O

Ordalie

Remove the models and there is nothing left to sell, which is the A band. The agreement itself settles it rather than the marketing: Terms of Sale clause 2.1 defines the subscription as three things and all three are model-run, an AI assistant that answers legal questions and analyses documents, a search engine described as using AI algorithms to understand the links between legal documents, and intelligent document generation producing contracts, memos and analyses.

There is no fourth, non-AI service in the definition; the only other item is training and support in the use of those three. The corpus underneath is real and large, and the tempting counter-argument is that a searchable database of 102 codes and case law would still have value with the models switched off. It does not carry, for the vendor's own reason: that database already exists free at Legifrance, and Ordalie positions expressly against it, naming manual Legifrance research as the thing it replaces.

What the buyer pays for is the synthesis and the citation, not the texts. Pricing follows the same logic and is stated in model terms, the free and paid tiers being separated by which legal AI models are available, basic against advanced, and by query volume rather than by any non-AI feature. Verified 12 September 2026.

Grounding is real, documented and openable by the reader, with a described retrieval method and no published measurement, which is the B band precisely. The grounding limb is met more fully than most records in this corpus reach: every answer displays its sources alongside it, citations carry direct links to the original text, references are given to the article, judgment number or page, the excerpts actually relied on are shown, and where possible the link resolves to Legifrance so the reader lands on the official version rather than a vendor rendering.

The retrieval method is described rather than asserted, the documentation stating that the assistant selects the relevant sources itself, shows the user which ones it selected, then sorts and synthesises them into an answer with matching citations, with legal references detected and formatted in real time as the answer is written. The user controls the retrieval perimeter by switching source families and jurisdictions on and off.

What is absent is everything A adds. No accuracy figure, error rate, test set or evaluation of any kind is published, so nothing here is testable by an outsider. Citation status is not checked, which is graded on the citator signal. And no statement was located describing what the system does when it finds no support. R40 governs the floor and the D limb does not fire: the no-hallucination claim on the marketing sits alongside architecture that is documented in detail, so it is not a bare claim. Verified 12 September 2026.

A written commitment that the product works alongside a supervising lawyer, with real review surfaces, short of any threshold at which it proceeds alone. The review surfaces are concrete and are the strongest part of this row: every answer carries clickable source dots the user opens to confirm the detail, the editor ships track changes where every modification is traceable, commentable and reversible, and the Ledger documentation tells the user in terms that its filters are there to help review and not to replace checking the cited source.

The route back to human judgement is contractual, Terms of Use 5.2 stating that Ordalie is not authorised to provide legal services and that the texts, positions and analyses it presents do not constitute legal recommendations or professional legal advice, and encouraging the user to seek the opinion of a duly qualified professional. Human oversight is also one of the five named dimensions of the CNB alignment claim.

R37 rule 2 governs what holds it off A. The same estate markets workflows that return a finished deliverable ready to export as PDF or share with your client, and press material describes automating up to eighty per cent of repetitive tasks, which cannot sit comfortably alongside a review-every-answer posture. The conflict is not itself the downgrade; what it reveals is that no threshold, confidence boundary or class of work is published at which the system runs without a reviewer, and no statement addresses what happens after it is wrong. That is the limb the B band names. Verified 12 September 2026.

Real deployment evidence with substance on both limbs separately and neither joined to the other, which is the B band in its exact terms. Customers are named: a logo strip headed as legal teams who use Ordalie daily carries Mondial Relay, Radio France, Ifop, Aramis Group, the Congres des Notaires de France, Editions Tissot, Carlini Avocats and Gouache Avocats, a mix of corporate legal departments, an institution and two law firms.

Three testimonials are attributed to a named individual and organisation, including the legal department of SNCF Connect and Tech and the Congres des Notaires de France, which under R122(2) is named customer evidence rather than outcome evidence and is counted here as attribution, not as a result. Figures are published separately: eight hours saved per week on average, a case timeline in three minutes against a stated manual baseline of three hours, and an hour instead of a full day.

The two never meet. Not one figure is attached to a named customer, no date appears against any deployment or any figure on the surfaces read, and no method is published for the eight-hour average, so a reader cannot tell what population it was drawn from or over what period. That is precisely what the B band describes, a named customer without figures and figures without the named customer. The case studies and news estate were not opened; under R25 they corroborate rather than carry a row standing on the strip itself, and they are the artifact that would move this row if they carry dates and a stated basis. Verified 12 September 2026.

Four of the five A limbs are met and met contractually, and the fifth fails, so the conjunctive band gives B. This is the closest call on the record and the note names the whole of it. Training: Terms of Sale 9.1 states flatly that client data is not used to train models, which is the agreement rather than a policy page. Segregation: case-based spaces, projects gathering a matter's material, role-based permissions, personal connections kept private from organisation connections, personal tags, and a statement that a user's own sources are never accessible to other users.

