Newcode vs Wordsmith: how they compare in 2026

Remove the models and the product has no reason to exist. Newcode holds no documents of its own; it connects to the systems a firm already runs and everything it adds on top is model-driven. Nova retrieves, analyses and drafts with referenced answers. Aurora is described as the AI-native intelligence engine at the heart of the platform, a builder in which a firm assembles agentic workflows from agent nodes, prompt templates and a language model selector. Retrieval itself is agentic rather than a lookup, the vendor describing an agent that plans, searches, evaluates and iterates until the context is right. The published capability list is the same picture in one line: workflow orchestration, contract review, case-law analysis, knowledge ingestion, data structuring, document analysis, structured outputs, legal reasoning and governed execution. Strip out the models and what remains is a permissions and connector layer with nothing to run, which is why the vendor calls the product an AI harness rather than a workspace with AI in it. Checked 5 September 2026.

The machine learning is the mechanism the buyer pays for, and there is no conventional platform underneath it. The product is a four-step flow of receive, route, resolve and record, and the two steps carrying the value are both model-driven: auto-triage that classifies an incoming request by priority, jurisdiction and commercial exposure and routes it to the right lawyer, and resolution that answers or drafts without one. The vendor draws the distinction itself, arguing that technology which only makes a lawyer faster leaves the operating model unchanged. Review, drafting, the assistant, agents, research and intake are each a model capability; repositories and reports are records of what those produced rather than standalone systems. Company incorporated October 2023 with no legacy platform to layer onto.

The retrieval method is described rather than asserted, and nothing about accuracy is measured. Nova is stated to return referenced answers grounded in the firm's own data or external verified sources, with grounded referenced responses given as a product bullet in its own right. More usefully, the retrieval architecture behind that is set out: the retrieval agent plans, searches, evaluates and iterates until the context is right, guided by firm-defined taxonomy, labels and walls. That is a described method with a stated stopping condition and a stated constraint, which is more than most records in this lane publish and is what the band asks for. The sources are the firm's own documents and named external sources, so a reader can open what an answer rests on. What is absent is any test of it: no accuracy figure, evaluation, test set, error rate or statement of failure modes appears anywhere on the readable estate, and no accuracy or benchmark page exists. Nothing addresses hallucination in either direction, and no published agreement exists in which an accuracy position might otherwise sit.

Grounding is real and described in specifics, and no measured accuracy is published anywhere. On the evidence side: the research module states coverage of more than 130 jurisdictions across 60 countries drawn from curated government, regulatory and authoritative sources, with direct integrations to Companies House, EDGAR and Open Corporates for entity verification; the assistant returns a cited summary with links to the underlying legislation; the Word add-in returns answers described as cited and traceable; and Reports links every extracted value to an exact clause and page number with a click-through to verify. A reader can therefore open and check the source, which is the limb most of this market fails. What does not exist on any surface read on 31 Aug 2026 is a number: no accuracy figure, no hallucination rate, no benchmark, no described test set, no published evaluation of any kind. The vendor also lists smart web search as a source feeding legal answers without stating how a conflict between a curated source and a web result is resolved.

Control is offered as configuration the firm sets, and the boundary of autonomous action is never stated. What is published is real and is about capability rather than restraint: matter-level configuration, granular permissions, audit, firm-defined taxonomy, labels and walls, the ability to choose the model and set the guardrails without waiting on a release, and governed execution named among the platform capabilities. A reasoning trace is visible in the interface, shown as an expandable thought process against each output, which is a genuine review surface. What is missing is the account of what the system does alone. Aurora is sold on deploying agentic workflows at scale to automate complex processes, and the interface shows an Auto toggle on a running task, so the question of when the system acts without a person is raised by the product's own material and answered nowhere. Nothing states which outputs require review, what happens when an agent is wrong, whether generated work is marked as generated, or what guardrails can actually be set to. The band above requires a written commitment that the models work alongside a supervising lawyer, and no such commitment was located.

