C
Coheso
Coheso is an AI legal front door and work management platform from Coheso, Inc. of New York, sold to in-house legal and compliance teams. Requests from the business arrive through Slack, Microsoft Teams, Gmail, Outlook or intake forms; the platform captures their context, uses AI to triage and route them, and tracks each one on shared boards through to resolution, with dashboards on volume, turnaround and the share resolved by AI.
Its AI Assist answers business users' questions from a knowledge base the legal team curates, citing the source passages, and routes sensitive topics through legal validation under response rules the legal team sets; agents built on the team's own playbooks take on recurring reviews, first drafts and follow-ups, and standard agreements are generated from the team's templates. Language model features run on OpenAI GPT models through the Azure OpenAI Service, customer documents are stored on Amazon Web Services, and data residency is offered in the US, EU and UAE. Named customers include Taskrabbit, M42 and Narvar.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models drive the product's headline capabilities, on top of a workflow system that would still run without them. AI triages each incoming request and decides whether it can be answered from source documents or needs a lawyer, answers business users' questions from the legal team's approved content, generates first drafts from the team's templates, and runs agents that apply the team's playbooks to recurring reviews.
Intake forms, routing rules, shared boards, status tracking and dashboards are conventional work management that functions without the models. Verified 22 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Answers are grounded in the customer's own material and cite it. The AI Assist page says business-facing answers draw from the contracts, policies and guidance documents the legal team curates, with citations linking to the source passages, and the ROI page says each response from the legal-side assistant cites every individual assertion with footnotes hyperlinked to the passage relied on. The home page adds a report of which documents the AI leans on most and which questions it cannot yet answer. No accuracy figures, test set or error rate are published. Verified 22 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The control structure is real and set by the customer. Legal teams write response rules defining what the AI can and cannot answer directly, validation workflows route sensitive answers through legal before they reach business users, the AI escalates questions that need a lawyer, and every AI interaction is logged and reviewable by legal. Agents handle repeat requests from the team's playbooks and leave judgement calls and exceptions with the lawyers.
What sits outside the customer's own configuration is not published: the vendor states no limit of its own on what the AI may answer unreviewed, no threshold at which it stops, and nothing on what happens after a wrong answer reaches a business user. Verified 22 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Named legal departments, dated, with figures a reader can check. The Taskrabbit case study of 30 April 2026 reports that within about three and a half months of launch the legal team logged 297 interactions through Slack, of which 211 were escalated to legal and 86 were resolved by AI, running on eight intake forms, and quotes the company's Principal Counsel on adoption. The Narvar study of 26 November 2025 describes a migration of more than 10,000 contracts with the data extracted for legal, finance and the deal desk, and the M42 study of September 2025 describes CLM templates completed automatically from intake forms.
The headline figures on the home page, up to 75 per cent faster responses and more than eight hours saved per attorney each week, carry no customer or method. Verified 22 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Specific commitments cover the model provider and little else. The security page says no data is stored with any language model provider used for processing and that data is processed and immediately discarded there, names data residency options in the US, EU and UAE, and describes SAML SSO, IP allow-listing and audit logs; the AI Assist page describes document-level permissions separating business-facing from internal legal content.
