C

Contractzy

CORA AI powers contract risk analysis, summarization, metadata extraction, and obligation management inside a broader contract lifecycle platform. Review starts with company guidebooks, while extraction turns scanned PDFs, images, and Word files into searchable information. Obligation management creates owners, milestones, deadlines, and renewal alerts from agreements. Templates, clause libraries, approvals, signatures, version history, and the repository remain useful without model inference.

Essentials and Professional also separate conventional contracting functions from the fuller AI package in Enterprise. The models therefore run substantial review and analysis functions, while established workflow and storage features remain a separate part of the product.

Risk analysis highlights ambiguous clauses and departures from company guidebooks, then lets reviewers inspect changes through tracked redlines. CORA AI also extracts parties, dates, monetary terms, and obligations from uploaded agreements. Accuracy claims include 98% for risk detection, 95% or more for metadata extraction, and up to 99% in the pricing FAQ, without a defined evaluation set or error breakdown. The contract text supplies context, but a retrieval method with linked primary legal authority and citation treatment is unspecified.

Severity labels describe contractual risk rather than confidence in an answer. Critical decisions still call for human review under the pricing guidance.

Reviewers upload a Word or PDF guidebook or generate one with AI, scan an agreement, and inspect highlighted risks and tracked revisions. Editable guidebooks encode company requirements, and alerts identify departures or high risk clauses. Contracts failing mandatory criteria are prevented from advancing until compliance is ensured. Legal teams retain control over precise edits, with approval routing and version history supporting review before execution.

The pricing guidance recommends human review for critical decisions. The remaining uncertainty is the control path after an incorrect classification: the criteria configuration, override permissions, and escalation route for an AI error are not specified.

Legal leaders at Bajaj Markets, Bridgestone, and Easebuzz describe actual use of the platform. Manish Jain emphasizes responsive support; Reni Verghese describes managing contracts against timelines; Nitin Bhuwania describes reducing administrative effort and retrieving executed agreements after digitization. These accounts identify customers and concrete activities, although they do not supply dated before and after measurements.

Separate CORA AI claims include an internal study of faster summarization and improved extraction, without a disclosed sample or method. Implementation generally takes two weeks to one month depending on integrations, customization, and migration. That estimate describes rollout effort rather than a measured customer outcome.

The agreement limits personal data use to delivering, maintaining, securing, and improving the contracted services under customer instructions. It covers contract files, attachments, metadata, communications, approval records, and access logs, and rules out selling customer data or unrelated advertising uses. Subprocessors must accept protections at least as strong as the agreement. Role permissions restrict visibility to authorized departments and users, while production access follows least privilege.

The improvement permission contains no explicit model training exclusion. Privilege preservation, work product treatment, matter isolation during retrieval, and foundation model retention commitments remain unspecified, so these provisions do not settle every confidentiality question for a law firm.

Legal departments use CORA AI to identify contractual risks, make edits, and manage approvals, while procurement, sales, finance, and HR users share the broader workflow. Human decision authority is explicit in the product positioning, and critical decisions are subject to a recommendation for human review. The CORA AI introduction also directs customers to consult their legal departments about regulatory implementation.

Those operating instructions do not establish an advice versus software boundary, permitted legal jurisdictions, or a position on unauthorized practice. The software terms disclaim warranties generally without a specific legal advice disclosure. Nonlawyer participation is supported without a corresponding professional responsibility framework.

The CORA AI introduction describes pretrained language models refined through legal expert feedback, regular updates, and testing across legal scenarios. That establishes a quality aspiration but leaves release criteria, review ownership, evaluation sets, and results across contract types or jurisdictions unspecified. The model training description refers broadly to contracts, legal materials, and precedents rather than a traceable evaluation program.

Prajot Borkar is the named data protection officer, responsible for privacy compliance; that role does not establish accountability for model behavior. Company guidebooks let customers impose their own contract policies, but they are distinct from governance of the vendor's models and training process.

The May 2026 agreement identifies eight subprocessors and their functions, including AWS for hosting, Bedrock inference, and Textract processing. Controls include encryption, least privilege access, internal multifactor authentication, audit logs, restricted production access, monitoring, and backups. Incident procedures cover identification, investigation, management, and response. Customer notification follows a confirmed personal data breach without undue delay where legally required, rather than an unconditional fixed deadline.

