S

Sirion

Sirion's contract lifecycle platform came before its AI, and the company has traded since 2012. The product is organized as Store, Create and Manage, covering repository, drafting, approval, negotiation, obligation tracking and performance management. Without the agents and agentOS, a working enterprise CLM remains, and Gartner classifies it as one. The models drive the capability Sirion now sells on top of it. Agents are described as extracting and normalizing contracts, assembling first drafts from a playbook, proposing redlines on the other side's paper and monitoring obligations. Customers can also build and deploy their own agents in agentOS.

AskSirion answers questions within one agreement or across the enterprise contract corpus, combining relevant clauses with related obligations, service levels, and counterparty records. Each answer links back to its underlying source, and the interface explains how it interpreted the user's request. Follow-up questions preserve context, while summaries, financial calculations, and date calculations draw on the same contract information.

Retrieval over the customer's agreements is therefore traceable. Sirion describes no externally reproducible accuracy evaluation, error breakdown, or legal citator. References to an agreement establish the source of a commercial term, rather than verifying that an external legal authority remains current.

AskSirion interprets a request and orchestrates agents for drafting, redlining, extraction, obligation tracking, and invoice reconciliation. Custom agent setup uses ordinary language to define the task, accessible data, connected systems, and when to escalate to the user. Agents can be tested with real scenarios and refined after launch. Recommendations include explanations and source links that allow review against the underlying contract.

This gives administrators an escalation mechanism beyond a general promise of human control. Sirion does not describe default stop conditions, the approval interface for consequential actions, or recovery after an incorrect action. The launch sequence permits an agent to go live before subsequent scenario testing.

Three customer representatives speak on the record with their roles and employers. Edzard Janssen is Chief Procurement Officer at RBI. Reinhard Plaza-Bartsch is Head of Digital Supply Chain and Operations at Vodafone. Angella Dikmic is Manager of IT Vendor Management at GTAA. All three quotes are qualitative, and all three people work in procurement or vendor management rather than legal. The five percentage claims name no customer and read as product capabilities, so named customers and published figures are never paired.

About 25 enterprise logos appear, including Citi, GE, Coca-Cola, Chevron, PayPal, Bayer, Rolls-Royce, Aramco, Yamaha, DP World and Zalando. Customers are in more than 70 countries, with more than $450 billion of contract value under management. Sirion also publishes a case study library.

Vendor library articles say customer data stays within the customer environment and is not used to train external language models. Clause 4.2 of the SaaS Terms, version 6, modified 26 August 2026, says otherwise. It reserves a right for Sirion to have its automated systems review and process Customer Data to generally inform machine learning capabilities in the services. None of the published agreements offers an opt out, and the agreement, not the library articles, is what binds.

The rest of the confidentiality framework is published and can be read before signing. The data processing addendum stores and processes all customer data in a Sirion application instance specific to the customer. It sets Article 32 technical and organizational measures, with AES-256 at rest and TLS 1.2 in transit. It imposes need to know and least privilege access with automatic logout, requires deletion within 30 days of termination, and commits to notifying the customer of a confirmed security incident within 72 hours.

Section 5 of the SaaS Terms adds mutual confidentiality, with a duty to give prior notice of any authority or court demand so the other party can object. The published agreements and trust center do not address privilege or work product.

The platform is sold to procurement, sales and finance teams as well as in house legal, all working on the same contracts. The three customer referees Sirion features are procurement and vendor management leaders, not lawyers. The home page, the trust center index with its AI ethics, compliance and security sections, and the terms and policies index say nothing on where tooling ends and legal advice begins. There is no statement that Sirion does not give legal advice, no professional responsibility or ethics page, no named bar or ethics guidance, including ABA Formal Opinion 512, and no jurisdiction limits.

The trust center has a section titled Artificial Intelligence Ethics and Governance, last modified 16 December 2025, and its whole content is three sentences. They say Sirion has set up an AI Governance Program called S-AIGP, which monitors and ensures compliance with the EU AI Act 2024/1689 and other AI regulations as they emerge. Readers are told to contact their Sirion Account Executive for more. Sirion publishes nothing on who owns model behavior, what is tested before release, how the program works, or bias and uneven output.

The data processing addendum, version 3, modified 2 July 2026, covers retention, access, subprocessors, incidents and encryption. Appendix B sets the retention period by the controller's contractual direction. Clause 8.1 requires deletion or return of all Customer Personal Data, including copies, within 30 days of termination. Any retention the law requires is limited to that purpose and stays under the agreement's protections, and the SaaS Terms add automatic deletion after 30 days as a backstop.

Access runs on a need to know and least privilege basis, with automatic logout on inactivity. Subprocessors are named in a list published at its own URL. Sirion gives notice and an objection right for any addition or replacement, imposes equivalent terms on each, and is liable for their breaches. Clause 4.3 commits Sirion to notify the customer within 72 hours of establishing material impact from a confirmed Security Incident, and Appendix B says 48 to 72 hours, with updates until resolved.

The definition expressly excludes unsuccessful attempts such as failed logins and denial of service attempts. Encryption is AES-256 at rest and TLS 1.2 in transit.

