O
Onspring
Onspring is a no code governance, risk and compliance platform for building and running GRC programs without developers. It covers risk management, regulatory change management, internal audit, policy management, control and framework mapping, third party and vendor risk, IT risk, ESG assessment, and business continuity. Business users configure applications, workflows, surveys, dashboards and reports through the interface, and frameworks including ISO, NIST and CMMC are mapped to controls.
A separate Corporate Counsel solution for in house legal departments covers legal request intake, matter tracking, legal opinions and research, a reusable clause library, and legal cost and budget tracking. Onspring AI, an optional add on module launched in October 2025 and extended into agentic operation in July 2026, is powered by Anthropic's Claude family of models and overseen by an internal AI governance council.
It drafts and revises field content, creates records from prompts, links related controls and requirements, detects duplicates, and summarizes documents such as SOC 2 reports. Named customers include American Family Insurance, Warner Bros. Discovery and Memorial Hermann Health System. Onspring maintains an annual SOC 2 Type II attestation.
Onspring, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Alternatives to Onspring
Vendors in the same categories as Onspring whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
- DDataGuardDataGuard is a European security and compliance platform that runs an organization's privacy program and information security management system in one place.
- SSaifrSaifr is a compliance AI business of FMR LLC, the parent of Fidelity Investments, incubated in Fidelity Labs and operated through Fidelity Labs, LLC and Saifr.ai, LLC.
- TTrustibleTrustible is an Arlington, Virginia company selling an AI governance platform organized around four stages.
- HHolistic AIHolistic AI sells an AI governance platform built from three modules.
- RRed Oak ComplianceRed Oak is a financial services compliance platform from Red Oak Compliance Solutions of Austin, Texas, sold to broker dealers, registered investment advisers, banks and insurers.
- CCorlyticsCorlytics sells a regulatory intelligence platform to banks, insurers, asset managers, payments firms and regulators.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AI here is an addition rather than a foundation, and the vendor says so. Onspring is a no code GRC platform that sold for years before any AI shipped. Onspring AI launched in October 2025 as an optional add on that customers enable and configure, and was extended in July 2026 into agentic operation. The vendor says customers have total control over when and how it is used, which also shows the product works without it.
Removing the model layer would remove an efficiency layer over data entry, documentation drafting, duplicate detection and record linking, and leave the whole platform standing. The AI is real, shipped, documented and dated.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Nothing is published. Onspring AI drafts and revises long form content, creates records from prompts, completes text predictively, and reads and summarizes uploaded documents such as SOC 2 reports to fill fields. Each is a generation task where a wrong output lands in a compliance record. None carries a published grounding claim, citation behavior, accuracy figure, precision or recall for duplicate detection or field extraction, hallucination rate, evaluation, or statement of what the assistant does when it has no answer.
The assistant is documented as able to answer from every record and application in a customer's GRC program, and nothing says how those answers are grounded in the underlying records.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The boundary on agent action is something the customer configures, not only a vendor assurance. The July 2026 release says administrators define the rules that prompt agent action, that automation works within boundaries the system administrator sets, and that the design aims at a governed assistant that keeps users in control. The module is opt in and configurable to organizational standards, and an internal AI governance council is named as the oversight body.
A compliance function can show an examiner three things: whether the module is on, what rules trigger action, and who governs it. None of the mechanics are published. There is no rule syntax, scope limit or statement of what an agent may never do, nothing on escalation or human confirmation, and no description of what the audit trail records when an agent rather than a person acts.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Customers are named. American Family Insurance uses the platform for IT risk and GRC program management, Warner Bros. Discovery for GRC management, Memorial Hermann Health System for audit, and Northgate Resorts reports saving 200 compliance hours from a single integration. The vendor also publishes an annual GRC Benchmarking Report, including a finding that 70 percent of GRC practitioners see simplifying repeated administrative work as the biggest AI opportunity; that is dated, attributable industry research rather than product evidence.
