Z

Zuva

Machine learning is the product in every form Zuva sells. The API is a REST service for extracting structured data from contracts and classifying documents, and Zuva Analyze puts the same extraction behind a self serve interface. Diligence Reviews, the third offer, are sold as AI assisted contract analysis with lawyer review, so even the service is built on the extraction. The models come from Kira Systems, and generative AI now adds answers and summaries in Analyze.

Remove the models and nothing is left: there is no document management, workflow or storage product underneath. The security overview says the API is not meant as a long term repository.

The output is the contract's own text and the method is described, and no accuracy figure is published. The extraction documentation describes each result as an instance of the requested text in the document, so a reader checks a finding against the clause it came from. The API page contrasts the fields with general purpose language models: the same input gives the same extraction every time. No recall, precision or error rate is published for the fields.

The Analyze page says other systems give maybe 70 to 80 percent accurate results and that internal testing found faster review with comparable accuracy, but it gives no test set or figure. Analyze's generative summaries are not described at all.

Human review is named for the service and not described for Analyze or the API. The Diligence Reviews pricing page lists review by former large firm M&A lawyers as part of every engagement. No page says what the reviewers check, how much of each document they read, or how an extraction they reject is handled. Zuva Analyze is described in three steps, upload, extract and export, with nothing on who reviews the export or what a user should verify.

The API leaves oversight entirely to the developer building on it. The product is extractive rather than agentic: it returns text found in the document and does not draft, send or decide anything. A missed provision produces no output to review, and nothing published says how the service or the software guards against that.

One named customer is published with a figure, without a date or method, and the rest of the evidence belongs to the earlier company. The API page says Microsoft's legal team used Zuva inside Power Automate and reports a reduction of roughly 75 percent in time spent on routine contract requests, with a target of going from a three day service level to about three minutes. No date, period, volume or method stands behind the figure, and the target is stated alongside the result.

The Analyze page features a case study of an in house lawyer at a global motorsports company and reports internal testing of 40 to 80 seconds a page against about three minutes manually. The claim that 18 of the world's top 25 M&A law firms used the same technology describes Kira Systems at its sale, not Zuva's customers.

Confidentiality, ownership and segregation are in writing, and training and privilege are addressed only in part. Under the license terms the customer owns its documents, customer data and outputs (section 6), and Zuva treats them as confidential information held to at least a commercially reasonable standard of care (section 8). Section 2(g) confines Zuva's improvement right to usage data, defined as information about access to and use of the service.

The security overview says model storage does not rely on the content of the documents used to train custom fields, and only the creating token can reach an account's data. No express training prohibition appears in the agreement. Nothing treats privilege or work product, and nothing covers what the generative AI provider behind Analyze summaries may keep.

The review service is sold as a substitute for law firm work to buyers who are not all lawyers, with only a standard disclaimer in the terms. The home page and the review service's pricing page offer sell side diligence and disclosure schedules with lawyer review, to buyers including chief financial officers and private equity firms. No page states whether that work is legal advice, whether Zuva is a law firm, whether a lawyer and client relationship arises, or who is responsible for the disclosure schedule a seller signs.

The accuracy disclaimer in the license terms limits output rather than drawing the advice line. Analyze is addressed to legal teams and the API to developers, and neither says where its output stops and a lawyer's judgment begins.

Parts of how the models are built are disclosed, and no governance framework, owner or testing result is published. The source of the training data is stated, and the Analyze page describes the fields as pretrained and tested. The science page lists about ten research papers by Zuva's research team on document review, interpretability and how lawyers work with AI, published on the principle that research advances through free dissemination.

The governance layer itself is missing. There is no responsible AI policy and no named person accountable for model behavior. Nothing describes what is tested before a field or model is released, and nothing reports how extraction quality varies across document types, languages or drafting styles.

Retention, deletion, encryption and segregation are published specifically, and subprocessors and incident practice are not. The customer sets how long uploads stay and can delete them early, access to each account's data is limited by token, and the security overview describes encryption in transit and at rest. Section 8(d) of the license terms commits Zuva to physical, managerial and technical safeguards and refers to a separate data protection addendum.

