Ontra vs PERSUIT: how they compare in 2026

The models drive the data products and sit as a layer on the service products. Insight extracts clauses and covenants from fund and credit agreements into structured obligation data, Accord produces AI markup against a digital playbook, and DDQ generates responses from a precedent library; all three are model driven. But for Contract Automation, the flagship, Ontra's pricing page says the work is done by people: qualified contract professionals on Standard, qualified lawyers on Advanced, and lawyers described as having experience at top firms on Premier. Remove the models and an outsourced negotiation service and an entity directory remain saleable. A core capability is model driven, on a workflow and document platform that would still work without it.

Persi is described by the vendor as the intelligence layer built into PERSUIT, and the pricing position is explicit: it is not bought separately and arrives with the platform. PERSUIT ran as a competitive RFP, fee arrangement and electronic billing platform for about a decade before Persi existed. Its underlying capabilities, such as request management, panel governance, invoice review and spend reporting, are workflow and data functions that stand without models. What the models add is real and central to how the product is now sold: matter triage, fee benchmarking, firm shortlisting, proposal evaluation and anomaly detection across six named workflow stages. The product would still function without them.

Accuracy is asserted and never measured. The AI page promises “reliable AI” and “expert-validated, actionable intelligence”, and AI Search is marketed as answering questions “informed by the full scope of your agreements”. No accuracy figure, test set, evaluation or named failure mode is published. Nothing published shows that an answer links back to a source passage a reader can open and check. The expert review process that catches hallucinations is covered under Autonomy and Oversight. The product works on the customer's own fund documents rather than primary law, so grounding to primary authority and citation status checks fall outside what it claims.

The dataset is described precisely, and the output is never measured. PERSUIT states that Persi draws on more than $22 billion in proposal data across more than 4,800 firms, and the proof page dates that dataset to platform transactions as of February 2026. No accuracy figure, evaluation, test set or named failure mode was found for Persi's own outputs on any page read. Persi's illustrated answers cite counts of comparable matters and percentages against benchmark. Nothing published shows that a user can open the underlying comparables to check them. Grounding to primary law and citator checks do not apply, since the product reasons over commercial pricing data rather than case law. Accuracy is asserted without measurement.

A written human review commitment is published with a described mechanism. The security page sets out a Human-in-the-Loop Model in which subject matter experts continually review text outputs for accuracy, flag potential hallucinations and enforce consistency across repeated questions. They then trace root causes to retrieval augmented generation prompting, query understanding or embedding models, naming the layers of the pipeline where failures are diagnosed. The pricing page adds a second control by tiering who does the work, from contract professionals to lawyers described as having experience at top firms. The rest of the control structure is missing: no thresholds, no statement of what runs unattended and what a customer must approve, and no described review screen or escalation route in the product.

PERSUIT publishes a clear written division of labor with a visible approval point. The Persi page states that Persi does not replace the customer's judgment: the customer brings the judgment and Persi brings the infrastructure. Every one of the six illustrated workflows ends at a confirmation rather than an action. Requests are drafted ready to review and send, a breaching invoice is put on hold pending review, and exceptions are flagged for the customer. The customer configures the constraints. Engagement rules such as minimum competitive bids, spend thresholds, panel requirements and diversity obligations apply to every matter, with a worked example of a $100,000 threshold triggering a competitive request to at least three panel firms. No autonomy modes are published, and nothing states what Persi may do without asking. The control structure is shown through product illustrations rather than documentation a buyer could hold the vendor to.

Attribution is strong, and the figures sit on the other side of it. Named customers come with named officers and titles: Vincent Taurassi, General Counsel and COO at Sentinel Capital Partners; Lizette Perez-Deisboeck, General Counsel and CCO at Battery Ventures; Jonathan Romick, General Counsel at Linden Capital Partners, describing an SEC production; and Ed Zelaski, Director of Compliance at Blue Point. Blackstone and Bain Capital Credit have their own case studies. Separately, the vendor publishes portfolio figures: more than 1,000 customers, more than 2 million documents processed, 9 of the top 10 PEI ranked firms, and 96 percent customer retention. A footnote gives the retention method: the average across customers using a platform solution for at least a year as of December 2025. That is a dated, assessable method, but it describes the vendor's book, not what changed at a named firm. Named customers come without figures, and figures without a named customer.

