Legal-specific · Document management and knowledge · Medium confidence
Affinda Holdings Ltd · Draftable Compare and Draftable Clean, which the security page says run on the customer's machines, plus the existence of a self-hosted API. A cloud API that receives documents was not separately documented on the pages read.
Document comparison and metadata cleaning for law firms, running locally in Word, Outlook and document systems, with ISO 27001:2022 and SOC 2 Type II claims.
Opens a private software assessment of Draftable for one task, with this profile’s questions to hand.
| Deployment | Self-hosted, SaaS |
|---|---|
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | ISO/IEC 27001:2022, SOC 2 Type II (Trust Services Criteria for Security) |
| Training on customer content | No |
| Retention summary | The security page says Draftable Compare and Draftable Clean run on the customer's machines, and that the vendor does not receive documents unless the customer chooses to share them for support or diagnostics. |
| Integrations | Microsoft 365, Microsoft Outlook, SharePoint, iManage, NetDocuments |
| Pricing summary | No price list was on the pages read. |
| Australian presence | Unknown — The homepage quotes an Allens chief information officer. The security page says Draftable is part of Affinda Holdings Ltd. No Australian hosting region or Australian contracting entity is named on the pages read. |
Define the configuration, people, information and tasks being assessed.
Public claim only
The homepage separates Draftable Compare, Draftable Clean, a desktop compare product and a REST API, including a self-hosted API. This profile covers Compare and Clean as local products. The security page says cloud services also exist.
Ask: Which SKU are we buying, and does any component upload a document to Draftable?
Public claim only
The security page says Compare runs on the customer's machines, Clean runs on the customer's machines, and the self-hosted API runs entirely on the customer's infrastructure. It also says the information-security system covers cloud services and that those services are hosted on AWS with encrypted daily backups. No AWS region is named.
Ask: For our SKU, which components stay on our machines and which, if any, use the AWS service, and in which region?
Public claim only
Compare produces redlines across Word, PDF, PowerPoint, Excel and Outlook, including side-by-side comparison, and is described as working in iManage and NetDocuments. Clean removes hidden metadata before a document leaves the firm. No generative drafting feature is described.
Ask: Which file types and DMS versions are supported in our environment, and does comparison change the source document?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on jurisdiction and legal content.
Ask: What is the written position on jurisdiction and legal content for the deployment we would buy, and which contract or policy states it?
Record the practical work needed to introduce and maintain the software.
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on licence and pricing unit.
Ask: What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it?
Public claim only
The homepage lists Microsoft 365, Outlook, SharePoint, iManage and NetDocuments. A REST API is offered for comparison at scale.
Ask: Demonstrate comparison launched from our DMS without a copy leaving the firm.
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on support and service levels.
Ask: What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it?
Compare complete work at the required quality, including checking and correction.
Public claim only
The homepage says the product is trusted by 1,300+ law firms and legal teams and quotes a 95%+ customer-satisfaction figure. No independent accuracy study is cited. An Allens chief information officer is quoted.
Ask: What comparison-accuracy measure applies to our document types, and is the 95% figure a survey of customers?
Public claim only
The product compares documents and strips metadata. It does not draft, research or give advice. The homepage says it is built for contracts, agreements and regulatory documents.
Ask: Which comparison output will lawyers rely on as the record of changes, and who checks it?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
The pages do not discuss client authority. Clean is described as removing metadata before a document leaves the firm.
Ask: Is metadata cleaning mandatory before external send, and who can override it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on model providers.
Ask: What is the written position on model providers for the deployment we would buy, and which contract or policy states it?
Not confirmed
AWS is named as the host for cloud services. No subprocessor list was on the pages read.
Ask: Provide the subprocessor list for any cloud component in our SKU, including AWS regions.
Public claim only
The security page says most products never receive documents, documents are received only if the customer shares them for support or diagnostics, and the vendor never gets documents without permission. It does not use the word training. Local processing is the basis for recording training as not applying to Compare and Clean.
Ask: Confirm in the agreement that documents processed by Compare and Clean are not uploaded and are not used to train any model.
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on feedback and secondary use.
Ask: What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it?
Public claim only
Because Compare and Clean are described as running locally, the security page says the vendor does not hold those documents. It does not state a retention period for support copies a customer chooses to send, or for cloud-service logs.
Ask: If we send a file for support, how long is it kept, and what logs does the cloud service retain?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on deletion and export.
Ask: What is the written position on deletion and export for the deployment we would buy, and which contract or policy states it?
Public claim only
The security page says the vendor does not receive documents unless the customer shares them for support or diagnostics, and that access to customer data is logged.
Ask: Who can open a file we send for support, and is that access notified to us?
Public claim only
The security page says least-privilege access, multi-factor authentication and logging of all access to customer data. It does not say whether that MFA is the customer's identity provider or Draftable staff access.
Ask: Whose MFA and logs apply: our users on the desktop install, or Draftable staff access to any cloud copy?
Public claim only
The security page says TLS 1.2 or 1.3 is used in transit and AES-256 at rest, and that legacy protocols and weak ciphers are prohibited. It also says local products do not send the documents.
Ask: Which of those encryption statements apply to our SKU, given local products do not upload the document?
Public claim only
The security page says Draftable, as part of Affinda Holdings Ltd, holds ISO/IEC 27001:2022 for its information-security system, a SOC 2 Type II attestation for the Security criterion, and independent penetration testing of the web application and API. It says certificates are in the trust centre. Those reports were not opened.
Ask: Provide the current ISO certificate and SOC 2 report, including scope, date and whether local software is in scope.
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on contract, dpa and liability.
Ask: What is the written position on contract, dpa and liability for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on cross-border transfers.
Ask: What is the written position on cross-border transfers for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on incidents and breach notice.
Ask: What is the written position on incidents and breach notice for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on changes to terms and models.
Ask: What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it?
Not confirmed
No exit terms were published. Local software can be uninstalled; cloud-log retention was not stated.
Ask: On exit, what cloud logs or support files are deleted, and within what period?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on connectors and external tools.
Ask: What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on web search and open-web grounding.
Ask: What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on actions the system can take.
Ask: What is the written position on actions the system can take for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on human review of output.
Ask: What is the written position on human review of output for the deployment we would buy, and which contract or policy states it?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI document management and knowledge tools Australia
