C
CobbleStone Software
CobbleStone Software sells Contract Insight, a contract lifecycle management platform that has been in the market since the mid-1990s and now carries a proprietary artificial intelligence layer called VISDOM. The platform side is broad and conventional for its class: a searchable contract repository with version control, template and clause authoring, configurable workflow automation with task alerts and escalation, key-date notifications, custom reporting, IntelliSign electronic signatures, and separately licensed modules for vendor management, e-procurement, e-sourcing, purchase orders, purchase requisitions, document assembly and OFAC screening.
VISDOM is the intelligence layer over that platform rather than a separate product. It extracts metadata and clauses from uploaded agreements, runs optical character recognition over legacy documents, checks drafts against a customer-defined playbook and flags deviations, proposes replacement language from an approved clause library, detects and calendarises obligations, scores risk and negotiating tone, and answers questions about the repository in plain language through an assistant called VISDOM Assist.
The generative tier, VISDOM+, adds clause drafting and summarisation and runs on third-party models from OpenAI alongside the vendor's own; the customer agreement names the model provider and commits the vendor to notice before changing it. VISDOM reaches the user inside the platform's own browser-based editor, which supports co-authoring, tracked edits and inline comments, and through add-ins for Microsoft Word and Outlook.
The software is sold in two delivery forms, a hosted edition running on Google Cloud Platform and an installed edition the customer runs on its own Windows and SQL Server infrastructure, with named-user and concurrent-user licensing. Buyers are legal, procurement, sales and IT teams, and the published customer base is weighted toward government, healthcare, education, pharmaceuticals and utilities, including El Paso County, the County of San Diego Health and Human Services Agency, SUNY Upstate Medical University and Chiesi. The contracting entity is CobbleStone Systems Corp., trading as CobbleStone Software, of Princeton, New Jersey.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the engine of a core capability layered on a product that would still function without them, which is the B band and is the vendor's own description of the architecture. VISDOM is presented as a native intelligence layer inside Contract Insight, using the same data model and clause library, and as something that attaches to an existing workflow rather than being a destination. Underneath it sits a full contract lifecycle management platform that predates the AI by decades: repository, version control, template and clause authoring, workflow automation, alerts, reporting, electronic signature, and separately licensed vendor management, e-procurement, e-sourcing, purchase order, requisition and OFAC modules.
Remove VISDOM and a working CLM and procurement suite remains, and the vendor sells the AI as a priced add-on with its own tiers rather than as the platform itself. That is the distinction from the records in this lane that carry A. Recorded on the other side: the 2026 releases push the AI further into the platform, with VISDOM embedded at platform level in the native online editor and described as operating autonomously there, and the vendor's own framing has moved from a feature to an agentic layer. It has not moved far enough to make the platform unsaleable without it. Verified 12 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is asserted without measurement and grounding is claimed without a described method, which is the C band. The grounding claim is real in the product's own idiom and worth stating: VISDOM works from the customer's own clause library, playbook and repository, using the same data model as the platform, and clause suggestions are described as generated based on precedence, so the output has an identifiable source inside the customer's own material.
The accuracy claim is unquantified, the strongest version being an assertion of consistent system-wide accuracy in a February 2026 release announcement. Nothing published gives an accuracy figure, a test set, an error rate, a benchmark or a described retrieval method, and no evaluation of extraction or clause-matching precision was located anywhere on the estate. R40 governs the floor and the D limb does not fire, because the position is not a bare no-hallucination claim: the Master Subscription Agreement disclaims warranties as to the quality, accuracy or validity of information residing on or passing through the system, and section 9.3(b) states that information available from the software may not be complete or accurate and that the customer assumes responsibility for its review and use.
The product cites no legal authority, so the authority-grounding and citation-status limbs do not apply under R15 and are not counted against it. Verified 12 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
A written commitment that the models work alongside a human decision-maker, with real review surfaces, short of the threshold at which the system acts alone. The commitment is unusually strong for this corpus because it is contractual rather than marketing: Master Subscription Agreement section 7.2 prohibits the customer from using any AI Tool as part of an automated decision-making process with legal effects unless the final decision is made by a human being, and from using it to provide advice that would normally be provided by a licensed professional.
