PostSig vs Sirion: how they compare in 2026

LineageAI reads agreements with their amendments, service orders, side letters, invoices and approvals, decides which terms govern, and answers business questions with clause level citations, using whichever approved model PostSig picks for each task. The inventory, spend and renewal tracking, dashboards, reports and document workspace would still run as a contract and spend system without the models, with inventory data arriving through an API, secure file transfer or a web portal. The same engine sits under Investor Rights Intelligence and VentureOS, PostSig's products for investment firms.

Sirion's contract lifecycle platform came before its AI, and the company has traded since 2012. The product is organized as Store, Create and Manage, covering repository, drafting, approval, negotiation, obligation tracking and performance management. Without the agents and agentOS, a working enterprise CLM remains, and Gartner classifies it as one. The models drive the capability Sirion now sells on top of it. Agents are described as extracting and normalizing contracts, assembling first drafts from a playbook, proposing redlines on the other side's paper and monitoring obligations. Customers can also build and deploy their own agents in agentOS.

PostSig says every conclusion links back to the agreements, records and provisions behind it, with clause level citations across contracts, agreements and side letters, so a user can open the customer's own documents to check an answer. The MCP page says current terms, citations, calculations and lineage stay attached when answers go to an AI assistant. No accuracy rate, test or evaluation is published. The Terms of Service warn that AI output may be inaccurate, is not a source of fact, and must be validated by the customer before any use. The product does not cite legal authority.

AskSirion answers questions within one agreement or across the enterprise contract corpus, combining relevant clauses with related obligations, service levels, and counterparty records. Each answer links back to its underlying source, and the interface explains how it interpreted the user's request. Follow-up questions preserve context, while summaries, financial calculations, and date calculations draw on the same contract information. Retrieval over the customer's agreements is therefore traceable. Sirion describes no externally reproducible accuracy evaluation, error breakdown, or legal citator. References to an agreement establish the source of a commercial term, rather than verifying that an external legal authority remains current.

The page for legal teams says PostSig gives business users answers backed by sources so legal can focus on standards and exceptions, and that it does not replace legal review. The MCP page says each request from an approved AI client is checked for user, data set, scope and policy, runs against an explicit CPM or IRI data set, and stays traceable, along with the tools used, the outputs and the access state. Whether AI clients can only read or can also change records is not stated. The design sends routine contract questions to business users without a lawyer, and no review step, threshold or limit on what answers may be used for is described. The Terms of Service put validation of output on the customer and make any use of AI output the customer's sole risk.

AskSirion interprets a request and orchestrates agents for drafting, redlining, extraction, obligation tracking, and invoice reconciliation. Custom agent setup uses ordinary language to define the task, accessible data, connected systems, and when to escalate to the user. Agents can be tested with real scenarios and refined after launch. Recommendations include explanations and source links that allow review against the underlying contract. This gives administrators an escalation mechanism beyond a general promise of human control. Sirion does not describe default stop conditions, the approval interface for consequential actions, or recovery after an incorrect action. The launch sequence permits an agent to go live before subsequent scenario testing.

The home page quotes Sheena Clark of UNA Data Group, Gary Glasser of Birch Hill Equity Partners and Chris Petrescu of CP Capital, and adds investor endorsements from Nick Adams, Managing Partner at Differential Ventures, and David Cremin, General Partner at Frontier Venture Capital. Logos shown include CP Capital, CJC, Merlin Ventures, Arch Ventures Partners and Frontier Venture Capital. The headline figures, more than $1 billion of economic value governed, 3.2 million business records connected and 50,000 rights and obligations tracked, describe platform scale rather than customer outcomes. A September 2025 blog post describes unnamed customers: a global bank that cut 15 Refinitiv terminals, 8 Bloomberg terminals and 8 FactSet workstations, and a hedge fund that avoided a six figure back charge. No measured result is attributed to a named customer. On 28 September 2026 PostSig won Best Data Governance Solution at the WatersTechnology 2026 Inside Market Data & Inside Reference Data Awards, which it described as its sixth award or recognition in 16 months.

Three customer representatives speak on the record with their roles and employers. Edzard Janssen is Chief Procurement Officer at RBI. Reinhard Plaza-Bartsch is Head of Digital Supply Chain and Operations at Vodafone. Angella Dikmic is Manager of IT Vendor Management at GTAA. All three quotes are qualitative, and all three people work in procurement or vendor management rather than legal. The five percentage claims name no customer and read as product capabilities, so named customers and published figures are never paired. About 25 enterprise logos appear, including Citi, GE, Coca-Cola, Chevron, PayPal, Bayer, Rolls-Royce, Aramco, Yamaha, DP World and Zalando, and the customer stories list adds BNY Mellon, Chemours, National Life Group and Asian Paints without figures. Sirion's 2026 press releases put the platform at more than 7 million contracts worth nearly $800 billion, with more than a million suppliers and customers, across more than 70 countries.

