Ontra vs ProVision: how they compare in 2026

The models drive the data products and sit as a layer on the service products. Insight extracts clauses and covenants from fund and credit agreements into structured obligation data, Accord produces AI markup against a digital playbook, and DDQ generates responses from a precedent library; all three are model driven. But for Contract Automation, the flagship, Ontra's pricing page says the work is done by people: qualified contract professionals on Standard, qualified lawyers on Advanced, and lawyers described as having experience at top firms on Premier. Remove the models and an outsourced negotiation service and an entity directory remain saleable. A core capability is model driven, on a workflow and document platform that would still work without it.

Extraction is the model's job: uploaded side letters, LPAs and master documents are read, and their provisions and investor terms are structured automatically. The support FAQ says the platform does not require AI to run and that the most advanced AI is deployed only where it adds value, with guardrails to retain control over outputs. A customer's own published account describes AI features as added when appropriate, according to each client's preferences and data security policies, so the AI is optional and set for each client. Without it the platform is still a structured repository of side letters and LP comment memos, with MFN election form generation and response tracking, provision comparison and merging, versioning and an action record.

Accuracy is asserted and never measured. The AI page promises “reliable AI” and “expert-validated, actionable intelligence”, and AI Search is marketed as answering questions “informed by the full scope of your agreements”. No accuracy figure, test set, evaluation or named failure mode is published. Nothing published shows that an answer links back to a source passage a reader can open and check. The expert review process that catches hallucinations is covered under Autonomy and Oversight. The product works on the customer's own fund documents rather than primary law, so grounding to primary authority and citation status checks fall outside what it claims.

Extraction is said to structure provisions while preserving the original legal text, and comparison is said to work without breaking traceability, so an output can be traced to its source clause. The support FAQ says fail safes or guardrails are provided to prevent hallucinations. No accuracy figure, test set, evaluation, error rate or description of the extraction method is published, and nothing states what share of provisions are extracted correctly or how an extraction error reaches a reviewer. A Data Security White Paper, described as a technical deep dive into the architecture, is available only by email.

A written human review commitment is published with a described mechanism. The security page sets out a Human-in-the-Loop Model in which subject matter experts continually review text outputs for accuracy, flag potential hallucinations and enforce consistency across repeated questions. They then trace root causes to retrieval augmented generation prompting, query understanding or embedding models, naming the layers of the pipeline where failures are diagnosed. The pricing page adds a second control by tiering who does the work, from contract professionals to lawyers described as having experience at top firms. The rest of the control structure is missing: no thresholds, no statement of what runs unattended and what a customer must approve, and no described review screen or escalation route in the product.

The about page says the technology is there to assist rather than to second guess professional judgment and that ProVision keeps the lawyer in control, and the overview repeats that structuring happens without compromising legal judgment. Extracted provisions and investor information are presented for review, MFN elections follow rules and parameters the team sets, and the home page describes visibility and control at every step, with a record of every action, approval and document version. No threshold is published at which the system acts without a reviewer, and nothing describes what happens to extractions nobody approves. No confidence signal appears against an individual provision, and the guardrails in the support FAQ are named without being described.

Attribution is strong, and the figures sit on the other side of it. Named customers come with named officers and titles: Vincent Taurassi, General Counsel and COO at Sentinel Capital Partners; Lizette Perez-Deisboeck, General Counsel and CCO at Battery Ventures; Jonathan Romick, General Counsel at Linden Capital Partners, describing an SEC production; and Ed Zelaski, Director of Compliance at Blue Point. Blackstone and Bain Capital Credit have their own case studies. Separately, the vendor publishes portfolio figures: more than 1,000 customers, more than 2 million documents processed, 9 of the top 10 PEI ranked firms, and 96 percent customer retention. A footnote gives the retention method: the average across customers using a platform solution for at least a year as of December 2025. That is a dated, assessable method, but it describes the vendor's book, not what changed at a named firm. Named customers come without figures, and figures without a named customer.

