Sandstone vs Streamline AI: how they compare in 2026
Sandstone and Streamline AI are direct substitutes, two in house legal request platforms that both capture work from Slack, Teams and email, classify and route it, and review contracts against a playbook. They emphasize different halves of that job. Streamline AI leads with the front door, moving requests through approval chains, escalations and SLA timers a legal operations team configures without engineering. Sandstone leads with execution, with agents that redline, draft and reply to comments, completing simpler work and handing complex matters to a lawyer. Beyond that, the two are close in shape. Streamline publishes both plans with figures, 22,900 dollars for Pro and 26,900 for Enterprise, with the feature split itemized line by line. Sandstone's distinctive commitment is contractual: clause 9.5 requires the customer's prior written permission before any subcontractor processes its data, a stronger control than a right to be notified.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models drive the features Sandstone sells on: agents that read an incoming request and route it, playbooks that learn from a team's own redlines and policies with each use, and agentic workflows that redline, draft and reply to comments. Underneath is a product that would still work without them. The repository of documents, companies, people and past decisions, the matter and task tracking, the intake channels and the reporting on cycle times and capacity form a legal operations system. The vendor describes the platform in those terms, as a single system of record and an operating layer.
Streamline AI combines legal intake, matter management and workflow automation with models that classify requests, retrieve organizational knowledge and evaluate contracts. Velo Copilot answers from the team's requests, agreements, conversations and matter history, and can help draft responses or route approvals. Knowledge Agent brings internal policy answers into Slack using a retrieval system over uploaded material. Contract Intelligence assesses clauses against an editable playbook generated from existing agreements. Those functions drive work across the platform, while forms, approval chains, task tracking and reporting remain useful without model output. Legal operations teams configure routing and escalation rules around the AI assistance.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Grounding is claimed but never described or measured. Multi-Source Citations is listed as a feature of the agentic workflows, alongside redlining and drafting from best practices, and the platform's premise is that output rests on the organization's own precedent. Nothing goes further: no retrieval method, accuracy figure, test set, evaluation or statement on hallucination is published. The subject comes up only in a customer story, which describes redlines previously drafted with general purpose tools that produced hallucinated Word output. That frames hallucination as a problem of the tools Sandstone replaced and says nothing about its own rate.
Knowledge Agent parses uploaded policies and other internal materials into a vector database for keyword and semantic retrieval. Its answers link directly to source files, allowing the user to inspect the relevant material. Contract Intelligence provides explanations of the clauses driving a contract's risk assessment, with previewable agreements and editable playbook standards. Velo draws from organizational records rather than an identified primary law collection. These are described grounding mechanisms, but no legal accuracy evaluation supplies a test population, failure analysis and reproducible results. The privacy policy warns that generated output may be incomplete or inaccurate and requires customer review before reliance.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The handoff rule is stated plainly: agents complete simple legal work and hand complex tasks to lawyers. That is a real division of labor, backed by described review surfaces, with redlines arriving as changes to accept or reject and routing sending work to a named owner. Clause 1 of the terms of service says these are self help services provided at the customer's specific direction. The boundary itself is not defined. Nothing says what makes work simple rather than complex, no threshold or confidence condition is described, and nothing states what happens after an agent is wrong. The Google Workspace add-on's published permissions include sending mail on the user's behalf, so agents can act outward, and no oversight condition is published for that.
Legal operations teams configure approval chains, routing, escalation and service level timers, with actions retained in an audit trail. Velo can assist with drafting responses, routing approvals and progressing requests within that operational setting. Contract Intelligence generates playbooks that the legal team can inspect and revise before use, while Knowledge Agent allows users to correct proposed values before saving a request. The privacy policy requires review of generated output and rules out consequential decisions without human review. The general control structure does not identify every action an agent can complete unattended or prescribe when uncertain reasoning must stop and return to a lawyer.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Five customers are named with substantive case studies rather than logos: Middesk, a business identity platform with a single in house counsel; MasterClass, whose General Counsel Kevin Yung is named; Crexi; Ocrolus; and Hypertherm, a global manufacturer. Each story describes the starting position, the problem and what the platform was deployed to do. None of the five includes a figure, so nothing is measured, and none is dated. Several are written in the present tense, describing what a customer is consolidating or working to eliminate rather than what it achieved, which reads as deployment still in progress.
