Legl vs Thirdfort: how they compare in 2026

The AI is a platform layer rather than a feature, and the vendor's own information architecture says so: Risk Agents is one of three items under Platform, alongside the Governance Layer and Integrations, and sits above the six solution modules rather than inside one of them. The agents are described as operating across the client lifecycle: researching and structuring screening matches, triaging ongoing monitoring alerts, reading bank statements in source of funds, analysing trust deeds for trustees, settlors and beneficiaries, auto-populating risk assessments, and running remediation loops back to the client. Screening and monitoring are described as running continuously using the agents. What holds this below the top band is the size of the non-AI spine underneath. Client payments and reconciliation, digital onboarding workflows, company registry retrieval, e-signature, dashboards and reporting all predate the agents and work without them, and the compliance value a firm buys, being a defensible file for an SRA or MLR audit, is produced by the workflow and the audit trail rather than by inference. The AI removes manual effort from a compliance process that would still run without it. Checked 7 September 2026.

The AI is real and vendor-claimed but it powers one product of five. Thirdfort sells identity verification, document verification, PEPs and sanctions screening, source of funds and know-your-business checks. Only document verification carries an AI claim, and it carries a clear one: a section headed An AI for detail, stating that artificial intelligence inspects every upload for signs of tampering, forgery and counterfeiting across visual, data and metadata elements, repeated in the FAQ in the first person as our AI. The flagship identity check makes no AI claim at all: its published mechanisms are cryptographic reading of the signing keys in an e-passport NFC chip and address matching against Experian data. The remaining products are screening and registry lookups against ComplyAdvantage, Dun and Bradstreet and Kyckr sources. Remove the models and four of the five checks are unaffected while document verification loses its detection engine. That restraint is itself evidence the claim is meant literally rather than decoratively, but it places the machine learning as a component of one module rather than the mechanism a buyer is paying for across the platform. Checked 7 September 2026.

Grounding is real and documented and a verification step is described, short of any accuracy figure an outsider could test. Screening matches are returned with a recommendation, a confidence level and the supporting evidence, so the reviewer sees what the model relied on rather than a bare conclusion, and the underlying sources are named suppliers a firm can identify. In source of funds the vendor describes a specific control: the AI reads the statements and surfaces income, large one-off payments, balance trends and higher-risk activity, with a mathematical validation step confirming the figures are consistent before they reach the reviewer. That is a described method with an arithmetic check on the model's output, which is more than most records on this axis publish. What is absent is measurement: no accuracy figure, no false positive or false negative rate, no test set, no evaluation and no named failure mode, on a product whose core function is deciding whether a flagged record really is the firm's client. One tension is recorded because a reader who finds it unaided should see it in the note: the published Terms of Use state that Legl makes no representations or warranties as to the truth, accuracy, quality or completeness of information provided in connection with the services, which sits against a product that returns confidence levels and validated figures. Grounding to primary legal authority does not bite on a due diligence product and is counted neither way. Checked 7 September 2026.

Grounding is real, documented and unusually verifiable, and there is a contractual accuracy undertaking, but nothing measures the result. Every identity document is cross-referenced against the Metropolitan Police's Amberhill database of documents reported lost or stolen, which is an external authoritative check a buyer can name. The identity check validates the cryptographic signing keys inside an e-passport chip rather than inferring from an image. Reference data is attributed to named suppliers with published terms. Clause 6.1(b) of the Terms of Use commits Thirdfort to use all commercially reasonable endeavours to ensure Reports are in all material respects accurate and complete, which is more than most records on this axis carry, and the app applies documented guardrails that block blurry, cropped or oversized uploads before they reach the model. What is absent is measurement. For a forgery detection product the natural figures are a detection rate and a false positive rate, and neither is published, nor a test set, an evaluation, or any named failure mode. One tension belongs on the record: Thirdfort warrants report accuracy in its own terms while the supplier terms it passes through disclaim it, with Experian stating it cannot accept liability for any failure of its services to achieve a particular result and Kyckr disclaiming any warranty of accuracy, completeness or reliability. Grounding to primary legal authority does not bite on a due diligence product and is counted neither way. Checked 7 September 2026.