Privilege addressed directly, which R33 makes decisive and which most records fail: legal privilege is named as the governing constraint on the lawyer-facing surface and carried as its own security commitment, and clauses 7.1 and 9.3 give it a mechanism rather than a slogan, an irrevocable undertaking binding Ordalie and its employees not to use or reveal the content of documents transmitted, with liability expressly acknowledged for breach, and a single narrow exception for salaried developers correcting a processing error, limited to files that errored, refusable by the customer, with correction copies irretrievably destroyed twenty-four hours after the error.

Third-party model providers: made explicit, the inference providers being contractually required to process in France, not to reuse client data for training and not to retain prompts, outputs or associated metadata. The limb that fails is retention and deletion stated. Deletion is stated well; retention is not, and worse, it is stated inconsistently, the pricing matrix offering unlimited history on the paid tiers while the documentation says conversations are kept for thirty days, and the agreement giving no period at all for uploaded documents. Verified 12 September 2026.

A real published position on advice against tooling, reaching further into the supervision dimension than most records at this grade, short of the treatment A asks for. The advice line is drawn in the agreement rather than in a footer, Terms of Use 5.2 stating that Ordalie is not authorised to provide legal services, that the texts, positions and analyses presented, suggested or found are not legal recommendations or professional legal advice, and directing the reader to a duly qualified professional.

That is specific about what is disclaimed and it is readable before signing, so C does not fire. The supervision dimension is touched rather than left out, which is unusual: the vendor states that the product is designed to align with the French national bar council's guidance on AI use by lawyers and enumerates human oversight and traceability among the dimensions, which engages the duty rather than merely disclaiming advice.

What holds it off A is who may use it and where. Three professional audiences are addressed by name, lawyers, in-house counsel and notaries, but the free plan is open self-serve to anyone with an email address and nothing published states that the product is for professionals only or addresses use by a non-lawyer, the nearest thing being a contractual bar in clause 3.1 on registering under a false professional status, which polices accuracy of a declaration rather than eligibility.

No jurisdictional limit on reliance is stated, on a product answering across five named jurisdictions, and nothing describes how a supervising lawyer discharges a competence duty over its output. Verified 12 September 2026.

A position exists and no mechanism, testing regime or accountable owner is published, which is C. What is located is an alignment claim rather than a governance programme: the vendor states that the product is designed to align with the CNB's requirements for AI use by lawyers and lists transparency, confidentiality, human oversight, data protection and traceability as the dimensions engaged. That claim is graded on the bar guidance signal, where it earns the named-guidance value, and it is deliberately not credited a second time here, because working one fact across two rows is the error the ground rules warn about most.

Read as governance it is an assertion of compliance with an external framework, unaudited, with no mapping document, no published assessment against the seven requirements and nothing a buyer could inspect. R36 is the calibration point and it cuts against a B: ISO 42001 earned a B because it is independently audited, and there is no ISO 42001 here. SOC 2 Type II and ISO 27001 are security attestations and are graded on the certifications row.

Nobody inside the vendor is named as accountable for AI, nothing is published about what is evaluated before a model or a workflow ships, and no incident or failure has been disclosed. Bias is addressed nowhere, and the shape it takes on this product is worth naming: answers are assembled from source families the user switches on and off across five jurisdictions of very different depth, so output quality is structurally uneven across practice areas and jurisdictions, and nothing published examines that. Verified 12 September 2026.

Four of the five limbs are published and specific and the fifth is both vague and self-contradictory, which is B. Access control: AES-256 at rest and HTTPS/TLS in transit, account isolation, access to content limited to authorised persons and logged where needed for security, operation or support, role-based permissions, and SSO/OIDC with access governance on the top tier. Subprocessors: a genuine named list in the privacy policy at article 3.4, Scaleway for hosting, AI inference providers including Azure France, and Stripe for payment, each with its function stated, updated 6 June 2026.

Incident practice: Terms of Sale 9.4 commits to notifying the customer without undue delay of a personal data breach so the customer can meet its own obligations. Deletion: unusually precise, content erased immediately and irreversibly from production environments when a user deletes it or the applicable period ends, with residual copies acknowledged as remaining in encrypted backups until overwritten, which is a more candid account of backup reality than this corpus usually sees.

Retention is the gap and it is a real one. No period is stated for uploaded documents anywhere in either agreement, the contractual formula being the period applicable to the relevant workspace or organisation without saying what that period is or who sets it. The documentation states that conversations are kept for thirty days while the pricing matrix sells unlimited history on both paid tiers, and nothing reconciles them.

