Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
This profile covers Conga CLM as described on the vendor product page read 2026-09-27, including the AI functions on that page (playbook comparison, clause flagging, suggested redlines, data extraction, analysis dashboards, summaries and contract question answering). Conga Composer (document generation), Conga Sign (e-signature), CPQ, Billing and Price Optimization are separate products on the same platform. The Trust and Compliance Center describes a platform AI solution branded AiMe and names AI features including AI Data Mapping, AI Agents, a chatbot, a Discovery Agent and a Q&A Agent; which of those are inside a Conga CLM subscription is not published.
Ask: Which modules does our order form cover, and which of AiMe, AI Agents, the Discovery Agent and the Q&A Agent are included in a Conga CLM subscription as opposed to being separately licensed?
Deployment and hosting
Public claim only
The Trust and Compliance Center, read 2026-09-27, states that Conga runs on Salesforce, AWS and Azure cloud infrastructure 'with multi-region availability across US, EU, and APAC' and that this 'includes data residency options'. The DPA records that 'Data processed is stored on servers managed by Salesforce, Amazon Web Services'. Australia is not named as a region or a residency option on any page read. No on-premises or self-hosted option is published.
Ask: Is an Australian data-centre region available for a Conga CLM tenant, and which of Salesforce, AWS and Azure would host our tenant, its backups and its AI processing?
AI functions in scope
Public claim only
The product page read 2026-09-27 names these AI functions: automatic comparison of contract language to a negotiation playbook; flagging of clauses the page calls high-risk; 'AI-recommended redlines' offered during negotiation; extraction of key text and table data, qualified '(no manual AI training)', to populate tracking and reporting fields; AI contract analysis behind configurable dashboards and alerts covering compliance, cycle time, workflow progress and volume; AI summaries of long contracts; and answers to contract questions for legal, sales and procurement. Authoring and review take place in Microsoft Word or Google Docs. The page names no model, provider or technique.
Ask: For each AI function on the product page, which Conga AI service performs it, and which can be disabled per user or per contract type?
Jurisdiction and legal content
Not confirmed
Conga CLM is described as a contract lifecycle management platform; no cited primary-law library, Australian legislation coverage or jurisdiction-specific legal content is claimed on any page read on 2026-09-27. The DPA defines 'Data Protection Laws and Regulations' to include 'the data protection laws of Australia' and section 8 addresses Australian processing, but that is a privacy provision rather than legal content in the product. The governing law of the Master Services Agreement was not established because the MSA itself was not read.
Ask: Does Conga CLM apply any Australian legal or regulatory content to its risk flags and playbook comparisons, or does it apply only the positions our own playbook defines?
Check for vendor content directing how AI describes the product
Not confirmed
A deliberate check for content telling AI models, assistants or crawlers how to describe the product found nothing on the checks made, as at 2026-09-27. What was checked: a site map of conga.com run with search terms including 'llms' returned 60 URLs with no /llms.txt, /ai-info, /ai or /for-ai path; and the four Conga pages read in full for this profile (the Conga CLM product page, the Artificial Intelligence Addendum, the Trust and Compliance Center and the Data Processing Addendum) carry no 'Instructions for AI Assistants' heading or comparable block addressed to AI models or assistants. Three things are deliberately not treated as the same thing: the Artificial Intelligence Addendum is a contractual document governing AI use inside the service, not narrative direction to AI; no llms.txt file describing products to language models was found at all; and no crawler allow or disallow directives were examined, those being access control rather than narrative control. Limitation stated rather than papered over: /llms.txt was not fetched, because no site map returned it and the credit budget for this profile was exhausted, so this is 'nothing found on the checks made' and not confirmed absence.
Ask: Does Conga publish an llms.txt file, an AI-information page, or any content advising AI models or assistants how to describe Conga CLM, and if so at which URLs?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional responsibility
Public claim only
The AI Addendum places responsibility for AI use on the customer: the customer is 'solely responsible for evaluating and validating AI-generated outputs prior to use', must not rely on outputs as the sole basis for a decision with legal, financial or regulatory impact, and where AI agents are used is 'solely responsible for its use of AI agents, including without limitation determining whether the actions by AI agents are appropriate, authorizing and supervising actions performed by AI agents'. Nothing on the pages read addresses client notice or consent to contract text being processed by the named third-party AI services.
