L

Legito

The vendor's own headline settles this. The AI page is titled AI-powered Document Automation and CLM, and its subtitle says AI powered and rule based document automation complement each other. Kedy AI is a real, named, shipped layer with five distinct capabilities, but it sits on top of a platform that stands entirely without it. Remove the models and a buyer still has interactive template automation, lifecycle management with routing and approvals, a no code application builder, an audit trail and a free electronic signature product.

That is the whole of the free plan and the whole of what the named customers are quoted describing. The company was founded in 2015, and its case studies, including the PwC deployment and the 450,000 hours figure, rest on rule based automation rather than on inference. AI accelerates authoring and extraction here; it is not the mechanism the buyer is paying for.

No accuracy content of any kind is published. There is no figure, test set, evaluation, third party validation or named failure mode on the AI page, the security page, the pricing page or the subscription agreement, and the agreement does not mention AI at all. The nearest thing to a control is a design constraint. AI drafting is described as inserting extracted data into automated templates while keeping the template fully intact, which bounds what the model can alter but says nothing about output accuracy.

The nearest thing to a limitation disclosure is a blog article asking whether a reader can accept that AI returns different results in two identical situations. It acknowledges nondeterminism in the abstract without stating what the product does about it. Grounding to primary legal authority does not apply to a document automation and CLM product. The knowledge base article on AI document drafting was not opened and may say more.

Autonomy is claimed and oversight is not described. The vendor states that AI agents will undertake regularly recurring tasks in the customer's workspace, which is unattended operation, and that Kedy AI navigates through workflows and controls lifecycle operations. Nothing published states what an agent may do without a human, at what point it stops, whether a confidence signal is shown to a reviewer, or what happens after an agent acts wrongly.

No approval gate for AI output is described anywhere. The platform audit trail, described on the security page as timeline and versioning, is a general control that predates the AI and is not presented as a way to oversee it. The subscription agreement, where a supervision obligation would ordinarily sit, is silent on AI entirely.

Deployment evidence is broad and well attributed. Named customers appear with logos, including PwC, Deloitte Legal, LexisNexis, Holland & Knight, Santander, Société Générale, UniCredit, Telia, Škoda, Vialto, U.S. VETS and the Bronx and New York County District Attorneys' offices, against a stated base of over 400,000 users. Testimonials carry full names and roles. Tomas Fiala, Director at PwC, describes a Center of Excellence running since 2018 across the PwC global network.

Others include Paul V. Saunders, Chief Innovation Officer and Partner at Stewart McKelvey, and Sony Varughese, Chief Technology Officer. Nel Pelle, Sales Manager at BAM, Galya Oster at Atrafin, Eli Cohen, Chief Operating Officer at RBI, and Jeremy Aber, a software attorney, are also quoted. Figures include contract checking falling from 20 to 50 minutes down to 5 minutes, 450,000 hours saved at a Big Four firm, and a deployment for 10,000 users built by two specialists working part time.

The figures sit inside testimonials and case study titles with no method, baseline, sample or date. None of the outcome evidence is attributed to Kedy AI; every quoted result describes rule based document automation.

Substantive published commitments, short of the full picture. The subscription agreement makes all data, files, documents and templates uploaded or created by the customer the customer's property. It grants Legito the right to use customer data solely to perform under the agreement, a purpose limitation rather than a broad license. Section 5 makes customer data the customer's confidential information and binds Legito to reasonable care, purpose limitation and access on a need to know basis under signed confidentiality agreements.

The AI page adds that no third party service processes customer data in AI and that data is never used for AI training. Retention is bounded: the customer may export for 30 days after termination, after which Legito may destroy the data. The customer chooses a named storage region, and the processing agreement bars transfer outside it without express written consent. Encryption is applied in transit and at rest with keys held away from the hosting provider, and a self anonymization feature covers data in documents.

Privilege and work product are not mentioned anywhere in the agreement or on any published surface. The product holds contract and back office documents rather than matter files.

