B

BlackBoiler

The product is an automated contract editing engine. It converts an organization's prior redlines, approved language and written guidance into executable playbook rules, applies them to a new agreement, and returns tracked changes and comments in Microsoft Word. There is no repository, workflow or signature product underneath that would work without the models. The June 2026 Veris release adds a generative, conversational layer for building playbooks and questioning clauses on top of the patented rules based editing engine, and both parts make up the product. The company says eleven United States patents cover document revision, playbook driven markup and clause handling.

The vendor describes a four stage chain: evidence (the customer's prior redlines, approved language and guidance), logic (how those become executable rules), checking (a judge validator that assesses whether a proposed change fits the intended outcome, plus statistical similarity checks), and output (tracked edits and comments for lawyer review). The earlier ContextAI feature shows, for each redline, the playbook rule that prompted it and earlier examples of the same edit in the organization, a trail a reviewer can open for every proposed change.

The vendor names failure modes: playbook coverage may be incomplete, contract language may depart from earlier examples, and unusual provisions may need a lawyer's fresh decision. The product cites no legal authority and has no citator; its output rests on the customer's own approved language, which is shown to the reviewer. No measured accuracy figure or test set is published.

The system runs the first pass markup alone, producing tracked changes and comments. It is constrained by the customer's approved playbook positions, which the customer reviews and approves before use. The review surface is Microsoft Word track changes in the document the reviewer already has open. The reviewer decides what to accept, change, reject, escalate or negotiate, and the vendor says new risks, exceptions and negotiation decisions are left to the right reviewer.

Nothing is applied to the agreement unless the reviewer accepts it, because the output is a proposal in tracked changes. Clause 3(b) of the Access Services Agreement says the same in contract terms: use of the Services is not a substitute for, and shall not replace, review and analysis by a lawyer. No marketing claims the system handles review on its own.

Four testimonials are published, each attributed only to a first name and surname initial or to a verified user, in the style of review site content, and none gives an organization or a figure. The customer base is described in categories (AmLaw 25 law firms, Fortune 1000 organizations and several construction customers), but no customer is named anywhere and no case study, deployment figure or before and after measure is published.

A 2021 AI Breakthrough award, a National Science Foundation SBIR award and Virginia Innovation Partnership Corporation portfolio status are recognition and funding rather than production use. Clause 12(c) of the Access Services Agreement bars either party from any public statement mentioning the other without written approval, so naming customers would need a waiver from each.

Under clause 7(b) the customer owns all contract data, training of third party foundation models is barred without customer authorization, and use of customer data is limited to configuring, improving, supporting and operating that customer's own use of the service. The vendor also says customer data is not used to train models shared with other customers. Data is isolated per customer, with dedicated instances available for enterprise deployments, access is limited to authorized staff with controls and logging, and data is encrypted in transit and at rest.

Mutual confidentiality runs five years, with trade secret protection lasting indefinitely. Privilege and work product are not addressed anywhere. No model provider is named, which leaves open whose model touches contract text and what that provider keeps.

Clause 3(b) of the Access Services Agreement, headed Review of Outputs and No Legal Advice, says use of the Services is not a substitute for, and shall not replace, review and analysis by a lawyer. Supervision and competence are addressed. The vendor sells to contract managers and procurement staff who are not lawyers, and says directly that a lawyer reviews the redline before anything moves forward and handles exceptions, new risks and negotiation decisions.

The marketing never describes the product as giving advice; it consistently describes a first pass returned to a lawyer. BlackBoiler sets no jurisdiction limits for the service. The only geographic limit is a website terms clause limiting site use to United States residents, which covers the website, not the service.

No AI governance position is published. Nobody is named as accountable for AI governance, no testing before release is described, no evaluation results are disclosed, and nothing addresses uneven output across contract types, counterparties or drafting styles. There is no responsible AI page, principles statement, model card, AI policy, ISO 42001 certification or outside governance assessment. The vendor does describe validation tools: a judge validator that checks alignment with the intended outcome, and statistical similarity checks. Those check individual outputs; nothing describes how the vendor builds, tests and answers for its models.

Customer data is kept for the length of the customer relationship unless agreed otherwise, and can be deleted at contract end or earlier on request. Access control is described in two documents. Access is limited to authorized staff who need it, with access controls and logging, and infrastructure access is secured by VPN, secure tokens and IP allowlists issued only to approved employees. Encryption is AES256 at rest and TLS in transit, backups are encrypted, and clause 7(b) confirms the customer owns its data and the vendor will not sell it.

