L

LexCheck

Remove the models and nothing remains to sell. The vendor states the systems are built on large language models, and the two capabilities that constitute the product both depend on them: automatic capture of a customer's preferred positions from an uploaded template into a working playbook, and evaluation of an incoming contract against those positions to surface deviations and propose redlines. There is no repository, workflow, approval or signature product underneath that would still function if the models were removed; the self-serve platform exists to review and edit the playbook the models generated.

Two named products ship: LexCheck Insights, described as AI-powered contract review software that evaluates every contract and catches deviations in seconds, and LexCheck Copilot. The vendor describes its playbooks as LLM-powered and trained on the most common provisions and ready to use across virtually every contract type.

Accuracy is asserted repeatedly and measured nowhere. The claims are comparative and unquantified: the vendor says its AI is highly accurate and lowers risk more than human review, and its blog says accuracy exceeds that of attorneys while cutting review time by more than ninety percent. No tested accuracy figure, test set, method or outside validation is published. No failure modes are named: nothing says what happens with language outside the playbook, unusual provisions or ambiguous positions.

What does exist is an explanation for each flag. The vendor says insights explain why particular contract language may be a problem, so a reviewer sees a reason attached to each flagged passage. No retrieval or matching method is published, so a buyer cannot tell what those explanations are based on. The product cites no legal authority and has no citator, so checks on authority do not apply; grounding here means the customer's own playbook positions.

Oversight is asserted and one real control is described, but nothing covers oversight of the output. The customer reviews and finalizes the drafted playbook in a self serve platform before use, can add fallback positions and adjust language, and the vendor says this keeps the customer in control. That control governs the standard, not the result. Nothing published says whether a lawyer must review the proposed redlines, when the system acts alone, what happens when it is wrong, or how a flagged contract returns to human judgment.

No human in the loop commitment appears anywhere, including the Terms of Service, which were read in full. Two of the vendor's statements pull against each other. The platform is said to keep the customer in control, while the technology page says the AI is highly accurate and lowers risk more than human review. The marketing also says the tools are easy enough for anyone to use without external support. The point at which output is relied on without legal review is not stated, and no written commitment that the models work alongside a supervising lawyer is published.

There is real deployment evidence with named customers, but the figures are not attributed. Two case studies name the customer and quote someone: NetApp, on contract review, and RSM, whose quoted reviewer calls it the best technology implementation they have witnessed for value and ease of use. A customer strip names Autodesk, Bio-Rad, DigiCert and NetApp. That is named production use, not logos alone. But the figures and the names are never joined.

The headline claims are aggregate: more than a seventy five percent increase in speed to close, contracts signed in as little as one day rather than weeks, and more than a fifty percent cut in legal costs per contract review. None is tied to a named customer, dated or supported by a stated method. The two case study pages were not opened and may say more.

There are substantial commitments a buyer can read before signing, with real gaps. The customer exclusively owns all Client Data, wherever it is stored or processed, and any interest the vendor might hold is assigned to it. Client Data is expressly part of the customer's Confidential Information, and confidentiality lasts through the term and after with no end date. Disclosure is limited to staff who need to know. Data is stored and processed in the United States, with ninety days' notice of any change in processing location.

The security page says customer data is used only to provide the service and that the vendor does not look into an account without permission. Encryption is AES-256 at rest and TLS 1.2 or higher in transit. The gaps: privilege and work product are not addressed anywhere. Training is not mentioned in any of the three published documents, so a buyer cannot tell whether contract text reaches a model, and with no model provider named, what a provider may keep is also unknown. Separation between users or matters is not addressed either, which matters because law firms are a named buyer segment.

Nothing published addresses the advice line, for a product that proposes contract language and is sold to people who are not lawyers. The Terms of Service were read in full and contain no statement that the service is not legal advice, no expectation of lawyer review, and nothing on competence or supervision. The privacy policy and the security and technology pages say nothing on the point either. The audience is clear: the vendor names legal, sales and procurement departments among its buyers and says its tools are easy for anyone to use, so a team can finish reviews without external support.

That is marketing to nonlawyers describing the product as a substitute for outside legal help, with no statement of what the product is and is not. Clause 11.3 disclaims warranties, including accuracy of results, but that allocates risk for defective performance and says nothing about whether output is legal advice or who should review it.

No governance position is published for a system whose output is proposed contract language. Nobody inside the vendor is named as accountable for AI, no testing or evaluation before release is described, no results are disclosed, and nothing addresses uneven output across contract types, counterparties, drafting styles or jurisdictions. There is no responsible AI page, principles statement, model card, AI policy, ISO 42001 certification or outside assessment.

The security policies on the security page govern IT assets, disaster recovery and access control under SOC 2; that is security governance, not AI governance. The accuracy statements on the technology page are marketing claims, not a testing regime. The gap stands out because the vendor claims its AI is more accurate than human review while publishing nothing that would let anyone test or govern that claim.

Published policy covers nearly everything, with one gap. Incident practice is strong. The Data Processing Addendum commits to written notice without undue delay and never later than twenty four hours after the vendor learns of a Security Incident, with the details the customer needs for its own notifications. The Terms add a broadly defined Security Event, a duty to notify and cooperate, and a right for the customer or a regulator to audit books, systems and logs after an incident.