The retention-side commitment that is specific runs to the inference providers rather than to Ordalie: they are contractually barred from retaining prompts, outputs or associated metadata. Verified 12 September 2026.

A real published position on liability that goes beyond disclaiming, short of anything that reaches the exposure the product actually creates. C does not fire, and the word that decides it is C's own: liability is not addressed only through a limitation clause. Two provisions go further. Terms of Sale 7.2 is an undertaking to carry professional liability insurance and any policy covering the risks of its activity, which is a published insurance position and is rare in this corpus.

Clauses 7.1 and 9.3 close the confidentiality undertaking with an express acknowledgement that Ordalie may be held liable for breach of it, which is a vendor accepting liability by name rather than excluding it. The limitation itself is comparatively narrow as drafted, Terms of Use 5.4 limiting liability to direct and proven damages rather than excluding whole categories of loss. What keeps it well short of A is that none of it is quantified or invocable and none of it touches accuracy.

No indemnity of any kind was located. No cap figure, no insurer, no cover limit and no statement that the customer benefits from the policy. No warranty of output, and the opposite: Terms of Use 5.1 supplies the site on a best-efforts basis with no obligation of result and tells the user they proceed at their own risk, and Terms of Sale 8.2 makes the user solely responsible for their use and disclaims responsibility if the service does not meet their needs.

The availability target of 99.95 per cent is expressly stated not to be an obligation of result and not to found any liability action, which sits against the pricing page selling priority support with an SLA on the top tier. So a buyer relying on a wrong answer has recourse to nothing published. Verified 12 September 2026.

Documented, verifiable integrations into the systems legal work already lives in, with direction and configuration described, which is every limb of the A band. Eighteen connectors are named and each carries its own documentation page: SharePoint, Workspaces, OneDrive, Outlook, Gmail, IMAP, Google Drive, Dropbox, Box, Nextcloud, Tomorro, Eudonet, Odoo, Nuxeo, iManage, Secib Neo, Microsoft Teams and Managed APIs, with Agestia named alongside.

Two of those are the systems this axis exists to test: iManage, the document management system a large part of the profession runs on, and Secib Neo, a French law-firm practice management platform. Direction is stated rather than implied, and stated per connector: iManage is brought in read-only through OAuth using credentials generated in iManage Control Center, Dropbox and Box can be granted write access so Ordalie saves produced documents back and creates folders, and the general rule is published that a read connection browses and previews while a write connection returns output to the source.

What a firm must configure is published to the field: tenant, site, client ID and secret or a certificate for organisation-wide SharePoint, WebDAV URL and credentials for Nextcloud, instance URL, optional database name and API key for Odoo, and a documented choice for iManage between one shared connection and each member signing in individually. Personal against organisation scoping is documented throughout, as is revocability.

Two limits are recorded and neither is an A limb: there is no public developer API, the managed APIs being described as for AI-assisted work rather than a general developer console, and two-way synchronisation is routed to the separate Vault module. Verified 12 September 2026.

Regions, tier differences and the processing-against-storage distinction are all published, which is the full A band and makes this the strongest residency disclosure located in this pull. The region is named and then named again at the level below: hosting is in France, and the host is identified as Scaleway with its corporate registration and its registered office given in both agreements, with the privacy policy going as far as the specific site, Paris 2.

What changes between tiers is published on the pricing matrix rather than left to a sales conversation: on-premise deployment is marked absent on the free and PRO tiers and present on MAX, alongside SSO/OIDC and access governance, and the enterprise route is described as adding on-premise or private hosting and custom connectors. The limb almost every record in this corpus misses is the one this vendor answers most deliberately.

Where data is stored and where it is processed are addressed separately and by different mechanisms: storage sits with Scaleway in France, while inference is performed by third-party providers, including Azure France, that are contractually required to process the data in France. So a buyer is told not merely that the service is French-hosted but that the model call does not leave the jurisdiction either, and is told which instrument makes that true.

Recorded and not credited, because it belongs to other rows: the same clause bars those providers from retaining prompts and outputs, which is stewardship, and identifies them, which is supply chain. One honest limit on the record: no region other than France is offered, so this is a single-region product, and the disclosure is complete rather than the choice being wide. Verified 12 September 2026.

Certification is real, named and stated in the vendor's own voice, with no route to the evidence, which is the B band. Two standards are claimed, SOC 2 Type II and ISO 27001, and they appear on the lawyer-facing page, in the answer to a direct FAQ question about client data protection, in a certifications panel and in the site footer. C does not fire, for two reasons that are worth separating. These are not unexplained badges: the claim is made in prose, in response to a question a buyer would actually ask, and it is accompanied by an infrastructure panel giving a last audit of January 2026 and a commitment to annual security audits, so a date of sorts is published.