Ask: Which document records that client contract text may be sent to Microsoft Azure OpenAI, Google Cloud Vision, AWS Textract and Zuva, and what notice does Conga expect us to give our clients before using Conga CLM on their matters?
Foundation-model and AI service providers
Public claim only
The Trust and Compliance Center, read 2026-09-27, names the providers behind Conga's AI features. It states that 'Features like AI Data Mapping, AI Agents, and our Chatbot rely on generative AI large language models (LLMs) leveraging Microsoft Azure OpenAI', and that 'Conga's Discovery Agent and Q&A Agent use a small number of specialized third-party services for document processing, including Google Cloud Vision (OCR), AWS Textract (table detection), Zuva (provision extraction), and Azure OpenAI (language model processing)'. These statements are platform-level; the Conga CLM product page itself names no model or provider, and which of these services runs behind each Conga CLM AI function is not published. The AI Addendum mentions 'Azure OpenAI GPT' only as an example inside a negative covenant about foundational-model training, which does not by itself establish what a Conga CLM tenant uses.
Ask: For a Conga CLM tenant, which named service performs each AI function, in which Azure, Google and AWS regions do those calls run, and can we require that model changes be notified to us in advance?
Subprocessors and notice of change
Public claim only
The DPA v4.1 records at clause 9.4.2 that 'A list of current Subprocessors for the Services is available at https://conga.com/privacy/subprocessors-and-subcontractors', that the customer agrees to the listed subprocessors as at execution, and that customers may subscribe to change notifications there. Clause 9.4.3 requires Conga to inform the customer at least 15 days before appointing a new subprocessor, including its name, location and activities, and gives the customer 15 days to object; if Conga cannot make a change available within 30 days the customer may terminate the affected order form with a pro-rata refund of prepaid fees, which is stated to be the sole and exclusive remedy. Clause 9.4.1 makes Conga liable for its subprocessors as if it performed their services itself. The subprocessor list itself was not read within the credit budget for this profile.
Ask: Provide the current dated subprocessor register for Conga CLM, identifying which entries process contract text or run AI inference and in which countries, and confirm our email address for the 15-day notices.
Training on customer content
Public claim only
The AI Addendum states that 'Conga shall not use Customer Data to train global or foundational models that serve multiple customers', that 'Any model training using Customer Data shall be limited to models specific to Customer's instance or tenant', that 'Conga does not use Customer Data to train third-party foundational models (e.g., Azure OpenAI GPT)', and that Conga 'will not permit any third party to use, either directly or indirectly, any Customer Data or AI Output to train, fine-tune, validate, test, or otherwise develop any AI system or model'. Two carve-outs sit alongside that. First, tenant-scoped training is permitted, and the Trust and Compliance Center states that transactional data 'is used to train your algorithm so it can provide recommendations specific to your customers and use case'. Second, 'Service Attributes', defined in the addendum to include 'data derived from Customer Data' in anonymised aggregate form, may be used 'for the purposes of improving its Subscription Services, training and refining AI models, conducting analytics, and developing new features'.
Ask: Is any tenant-specific model trained on our contract text for Conga CLM, where does that training run, and will you contractually exclude Service Attributes derived from our client matter data?
Feedback, telemetry and quality monitoring
Public claim only
The AI Addendum permits Conga to 'collect, use, and disclose quantitative and other usage information, including data derived from Customer Data' as Service Attributes 'for industry benchmarking, analytics, general industry trend reports, and other business purposes', in aggregate and anonymised form, with Conga retaining all rights in them. The Trust and Compliance Center adds that the data collected 'for the functionality and improvement of our AI models and AI Agent interactions' includes 'User Interaction Data', 'Transactional Data' and 'Feedback and Support Data: Your feedback, support requests, and any interaction with our customer support team'. No opt-out from Service Attributes collection is published, and no in-product rating control for Conga CLM AI outputs is described.
