J
Josef
Josef is a no code platform on which in house legal and compliance teams build self service tools for the rest of the business. Teams can build AI question and answer tools drawn from their own policies and playbooks, automate contract and document generation, and set up workflows for legal intake and approvals. The AI module, Josef Q, answers only from content the customer uploads and says so when it cannot find an answer, and a moderation layer lets the legal team review, edit and change the sources of what a tool tells people.
It connects to SharePoint, Confluence, Slack, Teams and Salesforce, and to legal systems including HighQ, Xakia, Dazychain and Actionstep. Data residency options cover the US, Europe, the UK and Australia. Josef Legal Pty Ltd is an Australian company, and named customers include L’Oréal, adidas, Bupa, Bumble and Orrick.
Josef, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Alternatives to Josef
Vendors in the same categories as Josef whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
- PProVisionProVision manages side letters and most favored nation (MFN) elections for lawyers who run private investment fund formations.
- PPERSUITPERSUIT is an outside counsel management platform for corporate legal departments, covering the work between deciding a matter needs a firm and paying the invoice.
- CCohesoCoheso is an AI legal front door and work management platform from Coheso, Inc. of New York, sold to in house legal and compliance teams.
- LLaurelLaurel, formerly Time by Ping, is AI timekeeping for professional services firms, operated by Time By Ping, Inc., doing business as Laurel, in San Francisco.
- CCounselLink+CounselLink+ is an enterprise legal management platform for corporate legal and claims departments.
- PPlexusPlexus is a legal operations platform for in house legal teams, sold as an AI powered Legal OS.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Josef sells three products: Josef Q for AI question and answer, contract automation, and workflow automation. Only the first is driven by models. The contract and workflow modules are template and rules automation that predate the AI layer, and they are what the L’Oréal case study's 66% turnaround figure rests on. Josef Q is not peripheral: it has its own login at q.joseflegal.com, four dedicated product pages and its own named customers at adidas, Bupa and Cityblock Health.
Remove it, though, and a working no code document and workflow platform remains. The models drive a core capability layered on a product that would still work without them.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Grounding is real and specifically documented. The AI controls page says Josef Q is a closed domain system answering only from uploaded content, and the source list shows the exact page, paragraph and clause an answer drew on, so a user can open and check the support. A document processing engine is described as scanning and optimizing uploaded content before indexing. No measured accuracy figure or test set is published.
Josef Q retrieves the customer's own policies rather than primary law, so grounding to primary authority and citation status checking are not capabilities it claims. Against that, the audit trail page carries an unqualified “No hallucinations!” claim, which is marketing running ahead of the mechanism, though it sits alongside a described architectural control and a published refusal path.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The control structure is published in detail. The AI controls page documents human moderation of every answer, adding and removing sources in a Moderation tab, a Tuning Lab for tone, length and spelling, and Smart and Follow-up Suggestions that shape what end users ask. The stop rule is published and specific: outside the uploaded content, the tool answers “Sorry, I don’t know.” The audit trail page adds that all user questions and generated answers are tracked and stored.
What is missing is a route back to human judgment. No escalation path from an unanswered question to a lawyer is published, and no thresholds or distinct autonomy modes are published. The review surfaces are the strongest part of the published material.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Attribution and figures are both present. The L’Oréal case study names Candy Welsh, Legal Counsel, and reports a 66% drop in contract turnaround, one contract moving from over an hour to 20 minutes, more than 100 such contracts a year, and roughly two weeks of work saved annually. Other named deployments carry named officers. Katherine Roseveare, General Counsel at adidas, is named for a deployment across more than 65,000 people, and Claire Nuske, Head of Legal Operations at Bupa, for more than 40 self service tools.
Wendy Chow, General Counsel at Cityblock Health, and Sheila Dusseau, Head of Global Legal Operations at Ferring Pharmaceuticals, are also named. No case study carries a date, and the 66% figure comes with no statement of how it was measured or over what period, so neither the method nor the currency can be assessed.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
No customer agreement is published. The only published documents are website terms and a privacy policy dated 15 February 2024, which applies to Josef as a controller rather than to customer content held as a processor. What is published is real but general. Josef's FAQ says customers keep full ownership of their data and Josef acts as custodian, and the security page states AES-256 at rest and TLS 1.3 in transit with server side keys held by Josef.
Nothing addresses training on customer content, tenant separation, or privilege and work product. For an in house buyer the key need is separation between tenants, and no separation of any kind is documented. The ownership and encryption commitments can be read before signing, but the commitments that matter most cannot.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The only published disclaimer covers the wrong thing. The website terms say content on the Josef website is for information purposes only, which addresses the marketing site rather than the output of a tool answering policy questions for employees. The product, meanwhile, is described in advice terms. The Josef Q demo panel offers scalable guidance and advice, and the FAQ describes legal aid organizations and boutique firms using Josef to deliver onboarding, wills and guidance tools to members of the public.
