Vesence
Vesence is an agentic AI platform for law firms and other professional services businesses, built to run inside Microsoft Office rather than alongside it. The same agent works across Word, Outlook, Excel and PowerPoint and in a web workspace where files, chats and drafts sit together in a project: drafting and filling templates, producing redlines that preserve Word formatting, checking spreadsheets against source documents, running quality checks over slides and inboxes, and applying a firm's house style. Every edit an agent makes lands as a tracked change the user accepts or rejects. Practice-area pages cover corporate, banking and finance, fund formation, dispute resolution, compliance, family law and business support. The company publishes an unusually complete contract set: general terms with a stated liability cap and an intellectual property indemnity, a data processing agreement, and a subprocessor list naming each legal entity, its processing region and which model routes it serves, with customers able to choose which inference providers are enabled. Processing runs exclusively in the EU on Microsoft Azure. Named customers include the Nordic firms Cederquist, Snellman, Andulf and Kanter. Vesence is operated by Vesence AB, a Swedish company.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
There is no conventional product underneath. The four Office add-ins have no non-model function at all: what they do is draft, redline, reformat, cross-check and quality-check, and each of those is model work. The web workspace holds files, chats and drafts in a project, but it exists to give the agent context rather than to be a document management system, and the vendor describes the whole thing as one agent across five products. The systems of record stay where they are, in Word, Outlook, Excel, PowerPoint and the firm's own files. Annex 1 to the data processing agreement puts it plainly from the other direction, describing the processing as machine learning algorithms processing collected text to generate responses and insights. Remove the models and nothing remains to sell. Verified 2 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is addressed candidly and never measured. Clause 3.6 of the general terms states that due to the inherent probabilistic nature of artificial intelligence the services may occasionally produce inaccurate output or suggestions, and that this does not constitute a Defect. Putting a hallucination acknowledgement in the operative agreement rather than a disclaimer footer is rare in this pull, and it is the opposite of the bare no-hallucination claim the D limb is written for, so D does not fire. What is absent is any measurement. No accuracy figure, test set, benchmark or published evaluation appears anywhere. The product-side answer is checking rather than grounding: a one-click check described as reviewing hundreds of errors across documents and inboxes, and cross-checking spreadsheet data against source documents. Neither is a described retrieval method, and the product does not ground to primary authority, so the B limbs do not bite. Verified 2 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The review surface is the strongest located in this pull and the threshold is missing. Every edit an agent makes lands as a tracked change across Word, Excel, PowerPoint and Outlook, with accept and reject controls, so the human checkpoint is the native review mode of the application the work already lives in rather than a bespoke approval screen. The obligation to use it is contractual, not aspirational: clause 4.2 requires the customer to assess the accuracy and quality of both input and output for its intended use, including conducting human reviews, and clause 10.5 repeats it. What is not published is what the agent does unattended. Nothing states which steps complete without a human, what an agent does when uncertain, or what happens after it is wrong, and the Outlook capability is described as drafting rather than sending without the boundary being stated. That unstated threshold is what the B band names. Verified 2 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Four law firms are named with their own case studies: Cederquist, Snellman, Andulf and Kanter, all Nordic, covering M&A, fund formation and full-service practice. One carries a figure attached to a named individual, with Maja Wettergren, Managing Partner at Cederquist, quoted as reaching 90 per cent weekly usage across the firm. Several case studies are dated, with the Snellman piece carrying 25 June 2026. That is dated, attributed deployment evidence, which is more than most records manage. It stops short of A on measurement. The one figure is an adoption rate rather than an outcome, so it reports how many lawyers opened the product rather than what changed in the work, and no method or basis is given for it. The individual case studies were not opened this pass, so this note credits only the customer index and home page. Verified 2 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Three of the five limbs are met, two in the agreement itself. Clause 7.1 provides that Vesence will not use Customer Data to train AI models and will not permit its subcontractors to do so, which settles training contractually rather than by policy. Retention and deletion are set out in Annex 1 to the data processing agreement in unusual detail, with instantaneous processing and no storage by default. The position on third party model providers is the most complete in this pull: named inference entities per route, Microsoft Modified Abuse Monitoring approval waiving prompt and completion storage on all production Azure OpenAI accounts, and OpenAI routing constrained to zero data retention endpoints. Two limbs fail. Segregation is stated at tenant level, that all customer data is logically isolated per tenant, and this vendor sells to law firms, where the band asks for matter level walls; nothing addresses separation between matters or teams inside one firm. And nothing anywhere addresses privilege or work product treatment directly, which the top band requires as its own limb. Verified 2 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