No subprocessor list is published, with only Amazon Web Services for hosting and Stripe for payments named, and no incident or breach notification practice appears anywhere. The vendor also discloses that individual client files may sometimes be downloaded temporarily onto an employee's encrypted hard drive for testing. No retention period is stated.

Clause 9(a) of the Access Services Agreement covers third party claims that the Services infringe or misappropriate United States intellectual property, with the vendor controlling the defense and able to modify, replace or terminate. Clause 9(a)(iii) carves out unauthorized combinations, customer changes, Customer Data and Third Party Products. Clause 10 caps total liability at amounts paid or payable in the twelve months before the claim, with exceptions for breach of confidentiality, IP infringement, customer payment obligations and breach of the use restrictions.

The agreement is explicit that output errors are the customer's risk. The IP indemnity does not reach output quality, clause 8 disclaims all warranties, and clause 3(b) defines the risk of relying on any edit, redline, comment, summary, suggestion or analysis as Customer's Assumed Risks. Clause 9(b)(ii) requires the customer to indemnify the vendor against third party claims arising from those risks. No insurance is mentioned.

The Microsoft Word add-in is the delivery surface. Review runs inside Word without moving to a separate tool, the playbook is chosen in the document, and output comes back as native tracked changes and comments for the reviewer to accept, change or reject. Single sign on and API access are listed as enterprise features, with nothing on what the API exposes or what a firm must configure. No document management, contract lifecycle or electronic signature platform is named as an integration partner.

The vendor positions itself as sitting alongside a CLM where the CLM leaves a gap, and as handing back to the customer's existing process, but names no connection.

The vendor says it uses isolation measures specific to each customer to keep customer data separate, that enterprise deployments may include dedicated customer instances and data separation controls, and that data is held in a silo open only to the client and necessary vendor staff. The service runs on Amazon Web Services, with production, staging and development all in AWS. No region is named, no choice of region is offered, no European or other non United States option is described, and processing location is not distinguished from storage. The vendor says expressly that it does not publish detailed architecture or infrastructure information.

Two pages claim SOC 2 Type II certification. No auditor, audit period, report date or scope is published, and no other certification is claimed: no ISO 27001, HIPAA attestation or public penetration test summary. The report is available to prospective customers on request through the sales or security review process. Further security materials and completed questionnaires are kept for enterprise evaluations, while team and individual subscribers are pointed to the public page.

That public Security and Trust page has a seventeen question FAQ covering hosting, encryption, isolation, access, retention, deletion, backups and authentication, and carries no reports, dates or covered standards.

The vendor refers to generative AI throughout, and no model, provider or architecture is described beyond the four stage evidence, logic, checking and output framing. Clause 7(b) of the agreement allows Customer Data to be processed using third party infrastructure, technology and AI services, and separately bars training third party foundation models without customer authorization. So third party models are in the supply chain under the contract, and nothing identifies them.

The Third Party Products definition gives only a generic example. Amazon Web Services is named, but as infrastructure, which says where a model runs, not whose it is. Stripe is a payment processor that never touches contract content and is routed outside the Word add-in and the conversational interface. No commitment to notify customers of a model change is published.

BlackBoiler charges $125 per user per month for Starter or $1,250 per user per year with annual billing. Starter includes two playbooks and 25 monthly contract uploads. Pro costs $300 per user per month or $3,000 per year and adds five playbooks per user, 100 monthly uploads, analytics, administration and multifactor authentication. Enterprise has custom pricing for unlimited contract volume, single sign on, API access, playbook help, onboarding and negotiated service terms.

A seven day trial requires a payment card and converts to the chosen subscription unless canceled. Setup charges for the larger deployment remain part of the enterprise quote.

Three buyer segments each have their own stated position: in house legal teams reviewing the same agreement types at volume, law firms applying set positions across client matters, and contract managers applying standards the legal team has already set. One industry has a dedicated page, construction and AEC contracting, supported by a claim of several construction customers. NDAs, service agreements and subcontracts are the recurring types the product is built for, with more complex contracts in scope subject to playbook coverage.

The vendor states the product's limit: how useful it is depends on playbook coverage, the language and context of the agreement, and lawyer review. Practice areas are not addressed, since coverage is by agreement type and industry, and government use is not described; a United States Government Rights clause in the agreement concerns license rights, not coverage.