Sirion publishes its SaaS terms and a separate end user agreement, so both can be read before signing. Clause 7.1 commits Sirion to indemnify and defend the customer against third party claims that use of the services infringes intellectual property. Clause 7.2 sets four exclusions, namely combination with materials Sirion did not provide, unapproved changes, unauthorized use, and use inconsistent with the documentation.

Clause 7.3 gives the remedies of securing the right to continue, replacing or modifying the services, or terminating with a pro rata refund of prepaid fees, as Sirion's sole and exclusive liability. Clause 7.4 has the customer indemnify Sirion over customer data. Clause 8.1 caps each party's total liability, across the whole term, at the fees paid for the subscription in the twelve months before the first event giving rise to a claim.

Clause 8.2 excludes lost profits, lost or damaged data and consequential loss, and under clause 8.3 the cap does not apply to fees owed, breach of confidentiality or the indemnities. Clause 6.2 warrants that the services perform materially in line with the documentation, with a pro rata refund if Sirion cannot correct a nonconformity reported within ten days. Separate Sirion AI Services terms extend the intellectual property indemnity to the AI features, but exclude claims that come from the customer failing to review or validate output.

Section 5.1 of those terms disclaims any warranty that output is accurate or free from hallucinations. No insurance position is published.

Nine named connectors are documented, each with its direction of travel, in the Non-Native Integrations article in Sirion University, last updated 24 February 2026. Four SAP Ariba accelerators cover procurement, bids, awards and contract workspaces. An executed contract request in Sirion creates a purchase requisition in Ariba, and the resulting purchase order is written back. Ariba sourcing events and RFPs become Contract Draft Requests on set triggers, one per bidding supplier with line items mapped, and supplier redlines move into Sirion for legal review.

Awarded RFx events create a draft request with awarded line items synced. Contracts finalized in Sirion copy into Ariba Contract Workspaces with metadata, documents, line items and status. Three more connectors cover supplier master data from Ariba, SAP S/4HANA Business Partners on scheduled transfers, and Oracle ERP with logging, error handling and sync status. The Microsoft Dynamics connector runs both ways in auto or manual mode.

The article describes configuration through triggers, modes and scheduling rather than as a full guide, and the wider Sirion University catalog needs a login. Sirion's openly accessible web pages do not document the Word add in or the Salesforce connector to this depth. No document management connector such as iManage or NetDocuments appears on them.

Sirion's application is SaaS hosted by a cloud provider, according to the data processing addendum, and all customer data is stored and processed in a Sirion application instance specific to that customer. That isolation commitment sits in a contract rather than in marketing. Four underlying providers appear in the trust center, namely AWS, Azure, Oracle and IBM, which suggests customer choice without offering it as an option.

Sirion's published documents make no residency commitment and give no region list or jurisdiction option. Nothing separates where processing happens from where data is stored. A Sirion library article describes the platform's multitenant scalability, which sits awkwardly beside the addendum's customer specific instance, and nothing published reconciles the two.

Appendix B of the data processing addendum names ISO 27001 as a held certification and describes the review process around it. Under clause 7.1, unless agreed otherwise, Sirion will give a copy of its latest security attestation report on the customer's written request, no more than once a year. Clause 7.2 adds a customer audit right, with scope, timing and controls agreed in advance and a reasonable fee. Appendix B also says Sirion reviews its cloud providers' SOC 1, SOC 2 and ISO 27001 reports as part of a shared responsibility model.

That is oversight of the infrastructure rather than an attestation over the application. The report route is open to existing customers, so a prospective customer cannot get the report before signing. The addendum names no auditor, coverage period or scope statement for the ISO certificate. Sirion's trust center states ISO 27001:2022 certification. Its SOC 1 Type II and SOC 2 Type II sections explain what those reports cover, and its security page attributes SOC 1 and SOC 2 to the cloud providers Sirion runs on.

A combination of more than ten large language models and more than 1,200 proprietary small language models powers the contract agents. A routing framework selects a model according to the task, while company content, policies, and risk preferences can refine agent behavior. The same architecture supports extraction, drafting, redlines, obligations, and invoice reconciliation through agentOS. Provider names, model families and versions, and processing locations for individual inference tasks are not identified.

There is also no model change notification commitment attached to this architecture description. The disclosure explains how different model types are combined without identifying every external model a customer inherits.

No pricing is published at any level, including the unit of charge. Sirion's site has no pricing page, no tier structure, no unit per seat, per contract or per agent, no volume banding and no statement of what implementation adds. Every call to action is a demo request. No published figure lets a prospective customer estimate cost before a sales process, even though Sirion publishes its SaaS terms, end user agreement and data processing addendum in full.

Eight industries have their own pages. Financial services is split into procurement and into capital markets and lending. Insurance has a separate solution for triaging underwriting submissions. The others are automotive, IT services, healthcare, pharmaceuticals and life sciences, telecom, and oil and gas. Five departments have their own pages, covering in house legal, legal operations, procurement, sales and finance.

Customers are in more than 70 countries, and the site is in English, German and French. Sirion does not say where the product stops. It excludes no contract or matter types, does not address law firms, government or public sector use, and describes coverage by industry and department rather than area of law.