T

Tomorro

Models run the capabilities Tomorro now leads with, on a contract lifecycle platform that would function without them. Creation from templates, collaboration, approval workflows, electronic signature, storage and reminders depend on no model. Oro is what the home page and its negotiation time claim rest on: extraction on import, summaries, translation and rewording, chat over contracts, playbook review clause by clause, and Legal Search.

Oro comes within each plan's credit allowance, and the activation article says only an administrator can turn it on and that it is off by default. The review, extraction and search sold to customers are model driven, while the system of record, workflow and signature around them would run with Oro switched off.

Answers are grounded in sources a reader can open, and the one accuracy figure has no method. Legal Search answers show their sources, which users can check on official websites, and playbook recommendations open the rule behind them on a click. The home page states that data extracted by Oro is 92 percent accurate, with no test set, document population, field list or date behind the figure. No figure is published for Legal Search answers or review recommendations.

The AI terms of use say AI features may generate incomplete, inaccurate or outdated responses. Nothing published says how often a cited source fails to support the answer.

What Oro does on its own, what it may not do and how a user checks it are all published. The negotiation recommendations article (updated 6 July 2026) gives each clause a status of acceptable, to check, not acceptable or missing, explains the risk and the deviation from the playbook, and suggests an action and, where relevant, rewording. It shows the playbook rule behind each result. It states that the AI never modifies the contract without the user's action and that nothing is sent to the counterparty: a comment for the other side is generated on request and pasted in by hand.

Users can apply, edit or ignore each suggestion. Automatic summaries and extraction run without a prompt. Outputs carry an AI label and are offered as suggestions to review, and the terms say they may not be the sole basis for a decision. The limits on the negotiation mode are categorical rather than general promises.

A measured result with a stated sample and a named legal department with a figure are both published, and the two never meet. The home page reports 53 percent shorter contract negotiation times from a comparative analysis of 12,248 contracts between 24 February and 2 March 2025, comparing companies using Oro with companies not using it. The sample and dates are stated, but no customer is named, and neither the selection of the two groups nor any control for differences between them is described.

The home page also quotes Nestlé's general manager for legal and compliance saying the company cut time spent on contracts by a factor of three, with no date, period or basis. The Doctrine case study names its legal and public affairs director, dates the rollout to 2022 and reports 40 active users and all contracts archived with metadata, which describes adoption rather than outcome.

Training, confidentiality and the model provider's position are in the contract; segregation is documented only within a customer, and privilege is not addressed. The general terms bar training on client data without the client's express agreement, article 13 leaves the client owner of its data, and article 15 binds both parties to strict confidentiality for five years after termination, indefinitely for trade secrets.

Both named model providers are stated not to store or train on the data. Access within a customer follows folders, groups and contract participation. Missing: any treatment of privilege or work product, any statement on how one customer's data is separated from another's, and a period for the temporary retention the AI terms allow.

A plain position that outputs are not legal advice is published and the service is limited to professionals, without a supervision dimension or jurisdiction limits. The AI terms of use (25 April 2025) state that AI outputs do not constitute legal advice and must not be relied upon as the sole basis for decision making, and that the customer remains solely responsible for their use. Article 3 of the general terms reserves the services for professionals.

The users are not only lawyers: the platform is also sold to business teams, and the Doctrine case study describes teams outside legal managing their own contracts under legal oversight. Nothing tells someone who is not a lawyer when a playbook result or a Legal Search answer needs a lawyer, and Legal Search does not say which jurisdictions it is reliable for.

A governance position grounded in the EU AI Act is published with real substance, without test results or a named owner. The AI terms of use (25 April 2025) classify Oro as a limited risk AI system and state that a data protection impact assessment covered the personal data processed, the risks to data subjects and the measures taken. The help center's AI Act compliance article says Oro is used only for business tasks such as summarizing contracts and analyzing clauses.

It says outputs are labeled as AI and presented as suggestions requiring review, that users can flag errors through a feedback mechanism, and that Tomorro keeps technical documentation of system design and risk assessment. The security page adds readiness for the EU AI Act and DORA, monitored through Vanta. Not published: what is tested before a model or feature is released, any measured error or bias finding across contract types, languages or jurisdictions, and who inside Tomorro is accountable for Oro's behavior.

Hosting, encryption, backup retention, deletion at termination and incident practice are published, and the subprocessor list cannot be read as text. The security page describes AWS hosting in the EU across three availability zones, encryption in transit and at rest with distinct keys, daily snapshots kept 365 days with point in time recovery, access restricted to authorized employees, annual independent penetration tests and documented incident procedures with automated alerts.