The advice line is stated in the operative agreement and stated fully. Clause 10.5 provides that output and any materials made available through the services are not to be viewed as professional advice of any kind, listing legal, tax, accounting, financial and investment advice by name, that Vesence is not an advisory firm, that it does not know the full context in which output will be used, and that it does not bear responsibility for decisions, actions, omissions or reliance based on it. Clause 4.2 adds the customer's obligation to conduct human reviews, which reaches the supervision dimension that most records in this pull leave untouched. Two things hold it at B. No jurisdiction limits are stated anywhere, and no bar or ethics guidance is engaged: the vendor is Swedish and engages the EU Artificial Intelligence Act at clause 3.2 instead, which binds the supplier rather than the lawyers using it. Verified 2 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
One real governance commitment exists and it sits in the contract rather than on a page. Clause 3.2 of the general terms requires the services to be provided in accordance with laws and regulations including but not limited to the EU Artificial Intelligence Act, which is a named instrument the customer can enforce, and it is materially more than a principles page. Everything the top bands ask for beyond that is absent. No governance framework is published, no individual or function is named as accountable for model behaviour, no pre-release testing regime is described, no certification such as ISO 42001 is claimed, and nothing at all is published about uneven output across matter types, counterparties or populations. The third party audits named on the security page are security assessments, which the axis treats as a different subject. Checked the home page, security page, general terms, data processing agreement, subprocessor list and about page on 2 September 2026. Verified 2 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
All five elements are published, current and specific. Retention is set out in Annex 1 to the data processing agreement: processing is instantaneous and no personal data is stored by default, with the sole exceptions of prompts inside customer-created agents, retained until the customer deletes them, and an optional Cloud agents feature, off unless the customer switches it on, which persists conversations and files until deleted or deactivated. Deletion runs on customer instruction at clause 9.3, with copies destroyed unless law requires retention. Access control covers Microsoft Entra ID with token-based authentication, role-based access with least privilege, enforced multi-factor authentication, audit logging and automated session management, with customer-side administrator control of users at clause 4.5. The subprocessor list is dated 20 May 2026 and names each legal entity, its headquarters, role, processing regions and whether it is required or optional. Incident practice is set out at clause 5 of the DPA: notice without undue delay, root cause investigation, description of the breach and affected data, and coordination on public statements and regulator notices. The one thing not published on a public page is a fixed breach notification deadline in hours. Verified 2 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
A buyer can read the whole allocation of loss before signing, with figures. Clause 10.2 caps each party's total aggregate liability per contract year at fifty per cent of the subscription fees invoiced in that year and excludes indirect damages; clause 10.3 lifts the cap for intent and gross negligence; clause 10.4 lists six named exclusions; and clause 10.6 sets claim windows of three months from awareness and six months from occurrence. Clause 11.1 gives an intellectual property infringement indemnity running from Vesence to the customer, with the remedies at 11.2 set out in order, procure a licence, replace, amend, or terminate and refund prepaid fees, and 11.3 makes it the sole and exclusive remedy. Warranties are real: clause 3.2 promises professional and workmanlike provision in accordance with law including the EU AI Act, and clause 6.3 warrants non-infringement to the best of Vesence's knowledge. What the vendor does not stand behind is output, and it says so specifically: clause 3.6 provides that occasional inaccurate output is not a Defect. The fifty per cent cap is materially lower than the annual-fees norm and is recorded here because a buyer should price it. Verified 2 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The product lives inside the drafting environment rather than connecting to it, and each surface has its own page describing what it does: tracked-change generation and template filling in Word, house-style drafting and inbox-wide error checking in Outlook, spreadsheet review and cross-checking against source documents in Excel, and slide quality checks and firm formatting in PowerPoint, with distribution through Microsoft AppSource and a mobile continuation of the same workspace. That is real depth in the four applications a professional services firm actually drafts in. What is absent is the rest of the stack a law firm runs. No document management integration is named, and iManage and NetDocuments do not appear anywhere, which matters more here than for an in-house product because the firm's matter files live in a DMS. No API, developer documentation or implementation guide was located, and nothing