PostSig vs Sirion: how they compare in 2026

The models drive the core task inside a platform that would still work without them. LineageAI reads agreements with their amendments, service orders, invoices and approvals to decide which terms govern and answers business questions from them. The inventory, spend and renewal tracking, dashboards, reports and document workspace would still run as a contract and spend system without the models. Verified 22 September 2026.

The models drive the capability being sold and sit on a contract lifecycle platform that predates them and would function without them. Sirion has traded since 2012 and the product is structured as Store, Create and Manage, covering repository, drafting, approval, negotiation, obligation tracking and performance management. Strip out the agents and agentOS and a working enterprise CLM remains, which is the category Gartner placed it in. The agentic layer is real rather than cosmetic, with agents described as extracting and normalising contracts, assembling first drafts from a playbook, proposing redlines on third-party paper and monitoring obligations, and agentOS lets a customer build and deploy their own. That is the B band: the machine learning is the engine of a core capability layered on a workflow system.

Answers are linked to their sources; accuracy is not measured. The site says every conclusion links back to the agreements, records and provisions behind it, so a user can open the customer's own documents to check an answer. No accuracy rate, test or evaluation is published, and the Terms of Service warn that AI output may be inaccurate and must be validated by the customer before any use. The product does not cite legal authority. Verified 22 September 2026.

Accuracy is asserted at length and measured nowhere. The grounding claim is specific and repeated: answers are described as carrying citations linked to the customer's own data, and vendor material states that every AI-generated response includes citations linked to exact sources with clause-level citation and justification. Five percentage figures are published prominently, but every one measures speed or coverage rather than correctness: 90 per cent faster centralisation, 85 per cent faster insights, up to 90 per cent faster time to contract, 99 per cent on-time obligation compliance, 70 per cent faster agentic automation. Searched the home page, the trust centre and its AI ethics, compliance and security sections on 31 Aug 2026 and located no accuracy figure, no error or hallucination rate, no test set and no published evaluation. Nothing addresses what the system does when the customer's contract set does not support an answer.

Oversight is asserted rather than built out. The legal-teams page says PostSig gives business users source-backed answers so legal can focus on standards and exceptions, and that it does not replace legal review; the MCP page says each request from an approved AI client is checked for user, data set, scope and policy. The design sends routine contract questions to business users without a lawyer, and no review step, threshold or limit on what answers may be used for is described; the terms put validation of output on the customer. Verified 22 September 2026.

Autonomy is claimed and the oversight mechanism is asserted in a phrase rather than described. Agents are said to sense intent, reason over enterprise data and act autonomously, to assemble first drafts and propose redlines, and to monitor obligations, surface gaps, trigger owners and drive follow-through. The single oversight statement located is that the user stays in control for strategic exceptions. What that leaves unpublished is everything the axis asks for: what an agent completes without a human, the threshold at which it stops and escalates, where the review point sits, and what happens after an output is wrong. agentOS is described as letting customers build, test and deploy agents, which implies configurable guardrails, but no control structure is documented. Searched the home page and the trust centre on 31 Aug 2026.

Named customers without measured results. The home page quotes Sheena Clark of UNA Data Group, Gary Glasser of Birch Hill Equity Partners and Chris Petrescu of CP Capital, alongside investor endorsements. Its headline figures, more than $1 billion of economic value governed, 3.2 million business records connected and 50,000 rights and obligations tracked, describe platform scale rather than customer outcomes. Verified 22 September 2026.

Named customers and published figures, never attached to each other. Three individuals speak on the record with roles and employers: Edzard Janssen, Chief Procurement Officer at RBI; Reinhard Plaza-Bartsch, Head of Digital Supply Chain and Operations at Vodafone; and Angella Dikmic, Manager of IT Vendor Management at GTAA. All three quotes are qualitative. The five percentage claims carry no customer at all and read as product capabilities. Roughly 25 enterprise logos appear including Citi, GE, Coca-Cola, Chevron, PayPal, Bayer, Rolls-Royce, Aramco, Yamaha, DP World and Zalando, with customers stated across more than 70 countries and contract value under management put at more than 450 billion dollars. Two things a reader should note: all three named referees sit in procurement or vendor management rather than legal, on a platform indexed here as a legal product; and the case study library was not opened on 31 Aug 2026, so dates and method remain rebuttable.

