D

Definely

The models drive a core capability layered on a product that works without them, and that is the vendor's own positioning. Definely was founded in 2017 and shipped its first product in September 2020, before modern generative AI, and it says being built natively in Word before that wave is a structural advantage. Read, Proof and the navigation and proofreading layer parse document structure, definitions and cross references deterministically and would work unchanged with no model behind them.

Vault is clause level indexing with semantic search. Enhance and Cascade are the generative and agentic layer. The vendor describes its approach as AI layered on tools that help lawyers complete concrete tasks, combining rules based logic, machine learning and RAG based generative AI. It says its advantage is not more AI but where and how AI is applied. Its Claude connector is described as rules based and deterministic, returning identical results on identical input.

Grounding is real and documented with the method described, short of published accuracy figures. The retrieval architecture is stated: clause level document indexing and chunking, RAG based models, an agentic architecture using multiple agents, and analysis scoped to the active contract and related documents rather than portfolio wide. Output grounds to the document a reader already has open, with definitions and cross references surfaced as links in the provision being read, which is verification by construction.

The Claude connector is documented as deterministic and reproducible, and as returning exactly what the tools return rather than improvising, which is a real published claim about grounding behavior. An AI architecture diagram and an AI security whitepaper are published through the trust center behind a request. Not located: any accuracy figure, hallucination rate, test set or evaluation. The published performance claim is a speed figure, 40 to 70 percent faster contract review.

A real written commitment that the models work alongside a supervising lawyer, with review surfaces, short of the full control structure. The vendor states its principle directly: AI is layered on top of tools that help lawyers complete concrete tasks rather than replacing legal judgment, and its stated automation target is roughly 80 percent of manual review work so the lawyer's expertise goes to the critical 20 percent.

Human oversight is inside the scope of its ISO 42001 certification, which is externally audited rather than asserted. The Word delivery model means suggestions arrive in a document the lawyer accepts or rejects. Not located: the threshold at which an agent stops, what Enhance or Cascade decide unaided, and what the vendor commits to when an output is wrong.

Real deployment evidence with substance, short of attributed figures. Named customers are published in two places: the trust center names organizations that have completed security review including Allen and Overy, Slaughter and May, Dentons, Shoosmiths, Shepherd and Wedderburn, Deloitte, Liberty Global, Diageo, Asian Development Bank and Barclays, and vendor material names JP Morgan, BT Group, P and O Cruises, Ericsson, KPMG, Samsung and IKEA.

Scale is stated at more than 150 enterprise customers and more than 40,000 active users across 30 plus countries, with 30 percent of revenue from the US. A customer stories section is published. Not located: a dated case study tying figures to a named customer with a method a reader can assess. The 40 to 70 percent speed figure is a product claim rather than a customer result.

Confidentiality rests on a substantial control framework, while a commitment on training is not published. The trust center publishes a data processing agreement, an access control policy, a data erasure entry, data protection and audit logging under product security, multi factor authentication, data subject request handling and a named data privacy officer. Local architecture diagrams for Read, Proof and Vault are available on request, which speaks to how much processing stays on the user's machine.

A search of the site, the trust center index, the privacy policy and the terms of use, plus a targeted search for a training commitment, located no statement of whether customer content may train models. Nothing states what the model providers may retain, attorney client privilege and work product are not treated, and no segregation between users or matters is published. For a vendor whose customers are Magic Circle firms handling counterparty documents, the training question is the one a buyer asks first, and the answer sits behind the trust center gate.

The audience is clear and narrow: large law firms, including Magic Circle and Am Law firms, and corporate legal departments, with no consumer or non lawyer surface anywhere on the site. The vendor states its AI does not replace legal judgment. Searched the site, the published terms of use, the privacy policy and the trust center on 29 Aug 2026. No position on the advice line, no treatment of competence or supervision duties, and no statement of jurisdiction limits is published, although the vendor operates in more than 30 countries. The position can be inferred from the product's shape but is not published.

Definely holds ISO/IEC 42001:2023 certification for AI management systems, audited by a named accredited certification body, Prescient Security. The trust center publishes what the certification covers rather than only the badge. It covers the full AI lifecycle from design through deployment, monitoring and improvement, and a formal AI System Register in which each AI system in scope carries impact assessments, defined ownership and continuous monitoring of performance and risk.

It also covers data protection, fairness, transparency, human oversight and risk assessment, internal AI adoption under the same controls as the AI in the products, and ongoing management reviews, internal audits and risk processes rather than a one time check. Defined ownership for each AI system supplies the named owner. The vendor also announced its intent to pursue the certification before achieving it, naming its assessor and monitoring tooling, so the claim was checkable in advance.