All four limbs of the top band are published separately and explicitly, which is rare enough on this axis to state limb by limb. What the system runs alone: screening, ongoing monitoring and remediation are described as running continuously, with clients re-screened daily, agents gathering and parsing documents, researching and structuring data, reading bank statements, analysing trust deeds, and operating remediation loops directly with the firm's client to collect missing information. What constrains it: the governance layer codifies the firm's own risk policies into Risk Rules the agents enforce, and administrators control screening configuration firm-wide, choosing which categories are screened, which PEP seniority levels, which source jurisdictions, how widely to search and how sensitive matching should be. How a lawyer checks it: matches are returned with a recommendation, a confidence level and the supporting evidence, the compliance dashboard gives a firm-wide view with downloadable reports, decisions and overrides are recorded with their reasoning, confirmed false positives can be whitelisted, and a weekly summary reaches the MLRO. The route back to human judgement: the vendor states that agents exist to flag discrepancies and non-conformity for human attention and that the decision stays with the reviewer, high-risk factors escalate automatically by email to the MLRO or nominated reviewers with the assessment queued for review, alerts can be assigned to a named reviewer, and reassessment dates are set by risk level. The published position is a division of labour rather than a slogan: agents do the gathering, research and structuring, and people decide. Checked 7 September 2026.

The route back to human judgement is contractual rather than advisory, which is rare on this axis. Clause 8 states that the Reports must not be relied on as the sole basis to make business decisions, that the firm is solely responsible for the conclusions drawn from them, and that Thirdfort provides no opinion and makes no recommendation on the treatment of results. The flow-down terms repeat it at supplier level, with ComplyAdvantage stipulating that results must not be used to draw any automatic conclusion or be relied on in isolation about any person flagged or not flagged. There is a review surface behind the words: the report presents flags in three states, showing what has passed, what is not relevant and what requires consideration, and the last of those is an explicit routing of the decision to a person. The uploaded document is stored alongside the report so the reviewer can check the model's input against its output. What is missing is the internal control structure. No threshold is published at which the system flags rather than passes, no confidence signal is described as visible to the reviewer, and nothing states what happens when a forgery is missed or a genuine document is wrongly flagged. Checked 7 September 2026.

Adoption evidence is strong and unusually well attributed to the buying role. Named firms include Lewis Silkin, Michelmores, Stephens Scown, Taylor Rose, Cripps, gunnercooke, Tollers, Wilkes, Blacks, Higgs, Woodstock, Wolferstans, Hall Brown Family Law, Harold Benjamin, Burnett and Reid, Robertsons, Sharmans and Laytons ETL. Testimonials carry full names and job titles, and the titles are the ones that matter for this product: Helen Strachan, Practice Director and MLRO at Burnett and Reid; Shivani Patel, Compliance Supervisor at gunnercooke; Guy Hurst, Compliance Manager at Wilkes; Will Taylor, CFO and COO at Hall Brown; Natasha Boyland, Director and Head of Risk and Operations at Woodstock; Simon Bagshaw, Director of Finance and IT at Tollers. Two concrete figures are published, both customer-stated: half of due diligence requests completed within 24 hours of being sent at gunnercooke, and three risk assessments in about twenty minutes against roughly an hour for one under the previous system at Sharmans. Two things hold this at B. The figures sit in testimonials with no method, sample, baseline date or independent basis, and only the Sharmans figure is a before-and-after. And the headline adoption count is inconsistent across the vendor's own current surfaces: the marketing site says more than 600 law firms while the trust centre description says more than 400 including 40 of the top 200. Both are the vendor's own live material and neither is reconcilable from outside, so the discrepancy is recorded and nothing is graded on either figure. Checked 7 September 2026.