No customer agreement is published, so none of this can be read as a term, and nothing addresses whether Coheso itself trains on customer content, how privileged material is treated, or how long Coheso keeps documents. The Privacy Notice, last modified 8 December 2025, reserves use of information to improve the Service and to analyse its accuracy. Verified 22 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Checked the home page, the AI Assist, security, ROI and privacy pages and the Taskrabbit case study on 22 September 2026. Nothing states that answers given to business users are not legal advice, who may rely on them, or how the product supports the legal team's professional supervision duties, and no customer terms are published where such a statement would usually sit. The product gives employees who are not lawyers answers to legal and compliance questions; the controls the legal team can set over those answers are real and are described under oversight, but they are product settings rather than a position on the advice line. Verified 22 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Governance is described as something the customer runs, not something Coheso publishes about itself. Response rules, validation workflows, audit trails for every AI interaction and usage analytics give the legal team the means to watch and correct the AI, and a report shows which questions it cannot yet answer. No governance framework, accountable owner, pre-release testing regime or bias finding of the vendor's own is published. Checked the home page, the AI Assist, security and privacy pages on 22 September 2026. Verified 22 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Most of the ground is covered on published pages. The Privacy Notice names where customer documents and logs are stored, on Amazon Web Services S3 and RDS, and names the other processors, including the Azure OpenAI Service for language model features and Adobe's PDF viewer; the security page adds zero retention at the model provider, SAML SSO, IP allow-listing, audit logs and residency options in the US, EU and UAE; and the trust centre carries a subprocessors section and offers a SOC 2 report and a penetration test report on request.
What is missing is a stated retention period, since the notice keeps information for as long as the Service is used and a reasonable time after, and any stated incident or breach notification practice. Verified 22 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Checked the home page, the security, AI Assist, ROI and privacy pages and the site footer on 22 September 2026. No customer agreement, terms of service or subscription terms are published, so nothing states who bears the loss when an AI answer or draft is wrong: no indemnity, cap, warranty or remedy was located. The Privacy Notice disclaims liability for disclosure of information through transmission errors, third-party access or causes beyond the company's control, which concerns data security rather than the product's output. Verified 22 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Named integrations exist and some of their behaviour is described. Requests are captured from Slack, Microsoft Teams, Gmail and Outlook with their context, and legal's responses sync back to the original thread; documents connect through Google Drive and SharePoint; Docusign and CLM connectors are listed; and the M42 case study describes intake form fields passing to the customer's CLM to generate standard agreements automatically.
No integration documentation is published describing what each connector moves, in which direction, or what a team must configure. Verified 22 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The residency options are named and the processing location is not. The security page offers data residency in the US, EU and UAE, and the trust centre lists an architecture diagram for each region, available on request. The Privacy Notice says customer documents and logs are stored on Amazon Web Services and that language model features run on the Azure OpenAI Service, without stating which region processes a customer's prompts, and it separately says information collected through the Service is stored and processed in the United States, which the regional options qualify without resolving. The tenancy model is not stated. Verified 22 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A named attestation with a request route. The security page states SOC 2 Type II, with annual independent audits over a full-year observation period, and independent penetration testing of the web application and infrastructure. The trust centre lists a SOC 2 Type II report, a penetration test report and regional architecture diagrams behind an access request, with the privacy policy open to view. The auditor, the report period and the scope are not stated on any page read. Verified 22 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The provider is named: the Privacy Notice says language model features use OpenAI's GPT models hosted on the Azure OpenAI Service, and the security page says no data is stored with any model provider used. The specific models and versions are not named, where the Azure processing runs is not stated, and no commitment to notify customers of a model change is published. Verified 22 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Checked the home page, the platform pages, the ROI calculator, the security page, the privacy page and the footer on 22 September 2026. No price, tier, unit of charge or package structure is published; the ROI calculator estimates the value of time saved without stating what the product costs, and every route to a figure is a demo request. Verified 22 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
The buyer is stated precisely: in-house legal and compliance teams, across industries the site names, including healthcare, technology, finance, chemicals, cybersecurity, beauty and wellness, and manufacturing. The work covered is clear from the product and case study pages: intake and triage of business requests, NDAs, MSAs, DPAs, vendor and marketing reviews, employment questions, contract generation and contract data migration.
What the product does not cover is not stated, and nothing addresses team size or use outside in-house legal. Verified 22 September 2026.
