I

Intapp

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Models do real work on top of a platform that ran for two decades without them, and the vendor's own architecture pages say so. The model half is genuine and named twice over. Intapp Assist is embedded in Intapp Time, Intapp Terms and DealCloud, providing natural language answers to conversational queries by analysing firm-specific data, generating insights and automating data entry and relationship tracking; its Ask Intapp feature runs inside Microsoft Teams and answers questions about client contractual obligations with direct links to source records. Intapp Celeste is a firm-wide AI layer with its own use-case library and architecture documentation, and its published subprocessor entry shows customers choosing between Anthropic models on Amazon Bedrock and Azure OpenAI models. The other half is not models and is the larger half: intake, conflicts, anti-money-laundering, ethical walls, timekeeping, prebilling, billing, matter-centric workspaces and relationship management are systems of record that a firm would still buy with the generative features removed, and the vendor describes its AI as built on an Intapp Data Foundation that exists to serve them. The transparency statement is candid about the mixture, describing products that operate by applying rule-based logic, statistical models and machine learning algorithms. Trust page, AI transparency statement, subprocessor list and product navigation read 7 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is real and documented, limitations are published with unusual candour, and nothing is measured. On grounding, the Ask Intapp feature is described as researching an answer exclusively by reference to the firm's own Intapp Terms data and returning it with direct links to the underlying source information, so the answer is bounded to a known corpus and traceable back to it. That is documented grounding with linked sources. On limitations the vendor goes further than most records in this corpus, publishing five explicit statements in its AI transparency statement: outputs may be inaccurate, incomplete or context dependent; performance depends on the quality and context of input data; no specific accuracy level is guaranteed unless explicitly stated; outputs are not a substitute for professional judgment or expertise; and outputs are not guaranteed to be error-free, uninterrupted, consistent, up-to-date, accurate, complete or free from bias. A separate AI Disclaimer is published in the product terms. What is absent is measurement of any kind. No accuracy figure, error rate, test set, benchmark or evaluation result is published for Assist, for Celeste or for any other AI feature, and no verification mechanism beyond the source link is described. A reader can establish what the vendor promises not to promise, and cannot establish how often the products are right. AI transparency statement, Assist and Terms product pages read 7 September 2026.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The autonomy boundary is stated and the oversight position is stated more bluntly than anywhere else in this corpus. What is published: the products are not intended to perform fully autonomous decision-making; users remain responsible for final decisions and for verifying outputs; the user or customer is ultimately responsible for the action taken or decision made; and users must not use the products for automated decision-making at all, which is listed among the prohibited uses alongside any use that would reclassify the system under the EU AI Act. Transparency at the point of use is addressed: users are informed when they are interacting with an AI system in accordance with EU AI Act transparency obligations, and are made aware that outputs are generated by artificial intelligence. The blunt part, and the reason this row is worth reading closely, is the vendor's statement that its products are operated by users without intervention by Intapp other than standard support, that Intapp therefore does not deploy human oversight in relation to a user's use of the products, and that implementing human oversight over outputs is the customer's and the user's responsibility. That is a clear allocation rather than a claim, and it tells a buyer exactly where the obligation sits. What is missing is the product half: no in-product review step, approval gate, confidence signal or escalation path is described, and no autonomy setting is configurable. AI transparency statement read in full 7 September 2026.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Institutional evidence of an unusual kind, and no measured AI outcome. The strongest element is structural rather than promotional: the vendor is a public company listed on NASDAQ as INTA, with an investor relations site and the periodic financial reporting that listing requires, which is a form of verifiable operating evidence almost no record in this corpus carries. Around it sit a named legal customer with a published case study, Fredrikson and Byron, described as choosing Intapp Terms to digitise and centralise management of its clients' outside counsel guidelines; a partner ecosystem the vendor states exceeds 100 organisations across data, technology, channel and services; a client community, a training university and a public system status site, all of which evidence an installed base that needs supporting. Dated product milestones are published, including the general availability announcement for Intapp Assist for Terms in August 2024. What is absent is outcome measurement for the AI. No deployment is quantified, no time or cost saving is measured, no adoption figure for Assist or Celeste is published, and the one percentage located, a claim that adopting Activator behaviours can increase partner revenue by up to 32 per cent, is attributed to research rather than to a customer result and concerns a behavioural programme rather than an AI feature. Recorded so the grade is read correctly: a clients page and a client stories library both exist in the navigation and neither was opened on this channel; they are the rebuttal route on this row. Trust page, product pages, investor announcement and site navigation read 7 September 2026.