Real deployment evidence at scale, short of assessable measurement. The published base is more than 1,500 regulated businesses, and named customers appear with attributed quotations rather than logos alone: Boyce Hatton on meeting HM Land Registry's Digital ID Standard, Thomas Legal on client completion times as a competitive differentiator, Mezzle on the client experience, and Direction Law, which states it set a target of a 50 per cent increase in the speed of its compliance process and believes it not only hit but exceeded it. Operational figures are published and specific: 75 per cent of individuals complete their checks within 24 hours, documents verified from 195 jurisdictions, electronic address verification across 17 jurisdictions, and reports returned in minutes. Two things hold this at B. The figures carry no method, sample, baseline or date, and the strongest of them is a customer's own belief about its target rather than a measured result. And none of the outcome evidence is attributed to the AI: the completion and speed claims describe the app and the check workflow, so a buyer assessing the forgery detection specifically has adoption evidence for the platform and none for the model. Checked 7 September 2026.

The commitments that exist are real, but the instrument that would govern the buyer is not published, and that is what decides this. The only agreement on the site is the Terms of Use, which by its own first clause governs the individual submitting a payment or completing a workflow, not the law firm. The firm-facing agreement exists and is named: the sub-processor policy refers throughout to the Legl Services Agreement and states that undefined terms take their meaning from it. It is published nowhere. A buyer therefore cannot read the confidentiality obligations, the data handling terms or the security commitments that would actually bind Legl to the firm. What is published and does count: a strong biometric commitment, under which neither Legl nor the firm ever receives the biometric identifier generated from the client's images, it is held by the provider only until Legl says it is no longer needed, and Legl states it does not use, disclose or retain biometric information for any other commercial purpose; a destruction obligation on the firm's request or when processing is no longer needed; and contractual safeguards imposed on all sixteen sub-processors, including confidentiality obligations on their personnel and prompt breach notification. Privilege and work product appear nowhere, and the product holds client identity and source-of-funds material rather than matter files. Checked 7 September 2026.

Substantive published commitments across most limbs, short of the one this axis exists for. The Terms of Use define mutual confidentiality with need-to-know access, a 30-day destroy-or-return obligation on request, and liability for the acts of permitted recipients. Clause 12.1 leaves the firm owning the intellectual property in its own data and clause 12.3 licenses that data to Thirdfort only to the extent needed to provide the Services. The data processing agreement makes the firm the controller and Thirdfort the processor, limits processing to the Services and the firm's instructions, and restricts access to personnel who need it. Security measures are specific: AES-256 or stronger at rest, TLS 1.2 or better in transit, two-factor authentication for platform users, least privilege and device encryption for staff, no storage on local machines, and a documented architectural separation of data between different customers. Deletion is concrete, with all initiation and report data removed within 30 days of a written request and the fields covered enumerated down to date of birth and home address. What is absent is privilege and work product, which appear nowhere in the estate. The omission costs a buyer less here than on a matter-facing product, because what Thirdfort holds is client identity and source-of-funds material rather than privileged case files, but the limb is required for the top band and it is not met. Checked 7 September 2026.

An express disclaimer exists in a published agreement and no conduct framework sits behind it. The Terms of Use state that nothing in the Legl Services, or in emails Legl sends on the law firm's behalf, is or should be construed as legal advice, and separately that the individual's use of the service is not determinative of their status as a client of the firm, with appropriate contractual arrangements to be put in place directly. Both are directed at the firm's client rather than at the firm, which is the right audience for a platform that communicates with clients under the firm's brand, and the second is a genuinely useful clarification of where the retainer sits. The product is also built around the firm's own regulatory obligations, with MLRO dashboards, defensible records of how each client was assessed and why, and audit-ready reporting. What is not addressed is professional responsibility in the firm's use of the AI: nothing names a conduct rule or regulator, nothing addresses supervision obligations when an agent acts, and nothing states what a firm must still do itself to discharge its duties. Limbs of this axis that turn on producing legal work product do not bite on a due diligence platform and are counted neither way. Checked 7 September 2026.