Cityblock Health replaced an IT ticketing system with Streamline as a central hub for legal matters and collaboration. General counsel Wendy Chow describes redesigning the service model around prioritization, clearer internal guidelines and service levels. The customer account attributes an estimated 10 to 20 percent recovery of internal legal time and approximately 40 percent lower outside counsel spend to that broader operating change. The team had fourteen members, including nine lawyers. These are named operational outcomes, but they do not isolate current AI features from process changes, provide a dated measurement window or describe an independent calculation of the estimated time savings.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive commitments are published in the agreement as well as the marketing. Clause 9.4 of the terms of service commits Sandstone to be able to identify the customer's data separately from any other data it controls, and clause 10 sets mutual confidentiality lasting five years after termination. The security page says Sandstone does not train models on customer data and that its model providers operate under zero data retention agreements, so they do not keep prompts or outputs. The customer sets retention, and export is available. Privileged material is named but not handled. The privacy policy lists Legal Advice and Attorney-Client Privileged Content, including internal legal memos and drafts marked privileged, as a category of sensitive information it processes, and then commits to nothing specific about how it is treated. Clause 1 of the terms disclaims an attorney client relationship with Sandstone, which is a different question.
Client data is not used to train models, Streamline states, while the privacy policy specifically prohibits training general purpose models and describes a provider training restriction. Knowledge Agent stores uploads and conversations in a separate customer container within Streamline's OpenAI account, under Streamline's control. Role and team permissions restrict access, including notes reserved for legal users. The user terms retain customer ownership but license content use to deliver, improve and support the service, with separate customer agreements governing subscriptions. The exact provider retention period and enterprise confidentiality terms are not supplied, and the user terms disclaim an attorney client relationship with Streamline.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The advice line is addressed directly in the operative agreement. Clause 1 of the terms of service says Sandstone provides self help services at the customer's specific direction, is not a law firm or a substitute for an attorney, and that outputs are not legal advice. It says a licensed attorney should be consulted on accuracy or applicability, and that use creates no attorney client relationship. The same clause treats the customer as a user whether a lawyer or a business user of a shared workspace, which acknowledges that people who are not lawyers use the product. No jurisdiction limits are stated, and nothing addresses the supervision and competence duties of the lawyers who sign off on the work. No bar or ethics guidance is cited.
The user terms state that Streamline is neither a law firm nor an attorney and does not replace an attorney's advice or services. They also deny creation of an attorney client relationship or privilege with the vendor. The current privacy policy expressly says AI output is not legal advice, requires review and validation before reliance, and excludes consequential automated decisions without human review. These statements sit alongside tools for contract analysis, internal policy answers and approval routing. The service does not map those controls to jurisdiction specific professional conduct requirements or explain a complete supervision framework for each agent action.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Nothing published addresses governance over model behavior. There is no responsible AI page, governance framework, certification such as ISO 42001 or named owner, no account of what is tested before a model or workflow ships, and nothing on uneven output across matter types, counterparties or populations. SOC 2 Type 2 and penetration testing are security matters, and the zero data retention arrangement with model providers is data protection. The trust center at trust.sandstone.com, hosted by Vanta, describes itself as covering advanced protections for agentic offerings without naming any.
Operational controls around the AI include editable playbooks, access permissions, review of generated output and logs of workflow decisions. Those are workflow controls, and Streamline describes no separate AI governance framework with an accountable owner, evaluation methods or results across populations and legal tasks. No bias testing results explain whether request classification and urgency assessments vary across business teams, languages or requester groups. Contract risk labels also lack a stated calibration study. Customer configured routing and human review can shape how work proceeds, but Streamline does not say how it validates model changes before release or monitors their legal effects.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Most of the ground is covered with specifics. The customer sets retention and can export data, and Sandstone's FAQ says plainly that it still stores what the customer puts in the product to run the service. Encryption is AES-256 at rest and TLS 1.3 in transit. Access control covers SAML single sign on, role based permissions, audit logs, session management and user lifecycle management. An in house security team monitors and responds to incidents around the clock. A published vulnerability disclosure policy commits to acknowledge reports within 72 hours, give updates, confirm resolution and offer safe harbor for good faith research. Clause 9.5 of the terms requires the customer's prior written permission before any subcontractor processes its data, with written notice of purpose and due diligence. No subprocessor list is published anywhere.
