C

Contract Logix

Contract Logix's AI drives two named features on a platform that works without them. The Contract Intelligence Engine works after signature: AI Contract Analysis detects which key terms and clauses a contract contains, and AI Data Extraction (AIDE) pulls chosen terms into the platform as data. It offers 92 standard fields, custom fields driven by extraction prompts, line item detail through Custom Data Objects, and reprocessing of a whole portfolio against a new setup without reloading documents.

Contract Logix Review works before signature, giving first pass redlines against the company's own standards in Word or Google Docs. Underneath is a full contract lifecycle platform: intake, authoring, negotiation workflow, repository, permissions and tracking of obligations, renewals and milestones, all of which the company sold before the AI existed.

An accuracy figure is stated, along with the gain from human review. AIDE is stated to reach about 95 percent or better on standard extraction fields, rising to about 99 percent with human validation. That tells a buyer the system is wrong on roughly one field in twenty unaided. What is missing: no test set, document count, field types or languages are described, no failure modes are named, and the words about and roughly cannot be tested.

No independent validation exists. The product extracts from the customer's own contracts and cites no outside authority, so fabricated sources are not the risk here.

Contract Logix quantifies its human review step. Its accuracy claim is about 95 percent or better unaided, rising to about 99 percent with human validation, which tells a buyer what skipping review costs. Review's output is described as first pass redlines, which sets the expectation that a person finishes the work. What is missing: no threshold at which the system defers or escalates, no confidence signal on an individual extraction, no list of fields or clauses it will not attempt, and nothing on what happens after an extraction is found wrong beyond reprocessing a portfolio.

Scale comes with one measured example. More than 60,000 legal, procurement, finance and sales professionals use the platform across hundreds of brands. The Director of Contracts at Soar Technology says a question that took three days now takes five minutes, which joins a named customer, a role and a figure. What is missing: it is a single example, it is not dated, and no method explains what the question was or how the old process worked.

Contract Logix publishes detailed access and data handling practices and says nothing about privilege. Its security page describes role and feature based permissions set by the customer, a customer System Owner who invites users, email validation, configurable passwords and SAML 2.0 single sign on. Staff undergo background screening and regular privacy and security training. Deletion and archiving follow the customer's policies, with restore limited by role.

The privacy policy covers the services as well as the websites. What is missing: privilege and work product are not addressed, no AI model provider is identified, and the confidentiality terms sit in an unpublished customer agreement.

Nothing published draws the advice line, for a product that produces legal work and is sold to people who are not lawyers. The audience includes procurement, finance and sales, with pages by department, role and process. Review produces first pass redlines, and the Intelligence Engine identifies terms and clauses in signed contracts. Nothing says whether that output is legal advice, whether a lawyer should review a redline before it goes to a counterparty, what a procurement or finance user may rely on, or who is accountable when a governing law or indemnity clause is misread.

The vendor addresses lawyers directly, with a Legal Department page and pages for General Counsel, Paralegal and Compliance Officer, so the audience is clear and the professional line is what is missing. No supervision statement or jurisdiction limit is published.

Nothing published on AI governance is published. The navigation and footer, covering platform, product, security, privacy, hosting, integration, solution, company, news and blog pages, contain no responsible AI page, AI policy, principles, acceptable use position or governance section. No framework such as NIST or ISO 42001, no accountable owner, no testing regime and no evaluation result beyond the headline accuracy figures is published, and bias is not addressed.

The site documents security and privacy carefully but not model governance. That matters because extractions feed the obligation and renewal tracking the platform is bought for, so uneven model behavior across contract types or languages would flow silently into the record.

Most of the ground is covered, with subprocessors and incident practice missing. Deletion and archiving follow the customer's own policies, supported by application and service controls, and only users with the right role can restore data. Access control is strongest: role and feature based permissions set by the customer, a designated System Owner, email validation of every user, configurable password policy, and SAML 2.0 single sign on with Azure Active Directory, ADFS, DUO, Okta and Ping.

