---
title: "Draftable (Affinda Holdings Ltd)"
url: "https://ailawframework.com/software/draftable"
type: "software_profile"
site: "AI Law Framework"
id: "draftable"
vendor: "Affinda Holdings Ltd"
category: "Legal-specific"
segment: "Document management and knowledge"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# Draftable (Affinda Holdings Ltd)

> Document comparison and metadata cleaning for law firms, running locally in Word, Outlook and document systems, with ISO 27001:2022 and SOC 2 Type II claims.

Canonical page: https://ailawframework.com/software/draftable  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Draftable Compare and Draftable Clean, which the security page says run on the customer's machines, plus the existence of a self-hosted API. A cloud API that receives documents was not separately documented on the pages read.

## Capabilities

- Document comparison

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | Self-hosted, SaaS |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | ISO/IEC 27001:2022, SOC 2 Type II (Trust Services Criteria for Security) |
| Training on customer content | No |
| Retention | The security page says Draftable Compare and Draftable Clean run on the customer's machines, and that the vendor does not receive documents unless the customer chooses to share them for support or diagnostics. |
| Integrations | Microsoft 365, Microsoft Outlook, SharePoint, iManage, NetDocuments |
| Pricing | No price list was on the pages read. |
| Australian presence | Unknown. The homepage quotes an Allens chief information officer. The security page says Draftable is part of Affinda Holdings Ltd. No Australian hosting region or Australian contracting entity is named on the pages read. |
| Website | https://www.draftable.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan and modules | Public claim only | The homepage separates Draftable Compare, Draftable Clean, a desktop compare product and a REST API, including a self-hosted API. This profile covers Compare and Clean as local products. The security page says cloud services also exist. | Which SKU are we buying, and does any component upload a document to Draftable? | [Draftable — home](https://www.draftable.com/); [Draftable — security](https://www.draftable.com/security) |
| Deployment and hosting | Public claim only | The security page says Compare runs on the customer's machines, Clean runs on the customer's machines, and the self-hosted API runs entirely on the customer's infrastructure. It also says the information-security system covers cloud services and that those services are hosted on AWS with encrypted daily backups. No AWS region is named. | For our SKU, which components stay on our machines and which, if any, use the AWS service, and in which region? | [Draftable — security](https://www.draftable.com/security) |
| Product surfaces | Public claim only | Compare produces redlines across Word, PDF, PowerPoint, Excel and Outlook, including side-by-side comparison, and is described as working in iManage and NetDocuments. Clean removes hidden metadata before a document leaves the firm. No generative drafting feature is described. | Which file types and DMS versions are supported in our environment, and does comparison change the source document? | [Draftable — home](https://www.draftable.com/) |
| Jurisdiction and legal content | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on jurisdiction and legal content. | What is the written position on jurisdiction and legal content for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Licence and pricing unit | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on licence and pricing unit. | What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Integrations | Public claim only | The homepage lists Microsoft 365, Outlook, SharePoint, iManage and NetDocuments. A REST API is offered for comparison at scale. | Demonstrate comparison launched from our DMS without a copy leaving the firm. | [Draftable — home](https://www.draftable.com/) |
| Support and service levels | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on support and service levels. | What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Independent quality evidence | Public claim only | The homepage says the product is trusted by 1,300+ law firms and legal teams and quotes a 95%+ customer-satisfaction figure. No independent accuracy study is cited. An Allens chief information officer is quoted. | What comparison-accuracy measure applies to our document types, and is the 95% figure a survey of customers? | [Draftable — home](https://www.draftable.com/) |
| Task fit | Public claim only | The product compares documents and strips metadata. It does not draft, research or give advice. The homepage says it is built for contracts, agreements and regulatory documents. | Which comparison output will lawyers rely on as the record of changes, and who checks it? | [Draftable — home](https://www.draftable.com/) |
| Client authority and client-facing use | Not confirmed | The pages do not discuss client authority. Clean is described as removing metadata before a document leaves the firm. | Is metadata cleaning mandatory before external send, and who can override it? | [Draftable — home](https://www.draftable.com/); [Draftable — security](https://www.draftable.com/security) |
| Model providers | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on model providers. | What is the written position on model providers for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Subprocessors | Not confirmed | AWS is named as the host for cloud services. No subprocessor list was on the pages read. | Provide the subprocessor list for any cloud component in our SKU, including AWS regions. | [Draftable — security](https://www.draftable.com/security) |