The named customers are described by use case without outcome methods, the 200 hours figure has no baseline or period, and none of the named accounts is a legal department. The evidence supports the GRC product rather than the Corporate Counsel solution.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
General confidentiality is claimed and evidenced; legal specific confidentiality is not addressed at all. The vendor publishes a SOC 2 Type II attestation covering security, availability and confidentiality, and states that information privacy, security and risk management policies are documented with defined roles, responsibilities, policies and procedures protecting stored data. That is a real confidentiality position for a platform generally.
What does not exist: any treatment of legal privilege or attorney work product, any statement about the confidentiality of matter records held in the Corporate Counsel solution, and any acknowledgment that a legal department's records on the platform differ in kind from an IT risk register. Checked the security page, the corporate counsel solution page, the platform pages and the AI announcements. This matters more than usual here because the same platform holds both the legal department's matters and the business units those matters concern.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Not addressed. The Corporate Counsel solution holds legal opinions, legal research and a clause library whose clauses are selected automatically by contract type, and Onspring AI can draft and revise long form field content across the platform. Generated or automatically selected contract language can reach a business user without a lawyer in between, and nothing addresses that risk. There is no statement that output is not legal advice, no position on the reviewing lawyer's role and no professional responsibility material.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
A governance body is named, and nothing it produces is published. Onspring AI is stated to operate under the oversight of the company's AI governance council, and customers can configure the module to their own organizational standards and compliance requirements. Nothing the council would produce is published: no AI policy, model evaluation, bias testing or fairness assessment, accuracy monitoring, drift or regression statement, model card or ISO 42001, and no description of what the council reviews or when. A named committee with no published output is a claim rather than evidence.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Platform stewardship is evidenced, and stewardship specific to the AI is not. The SOC 2 Type II attestation covers security, availability and confidentiality, documented privacy, security and risk management policies are stated, and SecurityScorecard is cited as giving a score of 100 out of 100. Nothing addresses what happens to customer content once it reaches the AI layer: whether customer records, policies or uploaded documents train or improve any model, how long prompts or generated output are kept, or how data flows to the model provider and back.
That gap stands out because the provider is named, so the vendor has disclosed the harder fact and stopped short of the easier one.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
No published position. Nothing is published on liability for AI output, indemnity, warranty, service levels, or remedy where a generated field value, an auto populated record or an agent action is wrong. The agentic release makes this a live question rather than a theoretical one, since an agent acting on administrator defined rules can write to compliance records that an examiner later reads. The vendor's answer to that risk is architectural, in the form of administrator boundaries and opt in configuration, rather than contractual, and no contractual position is public.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Integrations are named, and an open API is documented as the way to extend them. DocuSign, Microsoft 365, Google Drive and Slack are named, and the vendor says other systems connect through the Onspring API. A published customer account credits one integration with saving 200 compliance hours, which is evidence of use rather than a list. None of the named integrations is a legal practice system. There is no iManage, NetDocuments, SharePoint matter workspace, electronic billing or matter management connector, and nothing that would let the Corporate Counsel solution sit inside a legal department's existing document systems. The integrations are the business software a GRC platform needs.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Nothing is published from the vendor. Third party software directories describe the platform as cloud deployed, supporting Windows and macOS, with no mobile app; that is directory material, not vendor disclosure. Onspring's own pages say nothing about hosting provider, region, data residency, single tenant or dedicated instances, or where customer data is processed and stored. The security page could not be read in full, so a residency statement lower on that page may have been missed.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A named attestation, with its scope and currency stated, is published on the vendor's security page. Onspring states an annual SOC 2 Type II attestation prepared under AICPA standards and names the trust services criteria covered: security, availability and confidentiality. Naming the criteria matters, since a SOC 2 covering security alone is a much narrower report, and annual renewal addresses currency. A SecurityScorecard rating of 100 out of 100 is also cited; that is an external scanner score, not an audit.