Staff undergo background screening and regular privacy, security and regulatory training, including HIPAA. Hosting on Microsoft Azure has its own page. What is missing: no subprocessor list (the privacy policy mentions service providers that may be outside the United States without naming any), no breach notice practice, and no retention period for prompts or extraction outputs.

No published position on liability for AI output is published, because the customer agreement is not published. The footer terms govern website use, and their entire agreement clause carves out any separately executed customer agreement. So a customer agreement exists, and a buyer cannot read its risk allocation before a sales process. No warranty on extraction output, liability cap, indemnity, service level, uptime commitment or insurance position is published, though the vendor's own 95 percent accuracy figure admits a material error rate.

Nothing says who bears the loss when a wrong renewal date or liability cap flows into obligation tracking. The website terms set Massachusetts law, non exclusive.

Integrations meet the work where it happens. Review delivers its redlines inside Microsoft Word or Google Docs, so negotiators stay in the drafting tool. Single sign on runs over SAML 2.0 with Azure Active Directory, ADFS, DUO, Okta and Ping. An Integrations page exists, and Azure hosting has its own page. What is missing is depth: what each connection moves, in which direction, and what setup it needs. No practice, document or matter management, e-signature, ERP or procurement system is named on the pages read, which matters because procurement and finance are buyer groups. The Integrations page was not opened.

Microsoft Azure is the named host, with a dedicated page, and the security page describes Azure supported controls. That says whose data centers are used, not where a customer's contracts sit. No data center location, country, region or regional choice is stated. The privacy policy says service providers may be outside the United States, without naming them or the countries. Nothing states whether a customer's repository is shared or isolated, no single tenant, private cloud or on premises option is offered or refused, and nothing says where the extraction models run. A buyer with data location rules should ask where its contracts are stored and processed.

No independent security attestation is published. No SOC 1, SOC 2, ISO 27001 or similar certification, penetration test summary, third party assessment or trust center was found. The security page describes the vendor's own controls, from permissions and single sign on to staff screening, HIPAA training, customer set deletion and Azure hosting, but these are the vendor's statements, not a third party's check. The privacy policy claims certification under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. framework, with BBB National Programs for recourse.

That framework is self certification, not an audit, and the participant record could not be confirmed, so it is noted and not relied on.

Nothing published describes the model supply chain. The product pages detail what the AI does, from 92 extraction fields to reprocessing and accuracy, and say nothing about what performs it: no model, version, provider, or split between own and third party models, and nothing on whether Review and extraction share models. Microsoft Azure is named as host and Azure Active Directory for sign on, which is infrastructure rather than a model disclosure, and does not say whether Azure OpenAI, another API or an in house model reads contracts. Nothing covers what a provider may keep of a document sent for extraction, and no change notice is promised.

No pricing is published at any level, including the unit of charge. There is no pricing page; the site offers a demo request. No rate, per seat figure, minimum, term or implementation charge appears, and the website terms do not cover subscriptions, which sit in the unpublished customer agreement. A buyer cannot tell whether pricing is per user, per contract, by tier or by volume. Third party listings describe pricing by user count, contract volume and feature tier, with Submitter, Read Only and Full User levels and separate implementation fees; these are not the vendor's own and are not relied on. One listing gives the starting price as contact vendor.

Segments are described in detail, with the boundaries left open. A Legal Department page names General Counsel, Paralegal and Compliance Officer, each with its own page, alongside a Corporate Counsel's Guide to contract lifecycle management. Solution pages also cover industries (including healthcare, manufacturing, pharmaceutical and energy), departments, roles, processes and company sizes. More than 60,000 professionals across hundreds of brands use it.

What is missing: no contract types are named as handled well or poorly, the 92 standard fields are counted but not listed, no languages are stated, and no company size range is given. Legal is one of four buyer groups, with procurement, finance and sales.