4 public documents
The public pages on file for Coheso, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
coheso.ai/privacy-policy2 signals
Third Party Request and Subpoena Notice, Outside Counsel Guideline Readiness
Read Sep 22, 2026
-
coheso.ai/ai-assist1 signal
Ethical Walls and Matter Segregation
Read Sep 22, 2026
-
coheso.ai/security1 signal
Prompt and Output Retention
Read Sep 22, 2026
-
Fabricated Citation Record
Read Sep 22, 2026
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
No customer agreement, terms of service or equivalent contract is published on any surface located, and no policy page states a position on training. Nothing is granted and nothing is withheld, so a client has no term to hold the firm to. Where a policy page does state a position, the row takes the matching policy value instead and the summary records that no agreement exists.
No agreement that governs the product could be read: no customer agreement, terms of service or subscription terms are published. Checked on 22 September 2026, the home page, security page, AI Assist page, ROI page, Privacy Notice and trust centre listing state no position on whether Coheso trains on customer content. The security page says no data is stored with any language model provider, which concerns retention at the provider rather than training, and the Privacy Notice reserves use of information to improve the Service and analyse its accuracy without naming training.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
The security page says nothing is stored with any language model provider and that data is processed and immediately discarded there. Coheso itself keeps customer documents and logs on Amazon Web Services and logs every AI interaction for audit, and the Privacy Notice keeps information for as long as the Service is used and a reasonable time after. No retention period is stated for what a user submits to Coheso, and no customer setting to shorten it is described.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
The AI Assist page describes Coheso's own permission model over the knowledge base: document-level access controls keep business-facing and internal legal content separately scoped, and AI responses draw from the knowledge base with that access control applied. The legal team sets and maintains the permissions; nothing published maps them to matters, and no inheritance from a document management system's access model is described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Published terms or policy address disclosure to authorities or in response to legal process, and no commitment or reservation regarding customer notice is located anywhere. The vendor has told the customer that data can leave and has said nothing about whether the customer hears of it.
The Privacy Notice, last modified 8 December 2025, lists assisting law enforcement and responding to subpoenas among the uses of information, and says information may be disclosed to comply with law, to cooperate with government or law enforcement officials or private parties, and to respond to claims and legal process. No commitment to notify the customer, and no reservation of a discretion to do so, was located, and no customer agreement is published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
Checked the home page, the AI Assist page and the security page on 22 September 2026. The AI answers from the customer's own contracts, policies and guidance documents, and no body of primary law is identified behind its output.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Checked the home page, the AI Assist page and the security page on 22 September 2026. Answers cite the customer's own documents, and nothing addresses checking legal authority for subsequent history.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
The vendor describes refusal or abstention behaviour in public materials.
The home page says the AI decides for each request whether it can be answered from source documents or needs escalation, and the AI Assist page says it escalates automatically when a question requires legal review, routes answers on topics the legal team has flagged through legal validation first, and reports which questions it cannot yet answer so the team can fill the gap. No published evaluation shows how often it declines or escalates.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
Searched the AI Hallucination Cases database maintained by Damien Charlotin on 22 September 2026 for Coheso, and no recorded case was returned. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Checked the home page, the AI Assist, security, ROI and privacy pages and the Taskrabbit case study on 22 September 2026. No material refers to lawyers' professional or ethical obligations or names any ethics opinion.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
The product is bought by in-house legal teams whose work bills no client, so no fee between a lawyer and a client is touched. The savings Coheso claims are aimed at the buyer's own cost: responses up to 75 per cent faster, more than eight hours saved per attorney each week, and an ROI calculator estimating hours recovered and reduced outside counsel spend.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
The Privacy Notice names the processors that handle customer material, including Amazon Web Services for documents and logs, the Azure OpenAI Service for GPT-based features, Adobe's PDF viewer, Frontegg for user management, and Vercel and Render for analytics, and the trust centre carries a subprocessors section beside a SOC 2 report and penetration test report available on request. No client-facing disclosure pack on AI use is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Every AI interaction is logged with its cited sources and can be reviewed by legal, and responses are logged and searchable. No export of a per-document record covering the model used, the sources and the human check is described, and no disclosure guidance is published.