Named legal departments, a customer result and dated platform figures with their basis are all published. Named officers include Gabriel Harnier, General Counsel at SAP; Anne Robinson, Chief Legal Officer at IBM; Sabine Chalmers, General Counsel at BT Group; Leanne Geale, Group General Counsel at Nestlé; and Ernst van de Weert, General Counsel at Heineken. SAP reached its three year savings target in nine months. Platform figures are 26 percent average savings per matter, 30 percent with competitive sourcing, the lowest bid winning 48 percent of the time, and 79 percent of value awarded under an alternative fee arrangement. Each has its denominator explained and is footnoted as sourced from PERSUIT platform transactions as of February 2026. Each carries a caveat that individual results differ by matter type, industry and process design. The testimonials for individual customers are quotes without their own figures.

Training and model provider retention are answered; separation is not. The security page says Ontra never uses customer data to train models, and that data passed to third party LLM providers is processed only to deliver the service and deleted afterwards, which states what the model provider keeps. Terms of Service clause 10.2 commits Ontra to a reasonable degree of care over User Data. Against that, clause 6.2 reserves the right to collect usage data on an aggregated and anonymized basis to improve products, except as limited by a Customer Agreement. The no training promise therefore lives on a marketing page while the published agreement reserves an improvement use. Nothing documents separation between tenants, and clause 10.2 warns that other Users with access rights may reach User Data. Privilege and work product are not addressed, and the Customer Agreement is unpublished.

Confidentiality is asserted in general terms, and the substance sits behind an NDA. The privacy policy commits to reasonable steps against misuse and unauthorized access and states that employees may not view customer data unless necessary to diagnose a problem. It describes SSL/TLS in transit and logging of sign ins, and the security page adds SSO and role based access controls. Nothing addresses training on customer content. Persi is marketed as trained on the aggregate proposal dataset that customers themselves generate, and no published term says whether a given customer's proposals feed it. No retention or deletion position, segregation by matter or tenant, or treatment of privilege or work product was found. The security page lists the documents that would answer these, the subprocessor list, data flow diagrams and SOC 2 report, as available in the Trust Center under NDA. A buyer cannot read the commitments before entering an evaluation.

A real position covering the product, not just the website, is published. Terms of Service clause 12.2, headed No Legal or Other Advice, says nothing in the Services, software or documentation is legal advice, that Ontra is not a law firm and provides no legal services, advice or representation, and that no attorney client relationship is formed. It places responsibility for decisions taken in reliance on output with the user. The clause reaches the Platform, not only the marketing site. It sits in tension with the business: Ontra runs the Ontra Legal Network, and the pricing page sells access to qualified lawyers who negotiate the customer's contracts. Nothing addresses the buyer's own competence and supervision duties, no jurisdiction limits are named, and ABA Formal Opinion 512 is not mentioned.

Nothing is published on the advice line. No terms of service, customer agreement or disclaimer was found. The footer link labeled Privacy & Terms leads to a privacy policy alone, and the home, platform, Persi, security, integrations and proof pages carry no disclaimer. PERSUIT produces sourcing and pricing recommendations rather than legal work product. Persi is described as advising whether a matter should be insourced or sent out, recommending which firms to instruct, and evaluating which proposal represents best value. Those recommendations are used by in house lawyers and by law firms. No position on the line between tooling and professional judgment is published, and ABA Formal Opinion 512 is not mentioned.

Ontra holds ISO 42001, the international management system standard for AI, stated on the security page and shown as a badge on the home page. A certified AI management system is a governance framework with real substance, not a set of principles. Three things are missing. No person or committee at Ontra is named as accountable, no testing regime before release is described, and no result is disclosed on uneven output across document types, jurisdictions or counterparties. The SOC 2 and ISO 27001 attestations belong to security rather than AI governance.

No governance position is published for a system that allocates work between law firms. There is no responsible AI page, no named accountable owner, no testing regime before release, and no ISO 42001 or equivalent. Persi shortlists firms, scores firm performance with numeric value scores, and decides which firms are invited to compete for mandates worth six and seven figures. The vendor itself lists diversity obligations among the engagement rules the system enforces. Nothing published addresses whether those recommendations have been tested for uneven treatment across firms, jurisdictions or matter types. Security certifications are a different subject and are covered under Security Certifications.

Most of the ground is covered, and the gap is incident practice. The security page publishes AES-256 with rotating keys at rest and TLS 1.2 or above in transit, says third party LLM providers encrypt in both states, and commits to deleting data passed to those providers once processing is complete. It names a dedicated security team and the tools it runs: SAST, DAST, CDR, EDR, continuous GRC, WAF and MDM. A subprocessor list is published on the trust center at trust.ontra.ai, which also offers email notice of subprocessor changes. Not published: any incident response or breach notification practice, or any statement of how long documents and generated outputs are kept inside the platform, as distinct from the zero retention commitment at the model layer.