Nothing addressing unauthorized practice, professional responsibility or the boundary between the software and legal advice is published on any Workspace surface. The subscription agreement, which is the customer agreement for this product, contains no such provision, and neither the AI page, the legal department page nor the law firms page carries a disclaimer. One instrument on the same domain does address it. The Legito Marketplace terms of service require a user to tick a box agreeing that the application is not a legal service or its substitute.

The Marketplace is a separate product with its own purchase path, its own terms and its own single use conditions for consumers, so that acknowledgment governs a different transaction and does not apply to the Workspace product.

No governance disclosure is published. There is no AI policy, no acceptable use policy for AI, no responsible AI or ethics statement, no bias or fairness discussion, no ISO 42001 or NIST AI RMF alignment claim, and no named internal owner for AI decisions. No model evaluation or testing is described, and neither the subscription agreement nor the data processing agreement has a section on AI. Two blog articles discuss AI in document processes and where AI brings value and where its limits lie, but both are market commentary rather than statements of how the vendor governs its own models.

The ISO 27001 certification covers information security, and its quoted scope names document automation and CLM software development and hosting, not AI governance. Surfaces read: the AI page, the security page, the subscription agreement and its data processing exhibit, the pricing page and the site footer inventory.

Three express commitments sit together on the AI page. Kedy AI is hosted entirely on Legito servers, no third party services process customer data in AI, and customer data is never used for AI training. The subscription agreement is consistent with them: it grants Legito the right to use customer data solely to perform under the agreement and reserves no training or improvement right anywhere. The closest clause, on statistical information, permits Legito to compile and publish performance statistics about the service if they neither identify customer data or the customer nor permit reidentification.

That is a right to performance metrics, not to machine learning. The processing agreement bars transfer outside the chosen region, sets an eight hour breach notification undertaking, and requires subprocessors to be bound to confidentiality. The limit is placement. Every AI commitment lives on a marketing page, and the customer agreement, last modified in September 2023, does not mention AI at all, so a buyer has the vendor's word rather than a term to enforce.

A published agreement gives real general recourse and none specific to AI. A tiered availability warranty credits 10, 25 or 50 percent of the monthly fee by uptime level. If availability falls below 98 percent for two months in a row or any three in six, the customer may terminate and recover prepaid fees. Legito warrants that security and functionality will not materially decrease and that the service will perform in accordance with its documentation.

There is a 30 day cure period for material breach, an intellectual property indemnity covering defense costs, negotiated settlements and damages awarded by a court, and an eight hour breach notification undertaking in the processing exhibit. Against that, liability is capped at fees paid in the preceding twelve months, and all indirect damages are excluded, including loss of or unauthorized access to data. Nothing in the agreement addresses AI output.

There is no warranty, allocation of responsibility or remedy where Kedy AI extracts a term wrongly, drafts from the wrong source, or an agent acts on a bad inference. The processing exhibit also disclaims liability for customer data disclosed through a cyber attack despite reasonable efforts.

Integration is documented rather than asserted, and the documentation is public. A REST API is published with a Swagger specification, alongside webhooks described as a push API, programmable tags, a developers hub, and self service creation, deactivation and deletion of API keys. Named ready made integrations include Salesforce, Microsoft SharePoint and Zapier. The subscription agreement itself names DocuSign, Salesforce and HubSpot as third party services the platform works with, which puts the integration surface in the contract rather than only on a product page.

A Model Context Protocol server is published so that other AI applications can reach Legito features. Legal practice systems are absent. No document management system such as iManage or NetDocuments, no practice or matter management system, no time and billing system and no court or filing system appears in the integration inventory. The depth is real, and the direction is general enterprise back office rather than the legal stack.