The platform uses AES-256 encryption at rest, TLS in transit, role based access, single sign-on and security monitoring. Its processor schedule names infrastructure and AI suppliers, including OpenAI. The privacy policy describes limited provider retention under enterprise terms and expressly avoids promising zero retention. Knowledge Agent stores uploads and chats in customer containers that Streamline can modify or delete. Account and matter data remain for the agreement term and an agreed period afterward, followed by return or deletion. Exact provider retention windows, backup deletion timing and a fixed customer breach notification commitment are not available in the open service materials.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
A complete published position, and what it allocates to the customer is everything. Clause 14 gives real service warranties: enough trained personnel, reasonable efforts consistent with prevailing industry standards, provision in accordance with applicable laws, and no intentional introduction of malicious software. Clause 15 then disclaims all other warranties, states that the customer uses the services at its own risk, and records that Sandstone has no duty regarding how the customer interprets or uses the content. Clause 16.2 runs an indemnity from the customer to Sandstone, and no indemnity runs the other way beyond the mutual confidentiality indemnity at clause 10.4. Clause 17.1 then excludes direct damages altogether rather than capping them, so the warranties at clause 14 carry no monetary remedy. No cap figure and no insurance commitment appear. Nothing here gives the customer a recourse when output is wrong.
The user terms limit aggregate liability to the amount paid for the service or site involved in a claim, or $100 where a claim does not concern a product or service. They disclaim warranties and indirect losses to the extent permitted by law, and the indemnity runs from the user to Streamline. Subscribers also operate under a separate customer agreement governing delivery and access, so enterprise remedies may differ from the user terms. No distinct indemnity or warranty covers erroneous AI analysis or routing. Sensitive personal information, including health information, requires prior written consent in the customer agreement.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Reach is broad, and depth is not described. Twenty integrations are named with logos, across the systems in house legal work touches: Microsoft Word, Outlook, Teams and SharePoint, Google Docs and Drive, Slack, Salesforce, Jira, Asana, ServiceNow, Zendesk, HubSpot, Workday, Coupa, Notion, Box, Dropbox, OneDrive, Zip and Ironclad. The vendor claims more than fifty in all. Ironclad matters because it is a contract lifecycle system rather than a general business tool. A Google Workspace add-on is listed on the Marketplace with its permissions shown, which can be checked. Nothing says what synchronizes, in which direction, on what trigger, or what a customer configures, and no developer documentation, API reference or implementation guide is published.
Knowledge Agent setup begins with an administrator enabling the integration in organization settings and uploading material to the knowledge library. An administrator or Core Lead User supplies the files, and the agent is added to Slack and invited to the relevant channel. Users invoke it through a mention and receive answers linked to internal source material. Pro also includes Teams and signature connections, while Enterprise adds storage systems, Salesforce, Ironclad, NetDocuments and API access. The detailed Slack procedure identifies the material supplied, where questions originate, how responses return and the customer's configuration steps, although equivalent transfer instructions are not provided for every named connection.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Cloud delivery is implied, and neither tenancy nor region is stated. No region or residency option is published, and the agreement points away from one. Clause 9.6 says the customer's data will remain wherever Sandstone first places it, and the customer consents to transfer to group companies, service providers or agents who may be in other countries. The privacy policy adds that data may be stored in a foreign country whose privacy laws may be less strict than where it was collected. No tenancy model is stated, whether multi tenant, single tenant or private. Network isolation is named as a control on the security page, but that describes segmentation, not tenancy or residency.
