Tonkean LegalWorks

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models drive a core capability on a product that plainly functions without them. What the AI does is real and named: AI Front Door reads plain-language requests, LegalGPT triages and classifies unstructured inbound requests, and packaged agents handle NDA generation and contract work. But underneath sits a no-code process orchestration platform with forms, rules, approval chains, dashboards and integrations, marketed as 100 per cent no-code and sold to procurement and IT in identical form. The clearest evidence is contractual rather than promotional: the published sub-processor table lists Microsoft Azure for AI LLM engine services, OpenAI for AI/ML powered product features and Google Cloud for OCR, and marks all three opt in. A customer who does not opt in receives an orchestration platform with no model behind it. That is the definition of this band rather than the one above. Checked 4 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is described in outline and accuracy is disclaimed rather than measured. The retrieval story is stated: the AI Front Door trawls the data sources the customer has given it access to and generates a document if one does not already exist, and agents draw on connected enterprise systems, so a reader can tell in principle what an output is built from. Nothing beyond that exists. No accuracy figure, no test set, no evaluation, no error rate and no method description appears on any surface, and no output is presented with a traceable citation to the source record it came from. The agreement moves in the opposite direction and does so explicitly: Tonkean does not warrant that the Platform will meet the customer's requirements or expectations, including with respect to any actions or outcomes of use of Tonkean's A.I. Bot. Nothing addresses hallucination in either direction. Searched the LegalWorks page, the security page, the pricing page, the DPA and the customer terms on 4 September 2026; docs.tonkean.com and the AI handbook were not opened.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The division between what runs alone and what reaches a person is published clearly, and the threshold that decides it is the customer's rather than the vendor's. What runs unattended is stated: simple requests such as NDAs and statements of work are auto-handled, urgency is identified on every inbound request, and more complex matters including conflict waivers, intellectual property questions and outside counsel engagements are auto-routed to the right person or practice group. The control structure around it is real, with approval paths and risk tiers mapped to the department's policy, intake forms that adapt by risk level and matter type, and a full audit trail of actions and approvals. What holds this off the top band is that the thresholds are configured by the customer rather than published by the vendor, so a buyer cannot learn from the material what the system will do by default. No confidence signal, no abstention state and no described behaviour where the model misclassifies a request appears anywhere.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Substantial evidence exists for the platform and very little of it is legal. The logo wall on the LegalWorks page runs to twenty enterprises including Google, Lenovo, AbbVie, Workday, Cisco and Intuit, but it is headed trusted by enterprises like and is the same strip used across the site rather than a LegalWorks customer list. The headline figures are unattributed and carry no stated basis: 50 per cent cycle time reduction, 99 per cent of customers reporting higher adoption, 30 employee hours saved weekly, 7.7 billion steps automated annually. Of the three attributed quotes, two are procurement rather than legal, from the Head of Global Procurement at Semrush, who supplies the only hard figure at a cycle time of 19 days falling to 10, and the Head of Procurement at Cockroach Labs. The legal quote is from Mary O'Carroll, identified as former President of CLOC and Head of Legal Operations at Google, and speaks to Tonkean generally rather than to LegalWorks. A customer showcase exists and was not opened. On this record the deployment evidence for the legal product is thinner than the page's overall impression suggests.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The marketing addresses privilege directly and the agreement excludes the material it would protect, which is the gap this axis exists to surface. The LegalWorks governance section is the strongest privilege language in the pull: an audit trail of all actions and approvals presented as helping preserve attorney-client privilege, comprehensive role-based access control and ethical walls, item-level data retention and legal holds. Against that, the customer terms provide that User Content shall not be deemed information acquired by Tonkean, which removes customer content from the contractual confidentiality obligation entirely and refers it instead to the Security section, where Tonkean states it cannot fully ensure or warrant the absolute security and privacy of User Content or personal information. So the confidentiality commitment a buyer can actually enforce over its matter material is materially thinner than the product page implies. Two provisions point the other way and are recorded: Tonkean shall have no right in the User Content beyond the minimal rights required to facilitate use of the Platform and shall not use it for any other purpose, and the DPA bars Tonkean from deriving rights or benefits from Personal Information. Where marketing and agreement conflict the agreement governs, which is why this sits here rather than higher.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