The Terms of Service, updated July 2024, bind both parties to confidentiality and require advance notice, where the law permits, before customer data is disclosed under a subpoena or court order. The security page says content is accessible only to authorized users and logically isolated between customers, and the MCP page says tenant, record, document and user level access stays intact when AI clients connect. Section 3.5 of the Terms licenses PostSig to use customer data to provide the service and to create usage data and aggregated data, defined as data deidentified or aggregated so it no longer reasonably identifies the customer or an individual. Section 3.7(f) lets PostSig use that data to train, develop or enhance its AI models or other large language models, and no opt out is offered. PostSig's home page says there is no training on customer data. The Privacy Policy, updated July 30, 2025, lists generative artificial intelligence providers among its service providers without naming any. How long data is kept after termination beyond a discretionary 30 day window, and privilege, are not addressed.

Vendor library articles say customer data stays within the customer environment and is not used to train external language models. Clause 4.2 of the SaaS Terms, version 6, modified 26 August 2026, says otherwise. It reserves a right for Sirion to have its automated systems review and process Customer Data to generally inform machine learning capabilities in the services. None of the published agreements offers an opt out, and the agreement, not the library articles, is what binds. The rest of the confidentiality framework is published and can be read before signing. The data processing addendum stores and processes all customer data in a Sirion application instance specific to the customer. It sets Article 32 technical and organizational measures, with AES-256 at rest and TLS 1.2 in transit. It imposes need to know and least privilege access with automatic logout, requires deletion within 30 days of termination, and commits to notifying the customer of a confirmed security incident within 72 hours. Section 5 of the SaaS Terms adds mutual confidentiality, with a duty to give prior notice of any authority or court demand so the other party can object. The published agreements and trust center do not address privilege or work product.

The Terms of Service limit use to the customer's internal business purposes and say AI output is not to be relied on as a source of fact or a substitute for professional advice, and the page for legal teams says PostSig does not replace legal review. The legal solution page sells automatic translation of legal terms into lay language and less guidance from lawyers to other teams, so that business users answer contract questions themselves. Who reviews those answers is not addressed, and no limit by jurisdiction is stated.

The platform is sold to procurement, sales and finance teams as well as in house legal, all working on the same contracts. The three customer referees Sirion features are procurement and vendor management leaders, not lawyers. The home page, the trust center index with its AI ethics, compliance and security sections, and the terms and policies index say nothing on where tooling ends and legal advice begins. There is no statement that Sirion does not give legal advice, no professional responsibility or ethics page, no named bar or ethics guidance, including ABA Formal Opinion 512, and no jurisdiction limits.

No AI governance framework, accountable owner, testing before release, or finding on how answers perform across contract types or document sets is published. PostSig says it picks an approved model for each task, but who approves models, and against what standard, is not described. Its Best Data Governance Solution award relates to how the product handles customer data, not to how PostSig governs its own AI.

The trust center has a section titled Artificial Intelligence Ethics and Governance, last modified 16 December 2025, and its whole content is three sentences. They say Sirion has set up an AI Governance Program called S-AIGP, which monitors and ensures compliance with the EU AI Act 2024/1689 and other AI regulations as they emerge. Readers are told to contact their Sirion Account Executive for more. Sirion publishes nothing on who owns model behavior, what is tested before release, how the program works, or bias and uneven output.

The security page says content is accessible only to authorized users, logically isolated between customers, securely stored and monitored, with defined incident procedures and a Data Processing Addendum on request. The home page adds audit logs, with an audit trail on every workflow, encryption in transit and at rest, penetration testing and a "GDPR-Ready" label. Section 6.3 of the Terms of Service lets a customer request an export by email on termination. From 30 days after termination PostSig may delete customer data at its discretion, with no obligation to delete, and backups may be kept. The Terms bar customers from uploading prohibited data, including data covered by HIPAA, payment card data, data covered by COPPA or GLBA, and GDPR special category data. No retention period, subprocessor list or incident notification timeframe is published.

The data processing addendum, version 3, modified 2 July 2026, covers retention, access, subprocessors, incidents and encryption. Appendix B sets the retention period by the controller's contractual direction. Clause 8.1 requires deletion or return of all Customer Personal Data, including copies, within 30 days of termination. Any retention the law requires is limited to that purpose and stays under the agreement's protections, and the SaaS Terms add automatic deletion after 30 days as a backstop. Access runs on a need to know and least privilege basis, with automatic logout on inactivity. Subprocessors are named in a list published at its own URL. Sirion gives notice and an objection right for any addition or replacement, imposes equivalent terms on each, and is liable for their breaches. Clause 4.3 commits Sirion to notify the customer within 72 hours of establishing material impact from a confirmed Security Incident, and Appendix B says 48 to 72 hours, with updates until resolved. The definition expressly excludes unsuccessful attempts such as failed logins and denial of service attempts. Encryption is AES-256 at rest and TLS 1.2 in transit.