Article 18 of the general terms gives a thirty day period to export data in Word, PDF or CSV and commits Tomorro to destroy data thirty days after termination. The subprocessor schedule is published as images. The privacy policy keeps customer data for the relationship and five years after.

The general terms publish a cap, a higher cap for data protection, carve outs and an intellectual property indemnity, and they disclaim the AI's output. Article 9 of the general terms (version of 29 July 2026, French law, Paris Commercial Court) limits each party's liability to the amount invoiced in the twelve months before the first event giving rise to liability. Data protection claims carry twice that amount, and gross negligence and breaches of confidentiality fall outside the cap.

Tomorro indemnifies the client against third party claims that the service infringes intellectual property, except for unauthorized modifications or noncompliant use. The same article says AI results are suggestions only and do not engage Tomorro's liability as to their completeness, legal accuracy or suitability. Schedule 3 commits to 99 percent monthly availability.

Integrations into the systems company teams work in are documented with direction, triggers and configuration. The help center's integrations collection holds 22 articles. The Salesforce administration article covers installing the component from AppExchange, adding it to Lightning record pages, assigning permission sets and mapping fields. Contracts can be created from opportunities, accounts or cases by hand or through workflows an administrator sets to fire on field changes, with signed documents stored back to Salesforce and contract status updated there.

HubSpot, Microsoft Teams, a Word plugin and electronic signature have their own articles, and the home page names DocuSign, Zapier and Google Calendar among others. For engineers, the help center documents a REST API with MCP access, a GraphQL API, webhooks and worked use cases, and identity runs through SAML single sign on and SCIM provisioning. Document management systems used by law firms, such as iManage or NetDocuments, are not among the integrations.

Where data is stored, backed up and processed by the AI is published, and the tenancy model is not. The security page says production runs on AWS in the Paris region with backups in Frankfurt, and that all data remains in the European Union; article 5.2 of the general terms commits to a hosting provider located in the EU. AI processing goes to Azure OpenAI, with Mistral available from a French host, and data stays in the EU under either.

Article 14 permits transfers outside the EU only to the countries listed in schedule 2 with safeguards, and requires the client's prior consent for any future transfer. Development, staging and production run in isolated environments. Whether customers share infrastructure or are separated at the database or account level is not stated, and the service is offered only as one hosted platform, with no dedicated or on premises option.

ISO 27001:2022 is stated with its scope, and the trust center that would hold the evidence was not read. The security page says Tomorro is certified to ISO 27001:2022, with scope covering the software and internal development processes, that annual penetration tests are run by an independent firm with reports on request, and that compliance is monitored continuously through Vanta. It links a trust center at trust.tomorro.com and a public status page.

The home page also lists SOC 2 among frameworks Tomorro complies with, while the security page names no SOC 2 report, type or period; the two pages differ, and the security page gives the fact. No certification body, certificate number or audit date is published. Whether the certificate and reports in the trust center are open, available on request or held behind a sales conversation is not recorded.

Both model providers are named, with where they run and what they keep, and the models themselves are not. The AI terms of use say data submitted through the AI features goes to Azure OpenAI for processing and is not stored or reused for training by the provider. The Mistral article (updated 18 March 2026) says Oro runs on Azure OpenAI by default, that Mistral can be added as a provider hosted in France, and that a routing engine sends each task to the more effective provider.

It also says Mistral has been having scaling issues, which is why keeping both enabled is recommended. Neither page names a model or version, and Legal Search's source provider is not identified. Clients have thirty days to object to a new subprocessor, which would cover a new AI provider added to schedule 2, but nothing commits to notice when the model behind a provider changes.

The unit of charge, the term and the AI allowances are published, and no price is. The pricing page asks for a quote request and charges only for administrator and creator roles on a twelve month commitment, as recorded in the pricing structure, with a two week trial on request. Three plans with monthly Oro credit allowances appear in the help center, and the roles article explains the licenses a company pays for. Not published: any price per license or plan, the cost of extra credits, or implementation fees.

Who the platform serves is described with substance, and where it stops is stated only for Legal Search. The home page addresses legal teams managing contracts end to end and the business teams, from sales to procurement, that negotiate and sign them, from fast growing companies to groups such as Nestlé, Vinci and Sandoz. Case studies cover a legal research company's legal department (Doctrine) and a mortgage broker's HR team (Cafpi), among others, and the clause library is aimed at common commercial agreements.

The site is published in English and French. Legal Search states its own limits: more than 150 countries from open sources, without paid doctrine. Not stated: which contract types, governing laws and languages the playbook review and extraction are built and tested for, whether law firms are a supported segment, and which jurisdictions Legal Search covers deeply enough to rely on.