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Controls are stated at a high level and the question this vendor is uniquely placed to answer is not answered. What is published about the AI specifically is one paragraph: safeguards described as appropriate to a low-risk AI system, including encryption in transit and at rest, access controls and role-based permissions, data minimisation and retention limits, audit logging and monitoring, and secure development and testing practices. Around it the platform publishes a Tenant Access Policy, a client data stewardship page and matter-centric Microsoft 365 workspaces, none of which was opened on this channel and all of which are the rebuttal route on this row. What is absent is express privilege and work product treatment, which appears nowhere on any surface read, so the limb this axis exists for is untested and the top grade is unavailable. The sharper gap is specific to this vendor and worth naming plainly. Intapp sells Intapp Walls, a product whose stated purpose is to secure, control and enforce access to sensitive client information and to limit access to sensitive matters across applications, in fulfilment of a firm's ethical duty. Nothing published states whether Intapp Assist or Intapp Celeste, reading firm-specific data to answer questions, honour the walls that product enforces. A vendor that sells ethical walls and generative retrieval over the same estate is the one that could answer that question most directly, and on the surfaces read it does not. AI transparency statement, Walls and ethical walls pages, trust page and site navigation checked 7 September 2026.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Several limbs do not bite and are named rather than penalised, and what remains is generic. The products do not advise on law: they run new business intake, conflicts searching, anti-money-laundering checks, ethical walls, outside counsel guideline compliance, timekeeping, prebilling and relationship management, and the AI features answer questions about a firm's own contractual obligations and internal data rather than producing legal conclusions citing authority. So the unauthorised practice risk this axis was written for is structurally remote, the buyer is a firm's professional staff rather than the public, and no citator, no legal research output and no client-facing advice surface exists to fence. On what does bite the engagement is thin. The AI transparency statement records that outputs are not a substitute for professional judgment or expertise and that users must verify all outputs before relying on them, which is a general competence statement rather than an engagement with professional responsibility. One phrase comes closer and is recorded because it is the vendor's own framing: the ethical walls solution page describes the product as fulfilling a firm's ethical duty to its clients and profession, which acknowledges the duty while selling against it. No rule of professional conduct, bar guidance, ethics opinion or court practice direction is named anywhere. AI transparency statement, legal solution pages and site navigation read 7 September 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

The broadest published AI governance disclosure located in this pull, short of attestation and of a named owner. What exists is a dedicated, dated and versioned AI transparency statement, effective 2 August 2026, applying across all of the vendor's AI products, which is itself rare. Its content is substantive. It describes how the products work, by processing input data and applying rule-based logic, statistical models and machine learning algorithms. It engages the EU AI Act on three fronts: a self-assessed risk classification, describing safeguards appropriate to a low-risk AI system; transparency obligations, committing that users are informed when they are interacting with an AI system and that outputs are identified as AI-generated; and a prohibition on any use that would reclassify the system under the Act. It states prohibited uses including unlawful, discriminatory and harmful purposes and automated decision-making. It publishes a complaints route that expressly includes a user's local data protection authority or regulator. It commits to communicating material changes to the statement. And it acknowledges bias directly, stating that outputs are not guaranteed to be free from bias, which most records at this grade do not concede at all. Three things keep it below the top grade. Nobody is named as accountable for model behaviour. No pre-release evaluation, benchmark, red-team exercise or result is published, and the bias acknowledgement is a disclaimer rather than a measurement. And the statement says in terms that it is not a legally binding document and does not form a contract, so the governance is published as posture rather than obligation. AI transparency statement read in full 7 September 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Published policy across every limb this axis asks about, with the attestations independently audited and reachable. Certifications are named with the standards enumerated rather than gestured at: ISO 27001, ISO 27017, ISO 27018 and ISO 27701, SOC 1 and SOC 2, CSA STAR registration, and a Global Privacy Recognition for Processors certification. The auditor is named, Schellman, and the certificates are linked directly from the compliance page rather than sitting behind a request, with the CSA STAR entry pointing at the Cloud Security Alliance's own registry. A Shared Assessments SIG 2024 Lite questionnaire is published as a downloadable resource, which is the artefact a firm's procurement function actually sends. GovRAMP status is stated honestly as membership while a verified offering is pursued, rather than implied as achieved. On the data side the subprocessor disclosure is the most granular in this corpus, listing every subprocessor per product, per processing activity and per location, with routing rules stated where they differ, a subscription feed for changes and prior versions retained. Training is addressed: unless agreed otherwise with a customer, customer data uploaded into the AI products is not used to train them. Security measures are enumerated as encryption in transit and at rest, access controls and role-based permissions, data minimisation and retention limits, audit logging and monitoring, and secure development and testing. Cloud policies are published individually, covering maintenance, tenant access, sandbox and deprecated features, alongside a public status site. Two gaps are named: no incident or breach notification commitment was located on the surfaces read, and retention is described as subject to limits without any period being stated. Compliance page, subprocessor list, AI transparency statement and trust page read 7 September 2026.