Legl vs Thirdfort: how they compare in 2026

Risk Agents is one of three items under Platform on Legl's site, alongside the Governance Layer and Integrations, and sits above the six solution modules rather than inside one of them. The agents are described as working across the client lifecycle. They research and structure screening matches, triage ongoing monitoring alerts, read bank statements for source of funds, analyze trust deeds for trustees, settlors and beneficiaries, fill in risk assessments automatically, and run remediation loops back to the client. Screening and monitoring run continuously using the agents. Much of the platform does not depend on the AI. Client payments and reconciliation, digital onboarding workflows, company registry retrieval, electronic signature, dashboards and reporting all predate the agents and work without them. The file a firm needs for an SRA or MLR audit comes from the workflow and the audit trail rather than from the model. The AI removes manual effort from a compliance process that would still run without it.

Thirdfort sells identity verification, document verification, PEPs and sanctions screening, source of funds and know-your-business checks. Only document verification carries an AI claim: a section headed An AI for detail states that artificial intelligence inspects every upload for signs of tampering, forgery and counterfeiting across visual, data and metadata elements, and the FAQ repeats it in the first person as our AI. The identity check makes no AI claim; its published mechanisms are cryptographic reading of the signing keys in an e-passport NFC chip and address matching against Experian data. The remaining products are screening and registry lookups against ComplyAdvantage, Dun and Bradstreet and Kyckr sources. Without the models, four of the five checks are unaffected and document verification loses its detection engine.

Screening matches are returned with a recommendation, a confidence level and the supporting evidence, so the reviewer sees what the model relied on rather than a bare conclusion. The underlying sources are named suppliers a firm can identify. In source of funds, the AI reads bank statements and surfaces income, large single payments, balance trends and higher risk activity. A mathematical validation step confirms the figures are consistent before they reach the reviewer, an arithmetic check on the model's output. No accuracy figure, false positive or false negative rate, test set, evaluation or named failure mode is published, for a product whose core function is deciding whether a flagged record really is the firm's client. Legl's Terms of Use state that it makes no representations or warranties as to the truth, accuracy, quality or completeness of information provided with the services, while the product returns confidence levels and validated figures. The product does not cite legal authority.

Every identity document is checked against the Metropolitan Police's Amberhill database of documents reported lost or stolen. The identity check validates the cryptographic signing keys inside an electronic passport chip rather than inferring from an image, and reference data is attributed to named suppliers with published terms. Clause 6.1(b) of the Terms commits Thirdfort to use all commercially reasonable endeavors to ensure Reports are accurate and complete in all material respects. The app blocks blurry, cropped or oversized uploads before they reach the model. No detection rate or false positive rate is published for document verification, nor any test set, evaluation or named failure mode. The supplier terms passed through disclaim accuracy: Experian accepts no liability for any failure to achieve a particular result, and Kyckr disclaims any warranty of accuracy, completeness or reliability.

Screening, ongoing monitoring and remediation run continuously, and clients are screened again daily. The agents gather and parse documents, research and structure data, read bank statements, analyze trust deeds, and run remediation loops directly with the firm's client. The governance layer turns the firm's own risk policies into Risk Rules the agents enforce, and administrators set screening firm wide, choosing categories, PEP seniority levels, source jurisdictions, search breadth and matching sensitivity. Matches come with a recommendation, a confidence level and the supporting evidence. The compliance dashboard gives a view across the firm with downloadable reports, decisions and overrides are recorded with their reasoning, confirmed false positives can be whitelisted, and a weekly summary reaches the MLRO. Legl states that agents flag discrepancies and nonconformity for human attention and that the decision stays with the reviewer. High risk factors escalate automatically by email to the MLRO or nominated reviewers, alerts can be assigned to a named reviewer, and reassessment dates are set by risk level. Agents gather, research and structure; people decide.