Production servers run on AWS, and regional data hosting is offered as a separate option. The general privacy position describes processing in the United States and contractual safeguards for certain international transfers, while platform customer data is governed by a separate DPA. Knowledge Agent additionally stores files and conversations in Streamline's OpenAI account, divided into individual customer containers. No region table connects each hosting option with its AI inference and storage locations. The service also does not specify dedicated infrastructure arrangements. A regional application setting therefore does not by itself establish where every model request or retained conversation is processed.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
SOC 2 Type 2 is stated clearly and repeatedly on a security page written for the customer's security reviewer. The page also lists annual third party penetration tests, continuous automated scanning, internal assessments, and a security addendum described as aligned to SOC 2 Type 2 and available for counsel to review. No auditor is named, no coverage period or report date is published, and the page says further independent assessments are in the trust center rather than listing them. That trust center is at trust.sandstone.com, hosted by Vanta.
Streamline identifies SOC 2 Type II certification for its own service and describes regular external audits, vulnerability testing and review of suspicious activity. AWS supplies the underlying hosting, with the additional ISO 27001 and SOC 1, 2 and 3 claims attached to its data centers. The two levels of assurance should remain distinct. Public service information does not identify Streamline's auditor, report period or precise examination scope, and an accessible full audit report is not provided. Encryption, identity controls and outside security review explain some practices, but they do not replace inspection of the applicable assurance report.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Sandstone refers to its model providers repeatedly and names none of them. The security page says model providers operate under zero data retention agreements, so they do not keep prompts or outputs; that is a meaningful commitment, made without saying who the providers are. No model or provider is named, no subprocessor list is published, and nothing says where inference runs. Clause 9.5 of the agreement requires the customer's prior written permission before any subcontractor processes its data, with written notice of the purpose and of the due diligence performed. That gives a customer a contractual route to learn who is in the chain, but the vendor does not publish it.
The current processor schedule names OpenAI for email triage, analysis of files and request classification. Knowledge Agent specifically uses GPT-4o with retrieval over a vector database and stores customer material within Streamline's OpenAI account. Contract Intelligence separately refers to a proprietary model for risk assessment without giving its model lineage or version. Velo's feature description explains the organizational data it uses but does not provide a model specification. The disclosures cover part of the AI supply chain, including a named model for one feature; Streamline gives no inference regions, complete feature routing or notice of model substitutions.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure of charging are published, without any figure. Clause 13.2 of the terms of service says the service is a subscription, monthly or yearly at the customer's choice. Clause 13.3 says services may also be offered on a usage basis, with details at sign up and 30 days' written notice of changes. Clause 13.4 sets automatic renewal at the then current nonpromotional rate, with cancellation in the subscription management section, and 13.5 covers free trials. A buyer can learn what is charged for and how often before contacting anyone. There is no pricing page in the navigation or footer, no tier names or feature splits, and no figure anywhere; the only commercial route is Book a Demo. The structure sits in the agreement rather than on any sales page.
Pro starts at $22,900 and Enterprise at $26,900, each with four core users. Pro includes 5,000 business users and standard workflow, identity and signature connections. Enterprise allows unlimited business users and adds storage, Salesforce, Ironclad, NetDocuments and API connections. Onboarding is included, with a typical implementation of about sixty days supported by a dedicated team. Regional hosting is a separately priced option without a stated amount. The advertised figures carry no billing period or extra user rate, so a complete recurring cost cannot be worked out from them. Knowledge Agent and Dynamic Docs have no separately stated current add-on price.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
The buyer is described precisely by role: General Counsel, Chief Legal Officers, associate and assistant General Counsel, practice area leads and legal operations staff at scaling companies and enterprises. The five customer stories range from a company with a single in house counsel to a global manufacturer, across technology, consumer media, commercial real estate, financial document automation and industrial manufacturing. The boundary is left open. Practice areas are not listed, since coverage is described by workflow rather than matter type. No company size floor is stated beyond scaling, no jurisdiction or geography appears, and nothing says what the platform does not support. Law firms are implicitly out of scope but never named as such.
