K

Ketch

The AI drives a core capability, and the privacy platform underneath would still work without it. The Ketch Agent Network is described as the orchestration layer powering every product, with agents dispatched for discovery, risk, consent configuration, documentation and reporting, reading contracts and classifying data fields; an AI Governance module is sold alongside. Remove the models and consent capture and enforcement, the permission store, data subject request intake and fulfillment, identity resolution and the regulations hub remain, which is a working privacy platform.

The master services agreement defines AI Technology as one component of the Services rather than the Services themselves. The May 2026 Agent Network release is the point at which the AI layer became central to the marketing; the structure is a privacy platform with a model layer.

Answers are tied to sources, and no accuracy figure is published. The agent network page says the agent answers from what it knows about the customer's systems, configurations and processing activities, that every answer comes with a source, and that what a vendor may do with data is extracted from the legal text and cited to the clause. The regulations hub describes laws, enforcement actions and settlement terms summarized and mapped to where the customer operates.

Master services agreement section 7.3 says outputs may be inaccurate, incomplete or inappropriate and must be reviewed and validated before use. No accuracy measurement, test set or evaluation is published. The product cites the customer's own contracts and configurations, and the regulatory content does not name its sources.

The agreement makes the customer the reviewer, and the product offers real review surfaces, but no full control structure is published. Terms section 7.3 makes the customer responsible for reviewing and validating AI outputs before relying on them. The agent network page says the agent flags where a contract's permissions and a system's configuration disagree rather than acting on the mismatch, and that every answer carries a source for review.

Data subject request automation keeps an auditable trail for every request, and the Permission Vault keeps consent decisions as auditable evidence. Not published: thresholds for when an agent acts alone, which agent actions run without approval, and any route back after a wrong output beyond the customer's own correction.

Testimonials carry no attribution, and the only figure is aggregate scale. The home page carries quotes from legal, marketing and privacy operations teams, including that Ketch is software lawyers can use, without a named person or organization, and the figure of 67.2 billion consent transactions a month used across the site is a scale claim rather than a deployment outcome. A Customers page and customer stories are linked in the navigation.

Most commitments are in the published agreement, and privilege is not addressed. Master services agreement section 7.2 says Ketch will not, and will not let any third party, use customer data to train AI or machine learning models, with Feedback and Usage Data carved out for improving its AI Technology. The DPA states a multi tenant environment, Ketch's home page lists role based access, SSO and SCIM, and the Pro plan adds single tenant data residency.

DPA Schedule 3 keeps data for the life of the contract plus thirty days, then deletes or anonymizes it automatically, and DPA section 9 gives destruction or return on written request. Section 7.2 binds third party model providers on training, and the DPA commits subprocessors to the government access protections of the standard contractual clauses. The DPA says a current subprocessor list with countries is published at a stated URL. Nothing addresses privilege or work product.

Ketch takes a clear position on advice versus tooling, but says little about a supervising lawyer's duties and names no jurisdiction limits. Master services agreement section 3.4 states that the services, documentation and any communication from Ketch are not intended and should not be taken as legal advice, and section 9.2 that outputs are not to be relied on as a substitute for professional advice; section 7.3 requires the customer to validate AI outputs for accuracy, legality and compliance and bars representing them as made by a person.

The buyer is stated as privacy, legal and security teams. Nothing addresses how the product supports a supervising lawyer's duties beyond the review obligation, and no jurisdiction limit is named beyond the export control bar in section 3.3.

A governance commitment is made without a published mechanism, testing regime or accountable owner. Master services agreement section 7.1 states that Ketch designs and operates its AI Technology with commercially reasonable measures consistent with industry practice and maintains policies and processes reasonably designed to assess and mitigate material risks, which is a contractual undertaking to have a governance process rather than a description of one.

Ketch also sells an AI Governance product, which governs the customer's AI rather than describing Ketch's own. No framework, ISO 42001 or equivalent, description of testing before release or statement about uneven output is published.

Retention, deletion, access control, subprocessors and incident practice are all published and specific, in the DPA of 7 May 2026 and its Schedule 3. Customer data is kept for the life of the contract and thirty days, then deleted or permanently anonymized by an automated process; server logs are kept twelve months, and free services carry no retention obligation. DPA section 9 gives destruction or return on written request, and terms section 12.5 fixes the thirty day window.

