Legal-specific · Contract review and CLM · Medium confidence
Agiloft · Agiloft hosted CLM and the Astra contracts AI described on the homepage, together with the public security policy. The data processing addendum and trust portal were not opened.
Enterprise contract lifecycle platform with an Astra AI layer for extraction, search and agent-style review, hosted on AWS and sold from a US address.
Opens a private software assessment of Agiloft for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | United States, Worldwide or dynamically routed |
| Australian region | Unknown |
| Assurance | SOC 1, SOC 2, ISO 27001, ISO 27701 |
| Training on customer content | Unknown |
| Integrations | Salesforce, SAP, Oracle, DocuSign, Adobe Sign |
| Pricing summary | No price list was on the pages read. The homepage offers a demonstration. |
| Australian presence | Unknown — The security policy gives the address 303 Twin Dolphin Drive, Redwood City, CA 94065. Hosting is described as redundant AWS inside or outside the USA. Australia is not named. No Australian customer is named on the pages read. |
Define the configuration, people, information and tasks being assessed.
Public claim only
The homepage describes a contract lifecycle platform and Astra, a contracts AI layer for questions, review, extraction and agents that can review, negotiate and onboard contracts. It says configuration of approval chains does not require code. No priced modules were listed.
Ask: Which Astra agents are in our subscription, and which can send or sign without a person?
Public claim only
The security policy says the hosted service is fully redundant AWS, whether inside or outside the USA, on hardened, firewall-protected servers. It does not name an Australian region. The homepage does not describe on-premises deployment.
Ask: Which AWS region will hold our contracts, and is an Australian region available?
Public claim only
The homepage describes pre- and post-signature workflow, clause and obligation search, AI extraction, dashboards, and agents that review, negotiate and onboard. It says there are over 1,000 connectors, naming Salesforce, SAP, Oracle, DocuSign and Adobe Sign. E-signature is described as ready with DocuSign and Adobe Sign.
Ask: Which agents are generally available, and which actions require a user to approve a change before it is written back?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on jurisdiction and legal content.
Ask: What is the written position on jurisdiction and legal content for the deployment we would buy, and which contract or policy states it?
Record the practical work needed to introduce and maintain the software.
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on licence and pricing unit.
Ask: What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it?
Public claim only
The homepage says Agiloft syncs with Salesforce, SAP, Oracle and more than 1,000 other systems, and is e-signature ready with DocuSign and Adobe Sign.
Ask: Which connectors are in our licence, and do they inherit our contract permissions?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on support and service levels.
Ask: What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it?
Compare complete work at the required quality, including checking and correction.
Public claim only
The homepage states 96% customer retention, 99% implementation satisfaction and 96% support satisfaction. No independent extraction or redline study is cited.
Ask: What accuracy measure applies to extraction and redlines on our templates?
Public claim only
The product is for enterprise contracting: request, negotiation, signature, obligations and renewal, plus AI extraction and questions over the repository. It is not a litigation research tool.
Ask: Which contract types will agents be allowed to mark up, and which stay lawyer-only?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on client authority and client-facing use.
Ask: What is the written position on client authority and client-facing use for the deployment we would buy, and which contract or policy states it?
Not confirmed
Astra is described as AI embedded in the platform. No model provider is named.
Ask: Which model providers does Astra call, and in which region?
Not confirmed
AWS is named as the host. No subprocessor list was on the pages read. The security policy says a trust portal holds further documentation.
Ask: Provide the subprocessor list, including AWS and any model provider, with locations.
Not confirmed
The homepage says contracting expertise is trained into every model. That describes Agiloft's models, not whether customer contracts are used as training data. The security policy does not address training.
Ask: Are our contracts, prompts and edits excluded from training of Agiloft and of any model provider?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on feedback and secondary use.
Ask: What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on retention.
Ask: What is the written position on retention for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on deletion and export.
Ask: What is the written position on deletion and export for the deployment we would buy, and which contract or policy states it?
Not confirmed
The security policy does not say whether Agiloft staff can open customer contracts. Penetration-test reports are available under NDA, which is a document process, not a staff-access rule.
Ask: Who on your staff can read a contract, under what approval, and is it logged?
Public claim only
The security policy says access is controlled at record and field level by group permissions. It does not mention customer SSO or MFA.
Ask: Does the hosted service support our identity provider and MFA, and can field-level permissions hide a contract from a group?
Public claim only
The security policy says communications are protected with SSL and passwords are stored with SHA-2. It does not name TLS version or encryption at rest.
Ask: Is data encrypted at rest, with which algorithm, and is TLS 1.2 or higher required?
Public claim only
The security policy says Agiloft has SOC 1, SOC 2, ISO 27001 and ISO 27701 certification, annual penetration tests of the application and hosting after major upgrades, and social-engineering tests. A copy of the most recent security audit is available on a signed NDA. Reports were not opened. AWS compliance (SSAE 18, SOC 2 Type 2, HIPAA, GDPR) is stated as the provider's, not re-stated here as Agiloft's.
Ask: Provide the current SOC 2 and ISO certificates, including type, scope and period, for the hosted service we would use.
Not confirmed
The security policy is not the customer agreement. A DPA is published at a URL that was not read in this pass. Governing law was not on the pages read.
Ask: Provide the subscription agreement and DPA that would apply to an Australian customer, including liability and governing law.
Public claim only
Hosting is AWS inside or outside the USA. The policy does not say the customer chooses the country, and it does not mention Australia.
Ask: List the countries where our contracts may be stored or accessed, including support.
Not confirmed
The security policy describes risk management and testing. It does not state a customer breach-notice period. Contact for security questions is isms@agiloft.com.
Ask: What is the contractual notice period for a security incident, and is isms@agiloft.com the notice address?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on changes to terms and models.
Ask: What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on exit, return and deletion.
Ask: What is the written position on exit, return and deletion for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on connectors and external tools.
Ask: What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on web search and open-web grounding.
Ask: What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it?
Public claim only
The homepage says AI reviews, negotiates and onboards contracts automatically, with configurable agents that anticipate tasks and execute them, and that outputs are auditable. It also says a reviewer can ask questions and uncover insights. The boundary between suggestion and sending a markup is not defined.
Ask: Which agent actions can leave the tenancy, such as emailing a counterparty or sending for signature, without a named user confirming them?
Not confirmed
Auditable outputs are claimed. A required lawyer review before an agent negotiates or onboards is not stated.
Ask: Which contract actions require a lawyer's approval before they take effect?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI contract review and clm tools Australia