Responsibility is allocated in the agreement but no professional conduct framework is engaged. Clause 8 does the allocation squarely: the Reports help a firm understand risk and meet its compliance obligations, they must not be the sole basis of a decision, the firm is solely responsible for the conclusions it draws, and Thirdfort gives no opinion and makes no recommendation. The consumer wording in Appendix 1, which the firm is required to send to its client before lite screening and identity document verification, frames the check as part of the professional's own due diligence rather than as advice from Thirdfort. Both are more than most records carry. What is not addressed is professional conduct as such: nothing engages unauthorised practice, nothing names a conduct rule or regulator obligation that the firm's use of the product touches, and the estate contains no professional responsibility statement. Several limbs of this axis do not bite on a due diligence platform that never advises a client or produces legal work product, and they are not counted against the vendor; the grade reflects that a real allocation exists and a conduct framework does not. Checked 7 September 2026.

No governance disclosure was located. There is no AI policy, no responsible AI or ethics statement, no governance framework, no bias or fairness discussion, no ISO 42001 or NIST AI RMF alignment, no named internal owner for AI decisions, no model evaluation or testing description, and no AI provision in any published agreement. The gap is conspicuous rather than incidental on this record for two reasons that belong on it. First, the vendor markets its agents as auditable and sells a governance layer to firms, so governance is the vocabulary of the product, applied to the customer's risk policy and not to Legl's own models. Second, the platform runs biometric identity verification and AI risk scoring on individuals whose onboarding depends on the result, and demographic differential performance is a well-documented property of that class of system. Nothing published addresses fairness, error rates across populations, testing, or what recourse an individual has when a check goes against them. The ISO/IEC 27001 certification governs information security and is not read as covering this. Surfaces read on 7 September 2026: the Risk Agents page, the KYC, KYB and AML page, the pricing page, the Terms of Use in full, the sub-processor policy in full, the trust centre entry point and the site footer.

No governance disclosure was located anywhere in a legal estate that is otherwise unusually complete. There is no AI policy, no responsible AI or ethics statement, no governance framework, no ISO 42001 or NIST AI RMF alignment, no named internal owner for AI decisions, no model evaluation or testing description, and no AI-specific provision in the Terms of Use, the data processing agreement or the security measures page. The gap is more consequential here than the grade alone conveys, and the reason should be on the record rather than left to inference: the security measures page states that Thirdfort gathers and processes personal data including biometric information from clients, and the product applies automated document and identity checks to individuals whose onboarding depends on the result. Demographic differential performance is a well-documented property of biometric and document-image systems, and nothing published addresses fairness, differential error rates, testing across populations, or what recourse an individual has if a check wrongly flags them. The ISO/IEC 27001:2022 certification governs information security and is not read as covering this. Surfaces read on 7 September 2026: both AI-bearing product pages, the security measures page, the Terms of Use, the data processing agreement, the third-party products and terms, the terms index and the pricing page.

Real stewardship is documented for the data supply chain and almost nothing is documented for the AI. On the credit side the sub-processor policy is a working governance artifact rather than a list: it describes a commercially reasonable selection process evaluating security, privacy and confidentiality practices, and requires sub-processors to satisfy obligations equivalent to Legl's own, including processing only on documented controller instructions, using personnel bound to confidentiality, providing regular security and data protection training, maintaining technical and organisational measures, promptly informing Legl of any actual or potential breach, and cooperating with controller, data subject and regulator requests. Biometric handling is specific and restrictive. Destruction follows the firm's request or the end of the processing need. What is missing is the part this axis is about. No published surface states how client documents, bank statements or trust deeds are handled once an agent has read them, whether anything is retained from an inspection, whether client content is segregated from model operations, or what happens to the material a remediation loop collects. No AI-specific commitment of any kind was located, and the one improvement right in the published Terms covers de-identified technical device and system telemetry rather than client content. The firm-facing Legl Services Agreement, which is where terms would sit, is named in the sub-processor policy but is not published. Checked 7 September 2026.