A real oversight posture with described review surfaces, short of the threshold that would make it a full control structure. The published model is that work reaches a lawyer only when it needs judgement, with routing to a named role shown as part of the flow. The review surfaces are concrete rather than asserted: in Reports a reviewer clicks a cell to verify it against the cited clause and page, then approves and locks the value or flags it for review; in the Word add-in every proposed redline can be accepted, rejected or improved individually. Against that, the company page describes chaining drafting into an end-to-end workflow that receives a request, drafts, routes for approval and sends with no manual step required, and nothing published states the threshold at which the system stops and escalates rather than resolving, or what happens after an output is found to be wrong. The proportion of requests resolved without a lawyer is presented as a headline statistic on the home page but the counter renders as zero, so the autonomy level is unquantified.

The strongest named customer list in this pull, with no figure attached to any of it. The home page names, in text as well as logos, Kirkland and Ellis, DLA Piper, Reed Smith, Dickinson Wright, Wolters Kluwer, Robinson and Cole, The Bar of Ireland, Wiersholm, Haavind, Awilhelmsen, Ræder Bing, Simonsen Vogt Wiig, Ekko Advokatfirma and Helton, together with Norwegian public bodies including Helsetilsynet, Meteorologisk institutt and the Statsforvalteren offices, closing with a claim of more than one hundred law firms and enterprises. That is attribution a reader can check against real organisations. One testimonial carries a name and a role, Preben Brecke, Managing Partner at Haavind, describing the product as helping structure transactions, sharpen analysis and reach better decisions in private equity, M&A and complex disputes. What is entirely absent is measurement: no figure, no date and no described outcome accompanies any customer, and no case study was located on the readable estate. A customers page exists in the navigation and was not opened in this pass; it is named here as the limit.

Named customers, named individuals and at least one figure, short of dates and method. Trustpilot appears with Anoop Joshi, Chief Trust Officer, alongside a stated 85 percent reduction in contract review time; the Financial Times with Dan Guildford, General Counsel; Belron with Janet McCarthy, General Counsel; and Multiverse with Tara Haig, General Counsel. A logo strip carries 25 named organisations including BT, Canva, Deliveroo, Nikon, Rakuten, Selfridges, Skyscanner and Starling, and dedicated customer story pages exist. Two things hold this at B beyond the missing dates and method. The home page outcome counters, covering share resolved without a lawyer, speed, outside counsel reduction and hours saved per lawyer, all render as zeroes rather than figures, so the platform's own headline results are not actually stated. And the same sentence about lawyers focusing on strategic work is attributed on that page to both Anoop Joshi and Janet McCarthy. Individual case study pages were not opened on 31 Aug 2026, so the date and method limbs are rebuttable.

Walls are named as a product concept and no commitment about them can be read before signing. The home page states that retrieval is guided by firm-defined taxonomy, labels and walls, and that a firm gets governed, auditable, matter-level configuration with granular permissions over what each team can reach. Naming walls at all is unusual and it is why this is not the floor band. Everything else is unavailable. No customer agreement, master services agreement or data processing addendum exists on the estate, confirmed by a full footer inventory that carries only a cookie policy and a privacy policy. The privacy policy states in its own first line that it covers personal data collected when a visitor uses the website or the contact form, so it does not reach matter data. No statement on training use, no privilege or work product treatment, and nothing about what any model provider retains was located. The Vanta-hosted trust centre linked as the site's Security entry returned page metadata with no body on 5 September 2026 and is the rebuttal route; nothing is inferred from it in either direction.

Substantive commitments across most of this ground, with the training promise sitting in policy rather than in a located clause. Privilege is addressed directly rather than skirted: the security page states the product is designed to maintain attorney-client privilege and that its architecture aligns with ABA Formal Opinion 512. The no-training statement is unusually absolute and repeated, extending on a dedicated article to customer data never being used to train any underlying model or included in any pre-training corpus. The third-party model position is the strongest read in this pull: OpenAI, Anthropic and Google are each named with the specific contractual instrument under which zero data retention applies, and prompts and outputs are stated not to be stored, logged or used for training by any provider. Clause 11.2 of the terms binds each party to hold the other's Confidential Information and to use it only for implementing the contract. Two gaps hold it at B. No training prohibition was located in the retrievable portions of the customer agreement, so the commitment a buyer can point to is a policy statement rather than a term, and the data processing agreement that the terms incorporate by reference sits on a trust portal that refused automated access. Separation between customers is asserted as complete with no co-mingling, but no mechanism is documented.