Streamline serves internal legal departments, from small teams to larger functions, with roles for general counsel, staff attorneys and legal operations. Business colleagues submit requests through familiar channels, while legal users manage matters, approvals and responses. Contract Intelligence supports review against the organization's playbook and works alongside existing redlining tools; the wider platform connects to an existing CLM. Cityblock's healthcare team demonstrates one deployment, with additional customer examples in technology and other businesses. A detailed language, jurisdiction and practice matrix is not supplied, and the service is not positioned as a complete law firm billing or primary legal research platform.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The commitment is stated twice on the security page, once as a control and once in the review FAQ, and it is extended outward: model providers operate under zero data retention agreements so they do not retain prompts or outputs. It sits on a policy page rather than in the agreement. The published terms of service contain no matching term. What they do contain is clause 9.3, which provides that Sandstone owns derived data, defined as data it creates from the customer's data through aggregation, deidentification or anonymization for its own internal purposes.
That clause names neither training nor machine learning, so it does not contradict the promise, but it is the clause that bears on it. The privacy policy adds a narrower statement scoped to the Google Workspace integration, that Google data is not used to train generalized AI or ML models.
Streamline's public commitment prohibits training models on client data, and its current privacy policy specifically bars use of customer data for general purpose model training. The policy also states that its AI processor does not train on that material. Knowledge Agent separately prohibits OpenAI training or improvement from customer uploads. The user terms license limited service improvement and incorporate the privacy policy, while subscriptions have a separate customer agreement. A specific enterprise AI training clause is not available, so the record preserves the policy category.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is under customer control and export is available, as a stated commitment on the security page. Zero retention is not available at the Sandstone layer, and the vendor says so directly. Sandstone's FAQ says zero data retention applies to the model providers, which process a request and do not keep the prompt or output, while Sandstone stores what the customer puts in the product to run the service. No default period is published for a customer who sets nothing.
The agreement is permissive at the end: clause 19.3 says Sandstone may erase the customer's data on termination, and clause 20.2 makes retrieving data after termination subject to additional fees.
The privacy policy expressly states that AI processing is not subject to zero retention and describes limited provider retention under enterprise terms without a numerical duration. Knowledge Agent stores chat interactions and uploaded files in Streamline's OpenAI account, in a separate container for each customer. Streamline can modify or delete that material. Account and matter data remain through the customer agreement and for an agreed period afterward, followed by return or deletion. No single retention window covers prompts, saved files, generated answers and backups.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Separation is claimed and never documented. Sandstone's home page says agentic workflows respect permissions across systems, meaning retrieval should follow the access rules of the source systems. That matters because the platform reaches into Slack, Salesforce, SharePoint, Google Drive, Jira, Box and others where a company's own permissions live. Nothing describes how this is enforced, whether it is checked per user when a query runs, or what happens when a source system's permissions and Sandstone's own role based permissions disagree.
Clause 9.4 of the agreement says Sandstone will be able to identify the customer's data separately from other data it controls, which covers separation between customers, not between users or matters within one. Role based permissions and SAML single sign on are named on the security page without detail.
Permissions restrict access by role, team, matter type and function. Legal users have access to private legal notes, while administrators control who can use and upload material to Knowledge Agent. That feature also separates each customer's files and chats into its own container within Streamline's OpenAI account. These are controls of the Streamline environment rather than inherited permissions from a customer's external repository.
Streamline does not describe how each matter restriction is enforced during Velo retrieval or contract analysis, or any formal process for administering conflict walls.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The privacy policy addresses compelled disclosure directly, listing a subpoena or court order, compliance with any law, protecting the safety of any individual or the general public, and preventing violation of customer relationship terms. It also states separately that personal information may be disclosed as required by law or governmental audit. Nothing in the privacy policy, the terms of service including the confidentiality clause at 10, the website terms of use, the security page or the security policy commits to telling the customer, and nothing reserves discretion over notice either: the question of notification is simply never reached.
Clause 10.3 mentions disclosure to comply with a court order in the context of returning confidential information at the end of the agreement, which is not a notice provision.