Confidentiality is addressed in the agreement, alongside a right to train on de-identified data. The Terms of Service bind both parties to confidentiality and require advance notice, where the law permits, before customer data is disclosed under a subpoena or court order; the security page says content is accessible only to authorised users and logically isolated between customers. The same terms let PostSig create aggregated data from customer data, defined as de-identified or aggregated so it no longer reasonably identifies the customer or an individual, and use it to train, develop or enhance its AI models or other large language models, with no opt-out located, while the home page says there is no training on customer data. Which AI providers process customer data, how long it is kept after termination beyond a discretionary 30-day window, and privilege are not addressed. Verified 22 September 2026.

Note amended 31 Aug 2026 under R23 as amended; grade held at B, and the reasoning for holding it is set out because the underlying facts have moved against the vendor. The original note recorded that the no-training commitment was located only in vendor library articles rather than in the agreement. The SaaS Terms have since been read in full, version 6, modified 26 August 2026, and the position is worse than a silence: clause 4.2 reserves a right for Sirion to direct its automated systems to review and process Customer Data to generally inform machine learning capabilities in the Subscription Services, with no opt-out located. The published no-training statement and the governing agreement therefore contradict each other, and under the documents-beat-marketing rule the agreement is what binds. What still supports the grade is the rest of the confidentiality architecture, which is genuinely substantive and readable before signing: the data processing addendum stores and processes all customer data in a customer-specific Sirion application instance, sets Article 32 technical and organisational measures with AES-256 at rest and TLS 1.2 in transit, imposes need-to-know and least-privilege access with automatic logout, requires deletion within 30 days of termination, and commits to notifying the customer of a confirmed security incident within 72 hours. SaaS Terms section 5 adds a mutual confidentiality regime with a duty to give prior notice of any authority or court demand so the other party can object. Privilege and work product remain unaddressed on every surface read. The grade is held rather than dropped because the C band describes confidentiality asserted in general terms or reachable only through a sales conversation, and neither is true here. A reader who takes the B band's requirement of substantive commitments on training use to mean commitments not contradicted by the agreement would grade this C, and that reading is defensible on these facts.

A boilerplate disclaimer against advice-shaped marketing. The Terms of Service say AI output is not to be relied on as a source of fact or a substitute for professional advice, and the legal-teams page says PostSig does not replace legal review. The legal solution page, however, sells automatic legal translations into lay terms and a reduction in the legal guidance lawyers give other teams, so that business users answer contract questions themselves. Who reviews those answers is not addressed. Verified 22 September 2026.

Nothing published on the advice line was located. Searched the home page, the full trust centre index and its AI ethics, compliance and security sections, and the terms and policies index on 31 Aug 2026. No statement that Sirion does not provide legal advice, no professional responsibility or ethics page, no named bar or ethics guidance including ABA Formal Opinion 512, and no jurisdiction limits. The exposure is not theoretical: the platform is sold to procurement, sales and finance departments alongside in-house legal, all working on the same contracts, and the three customer referees the vendor chose to feature are procurement and vendor management leaders rather than lawyers. The SaaS terms and end user agreement were read only in fragments through the search index, so this grade is rebuttable if either carries a professional advice disclaimer.

Checked the home, about, legal solution, legal-teams, security and MCP pages, the Terms of Service and the Privacy Policy on 22 September 2026. No AI governance framework, accountable owner, testing before release, or finding on how answers perform across contract types or document sets was located. Verified 22 September 2026.

The trust centre carries a section titled Artificial Intelligence Ethics and Governance, and its entire published content is three sentences: that Sirion has instituted an AI Governance Program abbreviated S-AIGP, that the programme monitors and ensures compliance with the EU AI Act 2024/1689 and other global AI regulations as they emerge, and that the reader should contact their Sirion Account Executive for more information. The page was last modified 16 December 2025. Naming a programme and a regulation, then routing the substance to a sales conversation, is not a governance position: nothing is published about who owns model behaviour, what is tested before release, how the programme operates, or anything at all concerning bias or uneven output. Under the gating rule a referral to an account executive is the sales-gated tier and earns no credit. This is the sharpest example in this pull of a governance artifact that exists as a heading rather than as disclosure.

Security controls are described in general terms; retention, deletion and subprocessors are not committed. The security page says content is accessible only to authorised users, logically isolated between customers, securely stored and monitored, with defined incident procedures and a Data Processing Addendum on request; the home page adds audit logs, encryption and penetration testing. The Terms of Service let PostSig delete customer data at its discretion from 30 days after termination, with no obligation to delete, and backups may be kept. No subprocessor list or incident notification timeframe was located. Verified 22 September 2026.