Nothing published addresses the advice line. No statement that Newcode is not a law firm, no disclaimer that output is not legal advice, no description of the professional judgement required before generated work is used, no jurisdiction limit and nothing on supervision or competence was located. There is no terms of service on the estate in which such a clause could sit, and the privacy policy is scoped to the website. The exposure is broad on this product because the published use cases are the work itself: drafting engagement letters, extracting court dates and deadlines from a scheduling order, conducting discovery, preparing trial submissions, providing strategic advice, and handling government applications, complaints and administrative proceedings. The band above does not fit, because it describes a boilerplate disclaimer sitting in the terms and no terms exist. Searched the home page in full, the legal page and the site footer inventory on 5 September 2026; the trust centre would not render and is the rebuttal route.

A published position that engages with named guidance rather than reciting a disclaimer, short of the competence and supervision limb. The security page names ABA Formal Opinion 512 twice, once in stating that the architecture aligns with it and once in a FAQ answering whether legal professionals must disclose AI use, which tells the reader that obligations vary by jurisdiction and bar association, that some recommend disclosure for substantive use while others do not require it for internal tools, and that teams should review Opinion 512 and applicable local bar guidance. The same page states that the product supports professional legal judgment rather than replacing it, and a published article engages with SRA and bar association duties to prevent unauthorised disclosure of client information. What is missing: nothing published addresses a lawyer's own competence and supervision duties in operating the tool, no jurisdiction limits are placed on the advice line despite research coverage spanning 130 jurisdictions, and no statement that Wordsmith is not a law firm was located on any surface read on 31 Aug 2026, which matters for a product whose stated purpose is resolving legal requests without a lawyer.

No governance position was located. There is no responsible AI page, no principles statement, no accountable owner or function named for model behaviour, no pre-release evaluation regime, no management system and no certification such as ISO 42001. The vocabulary of governance is present in the product and means something different: governed execution, guardrails and matter-level configuration are controls a customer sets over its own deployment, not disclosure of how the vendor governs the models it ships. The privacy policy's automated decision-making clause addresses only website data and states that no solely automated decisions with legal effect are made there. The gap has a specific shape given the buyer list, which includes national public bodies and a bar association, and given a model-agnostic architecture in which the firm chooses the model: nothing published describes who is accountable for behaviour when the firm has selected the model and built the workflow. Home page, legal page and footer inventoried 5 September 2026; the trust centre would not render.

No governance position for model behaviour was located. Searched the home page, the security page and its full FAQ, the downloads page, the company page, the research, assistant, reports and Word integration pages, and the published articles on data privacy and contract review, on 31 Aug 2026. Nothing names an individual or role accountable for model behaviour, describes what is tested before a release ships, sets out a responsible AI framework or principles, or discloses anything about uneven output across matter types, counterparties or populations. The security disclosure is substantial but it is information security, which is a different subject and does not carry on this axis, and the ISO 27001 certification described as in progress is likewise a security standard rather than an AI management one. One limitation worth stating: the Vanta trust portal linked from the footer refused automated access, and if it carries an AI governance policy this grade is rebuttable on that document alone.

Access control is published at product level and everything downstream of processing is unavailable. What is stated: granular permissions, matter-level configuration, firm-defined labels and walls governing what retrieval can reach, audit described as a platform property, and a choice of cloud or local deployment. That is a real access story. What is absent for customer data is retention, deletion, incident practice and any subprocessor list, none of which appears anywhere readable. The privacy policy is thorough and covers the wrong subject: it states retention periods of twelve months for contact-form correspondence and ninety days for technical logs, tabulates GDPR legal bases, names transfer mechanisms and lists three website providers, Vercel, Resend and Cloudflare Turnstile, while confining itself by its own first line to data collected through the website. No agreement exists on the estate to carry the rest. The Vanta trust centre linked as the site's Security entry returned metadata with no body on 5 September 2026, so its contents are neither credited nor held against the vendor, and it is the rebuttal route on this row.

