Leah vs Oneflow: how they compare in 2026
Leah is a fit for organizations wanting an agentic CLM environment with contract answers, drafting and a range of repository connections. Its Contract Helpdesk connects answers to agreement clauses, and the CLM product now identifies NetDocuments as well as other file systems. Oneflow instead emphasizes interactive web agreements, Salesforce synchronization and workspace playbook review. Both offer inspectable contract findings, so the selection turns on the surrounding workflow and contractual commitments. Leah's agreement permits private customer model improvement while restricting third party training; Oneflow prohibits training on customer data but excludes generative AI confidentiality undertakings. In the separation between learning permissions and confidentiality protection, AI Legal Index identifies a distinction that a generic private AI label misses. Leah's ordinary IP indemnity also excludes AI output, while Oneflow's generative AI carveout removes all indemnification undertakings for that functionality.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Leah sells AI agents and an orchestration layer that sit on top of a contract lifecycle platform, and that platform works without them. The vendor describes it the other way round. It says other vendors bolted AI onto systems built for manual workflows, while Leah was designed from scratch with orchestration as the foundation. ContractPod Technologies has sold contract lifecycle management since 2012. Leah launched in March 2023 as an AI services hub within that platform, went standalone in May 2023, and Leah Intelligence followed in October 2024. Without the agents, the product is still a working CLM with guided intake, approval routing, DocuSign and Adobe Sign execution and a contract repository. That CLM has its own market and its own Gartner category placement. The orchestration layer on top is model driven.
AI supports several substantial contract tasks within Oneflow's wider platform. Write with AI drafts, edits and translates text inside an agreement; AI Extract imports participants, dates and duration into editable metadata. AI Review compares terms with a workspace playbook, and AI Insights aggregates the resulting risks across the portfolio. The premium package adds custom rules, dashboard widgets and a report for negotiation follow up. Electronic signatures, editable HTML agreements, permissions, approvals and renewal reminders continue to work without these models. Customers can disable AI, and several review capabilities remain in beta. AI therefore changes how users analyze contracts without replacing the underlying contract system.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Leah's Contract Helpdesk answers questions from the customer's agreements and links each response to the clause or document supplying the answer. Its illustrated payment example identifies the agreement version and clause number, while Leah Discovery extends retrieval across a portfolio. Users can open the underlying contract and initiate a reminder, amendment or escalation from the answer. This is a described route from a question to its contractual source. However, the product's categorical claim that Leah does not hallucinate is not supported by a published test set or error breakdown. The AI terms expressly disclaim accuracy, completeness and currency, and linked contract text does not validate external legal authority.
Review findings connect to highlighted passages in the agreement, with controls for moving between them. Each finding carries the relevant playbook concept, configured feedback and example clause text. A separate view identifies required clauses that the review did not find, while portfolio charts open the corresponding contract list. This lets the reviewer compare a proposed concern with the actual wording and the organization's rule. Oneflow warns that generated text can misstate facts, numbers and law and recommends human correction. No reproducible accuracy study, error rate or jurisdiction specific evaluation accompanies these features. The contract highlighting supports source verification, not validation of legal authority.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Customer policies determine which Leah agents may act, the data they may access, thresholds, and escalation requirements. The orchestrator applies approvals, escalations, and rejections during execution, then records the action, rationale, policy, inputs, and outcome. Policies are configurable rather than fixed defaults. The AI terms add a categorical limit: automated decisions with legal or similarly significant effects on individuals require adequate human review and legal compliance. Customers must also independently verify outputs and cannot present them as provider approved or wholly human generated. Trials and betas are restricted to internal evaluation. These contractual limits accompany the product's policy, execution, and audit loop.
