O

Ontra

The models drive the data products and sit as a layer on the service products. Insight extracts clauses and covenants from fund and credit agreements into structured obligation data, Accord produces AI markup against a digital playbook, and DDQ generates responses from a precedent library; all three are model driven. But for Contract Automation, the flagship, Ontra's pricing page says the work is done by people: qualified contract professionals on Standard, qualified lawyers on Advanced, and lawyers described as having experience at top firms on Premier.

Remove the models and an outsourced negotiation service and an entity directory remain saleable. A core capability is model driven, on a workflow and document platform that would still work without it.

Accuracy is asserted and never measured. The AI page promises “reliable AI” and “expert-validated, actionable intelligence”, and AI Search is marketed as answering questions “informed by the full scope of your agreements”. No accuracy figure, test set, evaluation or named failure mode is published. Nothing published shows that an answer links back to a source passage a reader can open and check. The expert review process that catches hallucinations is covered under Autonomy and Oversight.

The product works on the customer's own fund documents rather than primary law, so grounding to primary authority and citation status checks fall outside what it claims.

A written human review commitment is published with a described mechanism. The security page sets out a Human-in-the-Loop Model in which subject matter experts continually review text outputs for accuracy, flag potential hallucinations and enforce consistency across repeated questions. They then trace root causes to retrieval augmented generation prompting, query understanding or embedding models, naming the layers of the pipeline where failures are diagnosed.

The pricing page adds a second control by tiering who does the work, from contract professionals to lawyers described as having experience at top firms. The rest of the control structure is missing: no thresholds, no statement of what runs unattended and what a customer must approve, and no described review screen or escalation route in the product.

Attribution is strong, and the figures sit on the other side of it. Named customers come with named officers and titles: Vincent Taurassi, General Counsel and COO at Sentinel Capital Partners; Lizette Perez-Deisboeck, General Counsel and CCO at Battery Ventures; Jonathan Romick, General Counsel at Linden Capital Partners, describing an SEC production; and Ed Zelaski, Director of Compliance at Blue Point. Blackstone and Bain Capital Credit have their own case studies.

Separately, the vendor publishes portfolio figures: more than 1,000 customers, more than 2 million documents processed, 9 of the top 10 PEI ranked firms, and 96 percent customer retention. A footnote gives the retention method: the average across customers using a platform solution for at least a year as of December 2025. That is a dated, assessable method, but it describes the vendor's book, not what changed at a named firm. Named customers come without figures, and figures without a named customer.

Training and model provider retention are answered; separation is not. The security page says Ontra never uses customer data to train models, and that data passed to third party LLM providers is processed only to deliver the service and deleted afterwards, which states what the model provider keeps. Terms of Service clause 10.2 commits Ontra to a reasonable degree of care over User Data. Against that, clause 6.2 reserves the right to collect usage data on an aggregated and anonymized basis to improve products, except as limited by a Customer Agreement.

The no training promise therefore lives on a marketing page while the published agreement reserves an improvement use. Nothing documents separation between tenants, and clause 10.2 warns that other Users with access rights may reach User Data. Privilege and work product are not addressed, and the Customer Agreement is unpublished.

A real position covering the product, not just the website, is published. Terms of Service clause 12.2, headed No Legal or Other Advice, says nothing in the Services, software or documentation is legal advice, that Ontra is not a law firm and provides no legal services, advice or representation, and that no attorney client relationship is formed. It places responsibility for decisions taken in reliance on output with the user.

The clause reaches the Platform, not only the marketing site. It sits in tension with the business: Ontra runs the Ontra Legal Network, and the pricing page sells access to qualified lawyers who negotiate the customer's contracts. Nothing addresses the buyer's own competence and supervision duties, no jurisdiction limits are named, and ABA Formal Opinion 512 is not mentioned.

Ontra holds ISO 42001, the international management system standard for AI, stated on the security page and shown as a badge on the home page. A certified AI management system is a governance framework with real substance, not a set of principles. Three things are missing. No person or committee at Ontra is named as accountable, no testing regime before release is described, and no result is disclosed on uneven output across document types, jurisdictions or counterparties. The SOC 2 and ISO 27001 attestations belong to security rather than AI governance.