Substantive published policy across most of the ground, short of an openly reachable subprocessor list. Published on the security page: AES-256 at rest and TLS 1.2 or higher in transit; access restricted on a least privilege basis; SSO through Okta, Azure Active Directory and Google Workspace over OIDC and SAML 2.0 with MFA and role-based access control; annual independent penetration testing; and a formal incident response plan with confirmed breaches notified to affected customers within 72 hours together with details and remediation steps. The privacy policy adds a commitment to notify the customer and any applicable regulator of a suspected breach where legally required, and states that access is limited to those with a genuine business need under a duty of confidentiality. Retention is customer-controlled: data can be permanently deleted at any time, all customer data is permanently deleted on termination, and custom retention policies can be configured. A published article is candid that a platform must retain some information to function, which is more useful than an unqualified zero-retention claim. The gap is that no subprocessor list is published on the open site and no default retention period is stated; both the list and the incident response plan sit on the trust portal.

Nothing published addresses who bears the loss when the system is wrong. The site footer was inventoried in full on 5 September 2026 and carries two legal documents, a cookie policy and a privacy policy, both reached through anchors on a single legal page. There is no terms of service, no master services agreement, no customer agreement and no data processing addendum anywhere on the estate, so no indemnity, liability cap, warranty position, disclaimer of warranties, service level commitment or insurance statement can be read before entering a sales process. The privacy policy is scoped to website visitors and allocates nothing. The band above does not fit, because it requires a standard limitation clause disclaiming the exposure the product creates and there is no clause of any kind. The exposure is not theoretical on a platform that drafts filings, extracts court deadlines and runs agentic workflows for government bodies and international firms. The trust centre would not render and is the rebuttal route.

Liability is addressed through a limitation clause that disclaims the exposure the product creates, with the indemnity running the other way. Clause 8 requires the customer to indemnify Wordsmith, its officers, directors, employees, agents and consultants against liabilities, costs, damages and losses arising from the customer's use of the product and from any breach of the terms, carved back only where the claim arises from Wordsmith's own failure to meet its obligations. Clause 9.1.1 then states that Wordsmith shall not in any circumstances have liability for losses or damages suffered by the customer, subject to exceptions at clauses 9.2 and 9.6. No indemnity running to the customer, no warranty on output and no insurance position was located. A retrieval limit to state plainly: the terms page returns no body text to automated fetching, so the agreement was read through the search index, and the text of clauses 9.2 and 9.6, which carry the exceptions and would ordinarily contain any cap, could not be retrieved on 31 Aug 2026. If either contains a vendor indemnity or an output warranty this grade moves.

The most substantial integration story in this pull, short of documentation an implementer could work from. Newcode's premise is that it connects rather than replaces, and the named counterparties are the systems legal work actually lives in: iManage for document management, Outlook, SharePoint, OneDrive, Teams, and Word, Excel and PowerPoint, delivered through what the vendor describes as seamless reach into more than 750 Model Context Protocol servers. What moves is described at workflow level rather than left as logos, with a published example of drafting an engagement letter from a matter in Outlook using historical letters in SharePoint as fee benchmarks, a DMS search tool inside the assistant, and review, redlining and feedback carried out directly in Word. The vendor's own framing, that context follows the matter rather than the tool, is the correct description of what this axis measures. What is missing is depth a buyer could plan against: no field mapping, sync direction, trigger condition or permission model is documented, no developer or configuration documentation was located, and the 750 figure is a count rather than a list.

