L

Luminance

The artificial intelligence is the product, and the vendor owns much of the stack. Founded by mathematicians in 2015, it runs a multi model architecture it calls a Panel of Judges, combining foundation, fine tuned and proprietary models. It ships its own legal intelligence model, Luna Crescent, trained in house and deployed in its own environment. Remove the models and there is no product.

Substantive disclosure with a real gap. The vendor publishes ContractIQ Bench, a proprietary benchmark of 189,000 manually annotated and reviewed data points assessing interpretation of named provision types, including liability caps, termination for convenience and confidentiality obligations. It is tested on held out documents and concepts excluded from training, with blind evaluations by legal experts alongside. It publishes a result, 5 percent higher accuracy than leading general purpose models on contract understanding, and a speed figure of 200 to 400 tokens per second.

It also states that the model is trained to prioritize faithful extraction and to identify absence rather than invent an answer. Two gaps remain. The published figure is a relative difference with no absolute accuracy rate and no named comparator models, so a buyer cannot tell what the 5 percent is measured against. And the benchmark is proprietary, with no sample tasks or rubric published, so an outsider cannot inspect or run it again.

A real published commitment with a described control mechanism, short of the full structure. The Panel of Judges architecture is itself an oversight design and is documented: multiple models analyze each clause independently and reach consensus, which the vendor states reduces hallucination risk. Outputs are described as traceable, and Traffic Light Analysis ranks deviation risk visually so a reviewer sees where to look.

The vendor publishes a position piece arguing that human in the loop alone is insufficient and that systems must be designed for accuracy and transparency. Not located: where the review point sits when the product negotiates with a counterparty directly, the threshold at which it escalates to a lawyer, and what the vendor commits to when an output is wrong. The first gap matters because the product sends agreements to counterparties and negotiates on the customer's behalf.

Real deployment evidence with substance, short of attribution and method. Named customers appear in vendor and trade material including Hitachi, AMD, BBC Studios, Yokogawa and Koch, alongside a stated base of more than 700 organizations across 70 plus countries and all four of the Big Four consultancies. A customers page is published. The recurring figure, negotiation time reduced by up to 90 percent, is a vendor claim carrying a hedge and is not tied to any named customer, dated, or accompanied by a method.

Searched the site, the customers page, the press releases and the resources index and located no case study pairing a named organization with figures and a date.

Substantive published commitments, short of the full picture. Segregation is the strongest element and is documented precisely: each customer receives a dedicated single tenant instance with complete isolation and no mixing of data. Access control is documented in depth, including that vendor staff cannot view customer documents without explicit authorization given through the user interface, with all access tracked and audited.

Encryption is specified to the key management service, cipher and rotation practice. Two gaps remain. No prohibition on training with customer content is published anywhere in vendor material, which stands out for a vendor that trains its own models and publishes a figure of 220 million legal documents. Attorney client privilege and work product handling is not addressed directly.

A boilerplate structure sits in the terms while the product is sold well beyond lawyers. Dedicated solution pages target compliance, executive, sales, procurement, finance, human resources and marketing teams alongside legal, and the product negotiates contracts on a customer's behalf. Searched the site, the solution pages, the published terms and conditions, the privacy policy and the resources index on 29 Aug 2026.

No position on advice versus tooling, no treatment of competence or supervision duties, and no statement of jurisdiction limits is published, despite operation in more than 70 countries. The tool is marketed to marketing and HR departments.

Principles and architecture are published without a governance mechanism a buyer could audit. What exists is real and substantial: a published white paper on how the AI is built, a named Director of AI who writes technical material under his own name, and a research team based in Cambridge. There is also a described validation regime through ContractIQ Bench, and a security advisory board of named external experts. That board governs security rather than model behavior, and no equivalent exists for AI governance.

Not located: a named owner of model governance, a testing gate before release as distinct from benchmark results, an AI management certification such as ISO 42001, or anything on uneven output across matter types, parties or populations.

