names the trust services criteria in scope. That is more careful phrasing than most vendors on this index manage. Regular independent third party penetration testing is stated. A named external security advisory board including a former Director General of MI5 and two former Darktrace executives is published with full biographies. What is missing is the evidence route: no trust portal was located, no report is downloadable or requestable through a published flow, and no coverage period, report date or auditor name was located as of 29 Aug 2026. A security standards white paper is published, which is the nearest thing to an evidence route.

Amended 2 September 2026 under R42, after the Master Terms and Annexes v3.0c were read in full. The original note recorded that nothing committed the vendor to notifying customers when the provider set or the models change; that is withdrawn. DPA clause 4.3 requires a new subprocessor to be added to the published list and the customer notified at least thirty days before it processes any customer personal data, and clause 4.4 gives a thirty day objection right on reasonable data protection grounds, with termination of the affected order and a refund of prepaid unused fees if the objection cannot be resolved. The provider set is also larger than first recorded. The DPA Setup Page names four model providers rather than two, each listed against Leah Functionality with a parenthetical that no customer data is stored or retained by that provider and each with named jurisdictions: Anthropic PBC across the USA, Japan and the EU or UK; OpenAI LLC across the USA, Japan and the EU or Switzerland; Cohere Inc. across Canada, the USA, the EU or UK and Japan; and Google AI/ML alongside Google Cloud across the USA, Japan and the EU, Switzerland or UK. Microsoft Azure Services is separately listed for data hosting and translation, and the private deployment option remains identified as Azure OpenAI Studio. The grade does not move, and the limb that holds it is unchanged: no model or version is named for any of the four providers, and naming the house is not naming the model. The architectural disclosure problem also stands and is sharper with four providers than with two. The platform is described as dynamically selecting across multiple advanced language models to match each task to the right model, and as allowing customers to extend or customise models, so which provider handled a given piece of legal work remains unknowable to the buyer from anything published.

The supply chain is partly disclosed and the architecture is described in more depth than most. The vendor publishes that it runs a multi model Panel of Judges combining foundation, fine tuned and proprietary models, that it continuously evaluates and selects the best model per task, and that its own model Luna Crescent is deployed inside its own AWS environment. It states the supply chain consequence explicitly and in the customer's terms: owning the model reduces reliance on external model providers, limits data exposure to additional subprocessors, and protects customers from third party availability, pricing and access disruption. Hosting is named as AWS. What is not published is which foundation models sit in the panel, from which providers, or which tasks route to them, and no subprocessor list or change notification commitment was located as of 29 Aug 2026. A buyer therefore knows the shape of the chain and its own model, but not the third party links in it.

No pricing information is published at any level, including the unit of charge. Searched the home page, the AI governance page, the full primary navigation covering platform, solutions, resources and company, and the complete footer sitemap on 31 Aug 2026. There is no pricing page, no tier structure, no per-seat, per-contract or per-agent unit, no volume banding, and no indication of what implementation adds. Every call to action across the property is to request a demo. The closest the vendor comes is an implementation FAQ stating that timelines vary with scope and integrations and that a detailed plan is built during evaluation, which is a statement about effort rather than cost. Nothing published would let a prospective buyer form any view of price before entering a sales process.

Checked the site navigation, the platform and solution pages, the customers page, the about section and the footer on 29 Aug 2026. No pricing page exists on the property, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path terminates in a demo request. No free trial or self serve entry point was located, and no third party pricing figure was located either.

Segment coverage is documented precisely across two dimensions and the boundaries are never stated. By industry the vendor publishes dedicated pages for CPG and manufacturing, energy and utilities, financial services, healthcare, and pharma and medical devices, and describes its customers as Fortune 500 enterprises in regulated industries. By function it publishes pages for legal leadership, legal operations, sales and revenue, procurement, and finance, with distinct propositions written for the General Counsel, the contract operations team, the Chief Procurement Officer and the finance leader. The customer roster evidences that spread rather than merely claiming it, spanning banking, airlines, pharmaceuticals, consumer goods and engineering. What is absent is the far edge. No statement identifies which practice areas, contract types or matters the platform does not support, nothing addresses smaller organisations, and law firms appear only indirectly through managed service partners rather than as a served segment. Checked 31 Aug 2026.

Who the product serves is documented precisely across two dimensions, each with its own published pages. Six industries: manufacturing, financial services, pharmaceutical, technology, insurance and chemical. Eight business functions: legal, compliance, executive, sales, procurement, finance, human resources and marketing. Both law firms and corporate legal departments are addressed, with a stated base of more than 700 organisations across more than 70 countries including all four Big Four consultancies and named enterprises. An academic programme is published as a separate segment. The practice boundary is clear from the structure and consistent throughout: this is contract work end to end, from generation through negotiation to post execution analysis and investigation, and nothing on the property claims litigation or research capability it does not have.