Real integrations documented, with depth described in one place and asserted in the rest. The Word add-in is the strongest evidence: it is distributed through Microsoft AppSource under product identifier WA200008590, and its integration page describes what it actually does rather than that it exists, covering running a playbook against a contract in the sidebar, accepting, rejecting or improving each redline in place, querying the repository by at-mention to insert approved clause language, and running research with jurisdiction and language selection. A Slack app has its own install route, and dedicated pages exist for Microsoft 365 and MCP. Research integrates directly with Companies House, EDGAR and Open Corporates. The illustrated request flow shows context pulled from Salesforce, Slack and Ironclad. What is missing: no document management integration such as iManage or NetDocuments was located, the Salesforce and contract lifecycle connections appear in an illustrative workflow rather than in documentation stating what moves and in which direction, and no developer or API reference index was located on the open site on 31 Aug 2026.

The deployment limb is answered with a real option and the region limb is not addressed at all. The home page states that a firm gets cloud or local deployment options, which offers a self-hosted route rather than the single multi-tenant cloud most records in this lane assume, and pairs it with matter-level configuration and granular permissions over what each team can reach. A local deployment option is the strongest form the tenancy question can take, since it puts the customer in control of the environment entirely. Against that, no region is named anywhere for the hosted option, no cloud provider is identified for it, and no residency commitment appears in any readable material. The only geographic facts published are corporate, offices in Oslo, Stockholm, Dublin, New York and Palo Alto, which locate the company rather than the data, and the privacy policy's transfer section concerns website personal data by its own scope. This is the documented band gap where one limb is answered cleanly and the other not at all.

Residency is stated clearly and as a customer choice, and the tenancy model is not stated at all. The security page publishes hosting on AWS with EU data residency by default and US available, and adds a commitment that data is not transferred outside the customer's chosen region without explicit consent, which is a stronger statement than most vendors make because it binds the vendor to the customer's selection rather than merely offering one. The underlying AWS certifications are named as ISO 27001, SOC 1, SOC 2, SOC 3 and PCI DSS Level 1. Three things hold this at B, all checked 31 Aug 2026. Nothing published states whether the platform is multi-tenant or single-tenant, and separation between customers is asserted without a tenancy model behind it. No private, single-tenant or on-premises option was located. And where processing happens as distinct from where data is stored is not addressed: three US-headquartered model providers process prompts, and the relationship between that processing and the customer's chosen region is not explained.

A real trust portal on a recognised compliance platform, and nothing verifiable from outside it. The site footer links Security to a dedicated trust subdomain hosted on Vanta, which is the artifact this axis asks about and is materially more than a badge image; several records in this pull display certification marks with no portal behind them at all. What could not be established is anything inside it. The page returned title and metadata with no body on 5 September 2026, so no standard, certifying body, examination period, scope statement or report is establishable, and whether the portal fulfils on an email address or requires a sales conversation is unknown. No certification is claimed anywhere in the readable text of the estate, and no badge appears on any page. Under the convention for gated artifacts, where the access tier cannot be established the lower tier is graded and the reason stated, which is what this note does. This is the cheapest available upgrade on the record.

Certification is real and stated and a trust portal is openly linked, but no scope, date or auditor is available on any readable surface. The security page states SOC 2 Type II certification described as independent, GDPR compliance, annual independent penetration testing, and ISO 27001 in progress. A Vanta-hosted trust portal is linked from the site footer without a gate, and the vendor states that provider policies, the data processing agreement and the incident response plan sit there. That portal counts as a genuine access route and is credited here as reachable: it refused automated access through its robots file, which is a retrieval limit on the index's side and not a gap on the vendor's, so nothing is scored against Wordsmith for it. What could not be established from any surface read on 31 Aug 2026 is the substance an attestation is judged on: no auditor is named, no coverage period is given, no report scope is described, and no penetration test partner or summary appears. A badge stating SOC 2 Type II with no scope and no date is what the open site offers, and the portal is where the answer presumably sits.

Model choice is sold as a feature and no model or provider is named. The vendor offers the flexibility to use the language model that works best for a firm, tells buyers to choose the models and set the guardrails without waiting on a release, and shows a language model selector inside an agent node in its workflow builder, so a model layer is not merely acknowledged but made configurable. Naming which models are on offer is the next sentence and it is never written: no provider, no model family, no version and no hosting arrangement for any of them appears in the readable estate, and no commitment to notify customers when the available set changes was located. A model name appears in one interface illustration and is treated here as artwork rather than disclosure, since nothing corroborates it. The question carries weight in proportion to the architecture: a platform whose selling point is model flexibility across a firm's whole document estate is precisely where a buyer needs the list. The trust centre would not render and is the rebuttal route.