No jurisdiction limit, statement of who may rely on an answer, or disclosure requirement for consumers is published, and ABA Formal Opinion 512 is not mentioned. The disclaimer exists but does not reach the product, and the uses the vendor advertises to the public are where the advice line matters most.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
No governance position is published. There is no responsible AI page, no named internal owner, no testing regime before release, and no ISO 42001 or equivalent. Nothing addresses whether answer quality varies across topics, document types or populations. The moderation and review controls are real, but they are an oversight mechanism rather than governance, and security controls are a separate subject. The chief executive's published article on context engineering is a design argument, not a governance disclosure.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Access control is documented and the rest is not. The security page states AES-256 encryption at rest, TLS 1.3 in transit, encryption keys held by Josef on the server side and regular access audits, alongside OWASP and ASD secure coding frameworks, automated vulnerability scanning and annual third party penetration testing. What happens to uploaded documents and prompts afterwards is not addressed. The privacy policy keeps service data for the business relationship and an unstated period after, and describes deletion only as securely deleting or anonymizing once no legitimate business need remains.
No incident practice is published. The subprocessor list is not published; the privacy policy says it can be provided on request, and no self service portal or download route is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Nothing is published on who bears the loss when an answer is wrong. The only published liability clause sits in the website terms and excludes liability arising from use of the Josef website, limited, where it cannot be excluded, to resupplying the relevant services or information. That is a website clause, not a position on product output. No master subscription agreement, customer agreement, service level agreement, warranty or indemnity is published, and the site footer offers only the website terms, the privacy policy and a cookie notice.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Thirteen integrations are named and grouped by function, and the direction of data flow is described. Policies sync in from SharePoint and Confluence, data is pulled from Airtable and Google Sheets, and captured information is pushed out to Slack, Teams, SharePoint and Salesforce. The legal systems are present: HighQ, Xakia, Dazychain and Actionstep are all named. The Xakia entry goes furthest, describing Josef bots launched from Xakia's internal client portal so that requests stay managed within Xakia.
Two integrations, Actionstep and Xakia, have linked walkthroughs. No documentation an implementer could use is published: no developer index, no field mapping, and no statement of what a firm must configure. The integrations page answers any unlisted case by inviting a conversation with the team.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The security page and the FAQ both state data residency options in the US, Europe, the UK and Australia, a commitment to four regions stated consistently in two places. The tenancy model is never stated: nothing says whether customers sit in shared or separate instances. Processing location is not addressed separately from storage, and two documents pull in different directions. The security page offers regional residency, but the privacy policy says personal information may be transferred and processed outside the user's country, including in the United States, relying on standard data protection clauses for EEA and UK transfers.
The two are not necessarily inconsistent, since the privacy policy governs Josef as controller rather than the platform tenancy, but no published document reconciles them.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
SOC 2 Type II is stated on the security page, the FAQ and the home page, and the privacy policy states SOC 2 Type I and II. Annual third party penetration testing is stated, as are GDPR compliance and ISO certification of the underlying server infrastructure. Nothing that would let a reader check any of it is published. No auditor, scope or coverage period is named, no report or summary is offered by any route, and no trust center exists.
No Vanta, SafeBase or equivalent portal is linked from the footer or navigation. The standard is named in prose rather than only as a badge image, but there is no route to the evidence at all, not even a gated one.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Josef acknowledges a large language model underneath and never says whose. The chief executive's published position is that an LLM alone cannot be trusted and needs context engineering, and the audit trail page refers to GenAI engineering. No model, model provider or inference location is named. Hosting region and ISO certified infrastructure are published, but a hosting location shows where the software runs rather than whose model sees client content.
There is no commitment to notify customers if the underlying model changes. The only route to the supply chain is the subprocessor list the privacy policy says is available on request.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No pricing information is published at any level. There is no pricing page, and the navigation and footer of the home page, the Josef Q and integrations pages, the security page, the AI controls page and the FAQ carry no pricing entry. Every commercial path is a demo booking or a contact form. No tier names, packaging structure, unit of charge or figure is published, so nothing shows what is charged for, let alone how much.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is set out by segment, with named customers in each. The FAQ and customer navigation name five segments: in house legal, global law firms, boutique and NewLaw firms, legal aid organizations and community legal centers, and law schools. Each has its own page and named users. In house users include L’Oréal and Bumble, and firms include Orrick and Herbert Smith Freehills. NewLaw users include Hive Legal and Polaris Lawyers, legal aid users include Housing Court Answers and Everyday Justice, and education users include Cornell, NYU and the University of Pennsylvania.
Document types are named too, including NDAs, MSAs, employment agreements, powers of attorney and client onboarding forms, with question and answer uses grouped under commercial, privacy and data, legal operations and HR. The limits are not stated: Josef's FAQ says anything repeatable can be automated, government use is not addressed, and no page says where the product stops.