Administrators enable AI Review for a workspace and configure its playbook, including which clauses matter, which findings count as risks or issues, and what feedback appears. Role permissions separately control access to individual reviews and the Insights dashboard. Sent contracts receive continuing analysis; draft contracts require a manual review action. A person can inspect highlighted text, edit the playbook and use example wording when revising an agreement. The AI appendix advises human review before relying on output. No confidence cutoff, mandatory lawyer approval after an AI finding, or correction route for an already approved mistake is specified. Risk colors classify findings rather than stop execution.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Leah publishes qualitative quotes from four named people. Noelle Perkins is EVP and Chief Legal Officer at Cushman and Wakefield, and Lidia Kamleh is Chief Legal Officer at Dubai Future Foundation. Frances Bain-Cumberbatch is Chief Legal and External Affairs Officer at Ansa McAL, and Zillia Knight is Senior Legal Officer at Terumo Europe. Three results are published with the customer unnamed. A major American logistics company cut contract review time by 91 percent. A global manufacturer protected more than $18 million of revenue, and an American retail REIT tracked more than $2 million of savings. About 54 enterprise logos appear, including Philips, MUFG, Sandoz, Pernod Ricard, Alaska Airlines and Wood PLC. PwC and KPMG appear among them. PwC entered a commercial alliance in March 2024, and Epiq resells Leah in its Service Cloud. Integreon is quoted as an early adopter that resells it, and Pinsent Masons adopted it for managed legal services in July 2025. Partners and customers are shown together without distinction, and the Chief Product Officer of Execo, another services partner, is among the testimonials.
Puzzel's Sales Operations Manager, Anette Johnsen, describes generating offers and contracts from Salesforce opportunities with items from related CPQ quotes. She identifies a concrete benefit of the HTML format: participants revise one agreement instead of uploading successive files before signature. Other named users include Systembolaget's Head of Indirect Sourcing, Tor Myhrman, and Hedin Bil's HR Business Partner, Elin Skoglund, who describe handling agreements and maintaining oversight. These accounts establish operational use across sales, procurement and HR. They do not isolate AI review performance or supply a measured error reduction, evaluation period and sample for Oneflow's current AI packages.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Customer inputs and outputs are confidential Customer Data under the May 2026 agreement. Their use is limited to providing and maintaining the service, with a separate AI clause permitting training or improvement solely for that customer's benefit. The trust portal rules out generalized model training, while the DPA identifies four model providers that store or retain no Customer Data. Role permissions and a private Azure OpenAI environment support access isolation. Mutual confidentiality obligations and prior notice of legally compelled disclosure apply. Explicit privilege and work product preservation, and matter-specific retrieval walls inside a customer's organization, remain unspecified.
The AI appendix expressly prohibits Oneflow from training any AI model on customer data and takes precedence over conflicting general terms for AI features. Ordinary service confidentiality continues while information remains confidential, with restrictions on compelled disclosure. There is a consequential exception: the generative AI section excludes Oneflow's contractual confidentiality obligations along with liability, indemnities and service levels. Review, Insights and Extract have a separate processing section tied to the DPA. Workspace permissions and optional provider controls support access management, but attorney client privilege and work product receive no specific undertaking. The contract therefore requires attention to the exact AI functionality being enabled.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Attachment D requires independent review of every AI output for its intended use and prohibits representing output as provider approved or wholly human generated. Automated decisions with legal or similarly significant effects require adequate human review and compliance with law. The platform nevertheless promotes autonomous work across legal, procurement, finance, and contracting functions. These general AI use restrictions establish customer responsibilities, but do not explicitly distinguish legal advice from software assistance, restrict use by jurisdiction, or map professional competence duties. The broad legal automation positioning therefore has a contractual review requirement without a dedicated professional responsibility explanation for practicing lawyers.
Oneflow's AI appendix says output is not legal advice, legal conclusions, recommendations about legal rights or an application of law to a customer's circumstances. It advises human review because generated content can misstate law as well as facts. A separate UK article maps solicitor responsibilities to SRA standards, confidentiality, client communication and supervision, and describes practical review and pilot controls. North American terms also prohibit treating the platform as a substitute for an attorney. The product nevertheless serves sales, HR and other users without legal qualifications. No comprehensive jurisdiction by jurisdiction set of product restrictions or lawyer competence program is supplied.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
A dedicated AI governance page names six failure modes the vendor says it engineered out. They include black box decisions that cannot be defended to a regulator or board, and compliance frameworks retrofitted after the fact. Against them the page sets three pillars and a loop of policy, execution and audit. Each action is logged with its rationale and governing policy, in records described as tamper resistant and immutable. The page also says every action is measured against benchmarks for accuracy, bias and outcome, and that accountability is structural rather than aspirational. It names no person or role accountable for model behavior and describes no testing before release. It gives no benchmark method or schedule and discloses no bias measurement result.