The company names Cleary Gottlieb, Fried Frank, Goodwin, Paul Weiss, Proskauer, Ropes & Gray and Willkie Farr & Gallagher as customers, described as more than ten of the world's largest law firms. It quotes Theresa Spartichino, Director of Practice Technology at Ropes & Gray, and Conan Hines, Director of Practice Innovation at Fried Frank. Fried Frank published its own announcement of the deployment, quoting Becky Zelenka, partner and joint head of its Private Equity Funds group. ILS says that in 2025 the platform processed more than 5,000 side letters across over 450 matters, supporting more than 150 billion dollars of capital raised in six named markets. No figure is attributed to any named firm, the quotes describe operational clarity and quick adoption without measurement, and no case study is published.

Training and model provider retention are answered; separation is not. The security page says Ontra never uses customer data to train models, and that data passed to third party LLM providers is processed only to deliver the service and deleted afterwards, which states what the model provider keeps. Terms of Service clause 10.2 commits Ontra to a reasonable degree of care over User Data. Against that, clause 6.2 reserves the right to collect usage data on an aggregated and anonymized basis to improve products, except as limited by a Customer Agreement. The no training promise therefore lives on a marketing page while the published agreement reserves an improvement use. Nothing documents separation between tenants, and clause 10.2 warns that other Users with access rights may reach User Data. Privilege and work product are not addressed, and the Customer Agreement is unpublished.

ProVision runs in a single tenant AWS environment logically segregated per customer, and documents and extracted data sit in a dedicated instance and are said never to be mixed with other clients' data. There is no shared document storage across customers, access runs on granular role based control, and encryption is AES-256 at rest with TLS 1.2 or higher in transit. No privilege or work product treatment is named. The FAQ carries an entry headed Do you use our data to train AI models, but no training position is published in readable text. ILS's trust center also describes a zero knowledge framework under which ILS cannot access customer provisions or investor data, with end to end encryption at every stage, which sits in tension with a product that extracts and structures provisions on its servers. Nothing published reconciles the two, and the white paper that might is available only by email.

A real position covering the product, not just the website, is published. Terms of Service clause 12.2, headed No Legal or Other Advice, says nothing in the Services, software or documentation is legal advice, that Ontra is not a law firm and provides no legal services, advice or representation, and that no attorney client relationship is formed. It places responsibility for decisions taken in reliance on output with the user. The clause reaches the Platform, not only the marketing site. It sits in tension with the business: Ontra runs the Ontra Legal Network, and the pricing page sells access to qualified lawyers who negotiate the customer's contracts. Nothing addresses the buyer's own competence and supervision duties, no jurisdiction limits are named, and ABA Formal Opinion 512 is not mentioned.

The about page says the technology assists rather than second guesses professional judgment and that ProVision keeps the lawyer in control, and the overview describes structuring side letters and LPAs without compromising legal judgment. The audience is private investment funds lawyers at law firms and fund formation teams, so there is no consumer surface. No statement says outputs are not legal advice, nothing requires a lawyer to verify an extracted provision before relying on it, and no rule of professional conduct, bar or regulator is named. No jurisdiction limit is stated, although the company reports work across six markets with different regimes. The Terms of Service, described on the trust center as the governing agreement, are available only by email.

Ontra holds ISO 42001, the international management system standard for AI, stated on the security page and shown as a badge on the home page. A certified AI management system is a governance framework with real substance, not a set of principles. Three things are missing. No person or committee at Ontra is named as accountable, no testing regime before release is described, and no result is disclosed on uneven output across document types, jurisdictions or counterparties. The SOC 2 and ISO 27001 attestations belong to security rather than AI governance.

No governance position is published: there is no responsible AI page, principles statement, named owner accountable for model behavior or evaluation and testing regime, and nothing on bias or on uneven extraction quality across document types, drafting styles or jurisdictions. The site's navigation and footer list ProVision Overview, Trust Center, Blog, Support, About ILS, Our Team, Careers, Press Announcements, Contact, Privacy Policy and Cookies Policy, and none is a governance page. The trust center's Resource Vault lists eight items, all security, privacy or contractual documents rather than AI governance material. The support FAQ's reference to fail safes and guardrails is a product assurance, not a governance framework. A description of the company as taking a disciplined approach to AI led by lawyers comes from its lead investor rather than from the company.

