C

CORTO

Everything in the product starts from a model reading a firm's matter files. Once a storage account is connected, every matter folder becomes a chat space, and CORTO Chat answers questions about the whole matter, one document or a chosen folder. AI fills in the matter details panel from the documents and keeps it current, builds the firm's contact list from the names it finds, and drafts Fact Pages that tie supporting facts to each legal issue.

The Prompt Library turns a structured prompt and a template into a letter, brief or contract populated from matter details, and the AI Form Filler completes fillable PDF and Word forms from the same files. Matters, contacts and facts are all generated from the documents, so without the models the product would be a list of folders. Legal research sits outside, in LawY, which launches from a button in each matter.

Each chat answer carries references to the documents it relied on, and each reference opens the source file, so a lawyer can check a statement against the record it came from. A document status view shows which files in a matter the AI can read, which are still loading, which failed and which the user excluded, and a failed file can be reloaded before a critical query.

Answers draw on the firm's own documents rather than on primary law. Case law and legislation research runs through LawY, a separate service that offers verification by a practicing lawyer in listed jurisdictions. CORTO describes regular internal audits of output quality, monitoring for drift and human review for high risk uses. No accuracy figure, test set or error rate is published, and AI populated matter details carry a label saying they are generated and not final.

Most AI output lands in an editable surface before anyone relies on it. Users are told to review and verify every Prompt Library draft for legal accuracy, and AI populated matter details are marked as generated and not final. Automatic updates to matter details and to contacts can each be switched off, edits are kept in a change log, and an earlier version can be restored.

Canvas Control lets a lawyer regenerate, redirect or delete one section of a response without rerunning the whole draft. The Form Filler leaves blank any field the matter documents cannot answer, for the user to complete by hand, and a queued form can be cancelled or retried. No threshold at which the system stops is set, and nothing describes what follows when an automatic update writes a wrong fact into a matter beyond the change log and restore.

Thousands of law firms worldwide use the product, by CORTO's own description, and its home page counts questions asked, firms chatting and prompts run, with no customer named and no basis given for the figures. The quotes on its site come from CORTO's own head of product, chief technology officer and security staff rather than from customers.

The same platform runs Matter AI, a plug in that brings the AI into an outside practice management system, and Acctivity.ai for legal bookkeeping, with no usage figures for either. No case study, dated deployment, named firm or measured result is published for any of the three.

Client data is not used to train or tune AI models, and the model providers, OpenAI and Anthropic, are used under enterprise commitments that keep customer data out of their training. AI providers are isolated from CORTO's wider data environment and have no direct access to it. Each customer's data is kept apart from every other customer's, role based access and audit logging cover the platform, and matter documents are kept for 90 days.

These commitments come from CORTO's security material. No customer agreement or privacy policy text is published, so none of them can be read as a contract term before signing. Privilege and work product are not addressed by name, and nothing describes walls between matters inside a firm. Feedback that users give on responses, which can include sensitive information, is used to improve the service.

Law firms, corporate legal departments, barristers and legal service providers are the stated buyers, and the product is pitched as a way for legal professionals to work faster. Users are told to review and verify each draft for legal accuracy before using it and to check AI populated matter details, and human review for high risk uses is listed among the safeguards.

No statement says that CORTO gives no legal advice or that the lawyer stays responsible for the work, and no terms of use are published. Through the LawY connection, a practicing lawyer can verify an answer in Australia, the United Kingdom, Ireland, New Zealand, the United States and four Canadian provinces. In New Zealand and the United States that verification covers only named areas of law.

Four principles guide the product: responsibility, precision, reliability and partnership. New models are adopted after internal testing that includes evaluation by CORTO's in house legal team and by software built for model assessment, some of it from third parties. CORTO also runs internal audits of AI output quality and monitors for drift.

No AI policy, governance framework or accountable owner is published, and neither the test method nor its results appear. Nothing addresses whether output quality varies across matter types, jurisdictions or the two model providers a user can choose between.