That is a published constraint on what the system may be allowed to decide, drafted into the instrument that governs the product. The review surfaces are real: tracked edits, inline comments and co-authoring in the native online editor, high-risk clause flagging that triggers auditable reviews, and deviation reporting against the playbook before signature. R37 rule 2 identifies what is missing. The same estate describes AI operating autonomously within the editor, agents that analyse, flag and review without complex user configuration, and an assistant that runs compliance checks, and those cannot all sit alongside a human-decides rule without a stated boundary.
No threshold, confidence level or class of work is published at which the system stops and hands back. The note carries both so a reader can weigh them. Verified 12 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Named customers without figures, which is the B band's stated shape almost exactly. Fourteen organisations are named in a published case-study library, each with the edition deployed and a one-line account of what changed: El Paso County, Marion County, the County of San Diego Health and Human Services Agency, SUNY Upstate Medical University, Chiesi, Intarcia Therapeutics, Soquel Creek Water District, Regional Water Authority, Brownsville Public Utilities Board, NewFields, Rapattoni Corporation, CentroMotion, Wound Care Advantage and Vertical Screen.
The spread across government, healthcare, pharmaceuticals, utilities, manufacturing and software is itself evidence of production use rather than a pilot estate. What is absent is measurement attached to any of those names: not one carries a figure for cycle time, cost or volume on the index page read. The figures the vendor does publish are unattributed and sit at company level, being 95 per cent customer satisfaction according to its most recent survey, more than 5,000 organisations worldwide, a claim that digitised agreement workflows can drive up to 26 per cent efficiency gains, and a 1.8 times revenue velocity figure on the VISDOM page.
None states a basis. Analyst placement with Gartner, Forrester, IDC and QKS is recorded rather than credited, since analyst recognition is not deployment evidence. Individual case studies were not opened. Verified 12 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive published commitments on confidentiality, readable before signing, short of the full picture, which is B. What is published and contractual: Master Subscription Agreement section 8.1 defines Confidential Information to include Customer Data expressly, section 8.2 requires each party to hold it in strict confidence, to use no less than a reasonable degree of care, and not to disclose it except as approved in writing or as legally required, and those obligations survive termination without a time limit.
Tenant separation is stated as architecture on the VISDOM page, and the installed edition goes further by putting the whole application on the customer's own server under Exhibit A. The model-provider position is partly explicit and better than most of this corpus: section 7.1 names OpenAI as the AI Processor, states it may act as data subprocessor for information input into an AI Tool, and commits the vendor to reasonable advance notice before changing it.
Three A limbs fail. Privilege and work product are addressed nowhere, and R33 makes that limb decisive on its own. There is no contractual prohibition on training: section 8.3 reserves the right to collect and analyse data including information concerning Customer Data and to use it to improve and enhance the Services, and the no-training statements sit on product pages rather than in the agreement. And while the model provider is named, nothing states what OpenAI may retain of what is sent to it. Retention and deletion are not addressed in the agreement at all. Verified 12 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
A real published position on advice versus tooling, contractual rather than a website notice, short of the supervision and competence dimension. Two provisions carry it. Master Subscription Agreement section 7.2(ii) bars the customer from using any AI Tool to provide advice that would normally be provided by a licensed professional, naming legal advice expressly, which is a restriction on use rather than a disclaimer of status and is therefore addressed to the risk this axis exists for.
Section 9.3(b) adds the status statement plainly, that CobbleStone does not provide legal advice for the customer, alongside an allocation of responsibility for reviewing and using output. Section 7.2(i) reinforces both by requiring a human being to make the final decision wherever an AI Tool feeds a decision with legal effects. C does not fire: this is not boilerplate in the terms contradicted by marketing that speaks in advice terms, and the audience is named rather than left ambiguous.
