J

Jimini AI

The CGU defines what is sold as the "Système d'IA" and the Site as an interface for using it. Analysis, drafting and research are all model outputs, and the agentic workflow layer plans and runs tasks with several steps. The home page describes a design in which Jimini selects, orchestrates and continuously optimizes third party models for each task and builds legal reasoning, source handling and workflows on top. Remove the models and no document system or workflow engine is left underneath.

Grounding is real and documented. The research product is described as returning answers anchored in recognized sources of law. Legal Data Hunter is named in the CGU subprocessor table as the legal research provider, located in the European Union. The privacy policy describes the retrieval method: uploaded documents are indexed and split into paragraphs to support search and retrieval. What is missing is a measured figure a reader can examine.

Jimini's home page shows a precision claim in a headline counter, with no method, test set or date. No failure modes are named.

The CGU preamble, in bold at the top of the agreement, is emphatic: outputs are not legal advice, are not final, must be validated by a legal professional such as an avocat, and the user takes full responsibility for their use. Yet the product markets agentic systems that plan, run several steps and carry legal tasks through from start to finish, with more than 200 workflows designed and validated with in house lawyers.

Nothing reconciles the two. The gap is in the controls. No point is published at which an agent stops and hands back, no review surface is described inside a workflow, and nothing says what happens when an agent is wrong. The contractual requirement for human validation is real, but the control structure around it is not published.

There is named deployment evidence with substance, but no measurement. A case study on the vendor's blog dated 26 June 2025 names Hoche Avocats. It describes a three month trial followed by adoption across corporate, tax, employment, technology and litigation departments, a rollout managed jointly by partners and associates, and prompts built from the firm's own agreement frameworks and M&A audit reports. Attributed quotes name Louis Oudot de Dainville, partner at Gide Loyrette Nouel, and Jacques Perotto, partner at Alerion.

The Paris Bar partnership is dated May 2025 with its terms stated, three months of free access for firms of one to twenty lawyers, and Pierre Hoffman is quoted as Batonnier. More than 6,000 avocats and juristes are said to use the product. No measured outcome is documented. The Hoche study reports no result, and the home page figure for hours saved per lawyer sits in a headline counter with no method, cohort or date.

Every part is covered and readable before signing. The CGU itself prohibits training, and the prohibition extends to suppliers. Separation is documented at both levels buyers need: data is logically partitioned by user and by organization, and personal and enterprise libraries are stored separately. Access runs through Auth0 by Okta on least privilege, with access logged and audited. Professional secrecy has its own clause, citing article 66-5 of the law of 31 December 1971 and article 2.3 of the Règlement Intérieur National.

It acknowledges that the obligation is absolute and a matter of public order, and states that no data in submitted documents is accessible to third parties or used for anything other than providing the service. Retention and deletion are published by category, with a certificate of destruction on request. The position on model providers is the strongest part: each inference provider is named with its location and the basis of its zero retention arrangement. Separation between users and what the model provider may retain are both addressed.

The CGU preamble states in bold that outputs are not legal advice and must be validated by a legal professional, and that Odysai is not a law firm and gives no legal advice. It then names the governing statute: under the law of 31 December 1971 as amended, Odysai, its officers and its employees do not carry on legal consultation, the drafting of private deeds, or representation. The audience is limited expressly to users acting in a professional capacity, and consumer mediation under articles L.611-1 of the Code de la consommation is disapplied on that basis, so there is no consumer surface to disclose on.

The jurisdiction is stated throughout as continental and French law. The vendor's help center article on déontologie engages the CNB's recommendations and the EU AI Act compliance timetable. Competence and supervision rest on the validation requirement rather than on a separate statement.

Governance is the weakest part of an otherwise strong record. No AI governance framework is published: no ISO 42001, no responsible AI page, no named owner for model governance, no testing before release, and nothing on uneven output across matter types or populations. The vendor's help center article on déontologie covers the EU AI Act timetable and says technical documentation, the DPA and the security policy are available on request, so the governing documents sit behind a request.

ISO 27001:2022 is certified, but it is a security standard and does not answer this question. The data protection officer, Auriane Roussel, is named, but that is accountability for data protection, not AI governance.

Everything is published, specifically enough to hold the vendor to. Retention is set out by category. The document library and AI prompts and responses are kept for the life of the account plus 30 days, account data for one year after last connection, and billing data for ten years. Content from the Word and Outlook add-ins is not stored at all, and connector data is processed in real time with no storage. Deletion is specific: account deletion happens within the day, aggregated usage data is removed within the month, and a certificate of destruction is issued on request.

Access control uses Auth0 by Okta, least privilege, and logged and audited access, with AES-256 at rest, TLS 1.3 in transit, logical partitioning by user and organization, and vulnerability testing every six months. Subprocessors are named in a table with role, location and zero retention status. Any addition or replacement comes with 30 days' notice, a right to object, and a right to terminate without penalty if the objection is not resolved.