Oneflow promotes human accountability and warns against automation bias in its guidance for UK legal teams. It recommends evaluating missed issues, overrides and review quality rather than relying only on speed, and says its AI performs best in English and Swedish. These are useful limits and principles for customers designing a pilot. The public material does not identify an accountable AI governance owner, publish a model release evaluation, or report bias and performance differences across languages, contract types or populations. General ISO security controls and a list of security policies concern operational protection; they do not describe a separate AI testing and governance program.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The DPA names model, hosting, support, signature, and integration subprocessors with their locations and purposes. New subprocessors require 30 days' notice and permit an objection, with termination and unused-fee refunds if unresolved. Security incidents affecting personal data require notice within 48 hours of awareness. The trust portal describes role restrictions, identity-provider authentication, monitoring, incident exercises, and penetration testing. Contract data can be exported during the term and deleted following a request after termination, subject to backup and legal exceptions. A routine prompt history duration remains unspecified. Provider-level zero retention does not define the lifetime of records held by Leah itself.
Contract data is encrypted with AES 256 at rest and TLS 1.2 in transit. Customers configure permissions and retention policies; administrators can disable optional providers or AI features. Global DPA terms require breach notification without undue delay, while the North American DPA specifies 48 hours. Daily database snapshots last seven days, and system and authentication logs last 90 days. The DPA permits limited residual backups after deletion without fixing that period. Generative AI history can follow provider terms, while the product page promises removal of temporary review and import data. That leaves no single, specific retention schedule for every prompt and output.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Leah's May 2026 Cloud Terms exclude infringement by AI output from the provider's intellectual property indemnity. Attachment D also disclaims output accuracy, completeness and currency, requiring customers to independently verify results. Ordinary cloud service remedies remain: a performance warranty, correction or termination with a refund after an unsuccessful 30 day fix period, and an indemnity for covered service infringement claims. The general liability ceiling is fees paid or payable in the preceding twelve months, with a threefold ceiling for security or DPA breaches and specified uncapped claims. Trials and betas have no indemnity or warranty and a $1,000 cap. These software remedies do not remove the explicit AI output exclusions.
Ordinary global service terms include an intellectual property defense obligation, a material performance warranty and a general cap based on 12 months of fees. Those protections do not carry through unchanged to AI. The appendix supplies AI output as is, disclaims warranties and excludes all liability and indemnification undertakings for generative AI functionality, together with confidentiality obligations and agreed service levels. It also permits specified AI suspensions or termination without reimbursing fees. North American terms contain the same generative AI exclusion. A wrong clause, inaccurate summary or reliance on generated advice has no specific affirmative AI remedy in these published terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Leah connects contract workflows with Salesforce, Microsoft Dynamics and HubSpot opportunities, while an Outlook add in starts contracts, uploads attachments and triggers approvals that synchronize with the CLM. Signature connections let customers configure signing order, copied recipients and expiry dates, then return executed agreements to the repository. Word supports review and tracked changes. The current CLM page also lists SharePoint, OneDrive, Box, Google Drive, Dropbox and NetDocuments, replacing the earlier absence of a named legal document system. ERP connections include SAP, Oracle, Workday and Coupa. Detailed field mappings, direction and permission inheritance for every connector remain unspecified, especially for the document systems.
The Salesforce integration creates interactive contracts from opportunities and transfers contact, company and opportunity data into them. Its configurable sync sends data from Salesforce objects into Oneflow and returns contract values to Salesforce. Product tables can reflect price books or CPQ quotes, while workflows map contract stages back to pipeline stages. Engagement events and status changes appear in the Salesforce timeline, and returned contract data supports dashboards. Oneflow identifies separate setup guidance for older and newer integration versions and compatibility with Professional edition upward. HubSpot, Dynamics 365 and other CRM connections complement this workflow; Salesforce and Dynamics can require premium integration charges.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Shared cloud delivery is standard, with single tenant deployment and a private Azure OpenAI environment available for additional isolation. The May 2026 subprocessor schedule adds region-specific hosting arrangements across Microsoft Azure, Google Cloud, and Oracle Cloud. Azure lists Europe, the United States, and Australia; Oracle also includes India, while Google lists Japan and several European jurisdictions. Model providers have their own location lists, selected according to the customer's hosting region where applicable. This distinguishes hosting from model services, but does not establish a complete per-customer map of storage, inference, backups, and support access across each product configuration.