What is missing for A is everything about the lawyer's own duties. Nothing addresses how a supervising lawyer discharges competence or oversight obligations over AI-generated redlines, nothing states which of the four named buyer groups may operate which capability, and no jurisdictional limit is named anywhere. The product is sold to procurement, sales and IT alongside legal, and nothing published addresses what that means for the review of legal positions. Verified 12 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
No governance framework, testing regime or accountable owner is published, which is C. What exists is governance by contract rather than by programme, and it is recorded because it is real: Master Subscription Agreement section 7 is a dedicated Artificial Intelligence article that names the third-party AI Processor, states that CobbleStone is not a data controller of information processed through an AI Tool, places control of what is uploaded with the customer's users, restricts the uses to which AI Tools may be put, and reserves the right to alter or withdraw VISDOM+ on reasonable advance notice.
The product pages add a guardrails claim and an inference-only architecture statement. None of that is what the higher bands ask for. There is no responsible AI or AI governance page, no framework and no certification against one such as ISO 42001, no person or function inside the vendor is named as accountable for AI, nothing is published about what is evaluated before a model change ships, and there is no published position on uneven output across contract types, counterparty drafting styles or the seven languages the extraction engine claims to support.
The one place a bias question is directly raised by the product, sentiment and negotiating-tone analysis, is described as a capability with no accompanying account of how tone is judged or tested. Verified 12 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy across most of the ground, short of the full set, which is B. Retention and deletion are addressed in the privacy policy rather than left blank: personal information is kept as necessary to fulfil contracts and legal obligations and is retained until deleted by the vendor or as requested by the data owner, with deletion available on request at any time. Access control is documented across several surfaces: encryption at rest and in transit, tenant isolation, named and concurrent user licence models with server session timeouts defined in the agreement, and audit trails across AI chats, contracts and other key areas.
The subprocessor limb is partly met in an unusual way, through the agreement rather than a register: section 7.1 names OpenAI as the AI Processor and as a possible data subprocessor, with reasonable advance notice of change, so a customer can identify the third party that sees content sent to an AI Tool. Two gaps hold it at B, and they are the two the band names. There is no subprocessor list, so the hosting, support and infrastructure processors behind the platform are unidentified, with Google Cloud Platform surfacing only as an environment on the attestations page.
And no incident practice runs to the customer: the agreement obliges the customer to notify the vendor within 24 hours of a suspected compromise and says nothing about the vendor notifying the customer of a breach. Verified 12 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Liability is addressed through a limitation clause that disclaims the exposure the product creates, which is C, and as with the other records graded here today the grade turns on scope rather than on drafting quality. What is published is specific: section 11.1 caps total liability at the licence fees paid in the twelve months before the claim, excludes lost profits and indirect, incidental, consequential, special, exemplary and punitive damages, and makes adjustment, repair or replacement the customer's sole remedy for breach of warranty; section 11.2 preserves liability for death or personal injury caused by negligence, for fraud, and under the indemnity; section 12.6 requires any action to be brought within one year.
Section 10.1 is a genuine indemnity but runs only to third-party United States patent, trademark or copyright infringement, and section 10.3 removes it wherever the damages relate to the content of the customer's data. There is more warranty here than most records at this grade carry, section 9.2(b) warranting that the software will materially conform to the documentation with a correct-or-refund remedy inside ninety business days, and that is recorded.
It does not reach the question the axis asks. Nothing stands behind wrong AI output: section 9.3(a) disclaims all warranties as to accuracy or validity, section 9.3(b) puts review and use on the customer, and no insurance position or indemnity was located. Verified 12 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations, named and documented, short of a description of what they move, which is B. Named on the vendor's own surfaces: Microsoft Word and Microsoft Outlook add-ins carrying VISDOM into the drafting and mail surfaces, Salesforce, Microsoft Dynamics 365, Oracle, DocuSign, Adobe Acrobat Sign, Twilio and Unanet on the integration strip, plus an API described as available at the Elite tier for high-volume pipelines.
A published support-portal article adds native CLM integrations, connectors to Zapier and Microsoft Power Automate reaching thousands of applications, and a plugin environment for contract lifecycle systems with two described use cases, pushing a Word or PDF file into the platform from a contract record or intake form and round-tripping a prepared redline back without leaving the browser. That round trip is the one place depth is genuinely described.