The Terms of Service cap liability at the fees paid or payable in the prior twelve months, with breaches of sections 3.1, 3.3 and 10 outside the cap, exclude indirect damages, and warrant only that the service performs materially as documented. Trials and beta features come with no warranty, indemnity or support; trials last 30 days, and liability for them is capped at US $50.00. Use of any AI output is at the customer's sole risk, and the only indemnity runs from the customer to PostSig. High risk activities are excluded from permitted use. California law governs, with venue in San Francisco.

Sirion publishes its SaaS terms and a separate end user agreement, so both can be read before signing. Clause 7.1 commits Sirion to indemnify and defend the customer against third party claims that use of the services infringes intellectual property. Clause 7.2 sets five exclusions, namely combination with materials Sirion did not provide, unapproved changes, unauthorized use, use in violation of applicable law, and continued use after Sirion gives notice. Clause 7.3 gives the remedies of securing the right to continue, replacing or modifying the services, or terminating with a pro rata refund of prepaid fees, as Sirion's sole and exclusive liability. Clause 7.4 has the customer indemnify Sirion over customer data. Clause 8.1 caps each party's total liability, across the whole term, at the fees paid for the subscription in the twelve months before the first event giving rise to a claim. Clause 8.2 excludes lost profits, lost or damaged data and consequential loss, and under clause 8.3 the cap does not apply to fees owed, breach of confidentiality or the indemnities. Clause 6.2 warrants that the services perform materially in line with the documentation, with a pro rata refund if Sirion cannot correct a nonconformity reported within ten days. The AI services addendum extends the intellectual property indemnity to the AI features, but excludes claims that come from the customer failing to review or validate output, and section 2.5(a) gives beta AI features no indemnity. Section 5.1 of those terms disclaims any warranty that output is accurate or free from hallucinations. No insurance position is published.

A DocuSign integration imports signed agreements into PostSig in one step. PostSig MCP gives approved AI clients, such as Claude Enterprise, ChatGPT Enterprise, internal applications and enterprise agents, access to its answers after checking user, data set, scope and policy; whether those clients can write back is not stated. Inventory data arrives through an API, secure file transfer or a web portal. ERP and accounts payable data are inputs: those systems still process payments while PostSig checks each invoice against the contract, and reports compare uploaded invoices with the agreed terms. What syncs in each direction and how connections are configured is not documented, and the partners page names no partners.

Nine named connectors are documented, each with its direction of travel, in the Non-Native Integrations article in Sirion University, last updated 24 February 2026. Four SAP Ariba accelerators cover procurement, bids, awards and contract workspaces. An executed contract request in Sirion creates a purchase requisition in Ariba, and the resulting purchase order is written back. Ariba sourcing events and RFPs become Contract Draft Requests on set triggers, one per bidding supplier with line items mapped, and supplier redlines move into Sirion for legal review. Awarded RFx events create a draft request with awarded line items synced. Contracts finalized in Sirion copy into Ariba Contract Workspaces with metadata, documents, line items and status. Further connectors cover supplier master data from Ariba, SAP S/4HANA Business Partners on scheduled transfers, outline agreements sent from Sirion to S/4HANA, and Oracle ERP with logging, error handling and sync status. The Microsoft Dynamics connector runs both ways in auto or manual mode. A Salesforce page, updated November 2026, covers approvals inside Salesforce and signing through DocuSign or Adobe Sign, with signed contracts synced to both systems, and the Create line works with internal teams in Word and Outlook. Native integrations add DocuSign, Adobe Sign, Leegality and other signature services, ServiceNow and Jira, and SAML single sign on, while Integration Studio and public APIs reach more than 1,000 enterprise systems. A Legora partnership announced in October 2026 brings Legora's legal research into Sirion in phases. No document management connector such as iManage or NetDocuments appears.

The hosting region is a customer choice between the US and the EU, and the provider is not named. PostSig's home page says application services and customer data are hosted in the customer's selected US or EU region, that sensitive records can be kept in the right region and jurisdiction, and refers to regional processing, access and evidence controls. The security page says customer environments are logically isolated. The Privacy Policy, updated July 30, 2025, says personal information is stored and processed in the United States under standard contractual clauses, and describes PostSig as a data processor for platform data, so the region choice applies to customer data in the platform rather than to the website. No hosting provider, region beyond the US and EU, or deployment option other than the hosted service is named, and where AI processing runs is not stated separately.