Deletion is specific: all copies of Customer Personal Data, including archives, are destroyed within ninety days of termination, returned within thirty days on request, with secure destruction of media and a Certificate of Deletion within thirty days on request. Access control, encryption at rest and in transit, regular penetration and vulnerability testing, backups with a stated twenty four hour recovery time and recovery point, and an annual audit right are all published.

The gap is that no subprocessor list is published. The DPA makes one available on reasonable request, with thirty days' notice and an objection right before any new third party is used, which is strong change control but not a published list. Retention of contract content is described only as prescribed intervals, with no interval named.

Indemnity, caps, carve outs and insurance are all published in specific terms. Clause 9.1 goes beyond an intellectual property indemnity: the vendor covers losses from any Security Event, from any breach of the confidentiality and data security article, and from third party claims that the platform infringes intellectual property. It controls the defense at its own cost, with a license, replacement or refund path at 9.4.

Clause 10.1 caps liability at charges paid in the prior twelve months. Clause 9.3 excludes unauthorized combinations and designs the customer supplies, and clause 10.3 leaves liability uncapped for Security Events, confidentiality and data security failures, indemnities, fraud, willful misconduct, gross negligence and service level credits. Insurance has its own article: at least one million dollars of primary cover with A rated carriers, the customer named as an additional insured, and waiver of subrogation.

Clause 11.1 warrants that the platform performs as the Documentation describes, with a duty to repair or replace. Availability of 99.9 percent carries a defined credit and a termination right after three consecutive failures. One limit matters. Clause 11.3 disclaims accuracy of results, so the warranty covers conformity with the Documentation, not whether any individual redline is correct, and nothing can be invoked for a wrong output as such.

Integration with the contract stack is claimed, but no system is named. The vendor says the platform integrates with the customer's contract lifecycle management system and optimizes the negotiation phase, but names no CLM product anywhere. It publishes no integration page, partner list, connector documentation or API reference, and nothing describes what syncs, in which direction, or what an implementer would configure.

Microsoft Word is the one named system, and the product does deliver into it, keeping work in the customer's usual word processor; the privacy policy also mentions plugins exchanging information with LexCheck. That names a surface without saying what moves between it and the platform, and the main workflow described elsewhere is web based: the user signs in and uploads a contract.

Residency is published in detail, and processing is addressed separately from storage. Clause 1.6 names the primary data centers in Northern Virginia and the secondary in Oregon, and says the platform and Client Data may only be hosted there or at other sites the customer approves. Clause 8.6 says the services are provided from the United States and Client Data is stored and processed there. Any change in processing location needs at least ninety days' notice, and the customer may terminate without penalty, with a pro rata refund, if data is stored in a foreign jurisdiction it has not approved in writing.

The Data Processing Addendum commits the vendor to tell the customer in writing of every country where data is processed or stored and to obtain consent, and lists the United States as the only one. Hosting is on Amazon Web Services. Only one cloud deployment is offered, with no on premises, private cloud or region choice. One gap remains: the tenancy model is not stated, so a buyer cannot tell whether the deployment is shared or single tenant, or how customers are separated.

A named certification is claimed without scope or date, and the report is reachable only through sales. The vendor says it has achieved and maintains SOC 2 Type II and that its security policies are regularly reviewed and validated under SOC 2. No auditor, audit period, report date or scope is published. To get the latest Type II report, readers are told to contact their Account Executive. A GDPR badge sits under the same Certifications heading but is not a certification: it describes best practices for strict compliance, with no attestation, auditor or scope.

The security page itself is substantial and published by the vendor, covering hosting, encryption, data use, recovery objectives, ownership, policies, retention and penetration testing. There is no self serve route to evidence.

The vendor refers to the models in general terms and identifies nothing beneath them. It says its systems are built on large language models, that these suit large data sets, and that the playbooks are powered by LLMs and trained on the most common provisions. No model or provider is named, no architecture is described, and nothing says whether the models are the vendor's own or a third party's. The Terms of Service and the Data Processing Addendum were both read in full and neither names an AI subprocessor; the DPA's third party list is available only on request.

Amazon Web Services is named as the host and as a subcontractor in the support exclusions, but that says where a model runs, not whose model it is. With no model named, there is no change notice to describe.

No pricing is published at any level, not even the unit of charge. There is no pricing page, rate, band, tier, feature split, minimum term, seat minimum or free tier. Every purchase path leads to a demo or contact request. The agreement confirms this: fees are set in an Order Form, and clause 2.3 leaves the unit of measure to each order, whether named users, concurrent users, devices, locations or transactions. That describes what an order may contain, not what this vendor charges for.

Two terms govern how prices change rather than what they are. Clause 5.3 caps any renewal increase at the lesser of two percent of the prior year's charges or the rise in the vendor's list prices, which protects the buyer. Clause 5.4 sets payment within thirty days, with a one percent monthly late fee and a process for disputes raised in good faith. Clause 5.6 requires a satisfactory credit check before a subscription starts.

Who the product serves is listed explicitly, and the limits are left open. Seven segments are named: legal departments, sales departments, procurement departments, global enterprises, high growth businesses, private equity firms and law firms. The named customers span technology, professional services and life sciences. The material frames the platform for teams reviewing recurring commercial agreements at volume, and for nonspecialists applying positions the legal team has set.

The coverage boundary is open. Contract types are covered only by the claim that playbooks are ready to use on virtually every contract type, with no list of supported agreements and no statement of where the product works less well. Practice areas are not addressed; coverage is organized by buyer function. Government use is not described.