C

CobbleStone Software

VISDOM is a native intelligence layer inside Contract Insight, using the same data model and clause library, attached to existing workflows. Underneath is a full contract lifecycle management platform that predates the AI by decades: repository, version control, authoring, workflow, alerts, reporting, electronic signature, and separately licensed procurement and vendor modules. Without VISDOM, a working contract and procurement suite remains, and the AI is sold as a priced add on with its own tiers.

The 2026 releases push the AI further in, embedding VISDOM in the native editor, where it is described as operating autonomously, and the vendor now frames it as an agentic layer.

VISDOM works from the customer's own clause library, playbook and repository, and clause suggestions are described as based on precedence, so output has a source in the customer's material. The strongest accuracy claim, consistent system wide accuracy, comes from a February 2026 release announcement and is unquantified. No accuracy figure, test set, error rate, benchmark or retrieval method is published, and no evaluation of extraction or clause matching is published.

The agreement disclaims warranties on the quality, accuracy or validity of information in the system, and section 9.3(b) says output may not be complete or accurate and makes the customer responsible for reviewing it. The product cites no legal authority.

Section 7.2 of the Master Subscription Agreement bars using any AI Tool in automated decisions with legal effects unless a human makes the final decision, and bars using it to give advice normally given by a licensed professional. Review tools include tracked edits, inline comments and coauthoring in the editor, high risk clause flags that trigger auditable reviews, and deviation reports against the playbook before signature.

The vendor also describes AI operating autonomously in the editor, agents that analyze, flag and review without complex setup, and an assistant that runs compliance checks. No threshold, confidence level or type of work is published at which the system stops and hands back.

A case study library names fourteen organizations, each with the edition deployed and a line on what changed: El Paso County, Marion County, the County of San Diego Health and Human Services Agency, SUNY Upstate Medical University, Chiesi, Intarcia Therapeutics, Soquel Creek Water District, Regional Water Authority, Brownsville Public Utilities Board, NewFields, Rapattoni Corporation, CentroMotion, Wound Care Advantage and Vertical Screen.

None carries a figure for cycle time, cost or volume on the listing page. Company level figures are unattributed and unexplained: 95 percent customer satisfaction in its latest survey, more than 5,000 organizations worldwide, up to 26 percent efficiency gains from digitized agreement workflows, and 1.8 times revenue velocity on the VISDOM page. Analyst recognition comes from Gartner, Forrester, IDC and QKS.

Section 8.1 of the Master Subscription Agreement includes Customer Data in Confidential Information, and section 8.2 requires each party to hold it in strict confidence with at least reasonable care and disclose it only with written approval or as legally required, with no time limit after termination. Tenant separation is stated on the VISDOM page, and the installed edition puts the whole application on the customer's own server.

Section 7.1 names OpenAI as AI Processor and possible data subprocessor, with advance notice of change. Privilege and work product are not addressed. No contractual training prohibition exists: section 8.3 reserves the right to analyze data, including information concerning Customer Data, to improve the Services, and the statements against training sit on product pages. Nothing says what OpenAI may retain. Retention and deletion are not addressed in the agreement.

Section 7.2(ii) of the Master Subscription Agreement bars using any AI Tool to give advice normally given by a licensed professional, naming legal advice, which restricts use rather than only disclaiming status. Section 9.3(b) says CobbleStone does not provide legal advice and puts review and use of output on the customer. Section 7.2(i) requires a human to make the final decision wherever an AI Tool feeds a decision with legal effects.

The audience is named. Nothing addresses how a supervising lawyer meets competence or oversight duties over AI redlines, which buyer groups may use which features, or any jurisdictional limit. The product is sold to procurement, sales and IT alongside legal, and nothing addresses what that means for review of legal positions.

Section 7 of the Master Subscription Agreement is a dedicated AI article: it names the third party AI Processor, says CobbleStone is not a data controller for information processed through an AI Tool, leaves control of uploads with the customer's users, restricts how AI Tools may be used, and reserves the right to change or withdraw VISDOM+ on reasonable notice. Product pages add a guardrails claim and an inference only architecture.

There is no responsible AI page, framework or certification such as ISO 42001, no one named as accountable for AI, nothing on evaluation before model changes, and nothing on uneven output across contract types, counterparty drafting styles or the seven languages extraction claims to support. Sentiment and negotiating tone analysis is described with no account of how tone is judged or tested.

The privacy policy addresses retention and deletion: personal information is kept as needed for contracts and legal duties until deleted by the vendor or at the data owner's request, with deletion available on request at any time. Access control is documented: encryption at rest and in transit, tenant isolation, named and concurrent user licenses with session timeouts in the agreement, and audit trails across AI chats, contracts and other key areas.

Section 7.1 of the agreement names OpenAI as the AI Processor and a possible data subprocessor, with reasonable advance notice of any change. There is no subprocessor list, so hosting, support and infrastructure processors are unnamed, with Google Cloud Platform appearing only on the attestations page. No incident duty runs to the customer: the agreement requires the customer to notify the vendor within 24 hours of a suspected compromise, but says nothing about the vendor notifying the customer of a breach.