The security page publishes AES-256 with rotating keys at rest and TLS 1.2 or above in transit, says third party LLM providers encrypt in both states, and commits to deleting data passed to those providers once processing is complete. It names a dedicated security team and the tools it runs: SAST, DAST, CDR, EDR, continuous GRC, WAF and MDM. A subprocessor list is published on the trust center at trust.ontra.ai, which also offers email notice of subprocessor changes. No incident response or breach notification practice is published, and nothing states how long documents and generated outputs are kept inside the platform, as distinct from the zero retention commitment at the model layer.

ProVision publishes AES-256 encryption at rest, TLS 1.2 or higher in transit, single tenant AWS deployment with logical segregation per customer, granular role based access control, real time monitoring, redundant backups and configurable data residency options. No retention period, deletion route or certification, or named subprocessor appears on the site or the trust center. The documents that would cover each point are listed on the trust center, and each opens an email to the company's information security address: a GDPR Overview said to cover where data is hosted and which subprocessors are involved, a Data Processing Agreement, an Incident Response Overview and a Privacy Policy. The portal does not say whether a request is fulfilled without a sales conversation. A Privacy Policy also sits at a public footer link.

The published allocation is specific and runs one way. Terms of Service clause 13.2 caps Ontra's total liability at $100, disclaims all consequential, incidental and special damages, including loss or corruption of data, and carves out only fraud and willful misconduct. Clause 12.1 provides the Services as is with all warranties disclaimed, and clause 13.1 runs the only indemnity from the user to Ontra. There is no warranty on output, no insurance position and no indemnity to the customer. The document that would actually govern a buyer is not published. Clause 1 says a customer's written Customer Agreement supersedes these Terms, and no Customer Agreement, MSA or DPA is published on the site. The figure and the carve out can be read before signing, but what is published disclaims the exposure the product creates rather than standing behind it.

ILS's trust center lists a Terms of Service, described as the governing agreement for using ILS platforms, and its View link opens an email to the company's information security team. The Data Processing Agreement sits behind the same route, so neither agreement is published openly. No indemnity, cap, carve out, warranty on output or insurance position is published, and none of the home page, overview, about page, support FAQ or trust center carries any liability language.

Real integrations are named and described by what they do rather than how to configure them. The Ontra MCP Server gives a customer's own LLM real time, read only access to Atlas entity data, so a firm can query entities and ownership structures from its existing AI tool; direction and permission model are both stated. The Terms of Service name Ontra for Word as an application plugin, placing the product in the drafting tool lawyers already use. The Atlas pricing panel includes a Standard API package, the DDQ panel lists flexible exports, and Insight publishes side letter compliance exports. Contract Automation includes a document management system in all three editions. No integrations page, developer index or configuration documentation is published, and no connector to a legal document management system such as iManage or NetDocuments is named.

Documents enter by upload, described as side letters, LPAs and related documents uploaded in minutes, and outputs leave as generated election forms in PDF and Word. No document management system is connected, and neither iManage nor NetDocuments nor SharePoint is named; no practice management, matter management, electronic billing or fund administration system is named either. There is no integrations page in the site navigation or footer, no API reference and no developer documentation. The one published connection is for sign in: the support FAQ confirms single sign on with multi factor authentication, or username and password with two factor authentication, or both. At an AmLaw firm, the executed documents the product reads usually already sit in a document management system.

Cloud delivery is obvious, and neither tenancy nor residency is stated. The product is a web platform reached at app.ontra.ai, but none of the home page, the AI capabilities page, the security and privacy page, the pricing page or the Terms of Service states a tenancy model or offers a data residency region, and no processing location is given separately from storage. The only published point touching location is that third party LLM providers encrypt data in transit and at rest, which says nothing about where either sits. A trust center sits at trust.ontra.ai on Vanta.

ProVision is deployed in a secure single tenant AWS environment, logically segregated per customer, with each customer's documents and extracted data in a dedicated instance and no shared document storage across customers. ILS contrasts this with what it says most legal technology providers do, which is run shared multi tenant environments. Amazon Web Services is named as the host. Configurable data residency options are listed as a feature, but no region is named. Nothing states where processing happens as distinct from storage, and no model or inference location is published. A GDPR Overview said to cover where data is hosted is available only by email request.

