A

Aracor AI

Every function Aracor describes is an inference over an uploaded document set: a fully cited term comparison produced without setup or prompting, structured due diligence workflows, one click summarization of entire folders, redlining against preset or custom criteria, citation of answers back to source text at sentence level, optical character recognition over scanned material, and signature verification. No document management system, data room or workflow product is sold underneath on its own; the deal environment exists to hold the documents the models read and the findings they produce.

Article 4.5 of the agreement records that outputs are generated by third party large language models enhanced by Aracor's own Legal AI Engine.

Outputs link to the exact source language and reasoning, answers carry citations at sentence level drawn from the material, and term comparisons are fully cited, so a reader can open the source and check. Article 4.4 of the agreement warns that outputs may contain material inaccuracies even where they look accurate because of their detail, and that the customer should not rely on any output without confirming it independently.

Article 9.4 records that the models are probabilistic. No accuracy figure, evaluation, test set, error rate or benchmark appears anywhere, so the traceability design is documented but not measured.

Article 9.3 requires that the customer will not rely on any output without seeking the advice of, or vetting the output through, a duly licensed and qualified lawyer in the applicable subject matter and jurisdiction, and article 9.4 adds that output should be evaluated for accuracy as appropriate to the use case, including by ensuring qualified lawyer review. That places a supervising lawyer between the model and the decision, and every output is tied to source language a reviewer can open.

Nothing states what runs unattended, and the marketing sells a fully cited comparison in minutes with no setup and no prompting, which describes autonomous processing of an entire document set. No confidence signal, escalation path or route for handling errors is described, and nothing addresses what happens when a cited finding is wrong.

Two testimonials give a full name, role and organization: Nader A. Mettawa, General Counsel at Dabico Group, and Richard F. Christesen, Senior Commercial and Corporate Counsel at Constructor Group. Christesen's account links to a case study titled with a claim of 85 percent of review time saved. Another customer story reports review time on large document sets cut by at least 40 percent. A logo strip names eight organizations, including Dabico Airport Solutions, Virtuozzo, Chainstack, Constructor Capital and Dutchess Management.

Nothing is dated and neither percentage has a method. Fuel Venture Capital appears in the customer logo strip and is also the company's lead investor, which is not stated. The first quote in the user stories carousel is from Kevin J. Sullivan, Senior Advisor at Aracor, the vendor's own adviser shown alongside customers.

Zero data retention is the default: documents are processed only during a session and never stored or reused, in isolated environments with isolation for every session. Data is encrypted with TLS 1.2 or higher in transit and AES 256 at rest, with optional customer managed keys, role based access control, multifactor authentication and audit logging. Downstream model providers must support zero data retention, and article 4.6 commits that neither third party models nor Aracor's own engine will train on customer content without explicit consent.

Article VI makes customer content the customer's proprietary information, and the deployment options let a customer keep processing entirely in its own environment. No privilege or work product treatment appears, although privilege often attaches to transaction documents. Article 6.2 also allows use of proprietary information as needed to provide, improve and enhance the services, and the confidentiality duty ends five years after disclosure.

Article 9.3 says output may concern legal services or documents but is not formal legal advice, and that Aracor's services and output are for general information only. It says the customer will not rely on output without the advice of, or review by, a licensed and qualified lawyer in the relevant subject and jurisdiction. Article 9.4 makes the customer responsible for all decisions based on output and requires review by a qualified lawyer.

No bar association, rule of professional conduct or ethics opinion is named, and nothing addresses the supervision or competence duties of a firm putting a machine produced diligence finding in front of a client.

No governance position is published. The security page has a section titled Continuous Security and Responsible AI Development, but everything under it is security engineering: independent penetration testing, continuous vulnerability scanning, security reviews of new features, a controlled bug bounty, threat modeling, secure coding, peer reviews, red and blue team exercises and incident response procedures. Nothing names a person or function accountable for model behavior, describes evaluation of outputs before release, sets out AI principles, or addresses uneven performance across document types, deal sizes or the non English material the platform supports.

No ISO 42001 or equivalent is claimed. The published policies are the terms of service, the privacy policy and a data processing addendum.

Zero data retention is the default design: data is processed only during a session in isolated environments and never stored, logged or reused, and downstream providers are contractually required to do the same. Article 8.3 lets the customer delete its content at any time in the product. Access controls are listed: TLS 1.2 or higher in transit, AES 256 at rest, optional customer managed encryption keys, isolation for every session, role based access control, multifactor authentication and audit logging.