Elsewhere it is not. No field-level mapping, sync direction or configuration requirement is published for the CRM and ERP connections, the connector article notes that new connectors were invite-only and directs the reader to email support, and API documentation is obtained the same way rather than published. A technical wiki exists at wiki.cobblestonesoftware.com and was not opened; under R25 it corroborates rather than carries. Verified 12 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Deployment model is stated clearly with partial residency detail, which is B, and the deployment side of this record is stronger than most. Two delivery forms are published and genuinely distinct: a hosted edition, and an Enterprise Installed Edition that the customer runs on its own infrastructure, specified down to the operating system, database, processor, memory and disk in Exhibit A of the agreement, with the customer responsible for backup and firewalling.
For the installed edition residency is answered by construction and the agreement addresses it directly, section 2.3 permitting a single production instance located in the United States and its territories or any other country to which the software is legally exported, so the customer chooses where the data sits. Tenant isolation is stated for the hosted side, and the hosting environment is identified as Google Cloud Platform, though only in passing on the attestations page rather than on any product or security surface.
What is missing for A: no region menu or list of available regions is published for the hosted edition, nothing distinguishes where processing happens from where data is stored, and the AI path is the sharpest gap, since content sent to the named third-party AI Processor leaves the tenant and no surface states where that processing occurs. Verified 12 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Badges appear with no scope, no date and no report available, which is the C band, and the page is a clear example of it. The Attestations page lists sixteen entries, including SOC 1 Type II, SOC 2 Type II, FISMA, HIPAA, GSA, NIST, CSA, eVerify, TX-RAMP, VPAT, the Data Privacy Framework and CMMC 2.0. Not one carries an auditor, a report period, a certificate number, a scope statement or a downloadable report, and there is no trust portal or request route on the page at all.
Several entries do not survive reading. Safe Harbor is listed as a current attestation although that framework was invalidated in 2015. SSAE Type II is listed as if it were a certification, and is illustrated with a CSA STAR logo. ISO appears twice with no standard number, once as a bare entry and once as ISO for the Google Cloud Platform environment, which is Google's attestation rather than this vendor's and does not travel to the product without a scope connector under R16.
FedRAMP is listed the same way, as compliance of the GCP environment, while the vendor's own press release on the same site says it has achieved FedRAMP Ready status and is seeking a sponsor, which is a materially different claim. A separate certification strip on the case-studies page names ISO 27001 and GDPR compliance, which the Attestations page does not. Recorded rather than resolved. Verified 12 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The supply chain is partly disclosed, which is B, and this is the strongest row on the record and among the better disclosures in this lane. Two of the four A limbs are met and both are met in the agreement rather than in marketing. The provider is identified: Master Subscription Agreement section 7.1 states that the AI Processor as of the effective date is OpenAI, defines the AI Processor as the third-party data processor used to provide certain AI features, and states that it may act as data subprocessor for information input into an AI Tool.
Change notification is committed in the same clause, the vendor undertaking to change the AI Processor only with reasonable advance notice to the customer. The models are partly named, which is rarer still: the VISDOM pricing page states that VISDOM may use up to GPT-4 and GPT-4o with the vendor reserving the right to adjust model levels. Two things hold it off A. Where the models run is not stated anywhere, which matters because content leaves the tenant to reach them.
And the two disclosures contradict each other on notice: the pricing page says the vendor reserves the right to alter the AI without notice, while section 7.1 requires reasonable advance notice. R37 rule 1 governs and the agreement wins, but the contradiction is the finding and belongs on the record. Verified 12 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Real pricing is published for part of the range with the rest withheld, which is B, and the published part is the AI. Four VISDOM tiers carry figures and volumes: Basic free with up to 100,000 words a month and no overages, Starter at $3,995 billed annually with 500,000 words a month, Pro at $6,995 with 1,000,000, and Elite at $29,995 with 5,000,000, each shown with a monthly equivalent, above which the buyer is directed to sales.
The unit of charge is defined rather than gestured at: words processed in and out per iteration, shared and consumed across all users, not rolling over month to month, with overage invoiced in 750-word increments, and the same unit is written into Master Subscription Agreement section 7.3. Commercial terms sit in the agreement and are specific: payment within thirty days, non-refundable fees, interest at 1.50 per cent monthly, annual increases capped at eight per cent, automatic twelve-month renewal with thirty days' notice not to renew, thirty days' notice to terminate for convenience, a thirty-day evaluation period with a full refund of licence fees, and thirty days' notice for VISDOM+ price changes.