Clause 8 of the Terms says the Reports must not be the sole basis of business decisions, that the firm is solely responsible for its conclusions, and that Thirdfort gives no opinion and makes no recommendation on how to treat results. The supplier terms repeat this, with ComplyAdvantage saying results must not be used to draw any automatic conclusion or be relied on in isolation about anyone flagged or not flagged. The report shows flags in three states, for what has passed, what is not relevant and what needs consideration, and the last routes the decision to a person. The uploaded document is stored with the report, so a reviewer can check the model's input against its output. No threshold is published at which the system flags rather than passes, no confidence signal is described as visible to the reviewer, and nothing says what happens when a forgery is missed or a genuine document is wrongly flagged.

Named firms include Lewis Silkin, Michelmores, Stephens Scown, Taylor Rose, Cripps, gunnercooke, Tollers, Wilkes, Blacks, Higgs, Woodstock, Wolferstans, Hall Brown Family Law, Harold Benjamin, Burnett and Reid, Robertsons, Sharmans and Laytons ETL. Testimonials carry full names and job titles. They include Helen Strachan, Practice Director and MLRO at Burnett and Reid; Shivani Patel, Compliance Supervisor at gunnercooke; and Guy Hurst, Compliance Manager at Wilkes. Will Taylor, CFO and COO at Hall Brown, Natasha Boyland of Woodstock and Simon Bagshaw of Tollers are also quoted. Customers state two figures. At gunnercooke, half of due diligence requests were completed within 24 hours of being sent. At Sharmans, three risk assessments took about twenty minutes against roughly an hour for one under the previous system. Both sit in testimonials with no method, sample, baseline date or independent basis, and only the Sharmans figure compares before and after. The adoption count differs between pages: Legl's marketing site says more than 600 law firms, while its trust center description says more than 400, including 40 of the top 200.

More than 1,500 regulated businesses are said to use the platform, and named customers are quoted rather than shown only as logos. Boyce Hatton speaks on meeting HM Land Registry's Digital ID Standard, Thomas Legal on client completion times as a competitive edge, and Mezzle on the client experience. Direction Law says it set a target of a 50 percent faster compliance process and believes it exceeded it, Mishcon de Reya says onboarding for straightforward matters fell from days to minutes, and Penningtons Manches Cooper is quoted on checks for overseas clients. Operational figures are specific: 75 percent of people complete their checks within 24 hours, 96 percent of know-your-business reports return in under sixty seconds, documents are verified from 195 jurisdictions, electronic address verification covers 17, and reports return in minutes. The figures carry no method, sample, baseline or date. None of the outcome evidence is attributed to the AI; the completion and speed claims describe the app and the check workflow.

The only agreement on Legl's site is the Terms of Use, which by its own first clause governs the individual submitting a payment or completing a workflow, not the law firm. The subprocessor policy refers throughout to the Legl Services Agreement and takes its undefined terms from it, but that agreement is not published, so the confidentiality obligations, data handling terms and security commitments that would bind Legl to the firm cannot be read. The biometric commitment is specific. Neither Legl nor the firm ever receives the biometric identifier generated from the client's images; the provider holds it only until Legl says it is no longer needed; and Legl states it does not use, disclose or retain biometric information for any other commercial purpose. Data is destroyed on the firm's request or when processing is no longer needed, and contractual safeguards bind all sixteen subprocessors, including confidentiality for their personnel and prompt breach notification. Privilege and work product are not mentioned. The product holds client identity and source of funds material rather than matter files.

The Terms of Use set mutual confidentiality with access on a need to know basis, a 30 day obligation to destroy or return on request, and liability for the acts of permitted recipients. Clause 12.1 leaves the firm owning its data, and clause 12.3 licenses it to Thirdfort only as needed to provide the Services. The data processing agreement makes the firm the controller and Thirdfort the processor, limits processing to the firm's instructions and restricts access to staff who need it. Security measures are specific: AES-256 or stronger at rest, TLS 1.2 or better in transit, two factor authentication for users, least privilege and device encryption for staff, no storage on local machines, and documented separation of data between customers. All initiation and report data is deleted within 30 days of a written request, with the fields listed. Privilege and work product are not addressed. Thirdfort holds identity and source of funds material rather than privileged case files.