describes what synchronises or what a firm must configure beyond installing the add-ins. Verified 2 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Residency is published to a level of specificity nothing else in this pull approaches, and processing is separated from storage throughout. The subprocessor list gives regions per route: Sweden Central as the primary Azure region, West Europe for Static Web Apps, EU Azure OpenAI regions or DataZone deployments where Azure inference is used, and eu-central-1 in Frankfurt for the AWS Bedrock route. Annex 1 to the data processing agreement states that processing is performed exclusively within the EU and EEA, and the security page repeats it. The tenancy position is stated too, that all customer data is logically isolated per tenant, alongside a Zero Trust architecture and redundant infrastructure with automatic failover and point-in-time recovery. The subprocessor page even addresses which deployment types should not be used for EU traffic. The limitation a buyer should weigh is the flip side of that precision: there is one region policy and no non-EU option, so a customer with a data localisation requirement outside Europe is not served. That is a restriction on availability, disclosed, rather than an absence of disclosure. Verified 2 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
SOC 2 Type II is claimed with its scope named, described as independently audited controls for security, availability and confidentiality, which is more than the bare standard name most records offer. Regular third-party security audits and vulnerability assessments are stated, and the security page invites IT and compliance teams to ask for the report. What the top band asks for is missing on every remaining count. No auditor is named, no coverage period or report date is published, no penetration test summary is offered, and there is no trust centre or portal of any kind, so the route to the report is an email to support and its tier could not be established from what the page states. Clause 6 of the data processing agreement adds a contractual audit right, allowing the customer or its mandated third-party auditor to inspect, which is a real entitlement for a signed customer rather than accessible evidence for a prospect. Verified 2 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
This is the most complete supply chain disclosure located in the pull. The models are named on the product pages, including GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.5, Opus 5, Opus 4.8 and Gemini 3.7 Flash. The providers are named as legal entities rather than brands on a dated subprocessor list: Microsoft Ireland Operations Limited, Amazon Web Services EMEA SARL and OpenAI Ireland Ltd, each with headquarters, role and status. Where they run is given per route, from Sweden Central to Frankfurt. The routing itself is explained, so a reader can see that Claude models reached through Bedrock make AWS the subprocessor while OpenAI models reached through Azure make Microsoft the subprocessor, and the customer chooses which provider routes are enabled. Change is committed at clause 7.2 of the DPA: the list is updated before any new subprocessor is authorised, with a ten business day objection right at 7.3. Two limitations belong on the record. Notification is pull rather than push, since the DPA asks the customer to monitor the page with a URL tracking service. And the home page states that Vesence switches to a better model as soon as it ships, so model version changes within an authorised provider are not notified. Verified 2 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and the structure are published without the figure. Clause 5.1 puts subscription fees in an Order Form; clause 5.4 caps annual indexation at five per cent; clause 5.2 allows fee changes only in proportion to documented changes in third party costs such as Microsoft Azure; clause 12.1.3 sets twelve month automatic renewals terminable on sixty days notice; clause 12.1.2 gives a right to exit within the first three months of the initial term; and section 13 provides that a Pilot is free of charge unless the Order Form says otherwise. The usage-based unit is named rather than gestured at, with Annex 1 to the DPA describing Vesence Credits and consumption tracked at user, matter and day level. A free trial is offered from the home page. What is absent is everything above that: no pricing page, no tier names, no feature splits and no figure anywhere, and the structure sits in the agreement rather than on a commercial surface. Verified 2 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Practice coverage is documented better than by any other record in this pull. Seven areas each have their own page describing what the product does there: corporate, banking and finance, fund formation, dispute resolution, compliance, family law and business support, with the corporate page describing diligence across a data room and keeping defined terms and cross-references consistent from term sheet to signing. What is left open is the boundary and the segment. No firm size band is named, nothing distinguishes what the product supports for a large firm from a small one, and no jurisdiction is stated even though the named customers are Nordic and the agreement is governed by Swedish law with Stockholm arbitration. The buyer is also deliberately broader than legal: the vendor addresses law firms, banks, investment funds and enterprises together and describes itself as made for professional services, so a reader cannot tell where legal-specific capability ends and general document work begins. Nothing states what the product does not support. Verified 2 September 2026.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The published terms prohibit training on customer content. Not a policy page, the agreement.