What holds it off A is the platform itself. Contract Insight licensing is quoted through a Request Pricing form, no figure or band is published for it, and the licence model is named and concurrent user seats, so a buyer can price the AI precisely and cannot price the thing the AI runs inside. Verified 12 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment and practice coverage is described with substance and the boundaries are left open, which is B. Buyer coverage is published as its own navigation tier with four named audiences, Legal, Procurement, Sales and IT, each with a page, and the legal audience is addressed twice, once as a team and once as an industry. Sector coverage is enumerated across seven industry pages, healthcare, government, education, pharmaceuticals and life sciences, energy and utilities, financial services and legal, and the published customer base bears that out across counties, a state university medical centre, water districts, a public utility board and pharmaceutical companies, spanning public and private sector.
Product coverage is described edition by edition, with a comparison page setting out what differs between CLM editions and an add-on module list a buyer can read before speaking to anyone. What is left open holds it off A. No practice area inside a legal department is identified as supported or unsupported, the seven languages named for extraction are not tied to any statement about jurisdictional or drafting-convention coverage, nothing states which of the four named audiences may use which AI capability, and there is no published statement of what the product is not for.
The only firm-shaped datum located is that the design is aimed at in-house and public-sector contract functions rather than at law firms, and that is inferred from the estate rather than stated. Verified 12 September 2026.
4 public documents
The public pages on file for CobbleStone Software, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Good Law Verification, Refusal and Uncertainty Behaviour, Court Disclosure Support and 3 more
Read Sep 12, 2026
-
Bar Guidance Alignment, Outside Counsel Guideline Readiness, Third Party Request and Subpoena Notice
Read Sep 12, 2026
-
Prompt and Output Retention
Read Sep 12, 2026
-
Billing and Fee Posture
Read Sep 12, 2026
No published figureUSD, as published, never converted
- The AI has published prices; the software it runs inside does not.
- VISDOM Basic is free and processes up to 100,000 words a month, which is enough to try it out.
- Above that there are three annual plans: $3,995 for 500,000 words a month, $6,995 for a million, and $29,995 for five million. Bigger than that and you have to call sales.
- Words are counted going in and coming out, shared across everyone on your team, and anything unused disappears at the end of the month. Going over is billed in blocks of 750 words.
- What none of the pages tell you is what Contract Insight itself costs, and you need that to use any of this. That price comes from a form and a sales call.
- Once you are in: you pay within 30 days, the money is not refundable, renewals are automatic each year unless you give 30 days' notice, and they can raise the price by up to 8 per cent a year. There is a 30-day evaluation window at the start where you can walk away and get the licence fee back.
Published figures for the AI layer, published structure for the whole, and no figure for the platform licence. The VISDOM tiers are published in full with volumes: Basic is free with up to 100,000 words per month and no overages; VISDOM+ Starter is $3,995 billed annually, shown as a $332 monthly equivalent, with 500,000 words per month; Pro is $6,995 annually, $582 monthly equivalent, with 1,000,000 words; Elite is $29,995 annually, $2,499 monthly equivalent, with 5,000,000 words and described as built for API-driven pipelines.
Packages above five million words per month are quoted by a sales representative. A feature comparison table across the four tiers is published and states that all tiers carry the same VISDOM feature set today, the paid tiers differing on volume and on early access to new features. The unit of charge is defined on the page and again in Master Subscription Agreement section 7.3: words processed in and out per iteration, consumed across all authorized users, expiring at month end with no roll-over, and invoiced in increments of 750 words above the allotment, with thirty days' advance notice of any VISDOM+ price change.
The platform is the withheld half. Contract Insight licensing runs through a Request Pricing form with no figure, band or unit published, and the agreement shows the licence model is per End User on either a named or a concurrent basis, so seat count drives a number the buyer cannot see. Commercial terms from the agreement: payment within thirty days of invoice, all fees non-refundable unless expressly provided otherwise, interest at 1.50 per cent per month on overdue amounts, annual Subscription Fee increases capped at eight per cent, an initial twelve-month term renewing automatically unless the customer gives thirty days' notice, termination for convenience on thirty days' notice, Professional Services invoiced monthly for hours actually delivered, and a thirty-day evaluation period from delivery in which the customer may return the software and recover licence fees, excluding training, data transfer, installation and Professional Services.