Ask: Can our tenant be excluded from Service Attributes collection, and are prompts, ratings or support tickets about AI outputs used to refine any model that serves other customers?
Retention of contract text, prompts and outputs
Public claim only
The DPA's processing annex states the retention criteria as: 'Generally, retention of Personal Data should not be required. In case Personal Data should be retained, any retention period will be limited to the duration absolutely necessary to perform the Services pursuant to the Agreement.' The same annex records daily backups of Customer Data retained for 30 days, except for Subscription Services hosted on the Salesforce Platform, which Conga does not back up and from which the customer may extract its own copies. The Trust and Compliance Center states a zero-data-retention policy with Google Cloud Vision, AWS Textract, Zuva and Azure OpenAI, whereby documents 'are processed in real time and are not stored or retained after processing is complete'. No retention period is published for prompts, AI outputs, embeddings or extracted register data inside Conga CLM itself.
Ask: State the default and configurable retention for Conga CLM contract text, prompts, AI outputs, extracted fields and embeddings, and provide the zero-data-retention terms you hold with each named AI provider.
Deletion and certified erasure
Public claim only
DPA clause 9.6 states that 'Where applicable based on the Services, Conga will return and delete Personal Data in accordance with the Agreement, at the election of the Customer, within a reasonable period of time after the conclusion of the Agreement', that the customer is responsible for correcting, blocking or deleting Personal Data within its control in the Services, and that Conga will provide reasonable assistance where the customer cannot do so itself. 'A reasonable period of time' is not defined in days. No certificate of deletion and no deletion commitment covering backups, subprocessor copies or AI-processing systems is published on the pages read.
Ask: Define the deletion period in days for our tenant, state what happens to backups and any subprocessor copies, and confirm whether you will certify deletion in writing.
Vendor personnel access to contract content
Public claim only
DPA clause 4.1 requires Conga to ensure that personnel processing Personal Data are informed of its confidential nature, have received appropriate training and have executed written confidentiality agreements that survive the end of their engagement. Clause 4.2 limits access to personnel who require it to provide the Services. The DPA's security annex records role-based authorisation, a least-privilege model, access revocation on termination or role change, VP-or-above approval for role changes that add access, and quarterly access reviews. No customer-visible access log, ticketed-approval workflow or named list of support countries is published on the pages read.
Ask: Which Conga teams and which countries can read an Australian customer's contract text, under what approval, and can we receive an access log for our tenant?
Access control, SSO and audit logs
Public claim only
The DPA security annex records that 'Customer has the ability to limit access to the Subscription Services to authorized Customer Personnel to prevent unauthorized access to Customer Data, including through the use of multifactor authentication', and that Conga personnel access uses individualised passwords of at least 8 characters with regular automatic expiration, intrusion detection and prevention, and quarterly access reviews. The Trust and Compliance Center adds 'Manage access with RBAC, SSO via SAML 2.0 and OAuth 2.0, and MFA is applied for user and privileged accounts', and states that 'Rules-based access controls (RBAC), audit logs, and admin tools help you configure and manage AiMe'. Whether SSO, SCIM or exportable AI audit logs are included in a given subscription tier is not published.
Ask: Confirm SAML SSO, SCIM provisioning and enforced MFA on our tier, and whether we can export a complete audit log of AI prompts, outputs and agent actions for our Conga CLM tenant.
Encryption in transit and at rest
Public claim only
The DPA security annex states that 'All Customer Data, including Personal Data, is encrypted at rest and, in transit, using TLS encryption technology. TLS connections are negotiated for at least 256-bit encryption or stronger.' The Trust and Compliance Center adds that 'Each tenant has unique encryption keys' and that AiMe tenant environments are logically separated with dedicated encryption keys. No customer-managed or customer-held key option is published, and the at-rest algorithm is not named on the pages read.
Ask: Name the at-rest encryption algorithm and key-management model for a Conga CLM tenant, and state whether customer-managed keys are available and whether contract text is encrypted while in transit to Azure OpenAI and the named document-processing providers.