Amended 31 Aug 2026 under R23 as amended, from B to A. The Data Processing Addendum at /terms-and-policies/data-processing-addendum/, version 3, modified 2 July 2026, was read in full on 31 Aug 2026; the original grading rested on fragments recovered through the search index, and the full document supplies every element this axis asks for. Retention and deletion: Appendix B sets the retention period by the controller's contractual direction, and clause 8.1 requires deletion or return of all Customer Personal Data including copies within 30 days of termination, with any law-compelled retention limited to the purposes requiring it and kept under the Agreement's protections. The SaaS Terms add automatic deletion after 30 days as a backstop. Access control: defined permissions on need-to-know and least-privilege-by-default, with automatic logout on inactivity. Subprocessors: a named Sub-Processor List published at its own URL, with a commitment to notify and an objection right on any addition or replacement, equivalent contractual terms imposed on each, and Sirion remaining liable for their breaches. Incident practice: clause 4.3 commits to notifying the customer within 72 hours of establishing material impact from a confirmed Security Incident, with Appendix B stating 48 to 72 hours and continuing communication until resolution, and the definition expressly excludes unsuccessful attempts such as failed logins and denial-of-service attempts, which is a precision most vendors leave out. Encryption is AES-256 at rest and TLS 1.2 in transit. All five limbs are published, current and specific enough to hold the vendor to, which is what separates A from B here; the earlier B rested on the subprocessor list and incident window not having been located rather than on their absence.

A standard limitation clause, and no indemnity from PostSig. The Terms of Service cap liability at the fees paid in the prior twelve months, exclude indirect damages, and warrant only that the service performs materially as documented. Use of any AI output is at the customer's sole risk, and the only indemnity runs from the customer to PostSig. Verified 22 September 2026.

A real published position, readable before signing, short of the cap and silent on AI output. The SaaS terms and a separate end user agreement are both published openly. Clause 7.1 commits Sirion to indemnify and defend the customer against third-party claims that use of the subscription services infringes intellectual property rights. Clause 7.2 sets four named exclusions, covering combination with materials Sirion did not provide, unapproved modification, unauthorised use, and use inconsistent with the documentation. Clause 7.3 gives a remedy ladder of securing the right to continue, replacing or modifying the services, or terminating with a pro-rata refund of prepaid fees as Sirion's sole and exclusive liability. Clause 7.4 runs a reciprocal indemnity from the customer over customer data. What could not be established on 31 Aug 2026: the liability cap, since only fragments of the limitation clause were retrievable through the search index; any warranty on output; any insurance position; and any AI-specific treatment, since neither agreement carves AI output in or out of the indemnity.

Named connections, some with the flow described. A DocuSign integration imports signed agreements into PostSig in one step, and PostSig MCP gives approved AI clients such as Claude Enterprise and ChatGPT Enterprise access to its answers after checking user, data set, scope and policy. ERP and accounts-payable data are referred to as inputs. What syncs in each direction and how connections are configured is not documented. Verified 22 September 2026.

Written 31 Aug 2026 as an R7 amendment; this row was left unwritten in the original build because no integration surface had been opened and grading an absence would have scored a research gap against the vendor. Surface read on 31 Aug 2026: the Non-Native Integrations article in Sirion University at /sirion-university/integrations/non-native-integrations/, last updated 24 February 2026. It documents nine named connectors with the direction of travel stated for each, which is the depth this axis asks for and which almost nothing else in the corpus publishes. Four SAP Ariba accelerators cover procurement, bids, awards and contract workspaces: an executed contract request in Sirion creates a purchase requisition in Ariba and the resulting purchase order is written back to Sirion; Ariba sourcing events and RFPs convert into Contract Draft Requests on defined workflow triggers, one per bidding supplier with line items mapped from bid detail, and supplier redlines transfer into Sirion for legal review; awarded RFx events create a new draft request with awarded line items synced; and contracts finalised in Sirion replicate into Ariba Contract Workspaces with metadata, documents, line items and workflow status, by event-driven asynchronous processing. Three more cover supplier master data from Ariba, SAP S/4HANA Business Partners on scheduled transfers, and Oracle ERP with built-in logging, error handling and sync status visibility. The Microsoft Dynamics connector is explicitly bidirectional and runs in auto or manual mode. Configuration is described at the level of triggers, modes and scheduling rather than a full implementation guide, and the wider Sirion University catalogue requires a login. The documented depth sits on the procurement and ERP side; the Microsoft Word add-in is distributed through AppSource and Salesforce through AppExchange, but neither is documented to this depth on a page read, and no document management system connector such as iManage or NetDocuments was located.

Residency is offered without a region. The home page says sensitive records can be kept in the right region and jurisdiction, and the security page says customer environments are logically isolated. No region, hosting provider, processing location or deployment option other than the hosted service is named. Verified 22 September 2026.