| Training on customer content | Public claim only | The security page says most products never receive documents, documents are received only if the customer shares them for support or diagnostics, and the vendor never gets documents without permission. It does not use the word training. Local processing is the basis for recording training as not applying to Compare and Clean. | Confirm in the agreement that documents processed by Compare and Clean are not uploaded and are not used to train any model. | [Draftable — security](https://www.draftable.com/security) |
| Feedback and secondary use | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on feedback and secondary use. | What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Retention | Public claim only | Because Compare and Clean are described as running locally, the security page says the vendor does not hold those documents. It does not state a retention period for support copies a customer chooses to send, or for cloud-service logs. | If we send a file for support, how long is it kept, and what logs does the cloud service retain? | [Draftable — security](https://www.draftable.com/security) |
| Deletion and export | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on deletion and export. | What is the written position on deletion and export for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Human access to customer content | Public claim only | The security page says the vendor does not receive documents unless the customer shares them for support or diagnostics, and that access to customer data is logged. | Who can open a file we send for support, and is that access notified to us? | [Draftable — security](https://www.draftable.com/security) |
| Access control | Public claim only | The security page says least-privilege access, multi-factor authentication and logging of all access to customer data. It does not say whether that MFA is the customer's identity provider or Draftable staff access. | Whose MFA and logs apply: our users on the desktop install, or Draftable staff access to any cloud copy? | [Draftable — security](https://www.draftable.com/security) |
| Encryption | Public claim only | The security page says TLS 1.2 or 1.3 is used in transit and AES-256 at rest, and that legacy protocols and weak ciphers are prohibited. It also says local products do not send the documents. | Which of those encryption statements apply to our SKU, given local products do not upload the document? | [Draftable — security](https://www.draftable.com/security) |
| Assurance and certifications | Public claim only | The security page says Draftable, as part of Affinda Holdings Ltd, holds ISO/IEC 27001:2022 for its information-security system, a SOC 2 Type II attestation for the Security criterion, and independent penetration testing of the web application and API. It says certificates are in the trust centre. Those reports were not opened. | Provide the current ISO certificate and SOC 2 report, including scope, date and whether local software is in scope. | [Draftable — security](https://www.draftable.com/security) |
| Contract, DPA and liability | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on contract, dpa and liability. | What is the written position on contract, dpa and liability for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Cross-border transfers | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on cross-border transfers. | What is the written position on cross-border transfers for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Incidents and breach notice | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on incidents and breach notice. | What is the written position on incidents and breach notice for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Changes to terms and models | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on changes to terms and models. | What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Exit, return and deletion | Not confirmed | No exit terms were published. Local software can be uninstalled; cloud-log retention was not stated. | On exit, what cloud logs or support files are deleted, and within what period? | [Draftable — security](https://www.draftable.com/security) |
| Connectors and external tools | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on connectors and external tools. | What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Web search and open-web grounding | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on web search and open-web grounding. | What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Actions the system can take | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on actions the system can take. | What is the written position on actions the system can take for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |
| Human review of output | Not confirmed | The pages read on 2026-10-10 (the Draftable homepage and security page) do not state a position on human review of output. | What is the written position on human review of output for the deployment we would buy, and which contract or policy states it? | [Draftable — home](https://www.draftable.com/) |

## Notes

Security statements are vendor claims on the security page, which also says certificates sit in a trust centre. The trust-centre documents themselves were not opened. No people's names are recorded.

## Sources

- [Draftable — home](https://www.draftable.com/) (checked 2026-10-10)
- [Draftable — security](https://www.draftable.com/security) (checked 2026-10-10)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.