The prohibition is in the operative agreement at clause 7.1 and extends outward in the same sentence, which adds that Vesence will not permit its subcontractors to train on Customer Data either. It carries one proviso, unless explicitly agreed in writing, which is a variation clause rather than a product setting: nothing describes a configuration in which training is switched on. Annex 1 to the data processing agreement confirms the prohibition applies to the optional Cloud agents feature as well. Two adjacent permissions are disclosed and neither reaches content. Clause 7.2 allows Vesence to collect and disclose quantitative data derived from use of the services, described as statistics about which features were used, in anonymous and aggregated form. That clause names feature usage rather than machine learning, so it does not qualify the prohibition.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The customer sets the retention window and no retention is an available setting.
Zero retention is the default rather than an option the customer has to find. Annex 1 to the data processing agreement states that each processing is instantaneous and no personal data is stored, and the security page adds that documents are processed in memory and never persisted beyond the session. Persistence exists but the customer switches it on: prompts inside customer-created agents are retained until the customer deletes them, and a Cloud agents feature stores conversations and uploaded files between sessions, described expressly as optional and not activated by default. Where a customer does enable it, retention runs until the customer deletes the data, deactivates Cloud agents, stops using the service or requests removal, with storage in Vesence's Azure environment under the same no-training and tenant isolation terms. Usage data for Vesence Credits, where usage-based pricing is enabled, is retained for the term or until the customer asks for deletion.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
Vesence operates its own permission model rather than inheriting one, and documents it at the level of the tenant. The security page states logical isolation per tenant alongside role-based access control on least-privilege principles, Microsoft Entra ID token-based authentication, enforced multi-factor authentication and a Zero Trust architecture verifying every request. Clause 4.5 of the general terms puts user administration in the customer's hands, giving nominated personnel administrative privileges to manage users and access logging, which is the alignment burden this value describes. The gap matters for this buyer in particular. Vesence sells to law firms, where the question is whether one matter team can reach another's material, and nothing published addresses separation between matters, teams or users inside a single tenant. Tenant isolation answers the question between customers, not within one.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Clause 4.1(a) of the data processing agreement commits Vesence to notice before it acts. Where EU or member state law requires processing without the customer's instructions, Vesence undertakes to inform the customer of that requirement prior to processing, with the single exception of a legal prohibition on giving that information on important grounds of public interest. Notice before rather than after is a stronger formulation than most. It is not the top value because no transparency report was located: nothing published records how many requests have been received or how they were answered. Clause 8.3(e) of the general terms separately carves legally compelled disclosure out of the confidentiality obligation without addressing notice, and the two provisions read together are what the record rests on.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
Checked the home page, the five platform pages, the practice area pages, the security page, the general terms and the data processing agreement on 2 September 2026. No public material identifies a corpus and none is claimed. Annex 1 to the DPA describes the material as the text the user provides, being documents, agreements, questions, answers and conversations, so the product works on the firm's own files and the counterparty documents in front of it rather than on a published body of primary law. The coverage and title risks this signal tracks do not arise in that shape.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Checked the home page, the five platform pages, the practice area pages and the general terms on 2 September 2026. No public material addresses subsequent history, treatment flags or citator coverage, and none is claimed. The product drafts and checks documents rather than retrieving authority, so no good law check is offered; the dispute resolution practice page describes searching and structuring case material supplied by the firm rather than researching reported decisions. The honest value is that the question is not addressed rather than that a weaker form of checking exists.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
Checked the home page, the five platform pages, the security page, the general terms and the data processing agreement on 2 September 2026. Nothing describes what the product does when it cannot ground an answer. Clause 3.6 of the general terms comes closer than most vendors manage by acknowledging that the services may occasionally produce inaccurate output because of the probabilistic nature of artificial intelligence, but that is a disclosure that errors occur rather than an account of abstention. No no-answer path is documented and no confidence or grounding score is exposed, so the weaker values are false of this record as well. The one-click check feature reviews output for errors after generation, which is correction rather than refusal.