Legl's Terms of Use state that nothing in the Legl Services, or in emails Legl sends on the law firm's behalf, is or should be construed as legal advice. They state separately that the individual's use of the service does not determine whether they are a client of the firm, with contractual arrangements to be made directly. Both are directed at the firm's client, which fits a platform that communicates with clients under the firm's brand, and the second makes clear where the retainer sits. The product is built around the firm's own regulatory obligations, with MLRO dashboards, defensible records of how each client was assessed and why, and reporting ready for audit. Nothing addresses professional responsibility in the firm's use of the AI: no conduct rule or regulator is named, nothing covers supervision obligations when an agent acts, and nothing states what a firm must still do itself to meet its duties. A due diligence platform produces no legal work product.

Under clause 8 of the Terms, the Reports help a firm understand risk and meet its compliance obligations, must not be the sole basis of a decision, and leave the firm solely responsible for its conclusions; Thirdfort gives no opinion or recommendation. Appendix 1 contains wording the firm must send its client before lite screening and identity document verification, framing the check as part of the professional's own due diligence rather than advice from Thirdfort. Nothing engages unauthorized practice, nothing names a conduct rule or regulatory obligation that the firm's use of the product touches, and no statement on professional responsibility is published. The platform never advises a client or produces legal work product.

No AI policy, responsible AI or ethics statement, governance framework, or bias or fairness discussion is published on the Risk Agents page, the KYC, KYB and AML page, the pricing page, the Terms of Use, the subprocessor policy, the trust center entry page or the site footer. No ISO 42001 or NIST AI RMF alignment, named internal owner for AI decisions, model evaluation or testing description, or AI provision in any published agreement appears there either. Legl markets its agents as auditable and sells a governance layer to firms, applied to the customer's risk policy rather than to Legl's own models. The platform also runs biometric identity verification and AI risk scoring on individuals whose onboarding depends on the result, and nothing published addresses fairness, error rates across populations, testing, or what recourse an individual has when a check goes against them. The ISO/IEC 27001 certification covers information security, not AI governance.

The product pages that carry AI, the security measures page, the Terms of Use, the data processing agreement, the third party products and terms, the terms index and the pricing page contain no AI policy, responsible AI or ethics statement, governance framework, ISO 42001 or NIST AI RMF alignment, named internal owner for AI decisions, or description of model evaluation or testing, and no contract provision specific to AI. The security measures page says Thirdfort processes personal data including biometric information, and the product applies automated document and identity checks to people whose onboarding depends on the result. Uneven performance across demographic groups is a documented property of biometric and document image systems, and nothing published addresses fairness, differences in error rates, testing across populations, or what recourse a person has if a check wrongly flags them. The ISO/IEC 27001:2022 certification covers information security.

The subprocessor policy describes a commercially reasonable selection process evaluating security, privacy and confidentiality practices. Subprocessors must meet obligations equivalent to Legl's own: processing only on documented controller instructions, using personnel bound to confidentiality, training staff, maintaining technical and organizational measures, promptly reporting any breach, and cooperating with controller, data subject and regulator requests. Biometric handling is specific and restrictive, and destruction follows the firm's request or the end of the processing need. No published page states how client documents, bank statements or trust deeds are handled once an agent has read them, or whether anything is retained. Nothing says whether client content is kept apart from model operations, or what happens to material a remediation loop collects. No commitment specific to AI is published. The one improvement right in the published Terms covers deidentified device and system telemetry, not client content. The Legl Services Agreement, where data use terms would sit, is named but not published.