Independent security and AI assurance
Public claim only
The Trust and Compliance Center, read 2026-09-27, lists SOC 2 Type II ('Full platform coverage. Audited annually.'), ISO 27001, ISO 27701, PCI DSS, HIPAA Security Rule annual audits, GDPR and CCPA compliance badges, participation in the EU-U.S. Data Privacy Framework, and alignment of AI governance to the NIST AI Risk Management Framework. It also states annual third-party penetration tests plus SAST and DAST testing before releases. DPA clause 9.5.1 makes certifications and audit reports available on request under confidentiality, naming SOC 2, ISO 27001, APEC Cross Border Privacy Rules and SIG or CAIQ questionnaires as examples; clause 9.5.2 allows an additional audit at the customer's cost by mutual agreement. No ISO/IEC 42001 AI management certification is claimed, and no report was read.
Ask: Provide the current SOC 2 Type II report and ISO 27001 and ISO 27701 certificates with their scope statements, confirm that Conga CLM and the AI services are in scope, and share the most recent penetration-test summary.
Contracting entity, DPA and liability
Public claim only
The DPA v4.1, effective 22 October 2025, 'forms a part of the Master Services Agreement or other similar agreement' and is stated to be executed 'by and between Customer and Conga Corporation, on behalf of itself and its subsidiaries and Affiliates', with the DPA prevailing over conflicting terms. The Artificial Intelligence Addendum v1.0, effective 28 April 2026, is a separate standing document covering AI inputs, outputs, training limits and liability for AI outputs. Section 8 of the DPA addresses Australian data protection laws and records the parties' agreement that processing by Conga and its subprocessors 'constitutes a Use, and not a Disclosure, by Customer' under those laws. No Australian contracting entity or ACN is published, and the Master Services Agreement itself, its governing law and its liability cap were not read within the credit budget for this profile.
Ask: Which legal entity will contract with us for Australia, what is its ACN or ABN, what is the governing law and liability cap in the MSA, and do you accept that the APP 8 characterisation in section 8 of the DPA is a matter for our own assessment?
Cross-border transfers and Australian residency
Public claim only
The DPA implements the EU Standard Contractual Clauses for EEA, Swiss and UK personal data in controller-to-processor and processor-to-subprocessor modules, and section 8 addresses Australian data protection laws without naming a transfer mechanism or a storage country for Australian customers. The processing annex records that 'Data processed is stored on servers managed by Salesforce, Amazon Web Services'. The Trust and Compliance Center names multi-region availability across US, EU and APAC and says this 'includes data residency options'; Australia is not named. Nothing on the pages read states where AI inference runs, so whether contract text stays in Australia for processing is not established.
Ask: For an Australian Conga CLM tenant, list every country in which contract text is stored, processed, backed up, supported and used for AI inference, and state whether an Australia-only configuration exists.
Incident notification
Not confirmed
Two Conga documents state different notification windows. The DPA requires Conga, to the extent permitted by law, 'without undue delay, and in any event within 48 hours of becoming aware' to notify the customer of any actual or reasonably suspected unauthorised access, use, modification or disclosure of Personal Data by Conga or its subprocessors. The Trust and Compliance Center states 'We notify affected customers of critical security incidents within 72 hours' with post-incident reports available. The 48-hour figure appears in the contractual document and the 72-hour figure on the trust page; the two also describe different triggers, one a personal-data security breach and the other a critical security incident. No incident history is published on the pages read.
Ask: Which period governs our agreement, 48 hours under the DPA or 72 hours as published on the trust page, and will you notify us of incidents at a subprocessor that involve contract text but not personal data?
Notice of change to models, terms and processors
Public claim only
For subprocessors the DPA gives a defined process: at least 15 days' advance notice naming the new subprocessor, its location and activities, a 15-day objection window, and termination of the affected services with a pro-rata refund if Conga cannot avoid the objected-to subprocessor within 30 days. For models there is no equivalent commitment on the pages read: the Trust and Compliance Center states that 'AiMe uses third-party models that undergo testing, bias auditing, and benchmarking their providers before release' and that Conga can 'Rollback to any prior model version within hours if needed', but publishes no notice period before a model is changed. Both the DPA and the AI Addendum are versioned documents with effective dates and prior versions selectable on the page.