Production infrastructure uses AWS availability zones in Ireland, with document replication and backups in Sweden. Oneflow's AI FAQ broadly describes data as remaining in the EU, and Insights Premium is described as running within Oneflow's own EU infrastructure. The published subprocessor table gives a more varied picture: optional Legly review operates in Germany, optional OpenAI extraction in the United States, and Postmark email processing also in the United States. Administrators can disable optional services. The public descriptions do not fully reconcile these routes or map every AI function to a processing region. No on premises deployment is offered in the published package descriptions.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A-LIGN's ISO/IEC 27001:2022 certificate covers the information security management system for design, development, operation, maintenance, and support of Leah CLM and Leah Legal as SaaS. Certificate ISMS-CO-032326 was issued March 23, 2026 and expires March 23, 2029. The trust portal provides the certificate directly, alongside a SOC 3 report covering the contract management and Copilot systems from October 2024 through September 2025. That report addresses security, availability, confidentiality, and privacy, with Azure and customer control dependencies excluded from the auditor's examination. Penetration-test material is also available. These attestations concern system controls, not the correctness of an AI legal recommendation.
A public certificate issued by Qvalify covers Oneflow AB's digital solution for contract automation under ISO 9001:2015, ISO 14001:2015 and ISO 27001:2022. It was issued on June 28, 2024 and remains valid through June 30, 2027, identifying the Stockholm organization and its registration number. A June 2026 statement of applicability lists the security controls and their implementation status. The security center separately identifies SOC 1 Type 1 and SOC 2 Type 1 reports issued by Grant Thornton, available under NDA. Those reports concern control design; neither is identified as a Type II examination of operating effectiveness over a stated period.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The May 2026 DPA lists Anthropic, OpenAI, Cohere, and Google AI/ML for Leah functionality, each with a no-storage or no-retention statement and defined processing jurisdictions. Azure supports hosting, translation, and Office services; Oracle and Google add hosting options. Zuva handles document intelligence, and ABBYY is limited to older CLM deployments. The platform routes tasks among language models and allows customer customization. New subprocessors require 30 days' notice, with an objection and termination route. Model versions and the provider selected for a particular generated passage remain unspecified. The regional provider list describes available processing arrangements rather than a complete execution record.
The subprocessor list identifies Legly AB for contract review in Germany and OpenAI for extraction in the United States, alongside AWS infrastructure in Ireland and Sweden. Both AI suppliers are optional and controlled through account settings. The AI appendix directs customers to their Data Management page for the current generative model suppliers and their terms. It does not publish model versions or a complete function to model map. DPA provisions require reasonable advance notice of subprocessor changes to the customer's designated email address and allow a 14 day objection. That process concerns suppliers, without promising notice of every underlying model change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The cloud service uses negotiated orders with a default 12-month subscription, automatic renewal, and 30-day nonrenewal notice. Standard, Gold, and Platinum support plans set different support hours, response targets, and availability commitments. Professional services require an order or statement of work, with possible travel expenses and separately quoted configuration work. AI access is described as unlimited subject to fair use, including restrictions on excessive compute, API calls, storage, and transfer. No subscription amount, seat rate, or implementation price is stated. For applicable European switching arrangements, an early termination charge can include the remaining subscription fees despite the right to transfer data.
Business starts at $292 a month, billed annually, including five users; Enterprise has ten users and a custom quote. Business includes writing, extraction and summary features. Standard AI Review and Insights have conflicting public treatment: the pricing page marks paid beta additions, while September help guidance says they are included in Enterprise during beta. Insights Premium is explicitly a paid addition for Business and Enterprise. SMS, identity verification, premium integrations and enhanced support can cost more. A 14 day trial needs no card. Implementation has no published amount, and global annual renewals can increase by the greater of 5 percent or Swedish CPI.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Leah publishes dedicated industry pages for CPG and manufacturing, energy and utilities, financial services, healthcare, and pharma and medical devices. It describes its customers as Fortune 500 enterprises in regulated industries. By function it publishes pages for legal leadership, legal operations, sales and revenue, procurement, and finance. The pages carry distinct propositions written for the General Counsel, the contract operations team, the Chief Procurement Officer and the finance leader. The customer roster spans banking, airlines, pharmaceuticals, consumer goods and engineering. No published page says which practice areas, contract types or matters the platform does not support, and none addresses smaller organizations. Law firms appear only indirectly, through managed service partners, rather than as a served segment.