Processing is purpose limited twice: clause 12.3 of the Terms licenses client data only as needed to provide the Services, and clause 2.4(a) of the data processing agreement limits processing to the Services on the firm's instructions. No training or model improvement right is reserved, and the perpetual feedback license in clause 12.4 expressly excludes personal data. Deletion runs within 30 days, with the fields listed. Security measures are specific: annual penetration testing commissioned by the vendor, routine vulnerability scanning, security log monitoring, encryption at rest and in transit, and architectural separation between customers. Breach notification runs without undue delay under the processing agreement, and FCA licensing requires quarterly reports on operational and security risks to an outside supervisor. The privacy policy bars Thirdfort's AI providers by contract from training or fine-tuning on personal information and offers a person a human review of an automated check, but nothing addresses how document images and biometric material are handled by the model, how long the model's inputs and outputs persist, or whether anything is kept from an inspection once the report is produced.

The subprocessor policy twice names the Legl Services Agreement as the instrument governing the client relationship. That agreement is not published; Legl's legal footer carries only the Terms of Use, website terms, privacy policy and a trust center link, so what warranty, cap, indemnity, service level or remedy a firm would have cannot be read before purchase. The published Terms of Use exclude liability. Use is as is and as available, at the user's sole risk. Legl makes no representations or warranties as to the truth, accuracy, quality or completeness of information provided with the services, and excludes all other conditions, guarantees and implied or statutory warranties. It accepts no liability for loss or damage from use of the services and disclaims responsibility for any third party service provider. As a data processor, it states, it is not liable to the individual for acts or omissions on their personal data. The only indemnities run from the user to Legl. No cap figure, uptime commitment, service credit, cure period or right to terminate for degraded service is published.

The Terms of Use cap liability at the higher of 25,000 pounds or the fees paid in the previous twelve months, with data protection breaches carved out and capped separately at 2.5 million pounds in aggregate. Clause 6.1(b) warrants that Reports will be materially accurate and complete, intellectual property indemnities run both ways, uptime is committed at 99.5 percent monthly, and material breach carries a 30 day cure. Clause 16.2(b) lets a firm terminate immediately if an update materially reduces the service and no substitute follows, and clause 18 gives an annual audit right. Clause 9.3(g) excludes losses caused by Third Party Products, which is where the suppliers' parts of the checks sit. Clause 9.4 waives the firm's claims arising from the Platform, Services or Reports in connection with services the firm provides to its own client. Uptime is measured from when the customer reports a fault in writing, not from onset.

Ten named systems appear on Legl's product pages, all practice systems rather than general business tools. They are iManage and NetDocuments for document management; Clio Manage and Clio Operate, the latter named as Sharedo; Elite 3E for finance and practice management; Litera Foundation 365, named as Peppermint; Unity Practice Management, named as NebuLAW; Quill; Proclaim, named as DPS; and Partner for Windows. The former names help a UK firm that knows several of these products by the older brand. The set spans the two major document management systems, a major international finance platform and four practice systems specific to the UK. The product pages do not describe the depth of each connection: nothing states whether the integration writes back, what triggers a sync, whether an API is public, or what a firm must build.

The legal sector page names integrations with Actionstep, Redbrick, ProConvey, ALB, Tessaract and the Minerva onboarding platform, and says Thirdfort works with other case management systems on request. The partners list names Index Property Information, the Property Information Exchange, Moverly, MRI Software, On Point Data, Pali, Peppermint Technology, ProConvey, Progressive Legal Solutions, Reapit, Redbrick, Sage, Simply Conveyancing, Tessaract, TM Group, Unlatch, Vebra trading as Alto, X-Press Legal and Zoopla trading as YourKeys. Thirdfort publishes a separate API Agreement for clients and partners building a direct integration, incorporated by clause 21 of the Terms of Use, and the open API comes with the Compliance plan and above. Clause 2.2(b) contemplates a firm using the services entirely through a partner's platform, and clause 19 governs the information exchanged. Nothing says which direction data moves or what a firm must configure.