No named subprocessor list is published, and no incident notification period is stated. The privacy policy covers registration and site tracking and does not address uploaded documents.

The license terms publish a cap, carve outs and an intellectual property indemnity, and disclaim the accuracy of results. The DocAI and AI Trainer License Terms and Conditions, last updated 11 May 2022, are governed by Ontario law. Section 7(a) commits Zuva to indemnify the customer against third party claims that the services, used as the agreement allows, infringe intellectual property rights. Section 10 caps each party's liability at the amount paid in the six months before the claim, and carves fraud, willful misconduct and intellectual property infringement out of the cap.

Section 9(b) disclaims all other representations and warranties, including any warranty that results will be accurate or reliable. These terms cover the API and the software. The Diligence Reviews pages publish no engagement terms, so nothing says what Zuva stands behind when a disclosure schedule prepared with its lawyers is wrong.

The API is documented for developers, with one named connector into a workflow system and none into document management. The documentation covers file submission, OCR, classification, language detection, field extraction and custom field training, with a quick start, a Python SDK tutorial and a public API reference among the guides. A tutorial covers the Zuva Power Automate connector. That is enough for an engineer to build the extraction into another system.

Analyze exports results to Excel or Word for analysis across documents. No connector to a document management system such as iManage or NetDocuments, a CLM or a matter management system is published. Nothing describes what a Power Automate flow moves back beyond the extraction results, so integration depth depends on engineering by the customer.

Deployment options and regions are published, and the processing location of the generative features is not. The API servers run on Microsoft Azure in the United States and Europe, according to the security overview. The API is also available in a private cloud, including a different Azure region, or for self hosting on Azure or AWS for an added fee. The license terms place hosting, in section 2(d), in the jurisdiction the customer selects and user authentication in Canada or the European Union, and the FAQ confirms hosting on the Zuva cloud or on premises.

For extraction, storage and processing locations are clear across the shared cloud, a private cloud and the customer's own infrastructure. Nothing states where the generative AI behind Analyze answers and summaries runs, or whether it stays within the selected region.

SOC 2 Type II is stated across the site, and no report, auditor or period can be reached. The home page, the privacy policy footer and the API security overview all state the certification, and the overview's SOC2 compliance section says the Zuva API has obtained it. No auditor, report period, scope statement or route to request the report appears on those pages, the Analyze page or the documentation index, and no trust portal is linked.

The overview does describe controls in some detail: TLS 1.2 in transit, 256 bit encrypted storage, disaster recovery, security testing and response, and personnel security, under named information security policies.

The extraction models are described, and the provider behind the generative layer is not named. The about page says Zuva's AI is the technology developed at Kira Systems since 2011 and retained at the sale. Its research team works on the underlying models and on wrappers around general purpose AI. The Analyze page calls the fields purpose trained machine learning enhanced with generative AI for structured answers and summaries.

Custom fields are trained on the customer's own documents, and the extraction models run on Azure in the region the customer selects. Nothing names the provider or model producing the generative answers and summaries, where it runs, or what that provider keeps. No commitment to tell customers when a model or provider changes is published.

Rates and units are published for the self serve products and the review service, while enterprise and hosting terms are withheld. The pricing structure charges Analyze by the document, charges the API by the document and by the field after a free tier, and sets Diligence Reviews in fixed fee bands with stated turnaround times. Enterprise volume, private cloud, self hosting and rush delivery are left unpriced. From the published figures, the cost of a review project, a batch of contracts or an integration can be worked out without contacting Zuva.

Who each offer serves is stated, and so are the limits. Diligence Reviews are for the sell side of M&A, covering pre screens, disclosure schedules and execution status, for buyers such as chief financial officers, private equity firms selling portfolio companies and M&A advisors. Zuva Analyze is for legal teams and in house lawyers working on M&A, contract portfolio management and compliance. The API is for developers building contract automation into their own products.

The field library covers more than 1,400 provisions and more than 225 document types. Two boundaries are published. Under the Kira sale, Zuva agreed not to sell interface based contract analysis directly to law firms until later in 2026. And the out of the box fields were trained on publicly available English documents. Nothing states which governing laws or contract types beyond that population the fields have been tested on.