Not located: published testing results, or any disclosure of measured output differences across matter types, parties or populations, although fairness is inside the audited scope.

Substantive published policy covering most of the ground, through a complete trust center. Its named entries include access monitoring, data backups, data erasure, access log management, data access controls, logging, audit logging, multi factor authentication, firewall and web application firewall, and a separate production environment. It also lists a documented incident reporting process, business continuity and disaster recovery plans with a recovery time objective of 24 to 48 hours, supply chain risk management, vulnerability and patch management, responsible disclosure, and a software development lifecycle policy.

A 2026 independent penetration test is summarized publicly with its findings. Not located: a stated retention period for customer documents, a named subprocessor list, and a statement of what the model providers retain. Deletion is addressed as a data erasure entry without a published period.

Liability is addressed only through published terms with a standard structure. Terms of use and a privacy policy are published openly, and a data processing agreement is available through the trust center, so a buyer can read the framework before entering a sales process. No indemnity running to the customer for third party claims arising from output is published, and no warranty on output, stated liability cap figure or insurance position.

Real integrations exist and are documented, short of implementer level depth. The product is a native Microsoft Word add in rather than a connector alongside Word, which is the deepest possible placement for transactional drafting, and the vendor treats that as its structural differentiator. Document management integration is named specifically to iManage and NetDocuments, with Vault indexing a connected repository at clause and definition level and surfacing whether a clause is frequently used or marked gold standard.

An official Model Context Protocol connector is published in the Anthropic Claude marketplace with its seven exposed tools enumerated, its authentication route described, and an enterprise deployment path for IT teams, which is a documented integration into a second environment. An installation guide and network diagram are published through the trust center. Not located: documentation of what each document management integration moves, in which direction, and what an administrator must configure.

Cloud delivery is implied, and neither the region nor the tenancy model is stated. The trust center names Amazon Web Services as the infrastructure provider and lists a separate production environment. Local architecture diagrams for Read, Proof and Vault are available on request, which implies meaningful local processing but does not state a residency position. Searched the site, the trust center index and the published policies on 29 Aug 2026 and located no available regions, customer selectable residency, tenancy model, or statement of where processing happens as distinct from where data is stored.

For a UK vendor serving Magic Circle firms across more than 30 countries, a published residency option would be expected.

The certification disclosure is named, dated and attributed. ISO/IEC 27001:2022 was recertified in February 2026 by the British Assessment Bureau, now Amtivo, a UKAS accredited body, with the audit dated 4 February 2026 and zero major and zero minor nonconformities. SOC 2 Type 2 was recertified on 28 October 2025 under AICPA SSAE 18 standards, with Prescient Security named as auditor. ISO/IEC 42001:2023 is certified by Prescient Security, alongside Cyber Essentials and a GDPR program.

A 2026 independent penetration test is summarized: it covered web applications, APIs, client side integrations and external network infrastructure, was benchmarked against the OWASP Top Ten, and found low overall risk with no critical, high or medium severity findings. The summary compares this with the prior year's results, which did include medium severity findings. A SafeBase trust center holds the SOC 2 report, penetration test report, architecture diagrams, privacy and security whitepaper and policy set behind a self serve access request rather than a sales gate.

The vendor refers to its architecture without identifying what sits underneath. Published: an agentic architecture using multiple AI agents, RAG based models, clause level indexing, AWS as infrastructure, supply chain risk management as a trust center entry, and an AI architecture diagram and AI security whitepaper available on request. An Anthropic relationship is documented, but it is a distribution partnership placing a Definely connector inside Claude.

It is not a statement that Anthropic models power Definely's own products, and the two should not be conflated. No named model provider for the product itself, statement of where models run, subprocessor list or commitment to notify customers of supply chain changes is published.

No pricing page exists on the property, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path terminates in a demo booking. No free trial or self serve entry point is published, and no third party pricing figure is published either. Note that the vendor publishes a buyer's guide comparing drafting software that discusses competitors' pricing models in general terms without stating its own.

Who the product is for is documented precisely, and the vendor also publishes who it is not for. The ideal customer profile names large law firms including Magic Circle, Am Law 100 and Am Law 200 firms, and corporate legal departments at major enterprises. It also names lawyers on complex, high risk transactional work in M and A, banking, insurance and complex commercial agreements. Use cases are listed at task level, from analysis of multi document contract suites through issues list extraction.

The vendor's own guidance sets the boundary. It says Definely should not be described as a general purpose legal AI platform or a CLM system, and that it is optimized for complex, high risk contracts rather than high volume, low complexity documents. Its focus is the active contract and related documents rather than analysis across a portfolio.