Stewardship is documented at contract level and is genuinely tight, though none of it is AI-specific. Processing is purpose-limited twice over: clause 12.3 of the Terms licenses client data only to the extent needed to provide the Services, and clause 2.4(a) of the data processing agreement limits processing to providing the Services on the firm's instructions. No training or model improvement right is reserved anywhere in the estate. The perpetual feedback licence in clause 12.4 is drafted with an express carve-out stating it will not cover any personal data, which is the kind of detail that usually goes missing. Deletion is concrete and time-bound at 30 days with the fields enumerated. Security measures are specific and independently framed, including annual penetration testing commissioned by the vendor rather than by customers, routine vulnerability scanning, security log monitoring, encryption at rest and in transit, and architectural separation between customers. Breach notification runs without undue delay under the processing agreement, and FCA licensing obliges Thirdfort to file quarterly reports on its operational and security risks, which is external supervision of the security posture rather than self-assertion. What holds this at B is that nothing addresses the AI specifically: no statement covers how document images and biometric material are handled by the model, how long the model's inputs and outputs persist, or whether anything is retained from an inspection once the report is produced. Checked 7 September 2026.

Nothing establishing recourse to the buyer could be located, and the one published agreement excludes liability comprehensively. The Legl Services Agreement is named twice in the sub-processor policy as the instrument governing the client relationship and is published nowhere on the site, whose legal footer carries only the Terms of Use, website terms, privacy policy and a link to the trust centre. A firm therefore cannot establish before purchase what warranty, cap, indemnity, service level or remedy it would have. The instrument that is published runs the other way throughout. Use is on an as-is and as-available basis at the user's sole risk. Legl makes no representations or warranties as to the truth, accuracy, quality or completeness of information provided in connection with the services, and explicitly excludes all other conditions, guarantees and implied or statutory warranties. It accepts no liability for loss or damage of any kind arising from access to or use of the services, disclaims responsibility for the acts or omissions of any third-party service provider, and states that as a data processor it is not liable to the individual for any act or omission in relation to their personal data. The only indemnities run from the user to Legl. No cap figure, uptime commitment, service credit, cure period or termination-for-degradation right appears anywhere published. The grade records what is establishable on the date: the buyer's own agreement is unpublished and the available instrument allocates risk away from the vendor. Checked 7 September 2026.

Quantified recourse exists, which is uncommon, and the AI-relevant exposure is routed away from it, which matters. On the credit side the Terms of Use state figures rather than formulas: liability is capped at the higher of 25,000 pounds or the fees paid in the preceding twelve months, with breaches of data protection obligations carved out and capped separately at 2.5 million pounds in aggregate. Clause 6.1(b) warrants that Reports will be materially accurate and complete, mutual intellectual property indemnities run both ways, uptime is committed at 99.5 per cent monthly, material breach carries a 30-day cure, and clause 16.2(b) lets a firm terminate immediately if an update materially reduces the service and no substitute follows. Clause 18 gives an annual audit right with an undertaking to provide executive summaries of audit reports and copies of current third-party certifications. Against that sit three provisions a buyer should weigh together. Clause 9.3(g) excludes losses caused by Third Party Products, which is precisely where the supplier-provided elements of the checks sit. Clause 9.4 waives all the firm's potential claims arising from the Platform, Services or Reports in connection with the services the firm provides to its own client, which is the scenario a firm relying on a regulated due diligence check most needs covered. And uptime is measured from the moment the customer reports a fault in writing rather than from onset, so the commitment turns partly on the customer's own vigilance. Checked 7 September 2026.

The integration surface is the deepest in this lane and it is specifically legal. Ten named systems appear on the product pages, and they are practice systems rather than general business tools: iManage and NetDocuments on document management; Clio Manage and Clio Operate, the latter named as Sharedo; Elite 3E on finance and practice management; Litera Foundation 365, named as Peppermint; Unity Practice Management, named as NebuLAW; Quill; Proclaim, named as DPS; and Partner for Windows. The parenthetical former names are worth noting as a mark of care, since a UK firm buying this will know several of these products by the older brand. That set spans the two major document management systems, a major international finance platform and four UK-specific practice systems, which is a materially different position from a vendor naming Zapier and a CRM. What holds this below the top band is that the depth of each connection is not described on any surface read: nothing states whether the integration writes back, what triggers a sync, whether an API is public, or what a firm must build. The integrations index page was not opened in this pass and is named as the artifact that would settle it, and the row is amendable on that evidence. Checked 7 September 2026.