A generic privacy policy and a security summary are published, with the operative detail withheld. Published controls are SSL/TLS encryption in transit, employee access restricted to what is needed to diagnose problems, logging of sign ins, regular external security audits by contracted firms, and tested business continuity and disaster recovery plans. Role based access control and full audit logging across platform activity are also stated. No retention period, deletion practice beyond GDPR erasure rights, or incident or breach notification practice is published. A subprocessor list exists, but the security page places it in the Trust Center under NDA. The privacy policy is dated October 2021 and still relies on the EU-US Privacy Shield Framework, invalidated by Schrems II in July 2020. The policy covers the product without addressing what happens to matter data, proposals and prompts after processing.

The published allocation is specific and runs one way. Terms of Service clause 13.2 caps Ontra's total liability at $100, disclaims all consequential, incidental and special damages, including loss or corruption of data, and carves out only fraud and willful misconduct. Clause 12.1 provides the Services as is with all warranties disclaimed, and clause 13.1 runs the only indemnity from the user to Ontra. There is no warranty on output, no insurance position and no indemnity to the customer. The document that would actually govern a buyer is not published. Clause 1 says a customer's written Customer Agreement supersedes these Terms, and no Customer Agreement, MSA or DPA is published on the site. The figure and the carve out can be read before signing, but what is published disclaims the exposure the product creates rather than standing behind it.

Nothing published says who bears the loss when a recommendation is wrong. No terms of service, master subscription agreement, customer agreement or service level agreement was found. The footer was checked across six pages, and its Privacy & Terms link leads to a privacy policy with no liability, warranty or indemnity provision. No separate terms page appears in the navigation. The Trust Center is the only route to contractual documentation, and the security page states its contents are available under NDA, which is the vendor's choice to gate them. No indemnity, cap, carve out, warranty on output or insurance position can be read before a buyer enters an evaluation.

Real integrations are named and described by what they do rather than how to configure them. The Ontra MCP Server gives a customer's own LLM real time, read only access to Atlas entity data, so a firm can query entities and ownership structures from its existing AI tool; direction and permission model are both stated. The Terms of Service name Ontra for Word as an application plugin, placing the product in the drafting tool lawyers already use. The Atlas pricing panel includes a Standard API package, the DDQ panel lists flexible exports, and Insight publishes side letter compliance exports. Contract Automation includes a document management system in all three editions. No integrations page, developer index or configuration documentation is published, and no connector to a legal document management system such as iManage or NetDocuments is named.

Integration is documented in detail. Four connection routes are published, managed integrations, an RFP API, a reporting API and composable workflows, and each is documented at field level. Direction is stated explicitly. Matter management systems send PERSUIT the matter ID, reference data, legal team assignments, practice group and jurisdiction. When an RFP concludes, PERSUIT sends the billing system the PERSUIT ID, firm name, total budget, currency, matter owner, entity, category and department. Sample API fields are printed on the page, including request_id, participation_status, pricing_items, total_fee, average_rate, price_at_start and price_at_end. Managed integrations are stated to need no custom development, and a public API documentation URL is published. The target systems are described by category rather than by product, so no specific matter management or billing partner is named. The API documentation sits behind the application and was not opened.

Cloud delivery is obvious, and neither tenancy nor residency is stated. The product is a web platform reached at app.ontra.ai, but none of the home page, the AI capabilities page, the security and privacy page, the pricing page or the Terms of Service states a tenancy model or offers a data residency region, and no processing location is given separately from storage. The only published point touching location is that third party LLM providers encrypt data in transit and at rest, which says nothing about where either sits. A trust center sits at trust.ontra.ai on Vanta.

The host is named, and neither tenancy nor a residency option is stated. The security page states the platform runs on Google Cloud, with MongoDB and Qlik as data providers, which answers whose infrastructure is used but not where a given customer's data sits. No tenancy model is published. No residency option is offered. The only location material is in the privacy policy, which says personal information may be stored outside Australia with cloud providers in the United States, and that European personal data may be transferred to Australia and the US under standard data protection clauses. That is a transfer disclosure about personal information rather than a residency offering for platform data, and it comes from a policy dated October 2021. Processing location is not addressed as distinct from storage, and no region can be chosen by the customer.

