D

Docsum

The models do the core work on top of a repository that would still run without them. Docsum's base is a system of record that syncs signed agreements from the customer's tools. On it, AI extracts terms and obligations, reviews and redlines drafts against playbooks generated from the customer's precedent, answers questions across the repository, and runs intake agents for review, drafting and legal questions. Without the models, the sync, storage, views and alerts remain, but most of what the product is sold on does not.

Answers are grounded in the customer's own contracts, with citations, and accuracy is not measured. Docsum says answers are cited and drawn from across the repository, reviews compare positions against the customer's precedent, playbooks are generated from its templates, and users can flag and correct extracted values in place. No accuracy or error rate is published for extraction, issue detection or redlines, and the terms disclaim any warranty of accuracy.

Docsum commits in writing that legal stays in control, with real review points, short of a full structure. It describes agents that the business can reach but legal controls, approvals that can be set for any condition, and review and drafting outputs that can be held for legal review before they go anywhere; in Word, the reviewer proposes and applies redlines. The terms put all decisions on the customer. Not published: which outputs are held by default, what the email negotiation agent may send on its own, or what happens when an agent is unsure.

Results are quoted without a basis, and no customer is named. Docsum's site says review is 10 times faster and reports average outside counsel savings from users, with no figures a reader can check and no method. A product advisory council of named in house lawyers is published, but its members are presented as advisors, not customers, and no customer story or named deployment is published.

Docsum publishes real commitments on confidentiality and training, and addresses privilege only to say where it ends. The Terms say uploaded contracts and legal documents will not be used to improve the service, limit Docsum's use of customer content to providing the service, restrict access to people with a need, and commit to reasonable safeguards. The security page says Docsum holds contracts with model providers such as OpenAI and Anthropic under which customer data is not logged, stored or used to improve models, and that customers can delete data at any time.

Two limits apply. Where a customer buys the review service done by Docsum staff, those staff read its contracts, and the terms say those exchanges are not privileged. And nothing documents separation between users or matters inside an account beyond access rights.

Docsum states clearly what the product is and is not. The Terms say Docsum is not a law firm, gives no legal advice and creates no attorney client relationship, and that staff providing human assisted review act as contract analysts, not counsel; customers are told to consult a qualified attorney before critical decisions. The product is built for in house legal teams and lets business users reach it through agents that legal controls, and the security page claims alignment with the California Bar's AI guidance on oversight, competence, confidentiality and disclosure. The California Bar claim is not tied to any feature, and no jurisdiction limits are stated.

Docsum claims responsible AI without a mechanism anyone could audit. The security page promises responsible AI practices and carries a California Bar guidance badge, and the model provider contracts on training and retention are a real control. Nothing names who is accountable for the AI's output, what is tested before a release, or how extraction and review quality are measured across contract types.

Most of the ground is covered, short of a published subprocessor list and an incident commitment. Customers decide what to upload, set retention policies and can delete data at any time, with deletion described as permanent. The terms limit access to people with a need and commit to reasonable safeguards, enterprise plans add SAML single sign on, and Docsum's trust center lists controls including a data retention policy, access reviews and disaster recovery.

The subprocessor list and security documents sit behind an access request, and no incident notice commitment is published.

Liability is addressed only through standard limits that leave the product's risk with the customer. The Terms exclude indirect and consequential damages, cap Docsum's liability at the amount paid for the products ordered, and cap claims about its human assisted review work at the lesser of 12 months of fees for that service or $10,000. The customer indemnifies Docsum for claims arising from reliance on AI output or on the human assisted work product, and no indemnity runs the other way.

Real integrations are named with some depth, short of documentation an implementer could configure from. The Word add in installs from Microsoft AppSource; intake requests come in from Salesforce, Slack and email; signed agreements sync from DocuSign, Google Drive and Gmail, with other contract systems and CRMs on enterprise plans through an API; templates go out for signature through DocuSign; and an MCP server released in July 2026 exposes saved views, filters and extracted fields to assistants such as Claude for search and field queries. No API reference is published, and nothing says what each sync reads and writes.

Cloud delivery is implied, and nothing is stated about where it runs. Docsum's site says its infrastructure is designed to support GDPR, CCPA and HIPAA requirements, but names no hosting provider, region or tenancy model. An FAQ item on the site asks where data is hosted.

Docsum's certification is real, with the auditor named and the report available on request. It states SOC 2 Type II, attested by Prescient Security for security, availability and confidentiality controls through the Oneleet platform, and a Google CASA assessment against the OWASP application security standard. Its trust center lists controls and offers the report and other documents on request.

Model providers are named, without a full list or notice of change. The security page names OpenAI and Anthropic as examples of the foundation model providers Docsum uses, under contracts that bar logging, storing or training on customer data. It does not say which models, whether others are used, where inference runs, or that customers will be told when providers change.

Real pricing is published for the entry tier, and the larger tiers are withheld. The Core plan starts at $1,250 a month for up to 2,500 contracts, with 20 percent off for yearly billing; AI contract review is an add on at $150 or $250 per user a month depending on tier; and contract sync from DocuSign and Google Drive is $250 a month. Advanced and Enterprise plans are custom priced. A free trial is offered, described on different pages as 14 or 30 days.

Who it serves is described with substance, short of stated limits. The product is built for in house legal teams, with finance, procurement and sales as users through intake, and handles agreements such as NDAs, master services agreements, data processing addenda, statements of work, security questionnaires, business associate agreements, privacy policies and terms of service, with contract volumes set by tier. It does not say which languages, jurisdictions or contract types it handles poorly, or whether law firms are supported.