S

SpotDraft

SpotDraft is a full contract lifecycle system, with templates, conditional workflows and approvals, a shared editor, built in eSignature meeting ESIGN, eIDAS and ECA, a repository, reporting and analytics. Without SpotDraft AI, VerifAI, Intake and Sidebar, a working CLM with signature and workflow remains, and that CLM has its own market. The AI covers review inside Word, automatic extraction of more than a thousand metadata types, and agents that track regulatory change. SpotDraft now calls itself context aware, AI native CLM, though the platform predates that framing.

VerifAI connects each playbook guideline to source references in the contract and explains why a requirement is met or unmet. It then proposes wording, comments and tracked edits against the customer's preferred positions. That provides a contract level basis for inspecting a recommendation. SpotDraft's broader AI offering also promises explained recommendations with citations, while Sidebar monitors official regulatory sources.

These claims do not include a reproducible accuracy benchmark or a described citator for case law. The AI agreement explicitly anticipates inaccurate or incomplete internet material and requires independent validation, so source references are a review aid rather than a guarantee of legal correctness.

Users constrain VerifAI through their own playbooks or supplied guides, inspect the explanation for each deviation and receive edits as tracked changes in Word. Public guides let business colleagues conduct an initial review before legal involvement. The consolidated AI agreement requires human oversight and makes the customer responsible for checking outputs before business or legal decisions; it also excludes specified high risk uses.

Conditional CLM approvals and permission roles provide an additional organizational control. VerifAI's nutrition label nevertheless marks human involvement as absent. The binding verification requirement and editable review surface are concrete controls, while the label is an unresolved inconsistency in product messaging.

Eight in house lawyers are quoted by name, role and employer. Anna Claveria Brannan is Deputy General Counsel at IPSY. Susan Koenig is a former Senior Legal Operations Manager at Abnormal Security, and Micah Nessan a former General Counsel at Guideline. Reason Abajuo is VP of Legal and Corporate Affairs at Chaberton Energy, and Lizzy Gagan is Senior Legal Counsel at Beamery. Arzu Hasanova is Legal Counsel at Circularise, Aditi Kapoor is Director of Legal at Gameskraft, and Natasha Wilson is Head of Legal at SUN Mobility.

Every quote is qualitative. The quantified claims name no customer. They are two times faster closings, 65 percent lower cost, 70 percent less review time and contracts reviewed 15 times faster.

SpotDraft's consolidated agreement treats uploaded customer material as confidential and expressly forbids using customer data as a training dataset for machine learning or model training. Its DPA restricts personal data processing to customer instructions, protects generated personal data and provides isolation between Sidebar customer environments. Contract encryption keys and roles further limit access. The AI terms also state that using the service creates no attorney client relationship or related privilege beyond contractual confidentiality.

Generated material may be retained to debug reported issues, and provider specific retention is not fully explained. These commitments improve confidentiality assurance without establishing complete treatment of every privileged prompt and output.

The consolidated AI terms identify SpotDraft as a software provider, disclaim a lawyer relationship and make customers responsible for independent verification before legal or business decisions. Users must be told that AI is involved and cannot present generated output as human authored. Sidebar additionally prohibits processing sensitive financial or personal data and information about children under thirteen. These are concrete use boundaries alongside the company's references to California bar guidance and ABA Formal Opinion 512.

They do not map each product control to a professional duty or establish a jurisdiction by jurisdiction competence framework for legal work performed through the platform.

A formal risk governance policy approved by management defines an Enterprise Risk Management program, according to SpotDraft's security page. Periodic operational risk assessments feed management reports, with each risk rated, assigned an owner and tracked to treatment or acceptance. Privacy risk is assessed through vendor due diligence, and an information security team led by the Chief Technology Officer oversees the process.

The policy does not cover model behavior. SpotDraft's own web pages describe no testing before an AI release and no responsible AI framework. They do not address bias or uneven output across contract types, counterparties or populations.

The DPA requires notification within 48 hours of awareness of a personal data breach, advance notice of subprocessor changes and an objection process. It provides return of customer personal data within thirty days and deletion within ninety days of return or as directed, with legal retention exceptions and a deletion certificate. Access reviews, encryption and annual testing are specified. The subprocessor register now identifies the AI providers as well as hosting and support services.