An integration surface exists and is contractually governed, but no legal practice system was located first-party. Thirdfort publishes a separate API Agreement in its terms index, applying to clients, partners and potential partners who access the API to build a direct integration, and clause 21 of the Terms of Use incorporates it. Distribution through Partner Platforms is a first-class part of the model rather than an afterthought: clause 2.2(b) contemplates a firm using the Platform Services entirely through a partner's own platform, clause 19 governs the information exchanged, and a partners list is maintained at a published address. That is real integration depth in architecture. What could not be established is direction: no case management system, practice management system, document management system or legal accounting package is named in any surface read, so a buyer cannot tell from the vendor's own material which systems the product actually plugs into. The partners list itself was not opened in this pass and is named here as the artifact that would settle it; it is the row in this record most likely to move on a further pass, and it is amendable on newly located evidence. Checked 7 September 2026.

Neither limb is stated, which is what the band requires. Infrastructure suppliers are named in the sub-processor policy, being Amazon Web Services EMEA, Heroku, Microsoft Ireland Operations and Snowflake for cloud and data services, and the corporate entities named are European. That identifies who hosts, not where the data sits: no data centre location, no region, no residency option and no residency commitment appears on any surface read, and naming an Irish or Luxembourg contracting entity is not a statement about storage location. Tenancy is equally absent: nothing states whether the service is single-tenant, pooled or configurable, and no separation model is described beyond the fact that screening configuration changes apply firm-wide. The nearest thing to a residency term sits in the consumer Terms of Use, which bar the individual from accessing the services in any jurisdiction other than the United Kingdom where doing so would require Legl or its providers to physically store data in that jurisdiction without prior written consent. That is a restriction on the user rather than a commitment by the vendor, though it implies a United Kingdom storage default. A separate Australian estate exists across the site, which implies a second region without describing one. No self-hosted or private deployment option was located. Checked 7 September 2026.

Tenancy is addressed and region is not, which clears the floor on the tenancy limb alone. The security measures page states that Thirdfort hosts its technical infrastructure and databases on Google Cloud Platform, that data sits in GCP-managed database services across three data centres at different physical sites, that storage on local machines is not permitted, and that the software architecture ensures separation of data and of information security between different customers and application components. That is a documented multi-customer separation model rather than a bare assertion. Residency is the weaker half. The three data centres are not located for the reader, no region menu or residency choice is offered, and the vendor states plainly that it uses service providers located outside the United Kingdom and European Union, relying on contractual transfer mechanisms rather than on keeping data in region. Those mechanisms are properly specified: the data processing agreement incorporates module 2 of the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with Thirdfort as importer and the firm as exporter. The completed transfer schedules that would show the actual destinations are published as images and could not be read, which is recorded as a retrieval limit rather than an absence. No self-hosted or private deployment option exists, which is expected for a consumer-app-based verification service. Checked 7 September 2026.

Multiple current certifications, one of them independently checkable, presented through a real trust centre whose contents could not be read. Legl publishes its ISO/IEC 27001 certificate number, 0174467, in the footer of every page, which is more than most records on this axis offer: a number a buyer can take to the certification body rather than a badge. It is listed on the UK government's Digital Verification Services register maintained by the Office for Digital Identities and Attributes, under its registered name The Justice Platform Ltd, and is a certified Identity Service Provider against the Digital Identity and Attributes Trust Framework. A government register entry is verifiable entirely independently of the vendor, which is the strongest form this evidence takes. A dedicated trust centre exists at a subdomain, hosted on Vanta's European instance and linked from the site footer as Security. Two things hold this at B. No certification body or auditor is named, no certificate validity window is given, no certificate document is published on the main site, and no SOC 2 report for Legl itself was located. And the trust centre returned only page metadata: its body renders client-side and no document list, access tier or request flow could be read. That is recorded as a retrieval limit and is not graded against the vendor, but it does mean the access flow could not be assessed, so no credit is taken for what the portal may offer. The certifications named for sub-processors and payment partners belong to those companies and are not credited here. Checked 7 September 2026.