Residency is published, specific and contractually locked. The security page states that each customer may choose its data storage location and names three: Vint Hill, Virginia in the United States; Limburg, Germany in the European Union; and Melbourne, Victoria in Australia. Hosting is with OVH, named openly. The data processing exhibit provides that Legito may not transfer customer data to a third country outside the chosen server location without the customer's express written consent, which makes the choice an enforceable term.

Two gaps remain. Tenancy is nowhere stated, so a buyer cannot tell whether the service is single tenant, pooled or configurable, and no self hosted, private cloud or on premises option is published. There is also an inconsistency between the vendor's own pages. The account creation form on the AI page offers a server choice of Australia, Canada, Germany and the United States, adding Canada to the three locations the security page lists.

The certification body is named, and the evidence is dated. The security page states approval by Lloyd's Register to ISO/IEC 27001 and quotes the certified scope: the development and hosting of Legito document automation and contract lifecycle management software, and the provision of document automation and software configuration services. The certification is cited as ISO/IEC 27001:2013, a revision superseded by the 2022 edition.

The page states that the latest ISO 27001 audit was conducted in July 2021, on a page last modified in September 2024. No certificate document is published, no certificate number or validity window is given, there is no SOC 2 report, and there is no trust center or document request portal. The OVH certifications listed on the same page, ISO 27001, SOC 1 Type II, SOC 2 Type II, PCI DSS and a Cloud Security Alliance STAR self assessment, belong to the hosting provider, not to Legito.

The penetration testing described is the customers' own: the page states that large customers engage third party auditors and that Big Four firms regularly test the application. That describes customer diligence, not a program Legito commissions.

Nothing about the model itself is disclosed. No model, provider, model family or version is named, and the vendor does not say whether Kedy AI is built in house, fine tuned from open weights, or licensed and run on Legito infrastructure. What is published is architectural and useful to a buyer: Kedy AI is hosted entirely on Legito servers, and no third party service processes customer data in AI. That tells a firm that no external model provider sees client content, and it is covered under Deployment Model and Data Residency and under AI Safety and Data Stewardship.

Where the models run is not what the models are. Legito does name three AI services, OpenAI, Anthropic Claude and Google Gemini, but offers them expressly as optional alternatives for customers who prefer them. The page states that Kedy AI does not require any integration, so these are a substitute the customer elects rather than Kedy's supply chain. An assurance that no third party processes data in AI is difficult to reconcile with an undisclosed model of unstated provenance, and only the vendor can close that gap.

Real pricing information is published, but no rate is. A permanently free plan exists and its scope is named: document lifecycle management, the custom application builder and Legito Sign, as a lite version of the enterprise workspace described as free of charge forever. The electronic signature product is offered at no fee, and a 30 day trial opens all features with no credit card required. Pricing pages are maintained in six languages.

No paid figure, volume band, unit of charge, minimum term or seat minimum is published on any vendor page, and the pricing page carries no plan table in its rendered body. The Complete Features List section of the pricing page is a heading with no content in the extracted body; the page's structure indicates something belongs there, so it may say more. A third party site publishes monthly rates per user and a minimum user count, but it is not the vendor's own publication.

The legal surface is real and named but sits inside a wider back office platform. A dedicated Legal department page addresses legal operations directly, framed as no code automation for legal ops to apply expertise at scale with controls, automation and oversight. A Law Firms industry page addresses knowledge transfer and repeat drafting, and a Professional Associations page addresses member document portals. Legal adoption is evidenced by name: Holland & Knight, Stewart McKelvey with a published automation journey, Deloitte Legal, LexisNexis, and the Bronx and New York County District Attorneys' offices, the last with its own prosecution automation case study.

The interface and pricing pages are maintained in English, German, Spanish, French, Czech and Slovak, and three hosting regions serve the Americas, Europe and Asia-Pacific. Legal is one of seven departments and one of eight industries. There is no breakdown by practice area, no legal content for particular jurisdictions and no statement of which matter types are covered. A buyer can see that legal teams use it; they cannot see which legal work it is built for.