S

Spellbook

The models are the product. Review, Draft, Ask, Compare and the Associate agent are all generative capabilities delivered through a Word add in that exists to carry them. The company pivoted its whole business to generative AI in 2022, rebranding from Rally to Spellbook. Remove the models and there is no product, only an empty add in.

Grounding is real and documented, with the method described, and no figures are published. The vendor states its architecture explicitly. It does not fine tune; it connects general purpose models to proprietary market data and requires them to retrieve and cite rather than rely on learned patterns, reasoning that putting documents into a model's long term memory encourages hallucination. Compare benchmarks a clause against a stated corpus of more than 2,300 contract types and explains why differences matter, and Ask is published as producing answers with citations.

The vendor also publishes educational material on hallucination risk for its users. Not located: any accuracy figure, hallucination rate, test set or evaluation for its own product. The CEO has publicly questioned outside benchmarking studies of legal AI tools while the company publishes no measurement of its own.

A real written commitment has the models work alongside a supervising lawyer, with a working review surface and no full control structure. Associate is described as the first AI agent that can work through legal matters across several documents with the user's oversight, which puts the oversight position in the product's own headline claim. The delivery model is itself the review mechanism: output arrives as tracked redlines in a Word document that the lawyer accepts or rejects clause by clause, a concrete control point.

Not located: what the agent decides on its own within a matter, the threshold at which it stops, and what happens after an output is wrong.

Real deployment evidence with substance, short of the full A bar. Multiple named customer stories are published with individually attributed detail, including Dropbox with a named associate general counsel on video, Panasonic on saving three weeks building an RFP process, KMSC Law with a named partner, Alturas Capital Partners, Elevare Law and Westaway with a named managing partner. The logo wall names large enterprises including eBay, Fender, Crocs, Franklin Templeton, Hapag Lloyd, Valentino and DirecTV, and the vendor states more than 4,500 legal teams across 80 plus countries.

Figures appear but attach loosely: a named partner states Spellbook helps him bill an extra hour a day, and Panasonic's three weeks is a stated saving. Not located: a dated case study carrying figures with a method a reader can assess.

Substantive published commitments stop short of the full picture. Zero data retention agreements are stated as negotiated with both named model providers, OpenAI and Anthropic, with the mechanism described precisely: customer data in requests and responses is not persisted and exists only in memory to process a request. Encryption, SSO through Microsoft Entra with enforced MFA, and audit controls are stated. Two gaps remain.

Attorney client privilege and work product handling are not addressed directly in located material. Segregation between users or matters inside a customer is not documented, so for a product used by firms no walls at matter level are described.

The audience is unambiguous, transactional lawyers at firms and in house teams, with a signup form that asks a prospect to confirm they are a legal professional and offers no path for non lawyers. The vendor publishes educational material engaging with a lawyer's duty of competence and the obligation to verify AI output. What is not published, after checking the site, the solutions pages, the published terms of service and the learning hub on 29 Aug 2026, is a published position on the advice line, on supervision duties as distinct from competence, or on jurisdiction limits, despite the product being sold in more than 80 countries.

A published governance document has real substance and outside validation, without testing results or a named owner. The vendor commissioned an independent legal opinion from CMS Law on its classification under the EU AI Act, states that it was assessed as low risk, and makes the full opinion letter downloadable from its trust portal along with the controls implemented for that classification. An outside law firm's classification of the vendor's AI system, published in full, is a governance document rather than a principles page.

Not located: a named internal owner of model governance, published results of testing model behavior before release, or any disclosure about uneven output across matter types, parties or populations.

Substantive published policy covers most of the ground, and deletion is the gap. Published and specific: zero data retention at the model layer, with both providers named and the mechanism described; a complete subprocessor list with processing locations in the trust portal; AWS named as primary cloud provider; storage and processing locations stated as Canada and the US; and access control through Microsoft Entra, so a customer enforces its own authentication and MFA policy.