Neither tenancy nor data location is stated. The subprocessor policy names the infrastructure suppliers, Amazon Web Services EMEA, Heroku, Microsoft Ireland Operations and Snowflake, and the corporate entities named are European. That identifies who hosts, not where the data sits. No data center location, region, residency option or residency commitment is published, and an Irish or Luxembourg contracting entity says nothing about storage location. Nothing states whether the service is single tenant, pooled or configurable, and no separation model is described beyond screening configuration changes applying firm wide. The nearest thing to a residency term is in the consumer Terms of Use, which bar the individual from using the services outside the United Kingdom where that would require Legl or its providers to store data in that jurisdiction without prior written consent. That restricts the user rather than committing the vendor. Legl runs a separate Australian site, with no second region described. No self hosted or private deployment option is published.

The security measures page says Thirdfort hosts its infrastructure and databases on Google Cloud Platform, with data in managed database services across three data centers at different sites, no storage on local machines, and an architecture that separates data and information security between customers and application components. The three data centers are not located and no residency choice is offered. Thirdfort says it uses service providers outside the United Kingdom and European Union, relying on contractual transfer mechanisms rather than keeping data in region: the data processing agreement incorporates module 2 of the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with Thirdfort as importer and the firm as exporter. Its transfer annex names the Irish Data Protection Commission as the competent authority and points to the service provider page, whose data provider table places each provider's storage in the United Kingdom or the European Economic Area. No private deployment option is offered.

Legl publishes its ISO/IEC 27001 certificate number, 0174467, in the footer of every page, a number that can be taken to the certification body. It is listed under its registered name, The Justice Platform Ltd, on the UK government's Digital Verification Services register, which the Office for Digital Identities and Attributes maintains, and is a certified Identity Service Provider against the Digital Identity and Attributes Trust Framework. A government register entry can be checked entirely independently of the vendor. A trust center sits at a subdomain on Vanta's European instance, linked from the site footer as Security. No certification body or auditor is named, no validity window is given, no certificate document is published on the main site, and no SOC 2 report for Legl itself is published. Certifications named for subprocessors and payment partners belong to those companies.

Thirdfort states it holds ISO/IEC 27001:2022, the current revision, and is certified as an Identity Service Provider under the UK government's Digital Identity and Attributes Trust Framework, run by the Department for Science, Innovation and Technology. It is certified under the UK Digital Verification Services framework and appears on the GOV.UK register of digital identity services, a public register. FCA licensing adds outside supervision: in the vendor's account, the regulator has reviewed its security policies, and Thirdfort must file quarterly reports on operational and security risks. Penetration testing is annual and commissioned by the vendor, alongside routine vulnerability scanning and security log monitoring. No certificate, certificate number or validity period is published, no auditor or certification body is named, there is no SOC 2 report, and there is no trust center. Certifications are available under clause 18.2 on request during an audit, and clause 18.3 excludes access to external reports that are not public.

The subprocessor policy names sixteen suppliers as at 3 June 2025, each with its processing activity. It describes due diligence and contractual safeguards, notice of changes by email or in the customer's own environment, and a ten day objection window. A dated update log explains why Mitek Systems and Dun and Bradstreet were added in July 2024. No model or model provider appears in it. The list covers cloud and data infrastructure (Amazon Web Services, Heroku, Microsoft Ireland, Snowflake and Fivetran), identity and data suppliers (ComplyAdvantage, Equifax, Entrust Identity, Mitek, Creditsafe, Dun and Bradstreet and TrueLayer), and tooling (Datadog, Sentry, HelloSign and an email provider). None is a foundation model provider, and no page names a model, version or family, or states that the models are built in house. The agents read bank statements and analyze trust deeds, and nothing published says whose model processes a client's financial documents. The cloud providers show where the software runs, not which model runs on it.