Access control covers formal provisioning and removal, regular access reviews, staff confidentiality agreements and annual training, TLS 1.2 and 1.3 in transit, SSE-S3 encryption at rest and a named data protection officer. DPA section 5.2 publishes a current subprocessor list with countries at a stated URL, with notice of additions by subscription and a thirty day objection right. DPA section 7 commits to incident notice without undue delay, with cause and remediation.

Schedule 3 states a six hour recovery point and twenty four hour recovery time objective, annual penetration testing and annual restoration tests.

What Ketch stands behind is published and specific, including that it stands behind nothing on wrong output. Master services agreement section 10.1 gives an IP infringement indemnity with the exclusions in 10.2 and the remedies in 10.3, ending in termination with a pro rata refund; section 11.1 caps each party's aggregate liability at fees paid in the preceding twelve months and 11.2 excludes indirect loss including loss of data; section 9.1 warrants material conformity to documentation with the exclusive remedies in 12.3 and 12.4; section 7.3 places all responsibility for AI outputs on the customer and 9.2 disclaims warranties of accuracy and reliability; section 13 removes indemnity, warranty and, where enforceable, all liability for free services, with a cap of one thousand dollars otherwise. No insurance is stated, and order forms and the DPA prevail over the MSA on conflict.

Real integrations, documented, with depth described for some. The agent network page names Braze and Snowflake among hundreds of SaaS connections and says what the connection does: it classifies every field by sensitivity, category and purpose and keeps the inventory current as the stack changes. Public documentation is published at docs.ketch.com, and an Integrations page is linked in the navigation. The connections run to data systems, CRMs and marketing platforms, not to document, matter or electronic billing systems. For a privacy platform sold to an in house team, those data systems are the relevant estate.

The tenancy model is stated clearly, and the residency detail is partial. DPA section 6.2.2 says Ketch runs a multi tenant cloud environment. Schedule 3 says the infrastructure runs on Amazon Web Services across multiple availability zones, with backups in a separate geographic region, and Ketch's home page says the Pro plan adds single tenant data residency. No region is listed, and nothing states where model processing happens as distinct from storage.

The transfer provisions in DPA section 12 assume transfers from Europe to the United States under standard contractual clauses or the Data Privacy Framework.

Certification is stated, kept up under the contract and evidenced on request, and no report is available without asking. DPA section 6.2.1 says Ketch holds ISO 27001 certification and SSAE 18 SOC 2 Type II reports for the Services and will maintain them for the term, with reports available on written request under confidentiality. Schedule 3 adds ISO 27001:2022, annual independent assessment and annual penetration testing, and the home page adds ISO 27701. A trust center exists at trust.ketch.com. No auditor or coverage period is stated.

Ketch refers to AI Technology and underlying models without naming what sits underneath. The master services agreement defines AI Technology generically, section 7.4 refers to Ketch's underlying models and algorithms, and the privacy policy lists AI and machine learning services as a category of service provider. No model or model provider is named in the agreement, the DPA or the privacy policy. DPA section 5.2 says a current subprocessor list with identities and countries is published at ketch.com/subprocessors, with notice of additions by subscription.

The unit and structure are stated in the agreement without a figure. Master services agreement section 5.2 bases fees on the plan and usage limits in the order form, measured monthly, with defined units of Unique Identities and Contacts and automatic movement to the next plan on overage. Section 5.1 gives sixty days' notice of renewal price changes. Section 12.2 renews for the longer of the initial term or twelve months, with thirty days' notice of nonrenewal, and section 13 governs a free tier, Ketch Free, offered without warranty. Ketch's home page names a Pro tier with single tenant residency, and a pricing page is linked in the navigation.

Segment and coverage are described with substance; the boundaries are left open. Buyers are stated as privacy operations, legal, security and marketing teams, with industry solutions for retail and ecommerce, technology, financial services, healthcare, communications and media, automotive, travel and hospitality, and education, and regulatory coverage stated as GDPR, CCPA and CPRA, emerging US state laws through a US Privacy Law Atlas, and privacy and AI laws generally.

What is not stated is where the product stops: no jurisdiction, regulation or industry is named as unsupported, and no law firm use is described.