Most of the ground is covered, and the gap is incident practice. The security page publishes AES-256 with rotating keys at rest and TLS 1.2 or above in transit, says third party LLM providers encrypt in both states, and commits to deleting data passed to those providers once processing is complete. It names a dedicated security team and the tools it runs: SAST, DAST, CDR, EDR, continuous GRC, WAF and MDM. A subprocessor list is published on the trust center at trust.ontra.ai, which also offers email notice of subprocessor changes.

Not published: any incident response or breach notification practice, or any statement of how long documents and generated outputs are kept inside the platform, as distinct from the zero retention commitment at the model layer.

The published allocation is specific and runs one way. Terms of Service clause 13.2 caps Ontra's total liability at $100, disclaims all consequential, incidental and special damages, including loss or corruption of data, and carves out only fraud and willful misconduct. Clause 12.1 provides the Services as is with all warranties disclaimed, and clause 13.1 runs the only indemnity from the user to Ontra. There is no warranty on output, no insurance position and no indemnity to the customer.

The document that would actually govern a buyer is not published. Clause 1 says a customer's written Customer Agreement supersedes these Terms, and no Customer Agreement, MSA or DPA is published on the site. The figure and the carve out can be read before signing, but what is published disclaims the exposure the product creates rather than standing behind it.

Real integrations are named and described by what they do rather than how to configure them. The Ontra MCP Server gives a customer's own LLM real time, read only access to Atlas entity data, so a firm can query entities and ownership structures from its existing AI tool; direction and permission model are both stated. The Terms of Service name Ontra for Word as an application plugin, placing the product in the drafting tool lawyers already use.

The Atlas pricing panel includes a Standard API package, the DDQ panel lists flexible exports, and Insight publishes side letter compliance exports. Contract Automation includes a document management system in all three editions. No integrations page, developer index or configuration documentation is published, and no connector to a legal document management system such as iManage or NetDocuments is named.

Cloud delivery is obvious, and neither tenancy nor residency is stated. The product is a web platform reached at app.ontra.ai, but none of the home page, the AI capabilities page, the security and privacy page, the pricing page or the Terms of Service states a tenancy model or offers a data residency region, and no processing location is given separately from storage. The only published point touching location is that third party LLM providers encrypt data in transit and at rest, which says nothing about where either sits. A trust center sits at trust.ontra.ai on Vanta.

The certification set is strong. The security page states SOC 2 Type 2 across all five trust services criteria, with the scope specified, plus ISO 27001:2022 with the version named and ISO 42001. A trust center on Vanta at trust.ontra.ai is linked from the security page and says it carries subprocessor information and offers notice of changes. No auditor is named and no coverage period or report date is published, and nothing says whether reports can be downloaded, sit behind a click through, or require a sales conversation.

The architecture is described in detail and the providers behind it are never named. Ontra names its own pipeline layers, retrieval augmented generation, query understanding and embedding, and states a zero retention commitment at the model layer, so the shape of the system is visible and the model provider is known not to keep customer content. Nothing published answers the question of whose model sees customer content.

No model, model family or provider is named, and no inference location is stated. The trust center at trust.ontra.ai has a dedicated subprocessors page with email notice of changes to the list, so a change notice mechanism exists.

A real pricing page carries tiers, feature splits, the unit of charge and one actual number. Contract Automation publishes three editions with a comparison matrix covering playbook customization, who does the work, turnaround and document management. It states a monthly minimum fee of $2,000 on both Advanced and Premier, and no monthly minimum on Standard. Insight for Funds publishes three tiers and Insight for Credit two, each with a populated feature matrix.

Atlas, Accord, DDQ and KYC publish what their licenses include and route the figure to Request Pricing. Free trials and a proof of value are offered without a sales gate on several products. The rate per document that actually drives the bill is never published, so the floor is known but not the price, and six of the seven products carry no figure at all.

Coverage is described by buyer and by workflow with real precision. The site has pages by team (legal, compliance, finance and investor relations) and by firm type, covering investment firms, investment banks and law firms, the last aimed at automating MFN processes. The practice scope is concrete: NDAs and other routine contracts, engagement letters, side letters and MFN elections, credit agreements and covenants, entity management and CTA compliance, reverse KYC, and investor due diligence questionnaires.

The private markets framing is a real boundary, and the vendor repeats it everywhere. Limits inside that boundary are not stated. Nothing says which document types Contract Automation will decline, government use is not addressed, and the only scope caveat located is a pricing footnote that some document types, such as commercial agreements or engagement letters, take 48 hours rather than 24.