---
title: "Agiloft (Agiloft)"
url: "https://ailawframework.com/software/agiloft"
type: "software_profile"
site: "AI Law Framework"
id: "agiloft"
vendor: "Agiloft"
category: "Legal-specific"
segment: "Contract review and CLM"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# Agiloft (Agiloft)

> Enterprise contract lifecycle platform with an Astra AI layer for extraction, search and agent-style review, hosted on AWS and sold from a US address.

Canonical page: https://ailawframework.com/software/agiloft  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Agiloft hosted CLM and the Astra contracts AI described on the homepage, together with the public security policy. The data processing addendum and trust portal were not opened.

## Capabilities

- Contract review and redlining
- Contract drafting
- Data extraction
- Knowledge search
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | United States, Worldwide or dynamically routed |
| Australian region | Unknown |
| Assurance | SOC 1, SOC 2, ISO 27001, ISO 27701 |
| Training on customer content | Unknown |
| Integrations | Salesforce, SAP, Oracle, DocuSign, Adobe Sign |
| Pricing | No price list was on the pages read. The homepage offers a demonstration. |
| Australian presence | Unknown. The security policy gives the address 303 Twin Dolphin Drive, Redwood City, CA 94065. Hosting is described as redundant AWS inside or outside the USA. Australia is not named. No Australian customer is named on the pages read. |
| Website | https://www.agiloft.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan and modules | Public claim only | The homepage describes a contract lifecycle platform and Astra, a contracts AI layer for questions, review, extraction and agents that can review, negotiate and onboard contracts. It says configuration of approval chains does not require code. No priced modules were listed. | Which Astra agents are in our subscription, and which can send or sign without a person? | [Agiloft — home](https://www.agiloft.com/) |
| Deployment and hosting | Public claim only | The security policy says the hosted service is fully redundant AWS, whether inside or outside the USA, on hardened, firewall-protected servers. It does not name an Australian region. The homepage does not describe on-premises deployment. | Which AWS region will hold our contracts, and is an Australian region available? | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Product surfaces | Public claim only | The homepage describes pre- and post-signature workflow, clause and obligation search, AI extraction, dashboards, and agents that review, negotiate and onboard. It says there are over 1,000 connectors, naming Salesforce, SAP, Oracle, DocuSign and Adobe Sign. E-signature is described as ready with DocuSign and Adobe Sign. | Which agents are generally available, and which actions require a user to approve a change before it is written back? | [Agiloft — home](https://www.agiloft.com/) |
| Jurisdiction and legal content | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on jurisdiction and legal content. | What is the written position on jurisdiction and legal content for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Licence and pricing unit | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on licence and pricing unit. | What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Integrations | Public claim only | The homepage says Agiloft syncs with Salesforce, SAP, Oracle and more than 1,000 other systems, and is e-signature ready with DocuSign and Adobe Sign. | Which connectors are in our licence, and do they inherit our contract permissions? | [Agiloft — home](https://www.agiloft.com/) |
| Support and service levels | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on support and service levels. | What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Independent quality evidence | Public claim only | The homepage states 96% customer retention, 99% implementation satisfaction and 96% support satisfaction. No independent extraction or redline study is cited. | What accuracy measure applies to extraction and redlines on our templates? | [Agiloft — home](https://www.agiloft.com/) |
| Task fit | Public claim only | The product is for enterprise contracting: request, negotiation, signature, obligations and renewal, plus AI extraction and questions over the repository. It is not a litigation research tool. | Which contract types will agents be allowed to mark up, and which stay lawyer-only? | [Agiloft — home](https://www.agiloft.com/) |
| Client authority and client-facing use | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on client authority and client-facing use. | What is the written position on client authority and client-facing use for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Model providers | Not confirmed | Astra is described as AI embedded in the platform. No model provider is named. | Which model providers does Astra call, and in which region? | [Agiloft — home](https://www.agiloft.com/) |