Legal, procurement, sales, finance and HR teams can create and manage agreements in Oneflow. Legal users configure review rules and approve terms; business teams use reusable templates and CRM data for offers, sales agreements and employment documents. Named customers span telecoms, retail, recruitment and public sector purchasing. UK guidance also addresses solicitors using AI for commercial contract review, bringing professional duties into the intended audience. AI is optimized for English and Swedish, with variable results in other languages. The product does not supply a jurisdiction specific research corpus, and its coverage statements do not define supported litigation work or every category of legal agreement.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Attachment D permits use of inputs and outputs to train or improve AI features solely for the customer's benefit. The same agreement treats both as Customer Data. The trust portal excludes generalized model training, and the DPA says Anthropic, OpenAI, Cohere, and Google store or retain no Customer Data for Leah functionality. Private customer improvement is therefore permitted even though generalized training and retention by those model providers are restricted.
The AI appendix forbids Oneflow from using customer data to train any AI models and overrides conflicting general terms for AI issues. Inputs and attributable outputs fall within the customer data definition. The general service license permits improvement and anonymized analysis, and AI feedback may improve accuracy, but those clauses do not remove the express training ban. The product FAQ also says underlying models do not train on customer data.
Separate provider processing, retained history and the generative AI confidentiality exclusion remain relevant to handling client material.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Inputs and outputs are Customer Data under the AI terms. Export is available during the subscription, and deletion follows a request after termination within 60 days, with backup and legal exceptions. The DPA permits access, return, or deletion of personal data during service but sets no routine prompt history duration. Zero retention at named model providers does not define how long Leah keeps its own conversation, output, or audit records.
Oneflow permits customers to set retention policies for stored contracts, and its AI page says temporary import, review and Insights data is removed after use. Generative AI has a different contractual provision: input questions and output responses may remain as history under the model supplier's current terms. No uniform period covers that history or every provider copy. Daily database snapshots last seven days, system logs last 90 days, and residual backups after termination have no precise DPA deadline. Contract deletion therefore cannot be treated as an immediate purge of all AI processing records.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Leah describes role permissions, restrictions on the data agents may access, single tenant deployment and a private Azure OpenAI environment. These establish claimed controls for separating customer information and limiting access. Its trust portal also describes least privilege and reviews of staff access. The materials do not explain how retrieval enforces a barrier between separate legal matters inside one customer organization, or how permissions inherited from an external document system constrain an agent's answer. Corporate tenant isolation should not be assumed to provide a law firm's matter conflict controls.
Workspace roles control access to contracts, and Oneflow provides distinct permissions for AI Review and the Insights dashboard. Administrators enable review for selected workspaces and can disable AI features or optional suppliers. These controls can support departmental separation and limit who sees review results. The descriptions do not specify how retrieval enforces every contract permission within a workspace, how restrictions propagate to generated summaries, or how a law firm's matter wall follows an AI request. Permission controls alone do not establish a complete ethical wall mechanism for confidential client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 19 permits legally required disclosure of confidential information, including Customer Data. Where law permits, the recipient must give reasonable advance notice and cooperate at the discloser's expense to seek confidential treatment. Inputs and outputs are covered as Customer Data under the AI attachment. The obligation therefore reaches customer AI material as well as uploaded contracts, without a separate transparency report or history of government demands accompanying it.
Global confidentiality terms require reasonable prior notice when disclosure is legally compelled, unless notice is prohibited, and reasonable assistance at the customer's expense in seeking protection. That gives the customer an opportunity to contest or narrow a request involving ordinary confidential service data. The AI appendix expressly removes contractual confidentiality obligations for generative AI functionality, so the same protection should not be assumed across every AI route.