The user terms permit content processing to comply with a valid subpoena, request or other lawful process. The privacy policy also allows use compelled by law or court order. No advance notice or objection right accompanies those disclosure permissions. The customer DPA is referenced as governing processing of platform data but is not included in those materials. Privacy rights requests and general account notices are a different mechanism from a procedure for notifying customers of a legal demand.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No outside legal content is identified, and none is claimed. The platform works on the customer's own contracts, templates, redlines, policies and past decisions, drawn from the systems the business already uses, so it does not retrieve primary law. Nothing published suggests any external legal content is bundled.
Velo draws on the organization's requests, agreements, conversations and matter history. Knowledge Agent retrieves from files uploaded to an internal library, and Contract Intelligence applies standards derived from the customer's existing contracts. These descriptions identify customer material as the principal input, without naming a primary law collection, publisher license or jurisdictional update process. Model knowledge used during an explanation has no separate legal corpus inventory.
A contractual source or internal policy answer should therefore not be treated as a current research result from an identified body of law.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No public material addresses subsequent history, treatment flags or citator coverage, and none is claimed. The product is built on the organization's own precedent and business context rather than on primary authority, so no good law check is offered, and no weaker form of checking is described.
Streamline's internal knowledge and contract tools do not specify a licensed citator, case treatment indicator or integrated process for determining whether authority remains good law. Knowledge Agent can link to an uploaded source, which allows inspection of that file but says nothing about its continuing legal validity. Contract Intelligence applies an editable organizational playbook rather than a described precedent updating system.
The requirement to review generated output leaves legal verification with the user without supplying a distinct authority validation feature.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Nothing published describes what the platform does when it cannot ground an answer. The nearest statement is the home page's division of labor, that agents complete simple legal work and hand complex tasks to lawyers. That is a routing rule, not an account of declining: it does not say what an agent does when it is uncertain about work it has already taken on. No confidence or grounding score is shown and no path for declining to answer is documented.
The platform classifies requests and assesses contract risk, but the available workflows do not specify a refusal rule when supporting material is missing. High, Medium and Low contract labels describe risk against a playbook, rather than uncertainty about whether the answer is correct. Users can review sources, edit playbooks and correct proposed values, and lawyers retain responsibility for consequential work. No calibrated uncertainty indication, abstention condition or automatic clarification process explains how Knowledge Agent or Velo behaves when organizational records cannot answer a question.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, and reporting drawing on it, record no court order, opinion or disciplinary record naming Sandstone or the corporate name Glaze AI. Sandstone is a common word that appears in unrelated company names, which makes the record harder to search by name. The platform is also sold to in house departments for intake and contract work rather than to litigators for filings, so this risk is lower than for a research tool.
No tool entry or case narrative naming Streamline AI or LegalDesk was identified in the AI Hallucination Cases database as of October 16, 2026. Streamline's described workflows focus on internal requests, contract terms and organizational knowledge, so errors may affect routing or negotiations without appearing in a reported citation dispute. The database result does not validate generated answers or measure their error rate. Users still need to inspect supporting files and review proposed work before relying on it.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No public material engages with ABA Formal Opinion 512, any state bar opinion or any other named ethics guidance. Clause 1 of the terms of service covers similar ground in substance: Sandstone is not a law firm, outputs are not legal advice, a licensed attorney should be consulted, and no attorney client relationship arises. That is the vendor's own framing, not engagement with the guidance its buyers must follow.
Streamline states an advice boundary and requires review of AI output, but does not name a bar opinion or map its controls to rules on professional competence, confidentiality, supervision or candor. Its disclaimer of an attorney client relationship concerns the vendor's role rather than the obligations of the lawyers using the service. Internal legal teams must apply their own professional requirements to automated intake, policy answers and contract analysis. No jurisdictional guidance explains how those duties change for a particular agent or category of matter.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Nothing addresses billing, fees or disclosure of AI assisted work, and no record separating AI assisted work by matter is described. Reporting does measure matters, aggregating cycle times, risk exposure, capacity and deviation rates for legal operations to benchmark and report, but that records the work, not what the AI did within it. No time savings figure is claimed anywhere. Sandstone's buyer is the in house department that receives bills rather than a firm that issues them.