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Nothing establishable on this date states who bears the loss when an AI output is wrong, and the reasons divide into three which a reader should be able to tell apart. First, the customer agreement is not published. The AI transparency statement refers throughout to a Governing Agreement between the vendor and the customer entity, including any applicable orders, and no such document appears anywhere in the site's published inventory, which was read in full from the navigation and footer. So no indemnity, liability cap, warranty, service level, exclusive remedy or insurance position for the products can be read before entering a commercial conversation. Second, the one document on the site that does carry warranty and liability language is scoped to the website rather than to the products: the legal policy disclaims all representations and warranties as to the operation of this site and the information, content, materials or products included on this site, and excludes all damages of any kind arising from use of this site, which tells a buyer about the marketing estate and not about the software. Third, a document titled AI Disclaimer is published in the vendor's product terms and could not be retrieved on this channel; both the direct URL and a targeted search on distinctive clause language failed to return its body, so it is recorded as a limit of this reading rather than as an absence, and it is the primary rebuttal route on this row along with the published data processing addendum, which was not opened. What can be established points one way without settling it. The AI transparency statement says of itself that it is not a legally binding document and does not form a contract, so the most substantive AI-specific document the vendor publishes is expressly outside the bargain. Within it, the vendor states that no specific accuracy level is guaranteed unless explicitly stated, that outputs are not guaranteed to be error-free, accurate, complete or free from bias, and that the customer and user are ultimately responsible for the action taken or decision made. Site inventory, legal policy, AI transparency statement read and AI Disclaimer attempted 7 September 2026.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Integration is the product rather than an adjunct to it, and the named surfaces run deeper into the practice stack than any record in this lane. Microsoft is the spine and is named repeatedly and specifically: Ask Intapp is delivered as a Microsoft Teams application rather than only in a web console, so the AI answers arrive where the firm already works; Intapp Workspaces delivers matter-centric workspaces and content management inside Microsoft 365; a dedicated Microsoft Copilot offering applies the firm's business structure and security requirements to firm, client and engagement data in Microsoft 365 and beyond; and Microsoft Azure is the hosting layer. A dedicated integration product exists in its own right, the Intapp Integration Service, and its published subprocessor entry names Boomi as the cloud integration platform beneath it with customer data processed in the region of the customer's choice, which is an unusually concrete statement of how integration actually runs. Third-party data providers are named as subprocessors rather than described generically, including Dun and Bradstreet, S&P Global Market Intelligence, Grata and ESRI for content and mapping, and Plaid and Gresham for financial institution data feeds. A partner ecosystem is published with more than 100 organisations across data, technology and integration, channel and services partners, each with its own directory. What is not established is the depth of any single connector, because no API or developer documentation was located and the integrations page was not opened. Subprocessor list, product navigation, Copilot and collaboration pages read 7 September 2026.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Residency is published in more detail than anywhere else in this corpus and tenancy is not stated. On residency the disclosure is granular to a degree that is genuinely unusual. Hosting regions are named per product across the United States, Ireland, the Netherlands, the United Arab Emirates, Singapore, Australia and Canada, with location stated to depend on the customer's hosting location. Routing rules are published where they differ from the headline, recording that United Arab Emirates traffic for one email service is routed via the European Union and Singapore via Australia. AI processing location is stated separately and specifically: artificial intelligence features are processed in the United States or the European Union depending on the customer's hosting location, and customers located outside both are processed in the European Union. Where a subprocessor's data location is fixed regardless of the customer's region, the list says so explicitly. DealCloud is offered as four separate regional instances with distinct login endpoints for the United States, Europe, the United Arab Emirates and Asia-Pacific. The integration layer states that customer data is processed in the geographic region of the customer's choice. What is absent is the other co-equal limb. No tenancy model is described on the surfaces read: nothing states whether customers are single or multi-tenant, whether isolation is logical or physical, or what changes between tiers. A Tenant Access Policy is published and was not opened, and it is the named rebuttal route on this row. Subprocessor list, compliance page and product navigation read 7 September 2026.