The providers are named with unusual precision and the change commitment is absent. The security page identifies all three model providers, OpenAI, Anthropic and Google, states that each is used through a paid enterprise API, and names the specific contractual instrument under which zero data retention applies to each: OpenAI's API Data Usage Policy, Anthropic's Commercial Terms, and the paid API Gemini Terms. Naming the instrument rather than asserting a commitment in the abstract is more than almost any vendor does, and it lets a buyer check the upstream terms directly. Two gaps, checked 31 Aug 2026. No specific model or version is identified for any of the three, so a buyer knows whose models but not which, which matters for a product whose research module also feeds in live web results. And nothing published commits to notifying customers when the provider set or the models change, which for a multi-provider architecture is the disclosure a customer most needs.

No pricing information is published at any level, including the unit of charge. There is no pricing page in the site navigation, which carries solutions, academy, customers, security, about, news, careers and contact, and none in the footer, which carries only the cookie and privacy policies. Every commercial route on the estate is the same single call to action, book a demo. Nothing states whether the platform is licensed per user, per firm, per workflow, per agent run or on consumption, which is a live question on a product sold on agentic execution at scale where usage and cost would ordinarily be linked. No tier names, minimum commitment, term length or implementation cost appears, and because no terms of service or master agreement is published either, the payment provisions that would ordinarily disclose a charging structure are also unavailable. A buyer can learn nothing about cost without entering a sales process. No pricing row is owed on this record.

No pricing information is published at any level, including the unit of charge. Searched on 31 Aug 2026: the main navigation, which carries no pricing entry; the footer Product section, which lists downloads, comparisons, ROI and security and no pricing; the home page, the security page, the downloads page and the company page. Every call to action across the property is to book a demo. Neither a figure, a tier structure, a per-seat or per-matter unit, nor a statement of what implementation adds was located. The agreement confirms that a priced self-service route exists, since the self sign-up terms authorise charging fees by credit card, debit card or automated clearing house on online purchase, but no number is published anywhere a prospective buyer can reach without entering the signup flow or a sales process. The ROI page in the footer was not opened, so this is rebuttable if it carries a rate rather than a calculator.

Five buyer segments are described with distinct substance, and the boundary is never drawn. Law firms are addressed on billable capacity and firm-wide standards; in-house teams on standardising routine work, traceability and turnaround; insurance on matching claim facts to policy wordings and endorsements and surfacing coverage grants, exclusions and conditions precedent; banking and financial institutions on analysing facility agreements, loan agreements and master agreements at volume with review and redlining in Word; and government on case handling across applications, complaints, investigations and administrative proceedings. Each names the instruments and the work of that sector rather than restating a generic pitch, and the customer list corroborates the spread, running from international firms to a bar association to national public agencies. Practice depth is evidenced by named capabilities including fund formation, case-law analysis and jurisdictional comparison. What is absent is the limit: no jurisdiction is stated despite a Nordic base and US offices, no firm size band is given, nothing identifies a practice area or matter type the product does not suit, and nothing addresses the languages supported.

Segment coverage is described with real substance and the boundaries are left open. The property segments explicitly and in dedicated pages: by role for General Counsel and Legal Operations, by requesting team for procurement, sales, security and human resources, and by size across small business, mid-market and enterprise. Geographic and legal coverage is stated concretely as more than 130 jurisdictions across 60 countries, and the site publishes locale variants for eleven countries in five languages. What is absent is any statement of where the product stops. Law firm segments are not addressed, which is consistent with a product built for in-house teams, though external counsel appear only as recipients of shared reports and the position is never stated outright. Government and court use is not addressed. And practice coverage is expressed as the requesting business function rather than as areas of law, so a reader learns which internal team a request comes from but not which areas of law the product is competent in, on a platform whose research module claims 130 jurisdictions. Checked 31 Aug 2026.