A boilerplate disclaimer sits in a general agreement while the product is marketed in advice-adjacent terms. The customer terms state that the Service provides ideas, suggestions, analyses and other data for informational purposes only and not as advice, and disclaim responsibility for any information provided by the Service. That is a real sentence but a generic one, drafted for a business management platform rather than for a legal product, and the agreement carrying it was last updated May 2019, before LegalWorks and every agent now sold. Against it the marketing describes agents that handle complex contract analysis and negotiation strategies, and an AI Front Door that answers employees' legal questions directly. The audience limits the exposure and is stated plainly: the buyer is a corporate legal department and the requesters are its own employees, so there is no consumer surface and no unlicensed practice question of the ordinary kind. What is absent is everything above the disclaimer: no rule of professional conduct or bar guidance named, no jurisdiction limit, and nothing on how a legal team supervises an agent that answers a business question without a lawyer seeing it.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

No governance position for the vendor's own models was located, on a product whose agents act on matters without a lawyer in the loop for simple requests. There is no responsible AI page, no principles statement, no named owner accountable for model behaviour, no pre-release evaluation or testing regime, and nothing at all on bias, including nothing on whether triage and classification perform evenly across request types, business units or languages. That last gap matters here specifically, because the product's core function is deciding which requests are simple enough to resolve without a lawyer. The security page is thorough and entirely about information security, which the axis definition treats as a different subject and which is graded on the stewardship row rather than counted twice. An AI handbook page exists in the navigation, headed with questions about what an agent is and when one counts as an enterprise agent, and it was not opened; it is named here as the one surface that might carry governance material. Searched the LegalWorks page, the security page, the pricing page and the site navigation on 4 September 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Almost the whole set is published and one limb is soft. Retention is customer-controlled at unusual granularity, with item-level policies definable down to the field so data is held only as long as a given process needs, and the DPA adds that within 60 days of termination Tonkean will delete or return all Personal Data at the customer's choice and delete existing copies, retaining one copy only where law requires. Access control is described as comprehensive role-based control across data access and process creation, encryption is AES-256 at rest and in transit, and non-repudiation audit logs capture all edits and processed transactions. The sub-processor position is fully published rather than promised, naming each provider, its function and its country. Incident practice exists but is the weak limb: Tonkean commits to notify without undue delay after becoming aware of a Data Incident, with no stated clock, and the same clause bars the customer from publishing anything identifying Tonkean about an incident without prior written approval unless legally compelled, which is worth a buyer's attention.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Liability is addressed only through a limitation clause, and that clause disclaims the exposure the AI creates by name. The cap is short: aggregate liability may not exceed the consideration actually paid in the three months preceding the cause of the claim, against the twelve months more common in this corpus. Excluded damages are broad, covering loss or corruption of data, lost profits and pure economic loss. There is no indemnity running to the customer at all; the only intellectual property remedy is that Tonkean may at its sole discretion procure a licence, modify the Platform or terminate and refund the post-termination period, with the agreement stating that no other rights or remedies will accrue. The indemnity that does exist runs the other way, from customer to Tonkean. The warranty is repair-or-replace for material errors preventing ordinary use and expressly does not extend to any actions or outcomes of use of Tonkean's A.I. Bot. No insurance position was located. The dating is the sharpest fact: the agreement was last updated May 2019, so the instrument governing a 2026 agentic legal product predates it entirely and mentions AI once, to disclaim it.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Real integrations into the systems legal work lives in, named individually, with direction described in outline rather than in depth. The legal-specific connections are the ones that count and they are named: Ironclad for contract lifecycle management, TeamConnect for matter management, SimpleLegal for legal spend, alongside DocuSign and Adobe Sign for execution and SharePoint for documents. The wider set covers Salesforce, ServiceNow, JIRA, Slack, Microsoft Teams, email, Coupa and SAP, and the product's stated architecture is an orchestration layer across them rather than a destination to migrate into. Direction of travel is described at summary level, with contracts syncing from CLM to e-signature, approvals routed through email and chat, data pulled from billing systems and coordination with outside counsel platforms. What is missing for the top band is configuration detail: nothing published on the pages read states what a legal team must set up, what fields map, or what an integration requires. A public integration library and developer documentation both exist and were not opened; they are the cheapest available upgrade on this record.