The tenancy model is stated in the agreement and the regions are not stated anywhere. The data processing addendum states that the Sirion application is a SaaS application hosted by a cloud service provider and that all customer data is stored and processed in a customer-specific Sirion application instance, which is a real isolation statement carried in a contractual document rather than a marketing claim. The trust centre names four underlying providers, AWS, Azure, Oracle and IBM, which is unusually broad and implies customer choice without stating it as an option. Two gaps checked 31 Aug 2026: no data residency commitment, region list or jurisdiction option was located anywhere, and nothing addresses where processing happens as distinct from where data is stored. One tension worth a buyer's attention: a Sirion library article describes the platform's multi-tenant scalability, which sits awkwardly beside the addendum's customer-specific instance, and nothing published reconciles the two.

A named attestation and auditor, report under NDA. The security page says PostSig is SOC 2 Type II compliant, that the audit was conducted by Prescient Assurance, and that the report and detailed security controls are available to customers under NDA on request. No report period is published. Verified 22 September 2026.

The Data Processing Addendum, read in full on 31 Aug 2026, supplies two things. Appendix B names ISO 27001 as a held security certification and describes the review regime around it, and clause 7.1 gives a contractual access route: unless otherwise agreed, Sirion will provide a copy of its most current security attestation report on the customer's written request, no more than once annually. Clause 7.2 adds a customer audit right, with scope, timing and controls agreed in advance and a reasonable fee chargeable. Appendix B also records that the cloud provider's own SOC 1, SOC 2 and ISO 27001 reports are assessed by Sirion as part of a shared responsibility model, which is oversight of infrastructure rather than an attestation over the application and is not credited here. The grade is B because the access route is a contractual entitlement running to an existing customer, not a way for a buyer to obtain evidence before signing, and because no auditor is named, no coverage period is stated, and no scope statement says which systems the ISO certificate covers. The line is the sales conversation, and a report obtainable only after execution sits below the self serve tier that can reach A.

A named engine, with nothing said about what sits underneath. The site presents LineageAI as its cross-document intelligence, and the Terms of Service say aspects of the service rely on AI models. No model, model provider, inference location or change notification is published. Verified 22 September 2026.

The architecture is described and nothing underneath it is identified. Vendor material sets out a multi-model approach combining purpose-built small models trained on enterprise contracts with large language models, and presents that as the differentiator against generic models retrofitted for legal use. No large language model provider is named, no model or version is identified, no processing location is given for the model layer as distinct from the cloud infrastructure, and nothing commits Sirion to notifying customers when any of it changes. This sits above the floor because the architecture is genuinely described rather than gestured at, and below anything higher because a buyer inherits dependencies it cannot see. Searched the home page, the trust centre and its AI ethics, compliance and security sections on 31 Aug 2026.

Checked the home, CPM, inventory and legal pages and the Terms of Service on 22 September 2026. No price, unit or tier is published; the terms say fees are set in each order and describe only payment mechanics, in US dollars, due in 30 days, non-refundable and with a 1.5% monthly late charge. Verified 22 September 2026.

No pricing information is published at any level, including the unit of charge. Searched the home page, the full primary navigation across platform, solutions, resources and company, the footer sitemap, the trust centre and the terms and policies index on 31 Aug 2026. There is no pricing page, no tier structure, no per-seat, per-contract or per-agent unit, no volume banding and no statement of what implementation adds. Every call to action is a demo request. Nothing published would let a prospective buyer form any view of cost before entering a sales process, which is a notable contrast with the vendor's willingness to publish its SaaS terms, end user agreement and data processing addendum in full.

Buyers and use cases are named, short of limits. The site addresses market data, finance, procurement, legal, and risk and compliance teams at hedge funds, asset managers, banks, venture and private equity firms, family offices and data vendors, with use cases such as invoice reconciliation, renewals, usage and entitlements, DORA evidence and investor rights. The contract types and markets it does not handle are not stated. Verified 22 September 2026.

Segment coverage is documented precisely on two axes and the boundaries are left open. Eight industry verticals carry dedicated pages: financial services split into procurement and capital markets and credit, insurance with a separate underwriting submissions triage solution, automotive, IT services, healthcare, pharmaceuticals and life sciences, telecom, and oil and gas. Five departments carry their own pages: in-house legal, legal operations, procurement, sales and finance. Customers are stated across more than 70 countries and the site publishes in English, German and French. What is absent is any statement of where the product stops: no contract types or matter types are excluded, nothing addresses law firms, government or public sector use, and the practice dimension is expressed as industry and department rather than as areas of law. Checked 31 Aug 2026.