Section 11.1 caps total liability at license fees paid in the twelve months before the claim, excludes lost profits and indirect, incidental, consequential, special, exemplary and punitive damages, and makes adjustment, repair or replacement the sole remedy for breach of warranty. Section 11.2 preserves liability for death or personal injury from negligence, for fraud and under the indemnity. Section 12.6 requires claims within one year.

Section 10.1 indemnifies only against third party US patent, trademark or copyright infringement, and section 10.3 removes that where damages relate to the customer's data. Section 9.2(b) warrants that the software will materially conform to its documentation, with correction or refund within ninety business days. Nothing covers wrong AI output: section 9.3(a) disclaims all warranties of accuracy or validity, section 9.3(b) puts review and use on the customer, and no insurance position or data breach indemnity is published.

The vendor names Word and Outlook add-ins carrying VISDOM, plus Salesforce, Microsoft Dynamics 365, Oracle, DocuSign, Adobe Acrobat Sign, Twilio and Unanet, and an API at the Elite tier for high volume pipelines. A support article adds native integrations, connectors to Zapier and Microsoft Power Automate, and a plugin environment with two described uses: pushing a Word or PDF file into the platform from a contract record or intake form, and returning a prepared redline without leaving the browser.

That round trip is the only flow described in detail. No field mapping, sync direction or configuration is published for the CRM and ERP connections, new connectors were invite only with requests by email to support, and API documentation is obtained the same way. A technical wiki runs at wiki.cobblestonesoftware.com.

Two forms are published: a hosted edition, and an Enterprise Installed Edition the customer runs on its own infrastructure, specified down to operating system, database, processor, memory and disk in Exhibit A, with the customer handling backup and firewalls. For the installed edition, section 2.3 permits a single production instance in the United States and its territories or any country to which the software may legally be exported, so the customer chooses where data sits.

Tenant isolation is stated for the hosted edition, which runs on Google Cloud Platform, though that appears only on the attestations page. No list of hosted regions is published, processing is not distinguished from storage, and content sent to the named third party AI Processor leaves the tenant with no statement of where it is processed.

The Attestations page lists sixteen entries, including SOC 1 Type II, SOC 2 Type II, FISMA, HIPAA, GSA, NIST, CSA, eVerify, TX-RAMP, VPAT, the Data Privacy Framework and CMMC 2.0, none with an auditor, report period, certificate number, scope or report, and there is no trust portal or request route. Safe Harbor is listed as current, though that framework was invalidated in 2015. SSAE Type II is listed as a certification with a CSA STAR logo.

ISO appears twice without a standard number, once as ISO for the Google Cloud Platform environment, which is Google's attestation, not the vendor's. FedRAMP is listed as compliance of the GCP environment, while the vendor's own press release says it has reached FedRAMP Ready status and is seeking a sponsor. The case studies page names ISO 27001 and GDPR compliance, which the Attestations page does not.

Section 7.1 of the Master Subscription Agreement names OpenAI as the AI Processor as of the effective date, defines it as the third party processor for certain AI features, says it may act as data subprocessor for information input into an AI Tool, and commits to reasonable advance notice before changing it. The VISDOM pricing page says VISDOM may use up to GPT-4 and GPT-4o, with the vendor reserving the right to adjust model levels.

Where the models run is not stated, though content leaves the tenant to reach them. The two documents conflict on notice: the pricing page reserves the right to change the AI without notice, while section 7.1 requires reasonable advance notice.

Four VISDOM tiers carry figures and volumes: Basic free with up to 100,000 words a month and no overages, Starter at $3,995 a year with 500,000 words a month, Pro at $6,995 with 1,000,000, and Elite at $29,995 with 5,000,000, each with a monthly equivalent; above that, buyers contact sales. The unit is words processed in and out per iteration, shared across all users, not rolling over, with overage billed in 750 word increments, and the same unit appears in section 7.3 of the agreement.

The agreement sets payment within thirty days, nonrefundable fees, interest at 1.50 percent monthly, annual increases capped at eight percent, automatic twelve month renewal with thirty days' notice to opt out, thirty days' notice to terminate for convenience, a thirty day evaluation with full license refund, and thirty days' notice of VISDOM+ price changes. Contract Insight licensing, sold by named or concurrent user, goes through a Request Pricing form with no figure.

Four buyer groups have pages, Legal, Procurement, Sales and IT, with legal covered both as a team and as an industry. Seven industry pages cover healthcare, government, education, pharmaceuticals and life sciences, energy and utilities, financial services and legal, and the customer base matches: counties, a state university medical center, water districts, a public utility board and drug companies. A comparison page shows what differs between editions, and add on modules are listed.

No practice area within a legal department is named as supported or unsupported, the seven extraction languages are not tied to any jurisdiction or drafting convention, nothing says which buyer groups may use which AI features, and nothing says what the product is not for. The design appears aimed at in house and public sector contract teams rather than law firms, though this is not stated.