C

Chamelio

The AI powers the features Chamelio sells: redlining in Word, a playbook generator that draws standards from a team's own precedent, automatic metadata extraction, agentic workflows and an AI agent that answers from the department's documents. Without the models the product still works as a contract lifecycle management system, with a contract repository, a Vault, custom metadata columns, reminders, intake forms, task and matter tracking, approval routing, DocuSign orchestration and Insights dashboards. Chamelio sells itself as a CLM replacement and ships a CLM Migrator.

Models from leading providers are continuously evaluated and the top performers deployed automatically for specific tasks, Chamelio's documentation says, under a heading that claims this will guarantee the most accurate and reliable results. No benchmark, test set, accuracy figure or evaluation is published. The product page says every AI answer links back to the source document, which grounds answers in the customer's own material.

No retrieval method is described. The published percentages, 89 percent less review time on the home page and a customer's 90 percent, measure time saved, not correctness.

The API reference shows how review works. Tasks move through defined steps. An approval step lists eligible approvers and pending variables that can be retrieved, approval or rejection is submitted for each task, a running task can be canceled, and an activity log records comments, approvals and other actions. Redlines arrive in Word as suggestions for a lawyer to work through, not as applied changes. What is missing is the threshold.

Chamelio describes agentic workflows running complex tasks of several steps, and a customer says the system handles a first pass and escalates only what needs legal review. Nothing says which steps run unattended, what triggers an escalation, or what happens when the system is wrong.

Five customers are named with the person and title: Noa Weyl, General Counsel at Bizzabo; Noa Rosenberg Segalovitz, General Counsel at Lightricks; Aviad Levin, General Counsel at Socure; Maayan Yaakobovich, Senior Legal Counsel at Radware; and Duncan McQueen, Assistant General Counsel at Integrity. Two figures are tied to a named customer: a 90 percent cut in legal review time at Integrity, and NDA turnaround falling from 24 hours to under an hour at Lightricks. None is dated, and no measurement basis is given.

Chamelio's Terms of Service carry a clause headed No Third Party LLM Model Training. It says Customer Data sent to third party large language models is not used to train them, and that Chamelio has opted out of every available training option for each one. The data license is limited to providing the service, and the documentation extends the no training commitment to Chamelio's own models. Each customer's data is processed in isolated environments, with role based access control, user groups, legal entities and SCIM provisioning.

That separates customers from each other rather than walling off matters. Nothing addresses attorney client privilege or work product directly. Retention is stated only as keeping data as long as necessary to deliver the service, with no period.

The only statement on the advice line is a liability clause. The Terms of Service say Chamelio has no responsibility or liability for the accuracy of Customer Data or for the customer's use of, or reliance on, Outputs. That disclaims reliance without saying what the product is or is not, and no page says that output is not legal advice. The marketing uses advice language: the home page carries a customer quote describing the platform as providing strategic insight like a seasoned attorney, and the feature list includes risk and decision support, liability ranking and legal research.

The audience is clear, since Chamelio sells only to in house legal teams and has no consumer product. No bar or ethics guidance is cited.

There is no responsible AI page, governance framework, named owner or certification such as ISO 42001. What exists sits in the security documentation under AI Model Security: continuous benchmarking of models from leading providers, automatic deployment of the best performer for each task, controlled deployment and rollback through model versioning, output filtering and prompt injection safeguards. These are concrete mechanisms, but they are security and performance controls, not AI governance.

Nothing is published about uneven output across matter types, counterparties or populations, and no test results are disclosed.

Encryption is TLS 1.3 in transit and AES-256 at rest, with key rotation. Access control covers least privilege, regular user access reviews, restricted production access, multi factor authentication for administrators, role based access control, session timeouts, and single sign on with SCIM provisioning documented for each identity provider. Chamelio publishes a six stage incident process, from detection through containment and forensic investigation to a review afterward, with a commitment to notify affected customers and a security contact address.

Deletion works in the product: the API supports document deletion and fires a webhook when a document is permanently deleted. No subprocessor list is published. The documentation mentions AI subprocessors and vendor security evaluations without naming any, and the only retention period given is as long as necessary.

Under Chamelio's Terms of Service, the company has no responsibility or liability for the accuracy of Customer Data or for the customer's use of, or reliance on, Outputs, which disclaims the main risk this product creates. Article 10 limits liability: the parties agree it forms an essential basis of the bargain, it applies to the maximum extent permitted, and it extends to affiliates, licensors and suppliers. Indemnification sits at Article 9 and Warranty Disclaimers at 8.3, and both survive termination.

The Terms run from Articles 1 to 12. No cap figure, indemnity scope or warranty wording is stated in their readable text.

Every integration has its own setup guide in Chamelio's documentation, and each says what moves and in which direction. Salesforce: install the Chamelio AI package to generate contracts and sync legal data from Opportunities. DocuSign: signed contracts are captured into the repository automatically. Google Drive and SharePoint: documents come in through a native file picker. Slack: legal knowledge, answers and workflow triggers appear in channels.

Word: an add in, with its own installation guide, brings review and redlining into the drafting window. Underneath is a REST API with an OpenAPI specification covering document upload, search, contract data retrieval, workflow initiation, task approval, signature envelopes and file download, plus thirteen webhook events for document and workflow changes. Setup is documented too, including single sign on through Entra ID by OIDC and SAML, Okta by OIDC, and SCIM provisioning from both.

There is no iManage or NetDocuments integration, which matters less for a product sold only to in house departments rather than law firms.

Hosting spans AWS and Google Cloud Platform, using more than one cloud for redundancy, with virtual private cloud isolation, web application firewalls, DDoS protection and network segmentation, according to Chamelio's documentation. Residency is offered as options for storing data in specific locations, and cross border controls and jurisdiction compliance are mentioned. No region is named. No tenancy model is stated, whether multi tenant, single tenant or private, though each customer's data is processed in an isolated environment.

Chamelio claims SOC 2 Type 2 on its security page and in its documentation, which lists the scope as all five trust services criteria: security, availability, processing integrity, confidentiality and privacy. It states that independent security firms run penetration tests. No auditor, coverage period or report date is published, no penetration test summary is offered, and no route to get the report is described. The security page links a trust center at trust.chamelio.ai.

Chamelio's documentation describes the setup without naming providers. It says Chamelio uses the best model for each job rather than one model, benchmarks models from leading providers continuously, deploys the top performers automatically for specific tasks, and uses model versioning for controlled deployment and rollback. The Terms of Service define Third Party LLM, say a data processing agreement is in place with each one, and record that Chamelio has opted out of their training options.

No provider is named. AWS and Google Cloud Platform are named as hosts, which says where the software runs, not whose models it uses. There is no commitment to tell customers when models change, and automatic deployment means they can change without notice.

No pricing is published at any level, not even the unit of charge. Neither the site's navigation and footer (Product, Security, Learn, Company, Careers, Partnership and Contact) nor the documentation's full machine readable page index, which covers guides, integrations, API reference and webhooks, includes a pricing page. The only commercial route is Book a demo. The module names, Negotiate and Knowledge Center, are published, but no tier, seat or volume unit, term or figure appears.

The intended buyer is stated plainly. The documentation header says the platform is exclusively for in house legal teams, a dedicated page answers who it is for, and the marketing says the same throughout. Named customers are in house teams at technology companies, including Bizzabo, Lightricks, Socure, Radware, Integrity and Atera. No practice areas are listed. The documents the platform handles are listed instead: contracts, templates, policies, compliance documents, corporate records and regulatory filings.

No company size range, jurisdiction or geography is published, and nothing says which legal work the platform does not support.