Breaches are notified to the customer within 24 working hours of being qualified, and to the CNIL within 72 hours under article 33.

Liability runs entirely one way in the CGU. The CGU's limitation clause is an exclusion and nothing more. The company is not liable for damage from unavailability caused by outside factors, from use of outputs without prior validation by a qualified legal professional, from user breach, or from external attack. The intellectual property clause adds that the company cannot be held responsible for outputs or their use, expressly including error, approximation, or content a third party may claim.

There is no indemnity for the customer, no liability cap as a figure or multiple, and no warranty on the service or its output. No insurance position is published on the home page, in the CGU, the privacy policy or the legal notices, or in the trust center. What is published is a clear statement that the user bears the loss, readable before signing. The risk this product creates is wrong legal output, and the clause disclaims exactly that.

Integrations reach the systems legal work lives in, and the depth is documented. Jimini pour Word and Jimini pour Outlook each have their own product page and are included in the subscription. Word covers drafting, analysis, correction, comparison and translation; Outlook covers drafting, thread summaries and text improvement. Connectors run to Google Drive and SharePoint. The privacy policy documents each integration's data flow.

For the add-ins, document and email content, including attachments, is processed and discarded rather than stored, and only the prompt and the response are kept. For connectors, only files the user selects are accessed, processing is real time with no storage beyond immediate use, and access is revoked at once on disconnection or account deletion. Google connector handling follows the Google API Services User Data Policy.

What syncs, in which direction and what the firm must enable can all be answered from published material. No legal document management system such as iManage or NetDocuments is named.

Residency is stated flatly, all customer data is stored in France, and then backed with detail. The platform at app.jimini.ai is hosted by Scaleway and S3NS, both named, with Scaleway's registered address given, and both stated to have servers in the Paris region of France. Where processing happens is published separately from where data is stored, and named for each inference provider: Mistral AI in France, OpenAI's Europe deployment in the European Union, and Anthropic Claude models through Google Cloud Vertex AI in Belgium at europe-west1.

Tenancy is stated as logical partitioning by user and by organization. The marketing site is documented as setting no audience measurement cookie and storing nothing on the visitor's device. Jimini offers a single hosted deployment in one country rather than a set of options, so there are no tiers to compare.

A public trust center is live at trust.jimini.ai, with no sales call, email capture or NDA click through. It lists the entity as ODYSAI, shows ISO 27001:2022, and lists 114 controls grouped under business operations, governance, asset management and risk management. The DPA goes further, publishing certificate number IC-IS-2506288 and its validity to 17 June 2028, so the certificate can be verified independently. Two things are missing.

No certification body or auditor is named, and no attestation report is offered; the portal lists a single document without identifying it.

The supply chain is disclosed in detail. The CGU publishes a subprocessor table naming every provider with access to customer data, its role, its location and the basis of its zero retention arrangement. Inference runs through Mistral AI SAS in France on documented activation, OpenAI's Europe deployment in the EU under a signed contract amendment, and Google Cloud Vertex AI carrying Anthropic Claude models in Belgium (europe-west1) under written supplier approval.

The table also lists Scaleway and S3NS for hosting, Gradium SAS for voice transcription, DeepL for translation, Legal Data Hunter for legal research and Cloudflare for transit only, with no storage. The privacy policy repeats the inference provider list. Changes come with 30 days' notice, a right to object and a right to terminate without penalty. One gap remains. Anthropic Claude is named as a model family, but the specific Mistral and OpenAI models are not, and the home page describes continuous selection of the best models for each task, so which model handles a given request is not disclosed.

Two named plans are published with their features. The individual plan includes all tools, the Microsoft extensions, AI workflows and data confidentiality, and can be bought online with a two week free trial and no sales contact. The organization plan adds collaboration, training and onboarding, a usage dashboard and central billing, and goes through the sales team. The CGU sets the charging terms: online rates are those shown on the site at signup, in euros excluding tax, billed monthly or annually at the subscriber's choice, with 30 days' notice of any price change and a right to cancel before it takes effect.

The individual price is shown on the pricing page through an animated counter, and the CGU confirms prices are displayed at signup. Prices are published for part of the range, and the enterprise tier is withheld.

Segment coverage is described with real substance. The pricing page addresses independent avocats and organizations, splitting the latter into law firms and corporate legal departments, and the partnerships with local bars size the segment precisely, with the Paris agreement covering firms of one to twenty lawyers. The customer set spans both sides, naming law firms such as Gide Loyrette Nouel, Capstan, Hoche Avocats, FTPA and Franklin alongside corporates including CMA CGM, Petit Forestier, Léon Grosse and In Extenso.

Practice coverage is evidenced through the agentic workflow library, which is filterable by affaires, civil, immobilier, pénal and public. The jurisdictional boundary is stated plainly and repeatedly as continental and French law. What is left open is the far edge: no statement says which practice areas are not supported, government use is not addressed, and the five workflow filters are a library taxonomy rather than a declared scope of support.