The auditing firm is not named, the examination period is not stated, and no trust center or self serve request route for the report is published, so the report itself needs a sales conversation.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The provider is named outright, and nothing beyond the model family is. Onspring states in dated announcements that Onspring AI is powered by Anthropic's Claude family of generative AI models, in both the October 2025 launch and the July 2026 agentic release, and trade coverage of both repeats it. That is the fact a regulated buyer's own supervisor is most likely to ask for. No specific model or version is identified and no subprocessor list exists.
Nothing states whether the provider is engaged through an enterprise agreement, what terms govern data sent to it, how data flows, or what happens if the provider changes.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The pricing structure can be found, and no figure can. Subscription pricing scales by number of users and modules selected, with annual and multiyear options; extra modules cost more, and implementation services are included with the GRC Suite under some licensing models. Onspring AI is licensed separately as an add on. A buyer can see how the bill will grow. No price, range or entry point is published at any level, every route is a quote request, and third parties describe the licensing model as complex.
The structural detail comes from an independent review platform's product summary, not from an Onspring pricing page, and no vendor pricing page is published.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is broad across compliance and thin across legal work. ISO, NIST and CMMC frameworks are named, the platform spans risk, audit, vendor and third party risk, IT risk, policy, ESG and business continuity, and named deployments cover insurance, media and healthcare. Legal coverage is a single Corporate Counsel solution, positioned within business operations, describing matter tracking, requests, opinions, research, a clause library and cost tracking.
That is one in house legal use case, not practice coverage. Nothing addresses practice areas, jurisdictions or matter types, or separates a legal department's work from the compliance work the platform was built for. The Corporate Counsel material shows no recent update, while the GRC and AI material is refreshed often.
1 public document
The public pages on file for Onspring, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Client Data in Training
Read Aug 29, 2026
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A published agreement or policy exists and none of it addresses the question either way, or the document that would answer it could not be read and the summary names the retrieval limit. The summary states which shape the silence takes: an improvement right granted that never names training, or no improvement right granted at all.
Terms are silent. The security page describes what the SOC 2 attestation validates, quoted here, and that scope is about safeguarding data rather than about model training. No statement was located anywhere addressing whether customer records, uploaded documents or prompts are used to train or improve any model, in either direction. The gap is pointed because the vendor already names Anthropic's Claude as the model provider, so it has disclosed the harder fact and left the simpler one unanswered.
Checked the security page, the October 2025 and July 2026 AI announcements, the platform pages and the site footer on 29 Aug 2026. Recorded as silent, not as a negative commitment.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
No located public material states how long prompts and outputs are retained.
Not addressed. No retention period is published for prompts, assistant conversations, generated field content or agent actions, and nothing indicates whether retention is configurable or can be set to zero. The platform is explicitly a system of record that retains GRC data by design, but that is record retention rather than AI interaction retention, and the two are not the same question. Nothing states whether an administrator can see or purge what users asked the assistant. Checked the security page, both AI announcements and the platform pages on 29 Aug 2026.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Segregation is asserted in public materials with no published detail on how it is enforced.
Claimed and not documented, and the AI release raises the stakes on it. The vendor states clearly defined roles, responsibilities, policies and procedures protecting stored data, so an access model exists and is asserted. Nothing documents its granularity or whether it constrains the AI layer: the July 2026 assistant is described as living on every screen and answering from every record and application in the GRC program, and no published statement says those answers respect the asking user's record permissions.
For a platform holding both a legal department's matters and the business units those matters concern, that is the segregation question, and it is unanswered. No document management system exists to inherit permissions from, so the second model shape is the only applicable one. Checked the security page and both AI announcements on 29 Aug 2026.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
No located term or policy addresses third party requests for customer data.
Not addressed. No government or law enforcement request clause, no commitment to notify a customer before producing their data, and no transparency report were located. Checked the security page, the platform pages and the site footer on 29 Aug 2026.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
Not addressed, and largely not applicable in the usual sense. This product has no primary law corpus: the AI operates over the customer's own GRC records, policies, controls and uploaded documents rather than over published legislation or case law. The one adjacent disclosure is that governance frameworks including ISO, NIST and CMMC are supported and mapped to controls, which names standards bodies rather than a regulatory corpus with sources, jurisdictions and update lag.