Data remains as long as needed for service, legal, dispute, or security purposes. Return or deletion follows a written request at termination within a commercially reasonable timeframe, with unspecified backup schedules and legal exceptions.

The software terms cap the operator's and suppliers' liability at the amount the client actually paid. Service comes as is and as available, with broad exclusions for warranties, fitness, noninfringement, accuracy of performance, and correction of errors. The agreement does not attach an indemnity, insurance commitment, or enforceable accuracy warranty to CORA AI output. It also excludes responsibility for incomplete or corrupt backups and places independent backup responsibility on the client.

India is the defined country for governing law, with informal dispute resolution first. These terms allocate general software risk without promising a remedy for an incorrect contractual recommendation.

Salesforce users can create, approve, and sign contracts within their CRM, while HubSpot data can generate agreements and feed approval and signature steps. Oracle supports contract creation and management, and Jira tickets initiate creation and approvals. Slack brings contract updates and actions into team conversations; Gmail supports workflows from the inbox. DocuSign, Adobe Sign, and UAE Pass provide signature connections, with Zoho also supporting contract generation and tracking.

Custom APIs and integrations are available. Field mappings, authentication setup, synchronization conflicts, and permission propagation are not described, so the connection list does not establish a complete implementation specification for each workflow.

AWS cloud hosting is the standard delivery route, with an additional single tenant cloud option and deployment on customer premises. Implementation scope depends on integrations, migration, and customization, and Enterprise includes custom integration and deployment options. The agreement identifies AWS operations as global, including India, Singapore, and the United States, while other processors operate in additional global locations.

Cross-border safeguards may include applicable standard contractual clauses. These locations describe the processor network rather than selectable customer residency regions. The division between contract storage, model inference, OCR processing, and backup locations is not specified for each deployment option or subscription tier.

The company identifies itself as ISO 27001:2022 certified and describes encryption, AWS hosting, role permissions, and restricted production access. Its agreement adds TLS 1.2 or later, internal multifactor authentication, continuous monitoring, security alerts, and backup and recovery measures. On a reasonable written request, the company may provide existing compliance material, certifications, or third-party audit reports instead of a disruptive audit.

A current certificate scope, validity period, and directly accessible report are not supplied with these statements. Generic security language and a badge do not establish the scope of a separate SOC 2 examination or an AI-specific assurance program.

Amazon Bedrock supplies AI and machine learning processing, and Amazon Textract handles OCR and document processing within the AWS subprocessor role. CORA AI uses an array of pretrained language models and a training process involving legal contracts, materials, precedents, and expert feedback. This identifies infrastructure and broad architecture, while leaving the foundation model families, versions, routing rules, and fine-tuning arrangements unnamed.

Subprocessors may change as technical or operational needs evolve. The agreement does not commit to advance model change notices or identify which model handles a particular risk review, summary, or obligation extraction. Provider locations likewise do not assign inference to a particular region.

Essentials supports up to three users and 50 contracts each month; Professional allows up to ten users and 200 contracts; Enterprise starts above ten users with 500 monthly contracts. Each base subscription requires a quote. The pricing matrix lists Professional AI risk analysis at $40 per user per month, with up to 100 analyses monthly, while Enterprise includes 20 free reviews. Unlimited storage and distinct signature allowances accompany the plans.

Reviewers need no additional license. Integrations, customization, migration, and deployment affect implementation scope, but their charges are not stated. The AI add-on figure therefore does not represent the total cost of running the platform.

The primary audience is corporate legal operations alongside procurement, finance, sales, HR, compliance, and operational teams. Legal workflows include drafting, negotiation, risk review, approval, execution, repository retrieval, and ongoing obligations. Sector offerings include fintech, automotive, manufacturing, healthcare, software, real estate, logistics, and other commercial industries. Templates and guidebooks adapt review to company policies, while repository filters include jurisdiction, expiry, and contract value.

Regional offerings span Europe, the Americas, Asia, and the Middle East, but a jurisdiction and language support matrix is unspecified. Litigation research, court filing, and consumer legal representation are not established parts of the contracting service.