C

Claren

Every function Claren sells is a model output: redlining a contract in seconds with wording edited to the team's stated position, extracting key terms, and answering questions about a document with citations. There is no repository, workflow engine, matter system or document management layer that would survive the models being removed. The terms of service describe what is licensed as a software solution using artificial intelligence, and the product page markets an AI editor that goes from upload to redline with no setup and no plugins.

Even the tiers follow model use: Pro is capped by chat and file upload volume, and higher tiers add AI playbook generation and custom term extraction. Without the models, an upload form remains.

Clause 3.4 of the terms says the solution may contain outdated or inaccurate information, is trained on historical data with knowledge cutoff dates, may not reflect recent changes in statute or case law, and may produce errors, omissions or misinterpretations of legal concepts that need correction by qualified professionals. Clause 3.4.3 disclaims any representation as to accuracy, completeness or adequacy. The marketing describes the product as built on trusted legal sources, understanding contracts like a lawyer does, and offering answers with citations.

No accuracy figure, test set, evaluation, error rate or retrieval method appears anywhere. The trusted legal sources are never named, so what the citations point to beyond the customer's own uploaded document is not stated.

Clause 3.3.1 of the terms says all information, documents, analyses and other outputs must be reviewed by qualified legal counsel before being relied on, implemented or used as the basis for any decision. Under clause 3.3.3 the customer acknowledges that Claren has expressly told it so. Clause 5.2.10 goes further for one category, barring submission of Claren generated documents to courts in criminal proceedings without independent attorney review.

The product design supports this: the model produces a redline the lawyer accepts, rejects or edits, rather than writing to anything itself. There is no threshold at which the system acts alone, no confidence signal shown against an individual suggested edit, no abstention state, and no description of how a reviewer can tell a confident extraction from a marginal one.

Eight customer logos are published and five testimonials carry a full name, role and organization: Alan Owens, Head of Legal at H&M V Engineering; Arvinder Mangat, General Counsel at Encompass; Carl Dunton, General Counsel at Peak Energy; Chantal Schofield, Knowledge Manager at Telecom Infrastructure Partners; and Jamie Todd, Commercial Counsel at ScreenCloud. Three of the five are the senior legal officer of the named company.

One quote says the product helps spot what a reviewer might have missed when working at the edge of their knowledge. Another reports a lawyer asking after one week that it never be taken away. No figure attaches to any of them. Nothing is dated, no cycle time, volume or cost is given, and the company's own claims stay with unquantified language about hours saved and backlogs cleared. A case studies section and an ROI calculator are published.

Training is prohibited in the agreement itself, at clause 4.2.4. Segregation is documented: each user has a private and segregated data store on Neon, authentication and row level security for organization roles run through Clerk, and the security page says there is no cross contamination between client matters or organizations. The model provider question is answered directly, with zero data retention agreements in place with OpenAI and Anthropic and each provider's terms linked.

Encryption is AES-256 at rest and TLS 1.2 or higher in transit. Privilege is addressed only as data being treated with attorney client privilege in mind, and work product is never mentioned. The confidentiality obligation at clause 12.1 reaches only information clearly labeled or identified as confidential, a narrower net than uploaded matter material would usually fall into.

Clause 3.1 of the terms says the solution gives general information, is not a substitute for licensed legal counsel, does not provide legal advice, and creates no attorney client relationship. Clause 3.3 covers competence and supervision directly: all outputs must be reviewed by qualified legal counsel before reliance, and the customer acknowledges it was expressly told so. Clause 3.3.2 names the doctrine, cautioning users who are not licensed attorneys that use may amount to unauthorized practice of law if used to advise others.

Clause 3.2 excludes a whole category: the product must not substitute for representation in criminal matters, active court proceedings or any matter where liberty is at stake, and will not draft court filings in criminal proceedings without independent attorney review. Clause 3.5 names jurisdictional limits, citing variation between the United States and United Kingdom and among states, territories and localities, and puts compliance responsibility on the user. The product is sold to in house legal teams and has no consumer surface.

No AI governance position is published. There is no responsible AI page, no principles statement, no named owner accountable for model behavior, no evaluation or testing regime before release, and no red teaming description. Nothing addresses bias, including whether redlining or risk flagging performs evenly across contract types, counterparty positions, languages or jurisdictions, and the product is marketed as working across several languages and jurisdictions. The security page concerns information security only. Clause 3.4 of the terms discloses accuracy limits.

Retention and deletion are in the agreement rather than marketing. Clause 11.6 commits to deleting all content of the customer and its users within 30 days of the contract expiring. The security page adds that the terms and pilot agreements give a right to delete data at any time. Access control is described concretely: authentication and user management through Clerk, account specific sessions, authenticated API endpoints, row level security for organization roles, multifactor authentication for administrative access, production access on a need to know basis, background checks for staff with access to sensitive systems, and security training at onboarding and after.