No transparency report accompanies the commitment. North American and global agreements need to be matched to the contracting entity and enabled services.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Leah uses the customer's contracts, internal policies and playbooks to answer questions and guide its agents. Those materials are an internal reference base, not an identified external legal corpus. The vendor also refers to established legal precedents, without naming a case law database, jurisdiction, publisher or licensing arrangement. No update schedule accompanies that reference. Source links to a customer's agreement can establish the origin of a commercial term, but do not establish the provenance or rights basis of any external legal authority used in an answer.
Oneflow's review and portfolio analysis work with the customer's agreements and configured playbook concepts. Example clauses come from the organization's rule setup, and drafting can use selected text as input. No catalog of legislation, reported decisions or licensed legal commentary is supplied for these features. Naming a model provider does not identify the legal sources in its training data or their licensing terms.
The UK educational articles link professional guidance, but those links do not constitute a legal research corpus inside the product.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Leah describes no citator, treatment signal or currency check, and does not say whether legal authority is reviewed for later history. The platform manages contracts, obligations and procurement workflows rather than retrieving case law, so a citator is not part of what it sells. The vendor does refer to Leah operating against established legal precedents, without identifying any source. That is the one place the product invokes primary authority, and no verification step is described for it.
Highlighted review passages let a user inspect contract language, not whether a judicial decision remains authoritative. Oneflow has no published citator connection, treatment history service or automated check of legislation's current status. Teams maintain their own playbooks, including preferred and fallback clauses, so changing a rule after a legal development remains an organizational responsibility. The appendix warns that AI can generate incorrect law and recommends human review. A portfolio risk chart or missing clause flag does not establish that the underlying legal proposition remains valid.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The home page and the AI governance page describe no explicit path for Leah to decline to answer or abstain, and no confidence or grounding rating. The governance loop does produce rejections. Approvals, escalations and rejections are applied automatically according to the customer's rules. Those are policy outcomes set by configured guardrails, not the model declining because it cannot ground a response. Neither page says what Leah does when the customer's own contract set or playbook does not cover the question in front of it.
The AI Review interface separates findings from a missing clauses view. That view identifies playbook concepts absent from the agreement, giving the reviewer an explicit negative result instead of merely omitting a match. Red and yellow labels distinguish issues from risks; they are not numerical confidence estimates. Oneflow warns that generated facts and law can be wrong, but does not publish a general abstention rule for drafting or summaries. Missing clause handling is described for review, without promising that every unsupported question will be refused.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Neither Leah nor ContractPodAi appears in the AI Hallucination Cases database maintained by Damien Charlotin. Its entries concern court decisions involving hallucinated content, with tool names recorded where available. Leah's principal workflows cover commercial contracting, procurement, and related legal work rather than preparation of court submissions. That product setting helps explain the limited relevance of litigation records, but a missing entry is not a measure of the accuracy of its contract answers or redlines.
Damien Charlotin's AI Hallucination Cases database contained no entry naming Oneflow as of October 16, 2026. The result covers the database's reported court incidents, not every private use of the product or every inaccurate contract response. Oneflow itself discusses court examples involving generic AI tools in educational material; those examples do not identify Oneflow as the tool involved. Contract drafting and risk analysis can still produce incorrect law, which the AI appendix expressly warns about. The absence of a named incident provides no accuracy guarantee.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Leah publishes nothing that engages with bar or ethics guidance. That includes ABA Formal Opinion 512, state bar guidance in the United States, and Solicitors Regulation Authority or Law Society material. The company is headquartered in London and sells into legal departments across North America, Europe, Asia and Australia. Its published compliance material covers regulation and security frameworks, namely GDPR, CCPA, HIPAA, SOC and ISO. None of it addresses the professional conduct obligations that bind the lawyers using the product.
Oneflow's UK contract review guidance maps SRA standards and conduct duties to human supervision, confidentiality, client transparency and practical controls. It also discusses insurance, data protection and the legal team's responsibility for final judgment. This is a jurisdiction specific mapping with suggested review steps, rather than a generic statement that lawyers remain responsible. It is vendor guidance, not regulator approval or an independent finding of compliance. The mapping does not establish equivalent coverage for every jurisdiction in which Oneflow sells its platform.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Leah serves corporate legal, contracting, procurement, and finance teams, and also supports legal services delivered to clients. Pinsent Masons Vario adopted the platform for its Managed Legal Services and Consulting work, including contracting support for customers' internal legal departments. Corporate efficiency figures concern operating cost, while the firm's use can affect client service delivery. The platform records agent actions and policy decisions, but gives no specific method for adjusting client fees or disclosing saved lawyer time.