Confidentiality and data terms: HIPAA appears on the Attestations page as a bare entry with no scope, date or supporting report, and the VISDOM page carries a HIPAA Ready badge, which is a readiness claim rather than a compliance statement. No Business Associate Agreement is published, offered or referred to on any surface read, and the Master Subscription Agreement contains no health-data provisions and no restriction on submitting protected health information. That silence sits against a customer base the vendor publishes as including SUNY Upstate Medical University, the County of San Diego Health and Human Services Agency, Wound Care Advantage, Chiesi and Intarcia Therapeutics. No data processing addendum was recovered: the legal hub advertises DPAs and its body did not render to this index's fetcher.
Note: VISDOM tier figures, word volumes, overage rule and model-level statement read from the vendor's own VISDOM pricing page on 12 September 2026. Commercial terms read from the Master Subscription Agreement for Contract Insight Enterprise Installed Edition (Specified Term), last updated 1 June 2026, recovered as a PDF under the R8 step 4 ladder after the legal hub page returned its frame without a body, and read in full. entryPriceUsd is null and entryPriceDisplay is empty by deliberate judgement rather than for want of a figure: four figures are published, but they price the VISDOM AI layer only and the Contract Insight licence a buyer must hold to use it carries no published price, so a display figure would travel to comparison surfaces as the price of something it does not buy. The full tier table is in pricingBasis. Reported for sampling.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A public policy or trust page states no training on customer content, with no matching term located in the published agreement.
The public statement is a no, the agreement does not carry it, and both of the vendor's own formulations are qualified in ways a buyer should see. The VISDOM page states that proprietary contracts never train public models and answers the direct question with: never, VISDOM uses inference-only architecture for client data, documents are processed and not learned from, and model weights are not updated using non-permitted client content.
The pricing page adds that documents are not used to train global AI models. The qualifiers are the point. Public and global models leave the vendor's own models unaddressed, and non-permitted client content implies a category of permitted client content that is not defined anywhere located. No matching prohibition appears in the Master Subscription Agreement, which was read in full. What the agreement does contain runs the other way: section 8.3 reserves the right to collect and analyse data and other information relating to the provision, use and performance of the Services, including information concerning Customer Data, and to use it to improve and enhance the Services or Licensed Software and for other development purposes, and to disclose it in aggregate or de-identified form.
Following the same reading applied to other records today, that is an improvement right that never names training, so contractual-permitted is not reached under the R28 test. A third fact belongs here: section 7.1 sends content input into an AI Tool to OpenAI as AI Processor, and nothing published states what OpenAI may retain or train on.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
Retention is acknowledged in public material with no period stated, which is this value. The privacy policy addresses it directly: information is kept as necessary to fulfil contracts, interact with users, meet government regulations and support the establishment, exercise or defence of legal claims, is kept only as long as necessary as determined in the applicable governing documents or law, and is retained until deleted by the vendor or as requested by the data owner, with deletion available on request at any time.
That is a real published position and it is more than silence, but no number attaches to it and the governing documents that would set the period are the customer's own order form rather than anything published. Two things narrow it further for the purposes of this signal. The policy is written about personal information across the website and the software rather than about contract documents, prompts and generated output specifically, and the Master Subscription Agreement, read in full, sets no retention period and no deletion or return obligation on termination.
Separately, the product publishes audit trails across AI chats, which establishes that AI interactions are retained without saying for how long. Nothing addresses retention by the third-party AI Processor named in section 7.1.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
The product maintains its own documented permission model that the customer has to administer, which is this value rather than the stronger one. Separation between customers is stated architecturally, the VISDOM page asserting complete tenant isolation and the pricing page adding that data stays isolated within the customer's own CobbleStone environment; for the Enterprise Installed Edition the separation is absolute, since the application and database run on the customer's own server under Exhibit A of the agreement.