Testing is continuous, with independent penetration testing, ongoing vulnerability scanning, security review of each new feature and a controlled bug bounty, plus formal incident response procedures. No subprocessor register is published beyond the model providers and the two named payment processors. No hosting provider is named for the Aracor managed option, and no breach notification commitment or timeline is published.

Article 10.1 caps Aracor's total liability for all damages, losses and claims, in contract or tort including negligence, at one dollar, on a product sold for merger and acquisition diligence, where a missed obligation is the loss in question. Article 9.1 provides the services as is with all warranties disclaimed. Article 9.2 specifically disclaims that the services will produce accurate or relevant content or satisfactory output, and any control over the operation or availability of the AI models.

Article 10.3 has the customer indemnify Aracor for its use of the services, breach and customer content, and there is no indemnity from the vendor of any kind, including for intellectual property. The only published recourse is commercial: a fourteen day refund window under article 7.4.

Contract review can run in Word or in the Aracor platform, so Microsoft Word is a named integration described at workflow level, and Aracor has a listing in Microsoft's marketplace. No document management system is named, so nothing addresses iManage or NetDocuments. No virtual data room is named, though a diligence product's input is a data room, and no matter management, CLM or electronic signature system appears. No API, developer documentation or field mapping is published.

Article 5.1 reserves rights in technology developed for the services, including integrations, without specifying any, while article 3.1(v) bars running automated tasks against the service. Nothing published says what moves between Aracor and a customer's existing systems or what a customer must configure.

Three deployment options are published and specified. The first uses cloud models managed by Aracor, with data processed in Aracor's isolated environment under zero data retention. The second routes requests through the customer's own API keys, so the customer keeps its own contract and terms with the model provider and Aracor acts only as a secure interface. The third deploys a private model for one organization, either in the customer's own environment, on premise or in its private cloud, or in a fully isolated deployment managed by Aracor, with all computation and data kept inside.

No region is named for storage or processing, no cloud provider is identified for the Aracor managed options, and no residency commitment appears in the terms or on the security page, for a product sold into European transactions.

Four badges appear on Aracor's home page and twice on the security page: an AICPA SOC mark, an ISO mark, a zero data retention mark and a GDPR mark. The accompanying sentence says processing happens in secure, isolated environments aligned with ISO 27001, SOC 2 and GDPR, and a later line says Aracor aligns with recognized standards. Aligned with is not certified. No certification body, certificate number, examination period, scope or report is published.

A Security Whitepaper is listed in the resources, and its link leads nowhere. A trust center sits at a published subdomain, linked from the home page and twice from the security page.

Article 4.5 identifies the third party large language models as OpenAI's GPT models, Google Gemini and Anthropic Claude, with Aracor's own Legal AI Engine as the layer that enhances them, so the contract names which companies process a customer's documents. The security page lists the supported zero retention models as ChatGPT, GPT-OSS, Claude and Gemini. Hosting is described through the three deployment options, and article 4.7 records business licenses with those providers that exempt uploaded data from training.

No version is given for any model, so naming stops at the product family, and no commitment to notify customers when the models or a provider change is published.

No pricing is published at any level, including the unit of charge. There is no pricing page in the navigation or footer, and every commercial route leads to talk to sales. Nothing says whether the service is charged per user, deal, document, page or organization, and no rate, band, minimum, tier or term length is given, although the three deployment options plainly cost different amounts. The payment article covers mechanics rather than price.

Fees are paid in advance and are nonrefundable, a fourteen day refund window applies to a new subscription, named third parties process payments, and purchases may also go through a distributor. Article 7.1 obliges the customer to pay the published prices in effect at the time, yet no prices are published anywhere.

Three buyer segments each have their own page and stated goals. Investment funds, including private equity, venture capital, growth and family offices, buy to evaluate deals faster and spot issues early. In house legal and corporate development teams buy to keep deal terms aligned and maintain defensible records. Law firms in private equity, venture capital, mergers and acquisitions and corporate advisory practice buy to speed up reviews and keep work defensible.

Coverage is transactional throughout, covering diligence, term comparison, negotiation, closing and obligations after closing, and support for documents in several languages is claimed. Nothing says which transaction types or sizes the product does not suit, no jurisdiction is named for the diligence workflows, no firm or fund size is addressed, and the supported languages are never listed.