3 public documents
The public pages on file for Josef, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
joseflegal.com/privacy3 signals
Prompt and Output Retention, Third Party Request and Subpoena Notice, Outside Counsel Guideline Readiness
Read Sep 1, 2026
-
Refusal and Uncertainty Behavior
Read Sep 1, 2026
-
Fabricated Citation Record
Read Sep 1, 2026
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
No customer agreement, terms of service or equivalent contract is published on any surface located, and no policy page states a position on training. Nothing is granted and nothing is withheld, so a client has no term to hold the firm to. Where a policy page does state a position, the row takes the matching policy value instead and the summary records that no agreement exists.
No customer agreement is published, and no policy page states a position on training. The website terms, the privacy policy dated 15 February 2024, the security page, the FAQ and the Josef Q product and AI controls pages say nothing on it, and no customer agreement appears anywhere on the site. Josef's FAQ says customers keep full ownership of their data and Josef acts as custodian, which is an ownership statement rather than a training commitment. Josef Q answering only from uploaded content describes the retrieval source, not model training.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
Retention is acknowledged without a period. The privacy policy dated 15 February 2024 states Josef retains service data for the duration of the business relationship and a period afterwards for analysis, historical and archiving purposes, deleting or anonymizing it once no ongoing legitimate business need remains. No period is stated and no customer control is offered. The audit trail page separately states that all user questions and generated answers are tracked and stored by Josef Q, so prompts and outputs plainly persist, but no published document says for how long.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
No located public material addresses walls or matter level segregation.
The security page, privacy policy, FAQ, website terms and the Josef Q product and AI controls pages do not address ethical walls, matter level segregation or tenant separation. Access is described at the level of encryption and access auditing rather than who can see which content. Permissions are implied at tool level, since a builder selects which sources each tool draws on, but nothing published describes how separation between users, teams or matters is enforced at query time.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Published terms or policy address disclosure to authorities or in response to legal process, and no commitment or reservation regarding customer notice is located anywhere. The vendor has told the customer that data can leave and has said nothing about whether the customer hears of it.
The privacy policy addresses compelled disclosure and commits to nothing on notice. It states that information is provided to comply with the law, giving a search warrant, subpoena or court order as the examples, and separately that Josef discloses where required to enforcement agencies, government agencies and regulatory bodies. It contains no commitment to notify the customer and no exception for where notice is lawfully permitted.
The policy does state that Josef has received zero government requests for information since it was founded, which is a transparency statement rather than a published transparency report.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
The product does not retrieve primary law, so there is no legal corpus to source. Josef Q answers from the policies, playbooks and templates a customer uploads, which the vendor states explicitly in contrast to the open internet. No public material identifies any primary law source, license basis or update cadence. The question does not arise for this kind of product; the vendor has not declined to answer it.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No citator, and none would apply. Josef Q returns answers from policy and playbook content the customer uploads rather than case law or legislation, so there is no authority whose later history could be checked. Nothing on the product, AI controls or audit trail pages addresses how current the source content is, beyond letting an administrator add, update or remove documents in the Moderation tab.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The vendor describes refusal or abstention behavior in public materials.
Josef publishes an explicit path for questions it cannot answer. The AI controls page states that Josef Q is a closed domain system answering only from content the customer uploads, and that where it does not know the answer it says so in those words. The behavior is presented as a property of the closed domain rather than a prompt instruction. No published evaluation or observable test of the behavior exists.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
The AI Hallucination Cases database maintained by Damien Charlotin, and general sanctions coverage, record no court order, opinion or disciplinary record naming the product or the company, Josef Legal Pty Ltd. The database held roughly 1,668 cases as of July 2026. Josef Q does not generate citations to legal authority.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Nothing published engages with bar or ethics guidance. ABA Formal Opinion 512 is not mentioned, no state bar or law society opinion is named, and the site has no ethics or professional responsibility page. Josef sells to law firms and to legal aid organizations delivering tools to clients, which is where that guidance binds the buyer.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Public materials claim time savings without addressing billing or disclosure, and the product sits inside a fee relationship between a lawyer and a client where those savings would change the bill.
Time savings are published and the billing consequence is not addressed. The L’Oréal case study reports a 66% reduction in contract turnaround, a contract moving from over an hour to 20 minutes, and roughly two weeks of work saved a year. No public material addresses how AI assisted work should be recorded or disclosed on a bill. The question matters less for the main buyer, an in house team that does not bill clients, but Josef also sells to law firms and NewLaw practices building tools for clients, where it does arise.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The material exists behind a sales conversation or an executed agreement.
The material exists behind a request. The privacy policy states that a list of third party subprocessors can be provided on request, and no list is published. No model provider is named anywhere on the site, so a firm could not tell its client whose model sees the client’s content without first contacting Josef. No trust center, disclosure pack or consent material for clients is published. The request route is an email contact, not a self service portal.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a record exist, without an export for each document. The audit trail page states that all user questions and generated answers are tracked and stored by Josef Q, and the AI controls page states the source list shows the exact page, paragraph and clause an answer drew on, so what was asked, what was answered and what it relied on are all captured. No model is identified, no human verification step is recorded against an individual answer, and no export of a disclosure record for each document is described.
The product produces internal guidance rather than court filings, so this is an operational audit trail rather than one built for filings.