Six suppliers are named in a published, versioned document that reproduces their full terms: Onfido, Experian, IVXS UK trading as ComplyAdvantage, iProov, Dun and Bradstreet, and Kyckr Ireland. The service provider page separates data providers from technical providers, offers a subscription to subprocessor notices, and names Anthropic's Claude models, provided through Google Cloud Vertex AI, as the AI model provider for its AI features, with Instabase for document information extraction and Google Cloud as host. Its data provider table gives each provider's storage location, in the United Kingdom or the European Economic Area, and adds Truelayer, Signicat's ReadID, GBG Loqate, Creditsafe and Refinitiv World-Check. Clause 16.2 of the Terms gives 30 days' notice of any material change to the data provider list with a right to terminate, and clause 3.3 of the processing agreement requires written notice of new subprocessors within 30 days with a right to object. Experian's terms disclose that its services involve models based on statistical analysis, probability and predictive behavior. No model version is named, and the region where the Claude models run is not stated.

The charging model is published and no price is. Pricing is modular: the firm chooses the modules it needs and pays only for what it uses. Billing is monthly and described as predictable, there are no implementation fees, and there is no long term lock in. A named customer contrasts this with competitors requiring fixed contracts of up to 36 months and usage forecasts. ROI reporting and insights on cost savings are offered as part of the product. No price per module, check, seat or firm, volume band, minimum, term length or currency is published. The page carries no plan table, and the only route to a number is booking a demo. The page is titled transparent, value based pricing, and its meta description promises a transparent pricing structure with no surprises.

The law firm plans page lists three plans. Essentials runs from £167 a month plus VAT and credits for the checks a firm runs, with unlimited users, the full range of ID, AML and source of funds checks and AI agents for client due diligence. Compliance adds discounted credits on bulk purchases, approvals, a firm-wide dashboard and the open API, and Enterprise adds the largest credit discounts and single sign-on, both by quote. The pricing FAQ describes a monthly platform fee plus credits bought by annual subscription or in bundles, 12-month contracts, credits valid for two years and charges only for completed checks, and no price per check is published. The Terms of Use set the mechanics: fees exclude VAT, any increase carries 30 days' notice with a chance to stop using the service, and disputed invoices must be raised within 30 days. Overdue amounts carry interest at 4 percent above the Barclays base rate, suspension follows 7 days' notice, minimum purchase commitments exist and survive early termination, and a discounted trial may be offered at the vendor's discretion.

Every solution page addresses law firms, the named customers are all law firms, and the roles quoted are legal compliance roles. Customers range from national and international names such as Lewis Silkin and Michelmores, through regional practices including Stephens Scown, Cripps, Tollers and Wilkes, to gunnercooke with its alternative structure, Burnett and Reid in Scotland, and specialist family practices including Hall Brown. The trust center description claims forty of the top two hundred. The product addresses one workflow, client onboarding and anti money laundering diligence with payments attached, and applies it the same way whatever the matter. No breakdown by practice area or matter type, and no configuration for particular areas, is published beyond risk assessment templates a firm builds to its own policy. The regulatory frame rests on the SRA, the Money Laundering Regulations, HM Land Registry expectations, the DVS register and the Digital Identity and Attributes Trust Framework. A separate Australian site is the only other market.

Legal is one of four named sectors, alongside conveyancing, estate agents and accountants. The legal sector page offers law firms ID, AML, source of funds and know-your-business reports, certification under the UK Digital Verification Services trust framework and connections to practice management systems, and the insights library has a Lawyers category aimed at solicitors, including guidance on file notes that survive an SRA review and on enhanced due diligence after the 2026 Money Laundering Regulations reforms. In property, the enhanced NFC identity check is built to HM Land Registry's Safe Harbor standard under Practice Guide 81, and the platform supports corporate service providers meeting the Companies House identity standard. The checks cover documents from 195 jurisdictions and electronic address verification across 17. The practice surface is a single workflow, client onboarding and anti money laundering diligence, with no other legal practice area and no statement of matter types. The regulatory frame is the United Kingdom's, resting on FCA authorization, HM Land Registry, Companies House, the SRA and English law.