| Subprocessors | Not confirmed | AWS is named as the host. No subprocessor list was on the pages read. The security policy says a trust portal holds further documentation. | Provide the subprocessor list, including AWS and any model provider, with locations. | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Training on customer content | Not confirmed | The homepage says contracting expertise is trained into every model. That describes Agiloft's models, not whether customer contracts are used as training data. The security policy does not address training. | Are our contracts, prompts and edits excluded from training of Agiloft and of any model provider? | [Agiloft — home](https://www.agiloft.com/); [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Feedback and secondary use | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on feedback and secondary use. | What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Retention | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on retention. | What is the written position on retention for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Deletion and export | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on deletion and export. | What is the written position on deletion and export for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Human access to customer content | Not confirmed | The security policy does not say whether Agiloft staff can open customer contracts. Penetration-test reports are available under NDA, which is a document process, not a staff-access rule. | Who on your staff can read a contract, under what approval, and is it logged? | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Access control | Public claim only | The security policy says access is controlled at record and field level by group permissions. It does not mention customer SSO or MFA. | Does the hosted service support our identity provider and MFA, and can field-level permissions hide a contract from a group? | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Encryption | Public claim only | The security policy says communications are protected with SSL and passwords are stored with SHA-2. It does not name TLS version or encryption at rest. | Is data encrypted at rest, with which algorithm, and is TLS 1.2 or higher required? | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Assurance and certifications | Public claim only | The security policy says Agiloft has SOC 1, SOC 2, ISO 27001 and ISO 27701 certification, annual penetration tests of the application and hosting after major upgrades, and social-engineering tests. A copy of the most recent security audit is available on a signed NDA. Reports were not opened. AWS compliance (SSAE 18, SOC 2 Type 2, HIPAA, GDPR) is stated as the provider's, not re-stated here as Agiloft's. | Provide the current SOC 2 and ISO certificates, including type, scope and period, for the hosted service we would use. | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Contract, DPA and liability | Not confirmed | The security policy is not the customer agreement. A DPA is published at a URL that was not read in this pass. Governing law was not on the pages read. | Provide the subscription agreement and DPA that would apply to an Australian customer, including liability and governing law. | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Cross-border transfers | Public claim only | Hosting is AWS inside or outside the USA. The policy does not say the customer chooses the country, and it does not mention Australia. | List the countries where our contracts may be stored or accessed, including support. | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Incidents and breach notice | Not confirmed | The security policy describes risk management and testing. It does not state a customer breach-notice period. Contact for security questions is isms@agiloft.com. | What is the contractual notice period for a security incident, and is isms@agiloft.com the notice address? | [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) |
| Changes to terms and models | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on changes to terms and models. | What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Exit, return and deletion | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on exit, return and deletion. | What is the written position on exit, return and deletion for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Connectors and external tools | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on connectors and external tools. | What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Web search and open-web grounding | Not confirmed | The pages read on 2026-10-10 (the Agiloft homepage and security policy) do not state a position on web search and open-web grounding. | What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it? | [Agiloft — home](https://www.agiloft.com/) |
| Actions the system can take | Public claim only | The homepage says AI reviews, negotiates and onboards contracts automatically, with configurable agents that anticipate tasks and execute them, and that outputs are auditable. It also says a reviewer can ask questions and uncover insights. The boundary between suggestion and sending a markup is not defined. | Which agent actions can leave the tenancy, such as emailing a counterparty or sending for signature, without a named user confirming them? | [Agiloft — home](https://www.agiloft.com/) |
| Human review of output | Not confirmed | Auditable outputs are claimed. A required lawyer review before an agent negotiates or onboards is not stated. | Which contract actions require a lawyer's approval before they take effect? | [Agiloft — home](https://www.agiloft.com/) |

## Notes

The DPA URL is recorded because the security materials refer to it; the DPA body was not fetched in this pass, so DPA clauses are not treated as read. Certification names come from the security policy, which says audit reports are available via the trust portal under a process that was not completed. The homepage uses promotional language that is not repeated here.

## Sources

- [Agiloft — home](https://www.agiloft.com/) (checked 2026-10-10)
- [Agiloft — security policy](https://www.agiloft.com/terms-policies/security) (checked 2026-10-10)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.