Ask: What written notice will we receive before the model behind a Conga CLM AI function is changed, and can we require version pinning or a notice period in our order form?
Export and exit
Public claim only
DPA clause 9.6 provides for return and deletion of Personal Data at the customer's election within a reasonable period after the agreement concludes, with reasonable assistance from Conga where the customer cannot carry out the operation itself. The security annex notes that for Subscription Services hosted on the Salesforce Platform Conga does not back up Customer Data and 'Customer may extract Customer Data from the Salesforce Platform to perform its own backups'. No export format, export tooling or exit service level is published for Conga CLM on the pages read, and the termination provisions of the Master Services Agreement were not read.
Ask: What export formats and tooling are available for our contract repository, metadata, extracted fields and audit history on exit, over what period, and at what cost?
Connectors and third-party services
Public claim only
The product page states that users can 'Manage the entire contract lifecycle without leaving the tools you use every day, like Office, Dynamics, and Salesforce', that Conga CLM will 'Integrate with any CRM, ERP, or procure-to-pay system', and that contracts are authored and reviewed in Microsoft Word or Google Docs and shared internally and externally. The Trust and Compliance Center names the third-party services used inside AI features (Microsoft Azure OpenAI, Google Cloud Vision, AWS Textract, Zuva). Conga also publishes an integrations page and a partner directory, which were not read. Which connectors are on by default in a Conga CLM tenant is not published.
Ask: List every connector and third-party service that would be enabled for our tenant, what contract content each receives, and confirm that any we do not enable in writing is off.
Open-web retrieval
Not confirmed
Nothing on the four Conga pages read on 2026-09-27 states whether any Conga CLM AI function retrieves content from the public internet. The product page describes AI answers, summaries and searches over the customer's own contracts and repository. The AI Addendum defines the relevant features as generating outputs 'based on Customer inputs and other contextual data' without saying what 'other contextual data' includes. No setting to enable or disable web retrieval is documented on the pages read.
Ask: Do Conga CLM summaries, contract question answering, the Discovery Agent or the Q&A Agent retrieve anything from the public internet, and can web retrieval be disabled for our tenant?
Agent actions and confirmation
Public claim only
The AI Addendum states that 'AI agents use or incorporate AI technology that perform actions based on Customer's direction and configuration', that the customer's users 'may direct AI agents to take certain actions on behalf of Customer', and that the customer is solely responsible for 'authorizing and supervising actions performed by AI agents'; Conga disclaims liability for actions performed by agentic AI capabilities to the maximum extent permitted by law. The Trust and Compliance Center states that 'AiMe never acts autonomously on high-stakes decisions' and that 'Agent guardrails, approval thresholds, and human-in-the-loop confirmation can be built into every workflow', which describes controls that are configured rather than on by default. Which Conga CLM actions an agent can take without a second confirmation is not published.
Ask: Which Conga CLM actions can an AI agent perform without a separate human confirmation, are approval thresholds off by default, and can we prevent agents from sending, signing or amending a contract?
Human review before use
Public claim only
The AI Addendum states that Conga 'maintains human oversight over AI-enabled features and remains accountable for the design and operation of such features, which are intended to support, and not replace, human decision-making', and immediately after that 'Conga does not monitor or review AI-generated outputs, and Customer is responsible for evaluating any such output before relying on it'. It requires that 'appropriate human review and independent judgment should be exercised by Customer'. The Trust and Compliance Center adds that AiMe 'surfaces how every recommendation is generated', that users 'see reasoning behind AI-driven actions', and that 'confidence scores are shown wherever AiMe makes a suggestion'. No product control that forces a named reviewer before an output is used is described.
Ask: What product control can we switch on to require a named reviewer to sign off an AI redline or extracted register field before it is used, and can that control be mandated firm-wide?