Suppliers are named: Neon for data stores, Clerk for authentication, and OpenAI, Anthropic and Google for models. Incident response procedures are said to carry SLA targets for acknowledgment, escalation and resolution, but no target is published and no customer notification commitment or timeframe appears. There is no formal subprocessor register with locations; DPAs are available on request.

Clause 10.1.2 of the terms, dated 11 April 2026, caps total liability at the higher of 100 pounds or the fees paid in the twelve months before the claim, so for a customer in its first months the ceiling may be a hundred pounds. Clause 10.1.1 excludes special damage, lost profits, lost savings, lost business opportunity, lost contracts, goodwill, corrupted data and wasted expenditure. Clauses 10.3 to 10.5 disclaim output directly: outcomes are for general information only, are not meant to meet professional requirements, and carry no warranty that they are accurate, complete or up to date.

Claren also has no liability for the accuracy of customer content. Clause 9 runs the indemnity one way, from customer to Claren, and no vendor indemnity appears. Clause 10.2 preserves liability for death, personal injury caused by negligence, and fraud. No insurance position is published.

Slack and Microsoft Teams are described in the agreement rather than marketing. Clause 2.4 says the solution is designed to fit into an organization's internal communication and workflow system such as Slack or Teams, and that Claren may require the customer to hold an active account with one. It also says Claren may access the customer's Slack or Teams account and the channels it is told to access, and deliver content or outcomes through them.

That states the direction of data and the configuration needed. The Pro plan lists 15 or more data integrations without naming one, enterprise single sign on and SAML appear at the tier above, and no document management, contract lifecycle, matter management or electronic signature product is named. There is no integrations page, API reference or developer documentation in the site navigation.

The security page says cloud infrastructure is hosted in United States, United Kingdom or European Union data centers, with residency options for enterprise customers, and that all data including read replicas can be stored in a specific region on request. Tenancy is described through the data layer: each user has a private and segregated data store on Neon, with row level security for organization roles, though the platform is never called single tenant or multitenant.

Where processing happens, as distinct from where data sits, is not stated. Models are called through the OpenAI, Anthropic and Google APIs and no location is stated for any of them, so nothing published confirms that inference stays in the European Union for a customer choosing residency there.

The security page says Claren is currently pursuing SOC 2 Type II and ISO 27001 certification, expected in Q2 2026, and separately that Claren uses SOC 2 compliant vendors and third party software providers. Both sentences say the same thing: the certifications belong to suppliers and to the future, not to Claren. The home page instead lists SOC 2 compliant among the reasons to choose the product, with no qualification, and the two statements conflict.

Q2 2026 has passed with no published update. The supplier certification that is evidenced is Clerk's, with SOC 2 Type II and ISO 27001 and a link to its trust page, but nothing published extends that attestation to Claren's own systems. A trust center is said to be available on request, and no report, auditor, scope or period is published.

The security page says Claren uses models from OpenAI, Anthropic and Google through their APIs, and the latest open source models on request. Each provider's own no training position is cited with a link: OpenAI's enterprise privacy policy, Google's Gemini API additional terms and Anthropic's privacy terms. OpenAI's abuse monitoring retention of up to 30 days is disclosed, and Claren says it has zero data retention agreements with OpenAI and Anthropic.

No model or version is named, only the provider, so which model performs a redline is not stated. Where inference runs is never stated. No commitment to notify customers if a provider, model or arrangement changes is published, although the open source option is offered on request.

Three plans are published with names and contents. Pro carries unlimited chats, 100 chat file uploads, 100 data room uploads, AI redlines, a prompt library tuned for legal work, 15 or more data integrations and a Slack community. Scale-Up adds enterprise single sign on and SAML, a dedicated support manager, AI playbook generation, custom contract term extraction and data partitions. Enterprise adds AI training sessions every two weeks, enterprise permission and access controls, managed onboarding, direct access to the AI team and priority input on the roadmap.

No figure appears at any tier, and every call to action asks for a demo. A closing note says plans are based on average document usage and that packages and pricing vary by workflow and document volume. So volume drives the bill, and what a unit costs or what is included beyond the upload caps is not stated. An ROI calculator is published.

Supported work is clear: contract review, redlining, key term extraction and document question and answer for in house legal teams, across several languages and jurisdictions, with named customers in energy, telecommunications, retail, technology and drinks. The exclusions are explicit and come from the agreement. Clause 3.2 puts criminal matters, active court proceedings and any matter where liberty is at stake outside the product entirely.

Clause 3.5 says the product may not account for specific jurisdictional requirements or recent changes in local law, naming the United States and United Kingdom and variation among states and localities. No firm segment or size is stated, law firm use as against in house use is never addressed, government legal work is not mentioned, and no contract type is named as unsuitable.