F

Flank

Agents do the work end to end. A request arrives by email or chat, an agent identifies the task, runs it against the team's playbook, and either sends the result back or holds it for review. Flank Record agents file each executed contract at signature, extract its key terms and keep the estate current under a human supervisor.

In negotiation, agents handle objections on the customer's own paper in three modes. They can reject a counterparty change with a comment, layer a new tracked change over it so the trail stays visible, or leave it and attach reasoning. Counter redlines with fallback language work beside any of the three.

Once a deployment is running, designated users create new agents and assign task types in the governance platform in minutes. The model is an agentic service: a forward deployed team turns the lawyers' unwritten rules into playbooks the agents follow, and no separate workflow tool or CLM interface is sold.

Agents work from the customer's templates, playbooks and approved sources rather than from primary law. Research and Q&A answers draw on those approved sources. Review lists the checks it held with clause references, such as a liability cap at clause 11.2 or a silent rollover at 3.1, so the reviewer resolves flags instead of rereading the document. In drafting, anything the agent cannot resolve is highlighted rather than guessed.

Each agent is trained by the customer's own team, and every interaction can be tracked for accuracy. No measured error rate for drafts or redlines is given.

The legal team decides which work agents take and how much runs unattended. Supervision thresholds are set by topic, uncertainty or counterparty ask, beside escalation rules and risk tolerances, and complex or high risk requests are escalated. Supervised output lands in a queue with the original request, the agent's reasoning and the draft, and the reviewer chooses approve and send, edit, or mark as resolved.

Every workflow launches fully supervised, and supervision is dialed back workflow by workflow as results build. The reviewer can be the team's own lawyers, a partner firm or Flank's commercial counsel. Every decision, edit and negotiation point is logged, each correction trains the agent for next time, and the customer's team keeps final authority over outcomes.

Simmons & Simmons partner Lucy Shurwood says the firm's agents handle drafting, review and negotiation of NDAs, DPAs, service agreements and IMAs, and are live for its teams and its clients. A second customer quote, signed Andy Perk, says NDAs and vendor agreements now move with a speed the team did not expect.

Drafting agents have run in production at a global hospitality group since 2025, a second global hotel group runs its franchise packs on them, and a major international law firm runs four drafting workflows. A supervised request takes five minutes of a lawyer's time instead of sixty, by Flank's figure. None of these figures is tied to a named customer.

Customer data stays in a dedicated regional tenant on Google Cloud or Azure, never trains any model, and sits under zero data retention at the model providers. The data processing addendum of March 2026 names OpenAI, Anthropic, Google Cloud and Azure OpenAI as processors of model calls, with executed standard contractual clauses for three of them. It provides for deletion on termination and on the customer's instruction.

Privilege and work product are not addressed, for a product that drafts and negotiates on the customer's behalf and that law firms run for their clients.

Agents answer legal and policy questions from HR, procurement and other business teams directly, in email and chat, and Simmons & Simmons runs the agents for its clients. Flank's FAQ leaves final authority with the customer's team, with Flank supplying supervision controls, auditability and policy enforcement. No terms of service are published, and nothing tells a business user that an agent's answer is not legal advice. Jurisdiction limits are not stated.

ISO 42001 certification, number AIMS-LE-103025, covers an AI management system that the trust center describes as governing legal, safety and fairness considerations in building and running the AI features. An LLM FAQ on data handling, prompt injection controls, training assurances and ethical use is released on request.

Agent configurations live in a governance platform where designated users create agents, assign task types and manage settings, and every agent action is logged. The company has also formed an advisory board, The Orchestration Layer. No accountable owner or test results for agent output are named.

The data processing addendum commits to secure deletion after termination unless a retention duty applies, to correction or deletion on instruction, and to written notice within 24 hours of a personal data breach. Clause 9.3 names six subprocessors with locations, and a new or replaced subprocessor comes with written notice and two weeks to object.

Access is role based, with single sign on and audit logs. Trust center controls, monitored through Secureframe, include restricted access to customer data, user access reviews, a tested incident response plan and a data retention and disposal policy. The product privacy policy, effective 17 March 2026, keeps data only as long as its purposes require, though its update notice says the revision added specific retention periods.

No customer agreement is published. The site's legal set is the data processing addendum, an Impressum and three privacy notices, and the addendum carries no indemnity, liability cap or warranty on output, its terms running to data protection alone.

Agents send finished NDAs and negotiated positions to counterparties within the customer's thresholds. Nothing states whether Flank stands behind an agent acting inside them.

Agents work in the channels the business already uses: an Outlook inbox, Teams, Slack, forms, an intranet portal or the agent's own URL. CLMs, Jira and Salesforce are named among the tools agents work beside, without custom integration projects. In email, the agent reads the request, does the work and replies in the same thread with the draft attached. Flank Record answers questions in Teams, Slack or email, filtered to what the asker's role can see, and admins can browse the record in its own app.

A forward deployed engineer handles complex integrations. No developer documentation sets out what moves between Flank and a CLM or Salesforce.

Each customer gets a dedicated tenant in its chosen region on Google Cloud or Azure. Clause 8.1 of the data processing addendum bars Flank and its subprocessors from processing personal data outside the EEA and UK without the customer's prior written consent.

Hosting and model processing are listed separately in the addendum's subprocessor clause. Google Cloud is EU for hosting and global for model calls, and MongoDB and Mailgun run in the EU. Azure OpenAI runs in eight regions across Europe, North America and Japan, including Amsterdam, Sweden Central, Switzerland North and UK South. OpenAI and Anthropic process in the United States under executed standard contractual clauses.

SOC 2 Type II, ISO 42001, GDPR, CCPA and PDPL badges sit on the home page. The trust center at trust.flank.ai, run on Secureframe, releases the SOC 2 Type 2 report, the ISO 42001 certificate AIMS-LE-103025, the LLM FAQ and a penetration test remediation report through request buttons. It shows live controls across change management, availability, access, incident response, vendor risk and network security. No audit period or auditor appears on the open page.

Clause 9.3 of the data processing addendum names OpenAI and Anthropic as model providers in the United States, Google Cloud Platform as global for model calls and Azure OpenAI across eight regions. The trust center marks Google Cloud, Anthropic and OpenAI as model providers. A new or replaced subprocessor comes with written notice and a two week objection window, and clause 12.4 lets Flank update the list by publication where the law or a listed reason requires. Which model handles which task is not stated.

Pricing follows outcomes rather than seats, and the customer starts paying when the agents start delivering. Implementation is scoped in forward deployed engineering days per use case and fixed in a signed Agent Design Document before work begins, so the services bill is set in advance.

A deployment runs two weeks of discovery and design and two weeks of playbook engineering, then goes live in week five on one document type in one region, fully supervised. Flank Record needs roughly three months of upfront ingestion of the back catalog, and new customers join a waitlist. No figure is published, and the route in is a demo.

The buyer is the enterprise in house legal team, with a law firm offering that runs a firm's non billable drafting from its own precedents and packages the same agents as a client service. Seven task types are offered: triage and routing, third party review with redlines, drafting from templates, objection handling on the customer's own paper, research and Q&A from approved sources, custom prompts and bespoke workflows.

Templates named include NDAs, MSAs, DPAs, statements of work, term sheets and franchise agreements, and the deepest drafting deployment runs franchise packs for global hotel groups. A first deployment covers one document type in one region. No contract type, jurisdiction or company size is named as out of scope.