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certifications named, auditor named, and the certificates themselves reachable without a request, which is the combination this axis exists to reward and which almost no record in this corpus achieves. The published set is ISO 27001, ISO 27017, ISO 27018 and ISO 27701, each described by what it covers rather than listed as a badge; SOC 1 and SOC 2; CSA STAR registration; and a Global Privacy Recognition for Processors certification. The auditor is identified as Schellman, and the ISO and privacy processor certificates link directly to Schellman's own certificate service while the CSA STAR entry links to the Cloud Security Alliance registry entry for Integration Appliance, Inc., so a reader can verify the claims at source rather than take them on trust. No non-disclosure agreement, email address or sales conversation stands in the way of any of it. A Shared Assessments SIG 2024 Lite questionnaire is published as a resource, a DORA customer guide addresses the EU financial-sector regime, and a public cloud status site operates alongside individually published cloud policies. The vendor also states its GovRAMP position honestly as membership while actively pursuing verified offering status, which is a claim about where it is rather than where it would like to be read as being. What is absent, and it is the only thing: no audit period or scope statement is published on the compliance page itself, so a reader must open the linked certificates to establish what and when was covered, and no SOC report is downloadable from the page. Compliance page read in full and certificate links inspected 7 September 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Models named, providers identified, change notification operating, and the customer given a choice between models, which is the fullest disclosure on this axis located in the corpus. The subprocessor list is organised per product, and the AI entries are specific. For Intapp Celeste it names Amazon AWS Bedrock as a generative AI services provider which hosts Anthropic models, across six named regions, and states in terms that the customer can select Anthropic or Azure OpenAI models; it names Microsoft Azure AI Services for text generation and extraction; and it names Exa Labs for web grounding services. For Intapp Assist it names Microsoft Azure AI Services for text generation and summarisation. Anthropic PBC is separately named as a generative AI services provider for other products in the family. So a reader can establish which model families process their content, which provider serves them, in which region, for which product, and that the choice between two model families is theirs. Change notification is not a promise but a mechanism: the page carries an effective date, a subscription form for update notifications, and retained prior versions, with updates stated to be posted in accordance with the terms of the agreement. What is not published is the specific model version within each family, so a reader knows Anthropic or Azure OpenAI without knowing which release, and nothing states what happens to an in-flight matter when a model is deprecated. Subprocessor list of 11 August 2026 read in full 7 September 2026.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information is published at any level, including the unit of charge, and the site's own navigation establishes that no pricing page exists rather than that one could not be found. The published inventory was read in full: a products menu spanning fourteen named products, an industries menu spanning seven sectors, a why-Intapp menu covering company, data foundation, cloud infrastructure, partners, client resources, services and trust, and a footer repeating all of it alongside cloud, partner, learning, client and company sections. There is no pricing entry anywhere in either the header or the footer, and no pricing link on the trust, compliance or product pages read. Every conversion path on every page ends at the same two calls to action, scheduling a demo or contacting the company. No tier or edition is named, no unit is identified whether by seat, user, matter, timekeeper or module, no band or range appears, and no minimum or term is stated. Nothing indicates whether the fourteen products are priced separately or bundled. The company is listed on NASDAQ and publishes revenue in its financial reporting, so aggregate figures exist in the public domain, but nothing there tells an individual buyer what the product costs them, which is what this axis asks. Where the only route is an invitation to contact sales, no pricing row is owed and none is written. Full site navigation, footer, trust, compliance and product pages checked 7 September 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Buyer and workflow coverage is described with more granularity than any record in this lane, and no boundary is stated. Seven industries have their own solution sets: legal, accounting, consulting, corporate, investment banking and advisory, private capital and real assets. Within legal alone, twelve distinct solutions are published individually, being client intelligence, the Activator programme, Microsoft Copilot enablement, Microsoft 365 collaboration, compliant timekeeping, compliant prebilling, compliant time and billing, new business intake, conflicts management, outside counsel guideline compliance, anti-money-laundering and know-your-client, ethical walls, lateral hire onboarding and partner attestation management. The corporate segment is addressed separately with matter management and relationship management for in-house legal departments, so both sides of the legal market are served by named surfaces. Private capital is broken down further into ten named markets. Geographic reach is evidenced rather than asserted, with offices contactable in the United States, United Kingdom and Asia-Pacific and seven named hosting regions. What is absent is any limit. No firm size, practice area, matter type or jurisdiction is named as in or out of scope; nothing states a minimum deployment; and no coverage statement distinguishes which of the fourteen products carry AI features from those that do not, which matters on a record where the AI reaches only some of the estate. Full product and industry navigation, legal solution pages and contact details read 7 September 2026.