Regulatory change management is sold as a module, and nothing published names which regulatory sources feed it, which jurisdictions are covered, how current the feed is, or on what license basis any of it is obtained. That last part is a real gap rather than an inapplicable one. Checked the regulatory change management product page and the platform pages on 29 Aug 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Not addressed. The regulatory change management module monitors regulatory changes and aligns controls with evolving requirements, and Onspring AI can surface related regulatory controls and suggest which analyst to assign a new control to. That is change routing rather than a currency signal: nothing indicates whether the product flags that a regulation a control relies on has been superseded, withdrawn or amended, and no citator or treatment source is named. Checked the regulatory change management page, both AI announcements and the platform pages on 29 Aug 2026.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
Not addressed. No explicit no answer path, abstention behavior, confidence score or uncertainty signal is documented for either the assistant or the agentic features. The July 2026 release describes an assistant making contextualized decisions across workflows and answering from every record in the program, and says nothing about what it does when the records do not support an answer. The published control is the administrator defined boundary on what an agent may act on, which limits scope rather than describing behavior under uncertainty. Checked both AI announcements, the platform pages and the security page on 29 Aug 2026.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
None located, with the method stated. General web searches combining the vendor and product names with court, opinion, sanction, enforcement and disciplinary terms returned nothing on 29 Aug 2026, and no named docket database or court record tracker was searched. The exposure is low compared with a research or drafting product, since the AI writes internal compliance documentation and fills records rather than citing authority for filings. This records what was found and is not a clearance.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Not addressed. No named ethics opinion, no ABA Formal Opinion 512, no state bar guidance and no engagement with professional responsibility material of any kind was located, including on the Corporate Counsel solution page where it would be most expected. The vendor publishes extensively on compliance obligations owed by its customers' organizations and nothing on the professional duties of lawyers using the legal solution.
Checked the corporate counsel solution page, the resource and report material, both AI announcements and the platform pages on 29 Aug 2026.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
Outside the fee relationship: the buyer is an in house compliance or legal function that bills no client. Customer material reports 200 compliance hours saved from one integration, and the AI positioning rests on reducing repetitive administrative work, supported by a benchmarking finding that 70 percent of GRC practitioners see simplifying repeated administrative work as the biggest AI opportunity. All of that is the customer's internal time.
The Corporate Counsel solution tracks legal costs and budgets, but nothing addresses billing for AI assisted time or producing a record a department could disclose. Checked the Corporate Counsel page, the customer stories and both AI announcements on 29 Aug 2026.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
No located public material supports a client side disclosure obligation.
Not addressed, though one real element is present. The model provider is named outright, Anthropic's Claude family, in dated announcements, which is usually the hardest part of such a pack to obtain. Everything else is missing: no subprocessor list, data processing agreement or trust center, and no self serve route to the SOC 2 report, which is stated to exist but needs a sales conversation. A department could forward the model provider's name and nothing more. Checked the security page, both AI announcements, the platform pages and the site footer on 29 Aug 2026.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Partial record. The platform is built to evidence compliance to auditors and examiners: control authoring, attestations and documentation, evidence capture, task tracking with automated notifications, real time reporting, and framework to control mapping across ISO, NIST and CMMC. A customer can produce what was required, who was assigned, what was done and when. The AI dimension is where it stops short. Nothing indicates that a record carries which fields were AI generated, which model produced them, what sources the assistant drew on, or whether a human confirmed the output before it was saved.
With agentic action now writing into records under administrator rules, the distinction between a human entry and an agent entry is exactly what an examiner would probe, and no published export or audit view addresses it. Checked both AI announcements, the regulatory change management page and the platform pages on 29 Aug 2026.