And R16 does not bite the way it did on comparable records: the subject of the sentence is Ordalie, not its host, and the vendor does not reach for Scaleway's certifications to stand in for its own. What is missing is the whole evidentiary apparatus that A requires. No auditor is named for either standard. No report period or observation window is given, no certificate or report number, and no scope statement saying which systems or trust services criteria the SOC 2 covers.

There is no trust centre of any kind, and no route to a report at all, not even a sales-gated one: the site's own Security link in the footer resolves to the privacy policy rather than to a security page, so the page inventory contains no security surface. R5 is therefore not reached, because there is no access flow to grade. Nothing is published on penetration testing, vulnerability remediation or an incident response function. Verified 12 September 2026.

A provider is named and no model is, with no change notification, which is the first limb of the B band exactly. What is disclosed is more than most: privacy policy article 3.4 identifies AI inference providers, including Azure France, as a category of recipient, states what they are contractually required to do, and Terms of Sale 9.1 repeats the naming, so a buyer learns that inference runs through Microsoft's French Azure estate and not merely that advanced models are used.

Where the models run is stated, in France, contractually. R34 governs the rest and holds this at B: the A band lists the models being named and their providers being identified as separate limbs, and no model or version is named anywhere. The vendor's tier language, basic against advanced legal AI models, is a commercial label rather than a disclosure. No commitment to notify customers when the model or provider changes was located; the fifteen-day notice in Terms of Sale 2.3 attaches to deletion or major modification of a service, which is a different object, and the subprocessor list is framed as accurate as of the date of the policy update rather than as maintained.

The genuine tension on this row is recorded rather than resolved: the company's own positioning, and press coverage repeating it, is that Ordalie develops its own models, while its published documents name third-party inference providers. Both can be true at once, but nothing published reconciles them, so a reader cannot tell whether a given answer came from a model Ordalie built or one it rented. Verified 12 September 2026.

A buyer can learn what this costs without speaking to anyone, which is the A band, and the surrounding commercial mechanics are published to a level few records reach. Rates: a free plan at zero, PRO at 75 euros excluding VAT per user per month, MAX at 99 euros on the same basis, with annual billing at a stated ten per cent discount, giving 67.50 for PRO. The unit is named explicitly and repeatedly, per user and per month, and the VAT treatment is stated.

The structure is set out in a twenty-six row comparison across the three tiers covering models, query volume, history, source limits, uploads, exports, collaboration, integrations, governance and support, with an explicit legend for included, limited and not included. What implementation adds is answered for the self-serve range: purchase is by card or SEPA through a Stripe portal, seats are added or removed by an administrator with immediate prorated effect, plan changes prorate in both directions, monthly carries no commitment and cancels in a few clicks with no notice period, annual is billed once for twelve months, and invoices are consolidated and self-downloadable.

Two things are recorded and neither displaces the grade. The enterprise route beyond MAX is quote-based, covering Vault, on-premise or private hosting, custom connectors and pilots, which is the ordinary withholding at the top of a published range. And the same page contradicts itself about what the top tier includes, the matrix ticking the Vault module and on-premise deployment for MAX while the FAQ places both beyond MAX in the enterprise offer.

The Terms of Sale add a third conflict, stating prices include VAT at twenty per cent where the pricing page says all prices exclude it. Verified 12 September 2026.

Who this serves and what it covers are described with real substance, and the boundaries are left open or stated inconsistently, which is B. The audiences are three and each has a page of its own rather than a line in a list: lawyers in private practice, in-house counsel, and French notaries, the last being a genuinely distinct professional segment this corpus has not seen addressed before, supported by named notarial customers and workflows built for notaries.

Collaboration is described at firm level, with shared case files, role-based permissions and a private space per lawyer. Practice coverage is enumerated rather than claimed: the source documentation lists the 102 French codes by category, names the courts whose decisions are carried, identifies BOFiP for tax, and describes how a practitioner narrows the perimeter, with a worked example of a business-law specialist switching off the public health and urban planning codes.

Real limits are published, which is more than most: jurisdictions are selectable rather than assumed, uncovered countries are requestable, and the Ledger documentation warns that its filters may be incomplete. What holds it off A is that the boundary is not drawn where a buyer needs it. No firm size or segment is stated anywhere on the vendor's own surfaces, no practice area is identified as unsupported, and government use is not addressed.

More sharply, the coverage claim itself is inconsistent across live surfaces: the lawyer page and FAQ describe 3.5 million official texts across eight jurisdictions and name them as France, the EU, Germany, Italy, Spain, Belgium, Switzerland and Luxembourg, while the source documentation describes France, the EU, Luxembourg, Great Britain and Switzerland, carries no German, Italian, Spanish or Belgian corpus at all, and its own metadata says two million references. Verified 12 September 2026.