Substantive published policy covers most of the ground in specific detail. The security FAQ describes AWS Key Management Service encryption at S3 and EC2 level with AES-256 keys rotated regularly, TLS 1.2 or higher in transit, and dedicated single tenant instances. It describes role based and division level permissions configured by the customer under least privilege, configurable password and session timeout policy, mandatory staff security training, threat detection through Darktrace's Enterprise Immune System and Juniper firewalls, and an incident management process covering detection, mitigation and communication.

Backups are stated precisely: nightly to a secondary AWS data center in the same region, encrypted, and kept at least 14 days. Not located: a retention period or deletion control for customer documents in normal operation as distinct from backups, and a named subprocessor list.

Liability is addressed only through published terms carrying a standard structure. Terms and conditions are published openly alongside a privacy policy, cookie policy and anti slavery statement, so a buyer can read the allocation of loss before entering a sales process, which keeps this above a pure absence. Searched those documents, the security page and the security standards white paper entry point and located no indemnity running to the customer for third party claims arising from output, no warranty on output, no stated liability cap figure and no insurance position.

Worth noting the product negotiates with counterparties on a customer's behalf, which raises the recourse question more sharply than a review only tool.

Integrations are asserted at platform level with no documentation an implementer could use. The vendor describes connecting intake, negotiation, workflow and repository intelligence in one platform, and a Collaborate product exists for working with counterparties, and third party sources reference Microsoft Word and Outlook working surfaces. What is not published on the vendor's own property, after checking the platform pages, the technology page, the security page and the resources index, is any integrations page, any named connector for document management, contract lifecycle, e signature, CRM or ERP, and any description of what an integration moves or what an administrator configures. For an enterprise platform sold to procurement and finance functions, that absence is notable.

The deployment model is stated clearly, with partial residency detail. Three things are published and specific: a dedicated single tenant AWS instance per customer with complete isolation, deployment within the customer's own environment as an alternative to the hosted option, and backup to a secondary AWS data center within the same region, which confirms data stays in region. The vendor states AWS global infrastructure provides a solution tailored to geographic requirements.

What is missing is the list: no named available regions, no statement of which regions a customer may select, and no statement of where processing happens as distinct from where data is stored.

Certification is real and stated with correct nouns, short of accessible evidence. ISO 27001:2022 is named with its version and described as certification. The SOC 2 Type 2 language is precise: the vendor says it successfully completed a SOC 2 Type 2 examination assessing controls related to security, availability and confidentiality, which names the trust services criteria in scope. Regular independent third party penetration testing is stated.

A named external security advisory board, including a former Director General of MI5 and two former Darktrace executives, is published with full biographies. What is missing is the evidence route: no trust portal is published, no report is downloadable or requestable through a published flow, and no coverage period, report date or auditor name is published as of 29 Aug 2026. A security standards white paper is published, the nearest thing to an evidence route.

The supply chain is partly disclosed and the architecture is described in depth. The vendor publishes that it runs a multi model Panel of Judges combining foundation, fine tuned and proprietary models, that it continuously evaluates and selects the best model for each task, and that its own model Luna Crescent is deployed inside its own AWS environment. It states the consequence in the customer's terms: owning the model reduces reliance on external model providers, limits data exposure to additional subprocessors, and protects customers from third party availability, pricing and access disruption.

Hosting is named as AWS. Not published is which foundation models sit in the panel, from which providers, or which tasks route to them, and no subprocessor list or change notification commitment is published. A buyer knows the shape of the chain and its own model, but not the third party links in it.

No pricing page exists on the property, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path terminates in a demo request. No free trial or self serve entry point is published, and no third party pricing figure is published either.

Who the product serves is documented precisely across two dimensions, each with its own published pages. Six industries: manufacturing, financial services, pharmaceutical, technology, insurance and chemical. Eight business functions: legal, compliance, executive, sales, procurement, finance, human resources and marketing. Both law firms and corporate legal departments are addressed, with a stated base of more than 700 organizations across more than 70 countries including all four Big Four consultancies and named enterprises.

An academic program is published as a separate segment. The practice boundary is clear from the structure and consistent throughout: this is contract work end to end, from generation through negotiation to post execution analysis and investigation, and nothing on the property claims litigation or research capability it does not have.