Breach notification is addressed through implemented HIPAA Breach Notification rule controls, with signed business associate agreements downloadable, and a vulnerability disclosure policy is published. The security page and FAQ, the terms of service, the privacy policy and the trust portal entry point were searched. They showed no retention period for the vendor's own storage of documents, prompts and outputs, no customer control over that window, and no deletion commitment.

Liability is addressed only through published terms a buyer can read in advance, without a position on the exposure the product creates. Terms of service, a privacy policy and a refund policy are all published openly, and the refund policy is a published commercial commitment. Those documents, the security page and the trust portal entry point, searched, showed no indemnity to the customer for third party claims arising from output, no warranty on output, no stated liability cap figure and no insurance position.

The vendor will sign a business associate agreement for protected health information, which is a regulatory undertaking rather than recourse for wrong output.

Real integrations exist and are documented, short of depth. The product is delivered as a Microsoft Word add in and also runs in Google Docs, which is the deepest possible integration into the surface where transactional drafting actually happens rather than a connector alongside it. A dedicated integrations page is published, and the ACM product describes contracts arriving from email, Slack and Salesforce. Authentication integrates with Microsoft Entra.

Not located: legal specific document management connectors such as iManage or NetDocuments, and per integration documentation describing what moves in which direction and what an administrator configures.

Deployment model is stated clearly with partial residency detail. The vendor publishes that AWS is the primary cloud provider and that customer data is stored and processed in data centers in Canada and the US, with a full list of subprocessors and their locations in the trust portal. That is a real residency statement naming both jurisdictions. What is missing is customer choice and tenancy: no selectable region, no single tenant or private deployment option, and no statement of the tenancy model is published.

For a vendor selling into more than 80 countries, the absence of an EU or UK processing option is a live buyer question the site does not address.

Certification is real and stated with an open route to the evidence, without published scope. SOC 2 Type II and HIPAA are both named, and the badges on the home page link directly to named, dated resources in the trust portal rather than sitting as decorative images. The trust portal is at a stable URL and carries downloadable documents, including business associate agreements and the EU AI Act opinion letter. It works as a self serve request flow rather than a sales gate. Not located: the audit coverage period, the scope or the name of the auditing firm.

The models underneath are named, their providers identified, where they run is stated, and the commercial terms binding them are disclosed. The vendor names GPT-5 and Claude Opus as the models powering the product on its own home page, and names OpenAI and Anthropic as the providers. It states the zero data retention agreements negotiated with each and what they mean technically, names AWS as the primary cloud provider, states processing locations as Canada and the US, and publishes a complete subprocessor list at a stable trust portal URL.

Naming the specific model versions in marketing copy is what a customer inheriting the dependency needs. No explicit commitment to notify customers before the model supply chain changes is published, though the subprocessor list is where such a change would surface.

Pricing is gated behind a demo request while tier names and feature splits are published, so the shape is visible and the number is not. The pricing page publishes two named tiers, Law Firms and In House Teams, itemizes what each includes, states that pricing is structured around the number of team members on a license, and confirms a 7 day free trial with extended trials available for larger organizations. Free access for academic institutions is published.

So a buyer learns the unit of charge and the packaging without a sales call. No figure appears at any tier, and the only route to one is a demo booking.

Segment and practice coverage is described with substance, without the boundaries. Two buyer segments have dedicated pages, law firms and in house legal, and six industries have their own: energy, healthcare, financial services, technology, manufacturing, and retail and consumer goods. Firm size is addressed in the trial form, from 1 to 10 through 200 plus, and the vendor states more than 4,500 teams across more than 80 countries.

Practice focus is stated clearly and repeatedly as transactional and commercial legal work rather than claimed broadly, which is a real self limit. Litigation appears as an option in the signup form while nothing on the site describes litigation support, and no statement is published of which practice areas or firm sizes the product is not built for.