Sirion's application is SaaS hosted by a cloud provider, according to the data processing addendum, and all customer data is stored and processed in a Sirion application instance specific to that customer. That isolation commitment sits in a contract rather than in marketing. The subprocessor list, updated 28 September 2026, places hosting by provider: AWS in the United Kingdom, the United States, the EU and Asia Pacific, Azure in the United Kingdom and the UAE, Oracle in Saudi Arabia, India and the UAE, and IBM Cloud in the United States, with locations varying by the customer's preference. The addendum itself makes no residency commitment, and nothing separates where processing happens from where data is stored. Sirion completed an Australian IRAP assessment at OFFICIAL: Sensitive in August 2026. A Sirion library article describes the platform's multitenant scalability, which sits awkwardly beside the addendum's customer specific instance, and nothing published reconciles the two.

The security page says PostSig is SOC 2 Type II compliant, that the audit was conducted by Prescient Assurance, and that the report and detailed security controls are available to customers under NDA on request. Its home page lists encryption in transit and at rest, audit trails and penetration testing. No report period or scope is published.

Appendix B of the data processing addendum names ISO 27001 as a held certification and describes the review process around it. Under clause 7.1, unless agreed otherwise, Sirion will give a copy of its latest security attestation report on the customer's written request, no more than once a year. Clause 7.2 adds a customer audit right, with scope, timing and controls agreed in advance and a reasonable fee. Appendix B also says Sirion reviews its cloud providers' SOC 1, SOC 2 and ISO 27001 reports as part of a shared responsibility model. That is oversight of the infrastructure rather than an attestation over the application. The report route is open to existing customers, so a prospective customer cannot get the report before signing. The addendum names no auditor, coverage period or scope statement for the ISO certificate. Sirion's trust center states ISO 27001:2022 certification. Its SOC 1 Type II and SOC 2 Type II sections explain what those reports cover, and its security page attributes SOC 1 and SOC 2 to the cloud providers Sirion runs on.

The site presents LineageAI as its intelligence across documents, and the Terms of Service say aspects of the service rely on AI models. PostSig's home page says it selects the approved model best suited to each task and is not tied to a single provider. The Privacy Policy lists generative artificial intelligence providers among its service providers without naming one. No model, model provider, inference location or change notification is published.

A combination of more than ten large language models and more than 1,200 proprietary small language models powers the contract agents. A routing framework selects a model according to the task, while company content, policies, and risk preferences can refine agent behavior. The same architecture supports extraction, drafting, redlines, obligations, and invoice reconciliation through agentOS. The subprocessor list, updated 28 September 2026, names IBM Watson in the United States for the generative AI conversational bot in the platform, and section 7.4 of the AI services addendum lets third party AI providers process data in jurisdictions named in the documentation. Model families and versions for the other inference tasks are not identified, and no model change notification commitment is attached to the architecture description.

No price, unit or plan is published. The Terms of Service say fees are set in each order and renew at the then current fees, and describe only payment mechanics: in US dollars, due in 30 days, nonrefundable and with a 1.5% monthly late charge. Trials run for 30 days.

No pricing is published at any level, including the unit of charge. Sirion's site has no pricing page, no tier structure, no unit per seat, per contract or per agent, no volume banding and no statement of what implementation adds. Every call to action is a demo request. No published figure lets a prospective customer estimate cost before a sales process, even though Sirion publishes its SaaS terms, end user agreement and data processing addendum in full.

The site addresses market data, finance, procurement, legal, and risk and compliance teams at hedge funds, asset managers, banks, venture and private equity firms, family offices and data vendors, with use cases such as invoice reconciliation, renewals, usage and entitlements, DORA evidence and investor rights. Its market pages cover core financial firms, financial service providers, large financial institutions, market data consultants and data vendors, and the about page adds insurers. Investor Rights Intelligence is pitched as a replacement for Aumni, and VentureOS covers deal workflow, portfolio monitoring, cap tables and LP reporting. The Terms of Service limit use to internal business purposes and bar prohibited data. The contract types and markets it does not handle are not stated. Hendrik Bartel is PostSig's chief executive and one of its founders.

Eight industries have their own pages. Financial services is split into procurement and into capital markets and lending. Insurance has a separate solution for triaging underwriting submissions. The others are automotive, IT services, healthcare, pharmaceuticals and life sciences, telecom, and oil and gas. Five departments have their own pages, covering in house legal, legal operations, procurement, sales and finance. Customers are in more than 70 countries, and the site is in English, German and French. Sirion does not say where the product stops. It excludes no contract or matter types, does not address law firms, government or public sector use, and describes coverage by industry and department rather than area of law.