These contractual controls cover substantial ground, but the AI terms permit retention of generated material for debugging without a complete separate schedule for nonpersonal prompts, outputs and provider logs.

The consolidated agreement for the United States entity has a general cap of twelve months of fees paid or payable, a fivefold cap for specified confidentiality, legal compliance and indemnity claims, and exceptions including fraud and gross negligence. It also grants ordinary service intellectual property protection. However, the AI annex expressly excludes AI Services from that intellectual property indemnity and disclaims consequences of relying on generated output.

Sidebar is excluded from the uptime undertaking and credits. The separate signup terms still state an INR 100 cap. The applicable order and agreement matter; none of these provisions establishes a warranty that an AI legal conclusion is correct.

More than 30 integrations are stated, each with its own page. Salesforce, HubSpot, Slack, Microsoft Word for desktop, Google Drive, DocuSign, Greenhouse, Google Forms, Jira and Zapier are all linked directly from the pricing page. VerifAI runs review inside Microsoft Word, and negotiation and redlining are described as working in Word, Slack or SpotDraft itself. One named customer credits the Word desktop editor with driving adoption.

Single sign on covers Office 365, Google Workspace, Okta, Active Directory and custom SAML with zero touch provisioning. The connections center on corporate business systems; a native iManage or NetDocuments integration is not described.

The DPA assigns primary personal data storage to the Netherlands for EU customers, the United States for customers there and India for Indian customers. It permits controlled support and implementation access from India for other customers. The public security description still offers an additional Middle East region and says regional personal data does not leave its location, creating a distinction that requires contractual clarification.

VerifAI identifies Azure hosting alongside OpenAI and Anthropic models, while the subprocessor register adds other services. Their registered addresses are not processing regions. Consequently, whether every model call stays in the customer's primary storage country is left open.

Four compliance marks, for ISO, GDPR, HIPAA and AICPA SOC 2, appear on SpotDraft's home, pricing and security pages. Its home page lists them as ISO 27001, SOC 2 Type II, GDPR and HIPAA, and the footer on every page reads "An ISO/IEC 27001:2022 Certified Company". SpotDraft's help center lists its SOC 2 Type 2 and ISO 27001 reports with download links, and a March 2023 blog post announced the SOC 2 Type 2 result. SpotDraft also links a separate trust center at trustcenter.spotdraft.com.

Outside the reports themselves, no auditor, coverage period, report date or scope is published for the SOC 2. Independent penetration testers are said to be used, but none is named and no summary is published.

VerifAI identifies OpenAI GPT 4 and Anthropic Claude and describes selecting models by task, with an Azure instance also mentioned. The broader subprocessor register names Azure, OpenAI and Anthropic for metadata extraction, contract questions and guideline review, and Pinecone for vector retrieval. It states that those AI providers receive no data when AI features are unused. The DPA adds thirty days of notice before a subprocessor addition or replacement, with a customer objection route.

SpotDraft still gives no individual model versions, no full list of inference regions and no notice of changes within an existing provider. The single model nutrition label does not fully describe this wider supply chain.

SpotDraft prices the CLM by users or contract volume and includes standard implementation, migration, integration setup and support in its published package. It does not publish a subscription rate or a separate allowance for each AI feature. The consolidated agreement permits additional charges for custom work outside the order's scope, requires advance payment and treats fees as a minimum commitment. Its AI modules can be purchased separately under the order.

Indian stamp procurement has a distinct fee schedule and deposit under the India agreement, so stamping is not automatically part of an unlimited CLM price. VerifAI advertises a two week trial.

The core audience is corporate legal departments working with sales, finance, HR and procurement colleagues. Industry examples span software, HR technology, education technology, health technology and financial technology. The consolidated agreement limits use to the customer's own business and prohibits operating the service for third party benefit, which is relevant to a firm considering client delivery. VerifAI supports contract review through configurable playbooks, while Sidebar adds broader legal and operational assistance.

Sidebar's prohibition on sensitive personal and financial information limits the material that can be submitted. No complete list of supported legal jurisdictions or excluded contract issues accompanies the product offering.