The certification set is strong. The security page states SOC 2 Type 2 across all five trust services criteria, with the scope specified, plus ISO 27001:2022 with the version named and ISO 42001. A trust center on Vanta at trust.ontra.ai is linked from the security page and says it carries subprocessor information and offers notice of changes. No auditor is named and no coverage period or report date is published, and nothing says whether reports can be downloaded, sit behind a click through, or require a sales conversation.

ILS's trust center says a SOC 2 Type II report is independently issued and covers security, availability and processing integrity. The compliance section of the same page says the systems are aligned with SOC 2 Type II standards, and its summary strip reads SOC aligned, while the support FAQ says the company is SOC 2 Type 2 certified. Alignment is a self assessment and certification is not, so the pages conflict. No auditor, audit period or report date is published, and the report is reachable only by emailing the company's information security address, with no statement that the request is fulfilled without a sales conversation.

The architecture is described in detail and the providers behind it are never named. Ontra names its own pipeline layers, retrieval augmented generation, query understanding and embedding, and states a zero retention commitment at the model layer, so the shape of the system is visible and the model provider is known not to keep customer content. Nothing published answers the question of whose model sees customer content. No model, model family or provider is named, and no inference location is stated. The trust center at trust.ontra.ai has a dedicated subprocessors page with email notice of changes to the list, so a change notice mechanism exists.

The support FAQ says the platform deploys the most advanced AI only where it can add value. No model, provider or version is named, no inference location is stated, and no commitment to notify customers of changes is published. Amazon Web Services is named as the cloud host, which says where the platform sits, not whose model reads a side letter. ILS's trust center lists a GDPR Overview said to cover which subprocessors are involved, and its link opens an email request.

A real pricing page carries tiers, feature splits, the unit of charge and one actual number. Contract Automation publishes three editions with a comparison matrix covering playbook customization, who does the work, turnaround and document management. It states a monthly minimum fee of $2,000 on both Advanced and Premier, and no monthly minimum on Standard. Insight for Funds publishes three tiers and Insight for Credit two, each with a populated feature matrix. Atlas, Accord, DDQ and KYC publish what their licenses include and route the figure to Request Pricing. Free trials and a proof of value are offered without a sales gate on several products. The rate per document that actually drives the bill is never published, so the floor is known but not the price, and six of the seven products carry no figure at all.

No pricing information is published at any level, including the unit of charge. The site has no pricing page, and the support page lists a Sales contact for ProVision pricing, enterprise discussions and rollout planning behind an email link. Nothing states whether the platform is charged per matter, per fund, per side letter, per seat or as a license for the whole firm, and no tier, price range, minimum, term or implementation cost is published. Two FAQ entries are headed What is the ROI and What does a pilot look like; neither is a pricing disclosure.

Coverage is described by buyer and by workflow with real precision. The site has pages by team (legal, compliance, finance and investor relations) and by firm type, covering investment firms, investment banks and law firms, the last aimed at automating MFN processes. The practice scope is concrete: NDAs and other routine contracts, engagement letters, side letters and MFN elections, credit agreements and covenants, entity management and CTA compliance, reverse KYC, and investor due diligence questionnaires. The private markets framing is a real boundary, and the vendor repeats it everywhere. Limits inside that boundary are not stated. Nothing says which document types Contract Automation will decline, government use is not addressed, and the only scope caveat located is a pricing footnote that some document types, such as commercial agreements or engagement letters, take 48 hours rather than 24.

The product is addressed to private investment funds lawyers and fund formation teams. The work is named at the level of the task: side letters, limited partnership agreements, master side letter compilation, MFN elections and LP comment memos, described as work after a fund closes. The named customers are elite international law firms, and geographic reach is given as the United States, United Kingdom, European Union, Hong Kong, Singapore and the Middle East. The platform is described as serving both funds and law firms. No statement names fund types or structures it does not support, nothing says whether an in house fund legal team can buy it directly rather than through counsel, and no minimum firm size is given. Roadmap language describes expanding into a unified platform for fund formation teams.