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The tenancy picture is published in full and the region menu is not. Three options are described with what separates them: a Tonkean-managed multi-tenant public cloud on AWS, a single-tenant dedicated cloud not shared with other customers and also managed by Tonkean on AWS, and self-hosting in the customer's own environment on AWS, Azure or Google Cloud. The pricing page states which tier each sits in, with multi-tenant included and dedicated, customer-cloud and on-premises available on the enterprise plan at additional cost, so what changes between tiers is answerable. Processing location is establishable from the DPA rather than the marketing: every sub-processor is listed as United States except Tonkean Israel Ltd., and Schedule 2 incorporates the 2021 Standard Contractual Clauses with UK and Swiss addenda for transfers out of the EEA. What is absent is a published region choice for the managed offering, and no page states where data is stored as distinct from where it is processed.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certifications are real, named and scoped, and the evidence behind them is reachable only by customers. The security page states SOC 2 Type 2 compliance, independently audited, in accordance with the AICPA Trust Services Principles and Criteria and named to security, availability and confidentiality, so the scope is published rather than implied. ISO/IEC 27001:2022 is stated as achieved, with the standard version given. A HIPAA compliance page sits alongside them. Three things hold this off the top band. No auditor is named, no audit period or report date is given for either attestation, and access to the reports is expressly limited to existing customers, with the page inviting a customer to ask the team for the latest report. That is narrower than a sales gate: a prospective buyer evaluating the product has no route to the evidence at all, which is the condition the top band exists to distinguish. There is no trust portal, and the badges displayed are the certification marks themselves rather than unsupported logos.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The providers are named with their function and location, the change commitment is contractual, and the models themselves are not identified. Schedule 1 of the published DPA lists each sub-processor with a described service and a country: Microsoft Azure for AI LLM engine services, OpenAI, LLC for AI and machine learning powered product features, and Google Cloud Platform for OCR services, all in the United States, each marked opt in, alongside AWS for cloud storage, Elastic.co for the hosting index database, SendGrid for email and Tonkean Israel Ltd. as an affiliate sub-processor. Change notification is not a promise but a term: Tonkean shall notify before authorising any new sub-processor, the customer has seven days to object, and unresolved objection allows termination of the affected services. What fails is model naming. Azure and OpenAI are providers, not models, and no model or version is identified anywhere, so a buyer cannot establish which model reads a legal request. Provider identification and model naming are separate limbs of the top band and only one is met.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

The unit and the structure are published with real rigour and no figure appears anywhere. Charging is on Monthly Tracked Users, and the definition is unusually precise rather than gestural: an MTU is a unique person who in a calendar month submits a form, accesses a workspace app, submits or replies to an item in Slack or Teams, sends or replies to a Tonkean email, or engages by clicking a button or updating an item. The vendor states expressly that MTUs are not named seats and are not a count of records processed, that actions per tracked user are unlimited once counted, and that billing rests on the average MTU across the subscription year so that busy months even out. The quote is built from three components, the platform with unlimited workflows and connectors, the MTU volume, and optional deployment and services, and the hosting and support tiers are itemised with what each includes. No price, band, minimum or term is published and every route ends in a scheduled discussion. A buyer can therefore model the shape of the bill precisely and cannot learn what it costs.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The buyer and the work are described with substance and the edge of the product is left open. The segment is unambiguous: corporate and government in-house legal departments at enterprise scale, with the material addressed separately to three audiences that a legal operations buyer would recognise, being employees raising requests, the legal team itself, and cross-functional stakeholders in procurement, sales and IT. Practice coverage is expressed as the request types the product handles rather than as practice groups, and the list is specific: NDAs, statements of work, contract review, conflict waivers, intellectual property questions, outside counsel engagement, legal mailroom and email triage, and matter intake generally. Company-size evidence is real, with the customer set drawn from Fortune 500 and Fortune 200 enterprises. What is not stated is where the product stops. Nothing addresses law firm use, no minimum department size is given, no jurisdiction or language coverage is published, and no request type is identified as unsuitable for automated handling.