Retention periods are set out under CORTO's data classification, handling and retention policy: most user data is kept for seven years and matter documents uploaded to the platform for 90 days. Users can ask by email for their data to be deleted from the platform and the backend, with a separate address for Matter AI users. CORTO anonymizes data where it can.

Data is encrypted with TLS in transit and AES 256 at rest, staff with access to critical infrastructure pass police background checks and monthly security training, and the environment is monitored around the clock. An incident response plan covers containment, investigation and notice to affected users as the law requires, with no fixed notice period. AWS, OpenAI and Anthropic are named as providers, but no full subprocessor list is published.

No customer agreement is published, so no liability cap, indemnity, warranty on output or insurance position is available before signing. The terms of service link in the site footer leads to an empty page, and the Word add in asks each first time user to accept terms and conditions that are not published anywhere public. Nothing states who bears the loss when a draft, a filled form or an AI populated matter detail is wrong.

A storage connection comes first: matters and chat stay locked until one is linked. OneDrive (with a Microsoft business account), Dropbox and Google Drive connect from the startup screen, and CORTO's matter list mirrors the folder structure in that storage, so a firm's existing folders become its matters. Admins choose which folders to import, change the selection later and disconnect a service from account settings.

The CORTO for Microsoft Word add in, installed from Microsoft AppSource, brings chat and the Prompt Library into Word on Windows, Mac and the web, though not on phones or tablets. LawY opens from the matter toolbar in a new tab. No document management system such as iManage or NetDocuments and no practice management or billing system connects, and nothing says whether drafts save back into the firm's storage.

The service runs on AWS, across several data centers in the Oregon region, with continuous monitoring and a 24 hour recovery objective. AI processing uses third party services in the same region, and CORTO says plainly that data from Australian firms leaves Australia for both storage and processing.

Each customer's data is kept apart from every other customer's within that infrastructure. No second region, private cloud, on premises option or residency tier is offered. Transfers from the European Union and the United Kingdom rely on CORTO's certification under the EU and UK Data Privacy Framework with the United States.

A SOC 2 Type II report covers CORTO, Matter AI and Acctivity.ai, and a SOC 3 summary is offered for sharing without an NDA. CASA Tier 3 validation from the App Defense Alliance sits beside them, along with certification under the Data Privacy Framework for transfers from the European Union and the United Kingdom.

Reports and control detail sit in a trust center at trust.docorto.ai. The auditor, the report period and whether the SOC 2 report is open, self serve or sales gated are not stated outside it. External testers run a penetration test every year, and code passes scanning, peer review and internal testing before release, with web application firewalls filtering automated traffic between releases.

Generative features run on enterprise models from OpenAI and Anthropic and their successors, called through APIs routed via major cloud providers in the same Oregon region as the platform. CORTO trains no models of its own. A model selector in CORTO and Matter AI lets the user choose which model handles a prompt, and newly released models join after internal testing by CORTO's legal team.

The specific model versions in use are not named, and no notice is promised when a provider or model changes. Some AI features depend on these outside services, and CORTO says those features may slow or pause during a provider outage while the core platform keeps running.

No price, plan name or unit of charge is published. Firms book a consultation or sign up online, and the Word add in listing on Microsoft AppSource offers a 14 day free trial of the subscription it requires. Payment runs by card through a Stripe billing page where an admin upgrades or cancels the subscription, manages staff licenses and downloads invoices. What a seat costs, what the tiers include and whether setup carries a fee are not stated.

Buyers named are law firms, corporate legal departments, barristers and legal service providers, served from Sydney and San Francisco for firms in Australia and abroad. The Prompt Library filters templates by state and by matter type, and CORTO notes that some matter types have only a few prompts while its legal content team keeps adding more.

Limits are stated for individual features. The Form Filler handles only forms with active fields, and in Word only legacy form fields, so scanned forms and forms with blank lines for answers are out. The Word add in does not run on iOS or Android. Which states and practice areas the Prompt Library covers in depth is not listed, and LawY's verification reaches only named countries and, in New Zealand and the United States, named areas of law.