The vendor's UK AI review material addresses solicitors as well as internal legal departments and promotes faster review with retained professional judgment. Its product pages also describe reducing routine contract work and administrative effort. No accompanying procedure explains how a firm records AI time, adjusts a client invoice, discloses savings or passes through Oneflow charges. Subscription pricing is the buyer's software cost rather than a client billing policy.
Because the audience includes lawyers serving clients, the time savings claims cannot be treated solely as an organization's internal operating expense.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Attachment B includes the DPA, processing details, transfer mechanisms, and a subprocessor list by purpose, location, and product. Model providers are Anthropic, OpenAI, Cohere, and Google, alongside hosting, signatures, support, and integration suppliers. Codestone, Freshworks, Oracle, and Totango appear in the May 2026 list. New providers require 30 days' notice and permit objections. The AI terms separately disclose customer-specific training permission and require independent output review.
Oneflow supplies a public DPA, global and North American service terms, an AI appendix and a subprocessor table with functions and processing locations. Optional AI suppliers include Legly and OpenAI, and administrators can control optional services. A public ISO certificate and statement of applicability support security diligence; SOC reports require an NDA. These materials help counsel explain data handling to a client.
They do not form a dedicated client AI disclosure package, and the generative AI confidentiality exclusion and conflicting regional descriptions require specific attention in any outside counsel approval process.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The audit stage of Leah's published governance loop logs every decision. Each entry records what the agent did, why, under which policy, with what data and with what outcome. The records are described as tamper resistant, immutable and ready for any audit. That gives the action, the rule, the inputs and the result for each action. The published description of the log does not include the model. The platform chooses among several language models for each task and identifies no model or version, so the log does not show which system produced a given passage.
No export built for court disclosure or AI use certification is described. The audit framing is regulatory and internal rather than judicial.
AI Insights supports an export of portfolio analysis, and reviewers can inspect the contract passages associated with a playbook finding. Insights Premium adds an action report for internal discussion and negotiation. Enterprise also includes an account audit log, while signing workflows maintain transaction records. The published export instructions do not establish a complete record of model identity, prompt, output and human edits for each AI action.
These are useful contract administration records, but no court disclosure template or complete model provenance export is described for a later filing.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
Which one fits
Choose Leah if
- The contract environment needs NetDocuments among its repository connections.
- A clause linked Contract Helpdesk is central to the legal team's workflow.
- Agentic CLM and wider file services form the intended platform scope.
Choose Oneflow if
- The negotiation process centers on one editable web agreement.
- Salesforce objects, CPQ items and pipeline stages need synchronized contract data.
- A published Business package is useful for a smaller first deployment.
In summary
Leah
Leah combines agentic contract workflows with clause linked answers and repository connections including NetDocuments, SharePoint and other file services. Its service agreement distinguishes private learning, provider processing and ordinary service remedies.
Oneflow
Oneflow offers interactive contracts and configurable playbook reviews in a workspace connected to CRM activity. Customers can inspect highlighted findings, while Premium adds custom portfolio views and negotiation action reports.
Questions buyers ask
Does Leah now identify a NetDocuments connection?
Yes. Its current agentic CLM material lists NetDocuments alongside SharePoint, OneDrive, Box, Google Drive and Dropbox. The listing does not itself establish every permission or field mapping detail. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Can both platforms show where a review finding comes from?
Leah's Contract Helpdesk links answers to clauses and agreements. Oneflow provides highlighted text and a playbook concept for review findings, with a separate list of missing clauses. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Are their indemnity exclusions identical?
No. Leah retains an ordinary service IP indemnity with an AI output exclusion. Oneflow's generative AI appendix removes all indemnification undertakings for that functionality, as well as confidentiality and liability obligations. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What should a private AI claim be tested against?
When translating privacy language into contract rights, AI Legal Index distinguishes Leah's permitted private customer learning from Oneflow's training ban. Oneflow's separate confidentiality exclusion means the training rule alone does not establish the full protection of client material.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Leah's ordinary service indemnity and Oneflow's generative AI exclusions have different scopes.