Multiple current, independently granted certifications, published without a portal. Thirdfort states it holds ISO/IEC 27001:2022, the current revision of the standard rather than a superseded one, and separately holds certification as an Identity Service Provider under the Digital Identity and Attributes Trust Framework operated by the UK government's Department for Science, Innovation and Technology. It is certified under the UK Digital Verification Services trust framework and appears on the GOV.UK register of digital identity services, which is a public register a buyer can check independently of anything the vendor says. Regulatory supervision adds a further layer that is not a certification but functions like one: FCA licensing for account information services means, in the vendor's own account, that the regulator has reviewed its security policies and that Thirdfort must file quarterly reports on operational and security risks. Penetration testing is annual and vendor-commissioned, with remediation routed into engineering priority, alongside routine vulnerability scanning and security log monitoring. What holds this below the top band is artifact access. No certificate document, certificate number or validity period is published, no auditor or certification body is named, there is no SOC 2 report, and there is no trust centre or document portal. Certifications are obtainable, but through clause 18.2 on request during an audit rather than from the website, and clause 18.3 expressly excludes access to non-public external reports. Checked 7 September 2026.

A thorough supplier disclosure programme that has not been extended to the models. The sub-processor policy is genuinely good: sixteen suppliers named as at 3 June 2025, each with its processing activity stated, a described due diligence and contractual safeguard process, notice of changes by email or in the customer's own environment, a ten day objection window, and a dated update log explaining why Mitek Systems and Dun and Bradstreet were added in July 2024. Against that, no model or model provider appears anywhere in it. The list contains cloud and data infrastructure, being Amazon Web Services, Heroku, Microsoft Ireland, Snowflake and Fivetran; identity and data suppliers, being ComplyAdvantage, Equifax, Entrust Identity, Mitek, Creditsafe, Dun and Bradstreet and TrueLayer; and tooling, being Datadog, Sentry, HelloSign and an email provider. Not one entry is a foundation model provider, and no surface names a model, a version, a family, or states that the models are built in house. For a platform whose own navigation calls its AI layer Risk Agents and which describes those agents reading bank statements and analysing trust deeds, that is a real gap: a firm cannot tell whose model processes its client's financial documents. Naming the cloud providers says where the software runs and has been credited on deployment, not here. Checked 7 September 2026.

The supply chain is partly disclosed, and the part that is disclosed is done properly. Six suppliers are named in a published, versioned instrument with their full flow-down terms reproduced: Onfido, Experian, IVXS UK trading as ComplyAdvantage, iProov, Dun and Bradstreet, and Kyckr Ireland. A separate third-party service provider page, dated 24 October 2025, distinguishes data providers from technical service providers, explains the two categories of data shared, and offers a subscription to sub-processor notices. Change is governed contractually: clause 16.2 of the Terms gives 30 days' notice of any material change to the data provider list with a right to terminate, and clause 3.3 of the processing agreement requires written notice of new sub-processors within 30 days with a right to object. Experian's own flow-down terms disclose that its services involve models and techniques based on statistical analysis, probability and predictive behaviour, which is supplier-level model disclosure a buyer can read. What is missing is the mapping and the models. No model is named anywhere, no version or family is given, and the vendor never states which of the six suppliers, if any, provides the artificial intelligence behind document verification. Naming Google Cloud Platform tells a reader where the service runs, not whose model inspects a passport, and it is credited on deployment rather than counted twice here. Two artifacts that would close the gap could not be read and are recorded as retrieval limits: the feature-to-provider breakdown on the flow-down page is published as an image, and the provider tables on the service provider page render client-side and returned no content. Checked 7 September 2026.