The platform is sold to internal legal functions managing requests and allocating their own resources. Cityblock Health's reported savings concern bringing work in house and reducing outside counsel expenditure after redesigning its operating model. Workflow logs and service level reporting track departmental work rather than a lawyer's billable time attributable to AI assistance. No client invoice adjustment or AI fee disclosure mechanism is described.
Streamline's subscription charge is therefore distinct from how an outside law firm records and charges for work performed with AI.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The material exists and is reachable only by asking. The security page is written for this purpose, presented as something to send to a security team. It says reports, questionnaires and the rest of the review pack are in the trust center, and that a security addendum is available for the customer's counsel to review. The trust center is hosted by Vanta, and no subprocessor or model provider list appears on any public page.
Clause 9.5 of the terms gives the customer a right of prior written consent before any subcontractor processes its data, with notice of the purpose and the due diligence performed, which is a route to the information rather than a disclosure of it.
The current processor schedule identifies Heroku for application containers, AWS for hosting, MongoDB Atlas for databases, Redis for email routing, Google Workspace for communications and OpenAI for AI features. Knowledge Agent adds details about its GPT-4o retrieval workflow and customer containers. The privacy policy refers to a customer DPA, while public security information states certification and access controls.
Exact model retention periods, full feature routing and a packaged mapping to client AI restrictions are not supplied. The older Clearlaw description no longer reflects the current processor schedule.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Nothing addresses judicial standing orders, AI use disclosure or verification certification. Audit logs are named on the security page as an access control and reporting covers cycle times and workload, neither of which records which model produced which passage or what it retrieved, so no disclosure record for each document is described. The product class is relevant: the platform is sold to in house departments for intake, contracting and workflow rather than for court filing, so a filing disclosure obligation would usually fall on the outside counsel handling the matter.
An audit trail of requests, decisions and actions is retained, with historical reporting on approvals and workflow activity. Contract Intelligence preserves negotiation context and explains clauses driving its risk assessment, while Knowledge Agent links answers to underlying files. These elements can help reconstruct how internal legal work progressed. Streamline describes no complete export joining each output to its exact model version, full source context and human verification.
No court specific disclosure form or certification of independent legal authority review accompanies the operational history.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- AI Governance and Bias Disclosure
- Primary Law Corpus Provenance
- Good Law Verification
- Refusal and Uncertainty Behavior
- Bar Guidance Alignment
Which one fits
Choose Sandstone if
- The work itself is the bottleneck, not the routing. Sandstone's agents redline, draft and reply to comments, completing simpler work and handing complex matters to a lawyer. Playbooks are built from the team's own templates, redlines and policies and learn with each use, so negotiating positions stay consistent across the organization.
- You want a say in who else touches the data. Clause 9.5 of Sandstone's terms requires the customer's prior written permission before any subcontractor processes its data, with written notice of the purpose and of the due diligence performed. That is a stronger control than a right to be notified. Clause 9.4 commits Sandstone to be able to identify a customer's data separately from any other data it holds.
- Your work crosses twenty systems before it is done. Sandstone names integrations across Microsoft Word, Outlook, Teams and SharePoint, Google Docs and Drive, Slack, Salesforce, Jira, ServiceNow, Zendesk, HubSpot, Workday, Coupa, Notion, Box, Dropbox, OneDrive, Zip and Ironclad, with a Word add in and a Google Workspace add on whose permission scopes are published on the Marketplace.
Choose Streamline AI if
- You want to know the cost before the demo. Streamline AI publishes a figure for both plans on an open page, at 22,900 dollars for Pro and 26,900 for Enterprise, with four core users included on each. The feature split is itemized line by line, so a buyer can see exactly what the difference buys, and onboarding is stated to be included with a roughly sixty day implementation.