The certification set is strong. The security page states SOC 2 Type 2 across all five trust services criteria, with the scope specified, plus ISO 27001:2022 with the version named and ISO 42001. A trust center on Vanta at trust.ontra.ai is linked from the security page and says it carries subprocessor information and offers notice of changes. No auditor is named and no coverage period or report date is published, and nothing says whether reports can be downloaded, sit behind a click through, or require a sales conversation.

The certifications are real, current and itemized, but the evidence is not openly accessible. The security page states ISO/IEC 27001:2022 with the version named and describes it as independently audited rather than assessed by the company itself. It also states SOC 1 Type 2 attestation and CSA STAR certification. Third party external assessments are published with dates and scores: SecurityScorecard A and UpGuard 865/950, both stated as independently assessed in January 2025. A SafeBase trust center is named and publicly linked. The page lists what it holds: a penetration test report, network diagram, data flow diagrams, SOC reports, subprocessor list, ISO certificate and Statement of Applicability, and OSPAR for financial services buyers. The SOC 2 report is stated to be available under NDA once access is granted. No auditor is named for any attestation, no coverage period is given, and the SOC 2 scope is not specified. No request was submitted.

The architecture is described in detail and the providers behind it are never named. Ontra names its own pipeline layers, retrieval augmented generation, query understanding and embedding, and states a zero retention commitment at the model layer, so the shape of the system is visible and the model provider is known not to keep customer content. Nothing published answers the question of whose model sees customer content. No model, model family or provider is named, and no inference location is stated. The trust center at trust.ontra.ai has a dedicated subprocessors page with email notice of changes to the list, so a change notice mechanism exists.

Persi is described through its training data and never through its models. The vendor states repeatedly that Persi is trained on more than $22 billion of outside counsel management data and contrasts it with generic AI, naming Claude and Copilot only as competitor categories. No model, model provider, inference location or commitment to notify customers of changes was found on any page read. Google Cloud, MongoDB and Qlik are named on the security page. They answer where the software runs rather than whose model sees client content. The subprocessor list that might answer it is in the Trust Center under NDA. The vendor refers to proprietary intelligence without identifying what sits underneath.

A real pricing page carries tiers, feature splits, the unit of charge and one actual number. Contract Automation publishes three editions with a comparison matrix covering playbook customization, who does the work, turnaround and document management. It states a monthly minimum fee of $2,000 on both Advanced and Premier, and no monthly minimum on Standard. Insight for Funds publishes three tiers and Insight for Credit two, each with a populated feature matrix. Atlas, Accord, DDQ and KYC publish what their licenses include and route the figure to Request Pricing. Free trials and a proof of value are offered without a sales gate on several products. The rate per document that actually drives the bill is never published, so the floor is known but not the price, and six of the seven products carry no figure at all.

No pricing information is published at any level. There is no pricing page: the navigation and footer were checked across the home page and the platform, Persi, security, integrations, proof and privacy pages, and none has a pricing entry. No plan names, packaging structure, unit of charge or figure are published. Every commercial route is a demo request, an industry briefing or a contact form. The ROI calculator asks the buyer to supply its own outside counsel spend rather than disclosing what PERSUIT costs. Neither the shape of the pricing nor any number is published.

Coverage is described by buyer and by workflow with real precision. The site has pages by team (legal, compliance, finance and investor relations) and by firm type, covering investment firms, investment banks and law firms, the last aimed at automating MFN processes. The practice scope is concrete: NDAs and other routine contracts, engagement letters, side letters and MFN elections, credit agreements and covenants, entity management and CTA compliance, reverse KYC, and investor due diligence questionnaires. The private markets framing is a real boundary, and the vendor repeats it everywhere. Limits inside that boundary are not stated. Nothing says which document types Contract Automation will decline, government use is not addressed, and the only scope caveat located is a pricing footnote that some document types, such as commercial agreements or engagement letters, take 48 hours rather than 24.

Coverage is documented by role and by sector with real specificity. Five buyer pages are published: General Counsel and CLOs, legal operations, head of litigation, in house attorney, and law firm partners and business development. Law firms are a distinct buyer here, sitting on the other side of the same transaction. Nine industry pages are published, from financial services and life sciences to energy and real estate. Named matter types are disputes across jurisdictions, regulatory investigations, M&A and complex litigation. The limits are not stated, and the vendor declines to state them. It answers the objection that some matters are too complex by claiming that every matter type has been run through the platform and that complexity is the use case. Government legal departments are not addressed.