The charging model is published and no price is. What a buyer can establish first-party: pricing is modular, with the firm choosing the modules it needs and paying only for what it uses; billing is monthly and described as predictable; there are no implementation fees; and there is no long-term lock-in, a point a named customer reinforces by contrasting it with competitors requiring fixed contracts of up to thirty-six months and usage forecasts. ROI reporting and cost-savings insights are offered as part of the product. That is a described model rather than an invitation to call, and it lifts the axis off the floor. What is absent is every figure: no price per module, per check, per seat or per firm, no volume band, no minimum, no term length and no currency. The page carries no plan table of any kind, and the only route to a number is booking a demo. One tension is recorded because it is the vendor's own framing against its own page: the page is titled transparent, value-based pricing and its meta description promises a transparent, surprise-free pricing structure, on a page that publishes no cost. Transparency about how a buyer will be charged is real here; transparency about what they will pay is not. Checked 7 September 2026.

Commercial mechanics are published in the contract while prices are not published anywhere. The pricing page exists and is structured by buyer type, inviting a reader to select an industry to see available plans, with a custom quote offered for industries not listed. The plan detail sits behind that selector and rendered no content, which is recorded as unrendered rather than absent because the page's own wording states that plans are there to be seen. What is established first-party comes from the Terms of Use, and it is more than a sales invitation: fees are agreed separately and are exclusive of VAT, any increase carries 30 days' notice with an opportunity to stop using the service, disputed invoices must be raised within 30 days, overdue amounts carry interest at 4 per cent above the Barclays base rate, suspension follows 7 days' notice, minimum purchase commitments exist and survive early termination, and a discounted trial period may be offered at the vendor's discretion. Those are real commercial terms a buyer can rely on. What is absent is any figure, band or unit of charge: the product is bought as checks and plans, and no price per check, per seat or per plan appears on any surface read. The grade sits above the floor because published pricing information exists at the level of charging mechanics, and below the middle band because no rate is discoverable without a sales conversation. Checked 7 September 2026.

Deep in one workflow, broad across firm types, narrow across jurisdictions. The buyer surface is unambiguously legal: every solution page addresses law firms directly, the named customers are all law firms, and the roles quoted are legal compliance roles rather than generic operations. Firm coverage spans the range a UK vendor would want to show, from national and international names such as Lewis Silkin and Michelmores through strong regional practices including Stephens Scown, Cripps, Tollers and Wilkes, an alternative-structure firm in gunnercooke, a Scottish firm in Burnett and Reid, and specialist family practices including Hall Brown. The trust centre description claims forty of the top two hundred. What holds this at B is that coverage means firm types rather than practice areas: the product addresses one workflow, client onboarding and anti-money-laundering diligence with payments attached, and applies it identically whatever the matter is. No practice-area breakdown, matter-type coverage statement or area-specific configuration is published beyond risk assessment templates a firm builds to its own policy. The regulatory frame is also single-jurisdiction, resting on the SRA, the Money Laundering Regulations, HM Land Registry expectations, the DVS register and the Digital Identity and Attributes Trust Framework, with a separate Australian estate as the only other market. Checked 7 September 2026.

Coverage is deep in one practice area and deliberately narrow beyond it. Legal is one of four named sectors with a page of its own, alongside conveyancing, estate agents and accountants, and the insights library carries a dedicated Lawyers industry category with material aimed squarely at solicitors, including guidance on file notes that survive an SRA review and on enhanced due diligence after the 2026 Money Laundering Regulations reforms. Practice depth is strongest in property: the enhanced NFC identity check is built to HM Land Registry's Safe Harbour standard under Practice Guide 81, and the platform supports Authorised Corporate Services Providers meeting the Companies House identity verification standard for directors and persons of significant control. Geographic reach in the checks themselves is broad, covering documents from 195 jurisdictions and electronic address verification across 17. What holds this at B is that the practice surface is a single workflow rather than a range: client onboarding and anti-money-laundering diligence, with no other legal practice area addressed and no matter-type coverage statement. The regulatory frame is also single-jurisdiction, resting on FCA authorisation, HM Land Registry, Companies House, the SRA and English governing law, so a firm outside the United Kingdom sees a product built around a compliance regime that is not its own. The legal sector page redirected to an insights article when fetched and was not read directly; the sector's existence and its content are established from the site navigation and the insights category. Checked 7 September 2026.