Inside a deployment the model is the vendor's own. The agreement defines named and concurrent End User licence models with server session timeouts, the marketing describes highly robust security options, and section 6.1 places responsibility on the customer to administer the system successfully, which is exactly the alignment burden this value describes. Retrieval is not shown to enforce an external document system's access model at query time, so the top value is not reached.
What is not addressed is segregation between matters or deals inside one deployment: nothing published describes a wall between one business unit's contracts and another's, which matters here because the platform is sold to legal, procurement, sales and IT in the same instance and the AI assistant answers questions across the whole repository.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Published terms or policy address disclosure to authorities or in response to legal process, and no commitment or reservation regarding customer notice is located anywhere. The vendor has told the customer that data can leave and has said nothing about whether the customer hears of it.
Compelled disclosure is addressed and customer notice is absent, which is this value precisely. Master Subscription Agreement section 8.2 obliges each party to hold the other's Confidential Information in strict confidence and not to disclose it to any third party except as approved in writing or as legally required, and Customer Data is inside the definition of Confidential Information under section 8.1. So the agreement tells the customer plainly that its data can leave on legal compulsion.
What is absent is any treatment of what happens next. No clause commits the vendor to notify the customer of a subpoena, court order, warrant or law enforcement request, none reserves discretion over whether to notify, none commits to seeking a protective order or to redirecting the authority to the customer, and none sets any period for anything. The privacy policy, recovered through the search index, addresses onward transfers and the Data Privacy Framework and was not located to address notice either.
No transparency report of any kind was found. The distinction from a vendor that says nothing at all is that this one has addressed disclosure and stopped short of notice, which is the state this value was added to record.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Sources are identified without stating the licence or rights basis.
The sources behind the output are identified and no rights basis is stated for any of them, which is this value. The primary corpus is named and is the customer's own: VISDOM is described as using the same data model and clause library as the platform, drafting clause language based on precedence, matching against the customer's approved clause library and enforcing a playbook the organisation defines once, so the material the answers come from is the customer's own repository.
The generative layer is also identified, the agreement naming OpenAI as AI Processor and the pricing page naming GPT-4 and GPT-4o as the model levels that may be used, which tells a reader what general corpus sits behind the language generation even though its contents are not described. The rights basis is stated nowhere. The agreement grants the vendor rights over Customer Data through sections 8.3 and 2.6 but says nothing about the provenance or licensing of anything the models bring with them.
The one place the product reaches outside the customer's own material is the compliance question-and-answer capability, which maps contract language to regulatory frameworks including GDPR and HIPAA obligations, and no source, edition or update cadence is published for those frameworks.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No located public material addresses whether authority is checked for subsequent history, and on this product class the question largely does not arise. The product cites no cases, statutes or regulations to a reader: it works on the customer's own contracts, matching clauses against a playbook and an approved library, extracting obligations and dates, and drafting replacement language from precedent inside the customer's own estate.
The one capability that touches external law is the compliance question-and-answer feature, which is described as mapping contract language to regulatory frameworks such as GDPR and HIPAA in real time, and nothing published states how those frameworks are kept current, which edition is held, or what happens when a regulation changes. The nearest published currency mechanism is the Horizon Scanning capability advertised on other vendors' terms elsewhere in this corpus and not offered here.
Recorded so the row states the position rather than leaving a reader to infer it. Verified against the product and pricing surfaces on the date shown.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No located public material addresses what the product does when it cannot ground an answer. The nearest thing published is a claim that the assistant is kept on track by guardrails that align with the customer's process and data, which describes a constraint without describing a behaviour, and a risk-flagging design in which high-risk clauses are surfaced and auditable reviews triggered, which is detection rather than abstention.
Nothing states that the system declines to answer, marks an answer as unsupported, reports that a clause could not be matched to the playbook, or exposes a confidence or grounding score to the user. The contractual material points the other way rather than filling the gap: section 9.3(b) of the agreement places responsibility for reviewing and using output on the customer, and section 7.2 requires a human to make any final decision with legal effects, both of which allocate the consequences of an ungrounded answer without describing what the system does before one is produced.