- The front door is the problem. Streamline captures requests from configurable forms and from Slack, Teams and email, classifies each one by type and urgency, applies routing rules and opens a structured record. It then runs conditional routing, approval chains, escalations and SLA timers that legal operations configures without engineering. Access is scoped by role, team and matter type, and legal only notes stay inside the legal team.
- You need to tell your reviewer who processes what. Streamline publishes its subprocessor list openly at a public URL with each supplier's address, contact and purpose. It also names the model licensor behind one capability, stating that Clearlaw, Inc. is licensed to provide the large language model for SmartParse.
In summary
Sandstone
Sandstone is an AI platform for in house legal departments built around the intake, routing and execution of legal requests. Agents read intent and route work, a repository holds documents, companies, people and past decisions, and playbooks are built from a team's own templates and redlines. Agentic workflows redline, draft and reply to comments before handing complex matters to a lawyer. According to the AI Legal Index, its terms require the customer's prior written permission before any subcontractor processes its data, and its security page states zero data retention agreements with model providers. It names no model provider and publishes no accuracy measurement or AI governance material.
Streamline AI
Streamline AI is the legal front door for an in house team. Business users submit requests through configurable forms or from Slack, Teams and email, and the platform classifies each one, applies routing rules and opens a structured record. It then runs approval chains, escalations and SLA timers configured by legal operations without engineering, alongside matter management, contract review against a playbook and dashboards. According to the AI Legal Index, both of its plans carry a published figure with the feature split itemized. It publishes its subprocessor list openly and names Clearlaw as the model licensor behind SmartParse. No AI governance material or accuracy measurement is published.
Questions buyers ask
Are Sandstone and Streamline AI alternatives to each other?
Yes. Both are in house legal request platforms, both capture requests from Slack, Teams and email, both classify and route them, and both review contracts against a playbook, so a team evaluating one will meet the other. They differ in emphasis rather than in category. Streamline AI leads with the front door and the process around it, and Sandstone leads with execution, redlining and drafting the work rather than routing it. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
What does each cost?
Streamline AI publishes both plans on an open page, at 22,900 dollars for Pro and 26,900 for Enterprise, with the feature split itemized and onboarding included, though the billing period is not stated and both figures are floors. Sandstone publishes the structure without the number: its terms state that the service is offered on a monthly or yearly subscription and may also be offered on a usage basis, with automatic renewal at the then current rate, and no pricing page exists on the site. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
Do either name the model behind the AI?
Streamline AI names one: its published subprocessor list states that it licenses Clearlaw, Inc. to provide the large language model for SmartParse. That covers one capability among at least six the site markets as AI, and no model or provider is identified for the others. On Sandstone no model or provider is named anywhere, though the security page states that its model providers operate under zero data retention agreements so they do not retain prompts or outputs. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
What do they say about your data?
Both state that they do not train on customer data. Sandstone adds zero data retention agreements with its model providers, a commitment to identify customer data separately, mutual confidentiality surviving five years, and customer set retention with export. Streamline states the same training position on its home page and in its FAQ, publishes its subprocessor list openly, and offers configurable data residency as a named add on, with the default position being processing in the United States. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
What do Sandstone and Streamline AI both leave unpublished?
Neither publishes an accuracy measurement: no test set, evaluation or named failure mode appears on either record, and Streamline's one accuracy figure sits inside a dashboard illustration rather than a benchmark. Neither publishes an AI governance position. And neither states the threshold that matters most on an agentic product, which is what makes a matter complex enough to reach a lawyer rather than being completed by the system. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
The shared gap is governance. Both products classify or route legal work with models, and neither publishes an accountable owner, a pre release testing regime, or anything on whether outcomes hold evenly across request types, business units or requesters. Two specifics belong alongside it. Sandstone's privacy policy names legal advice and attorney client privileged content as a category of sensitive information it processes, including internal memos and drafts marked privileged, and nothing published states how that material is handled. Clause 17.1 of its terms excludes direct damages altogether rather than capping them. On Streamline AI, the ISO 27001 and SOC reports referenced on its security page attach to the hosting data centers rather than to Streamline. Neither vendor reviewed this page.