Fabricated Citation Record
Does a public court record exist involving output from this product?
No court order, opinion or disciplinary record naming this product has been located as of the date shown. This is a statement about the public record, not a finding about the product.
Searched the AI Hallucination Cases database maintained by Damien Charlotin, and reporting drawing on it, on 2 September 2026 on the product and corporate name Vesence and Vesence AB. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product. Two things bound it: the vendor is Swedish with a Nordic customer base, and the database is heavily weighted to United States filings, so a European product is less likely to surface even where an incident occurred; and the product drafts and reviews documents rather than retrieving authority, so the fabricated citation exposure is structurally lower than for a research tool.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Checked the home page, platform and practice area pages, security page, general terms, data processing agreement, subprocessor list and about page on 2 September 2026. No public material engages with ABA Formal Opinion 512, any state bar opinion, or any national bar or law society guidance in the Nordic markets where the named customers sit. The vendor does engage a named instrument, committing at clause 3.2 of the general terms to provide the services in accordance with the EU Artificial Intelligence Act, but that regulates the supplier rather than the professional obligations of the lawyers using the product, which is what this signal records.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
A usable record of AI assisted work exists with no published fee guidance.
A per matter record of AI assisted work exists and is described in the agreement rather than inferred. Annex 1 to the data processing agreement states that where usage-based pricing is enabled, Vesence Credit consumption data is collected at user, matter and day level in order to display that consumption to the customer through the services. Credits are consumed by AI work, so a firm running usage-based pricing can see which matters the AI worked on, by whom and when, which is the record this signal asks for. Two limits keep it off the top value. The record exists only where usage-based pricing is enabled rather than for every customer, and no fee guidance of any kind is published: nothing addresses how AI assisted time should be billed to a client, disclosed, or reconciled against an hourly rate.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A subprocessor and model provider list plus client facing disclosure material is published or available without an agreement in place.
All three artifacts are published and reachable without an agreement. The subprocessor list, dated 20 May 2026, names each legal entity with its headquarters, role, processing regions and required or optional status, and it separates the core hosting subprocessor from the AI inference providers, so a firm can tell a client exactly which entities may see its content and where. The model provider position is set out route by route, including that Anthropic is not listed separately where Claude is reached through Bedrock and why. The data processing agreement is published in full and is drafted to be forwarded, with clause 7.2 committing to update the list before authorising any new subprocessor and clause 7.3 giving a ten business day objection right. One practical limitation belongs on the record: notification is pull rather than push, since clause 7.2 asks the customer to monitor the page using a URL tracking service.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
No located public material addresses court disclosure or verification certification.
Checked the home page, the five platform pages, the practice area pages, the security page, the general terms and the data processing agreement on 2 September 2026. Nothing addresses judicial standing orders, AI use disclosure or verification certification, and no exportable per document record of model used, sources retrieved and human verification is described. The product does leave an unusually good trail in the document itself, since every agent edit lands as a tracked change that a person accepted or rejected, and Vesence Credit consumption is recorded per matter where usage-based pricing is on. Neither records which model produced which passage, so neither answers the question this signal asks.