Recorded as an established absence: the product pages, the pricing page and its FAQ, and the full agreement were read on the date shown.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
Searched on 12 September 2026, on both the product name and the company name, against published trackers of decisions on AI-generated fabricated citations including coverage of the Damien Charlotin AI Hallucination Cases database and two independent sanctions trackers, for any court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product. None located. This is a statement about the public record on that one subject as of the date shown, and under R119 this signal records fabricated citations and nothing else, so it is not a litigation history and no other proceeding involving the vendor would appear here.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Public materials refer to professional responsibility in general terms without naming guidance.
Professional responsibility is referred to in general terms and no guidance is named. Master Subscription Agreement section 7.2 restricts the customer from using any AI Tool to provide advice that would normally be provided by a licensed professional, naming legal advice expressly, and from using one in automated decision-making with legal effects unless a human makes the final decision. That is a reference to the professional licensing framework rather than a disclaimer of the vendor's own status, and it is addressed to the customer's conduct, which is why this row takes a value at all rather than recording nothing.
It is graded here on that clause and not on the separate statement in section 9.3(b) that the vendor does not provide legal advice, which is a status disclaimer and is graded on the professional responsibility axis. Nothing further is engaged. No bar or ethics opinion is cited anywhere on the estate, ABA Formal Opinion 512 does not appear, no state guidance on generative AI in legal work is referenced, and nothing maps any capability to a jurisdiction's rules of professional conduct.
The absence carries weight on this record because the platform is sold to procurement, sales and IT teams alongside legal and the same AI capabilities are available to all of them.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
The product does not touch a fee between a lawyer and a client, because it is bought by teams that bill no client for the work. The named audiences are legal, procurement, sales and IT departments inside the buying organisation, and the published customer base is weighted toward counties, public utilities, a state university medical centre, health and human services agencies and pharmaceutical companies, all of them running their own contracts rather than billing a client for reviewing them.
The vendor's efficiency claims, 26 per cent efficiency gains from digitised agreement workflows and 1.8 times revenue velocity, are aimed at the buyer's own cost and cycle time, and under this value they are recorded here rather than making the row a savings claim, because no client bill sits in the loop. Worth noting for a reader working the other way round: the AI is metered and priced in a way that would make pass-through arithmetic possible if anyone wanted it, with words consumed in and out per iteration, shared across all users, and overage billed in 750-word increments.
Nothing published addresses disclosure of AI use or AI cost in any fee or billing context, and nothing needs to on this buyer's side of the relationship.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
A model provider is identified in a published, ungated agreement, which is what this value records. Master Subscription Agreement section 7.1 defines the AI Processor as the third-party data processor used to provide certain artificial intelligence features, names it as OpenAI as of the effective date, states that it may act as data subprocessor for any information input into an AI Tool, and commits the vendor to reasonable advance notice before changing it.
A company asked by its counterparty or its own counsel which third party sees content sent to the AI can therefore answer from the public record, which most records in this corpus cannot. Under R29 that is the substance of the naming limb: a statement about who touches customer content rather than a partnership boast. The top value is not reached because the other two limbs are missing. There is no subprocessor list, so hosting, support and infrastructure processors are unidentified and Google Cloud Platform surfaces only in passing on the attestations page, and no client-facing disclosure pack, consent notice or forwardable annex exists.
The legal hub advertises data processing addenda but its body did not render to this index's fetcher and no DPA was recovered, so nothing is credited to one.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a record exist, short of a document-level export, which is this value. The AI-specific element is the one that counts and it is published in the vendor's own words: audit trails across AI chats, contracts and other key areas, which means interactions with the assistant are logged rather than ephemeral. Around it sit the ordinary evidentiary ingredients of a contract platform: robust document version control, tracked edits and inline comments in the native editor, an approval and workflow history, and deviation reporting showing where a draft departed from the approved playbook.
Together those would let a party show who changed what and when. What is absent is everything that would turn that into a disclosure record about the AI. Nothing states that any export identifies which model produced a passage, and the model level is in any case variable by the vendor's own reservation to adjust between GPT-4 and GPT-4o; nothing marks machine-generated text against human-edited text in an exportable form; and no disclosure template, certification form or court-facing guidance was located anywhere on the estate.