Legal-specific · Contract review and CLM · Medium confidence
LegalFly BV · Order-form SaaS (managed), single-tenant in a chosen Azure region, single-tenant plus on-prem anonymisation, or private-cloud/hybrid/on-prem as marketed. General Terms 24 April 2025 plus a separate DPA that is not published.
European enterprise legal operating system for in-house teams: contract review, research, drafting, compliance monitoring and governed workflows, with pre-analysis anonymisation.
Opens a private software assessment of LEGALFLY for one task, with this profile’s questions to hand.
| Deployment | SaaS, Private cloud, On-premises, Hybrid |
|---|---|
| Hosting regions | European Union / EEA, United Kingdom, Another named location |
| Australian region | No |
| Model providers | Anthropic, OpenAI |
| Assurance | ISO 27001, SOC 2 Type II |
| Training on customer content | No |
| Retention summary | Controller privacy (1 March 2026) has no numbered SaaS retention. Trust centre lists a Data Retention and Disposal Policy (request-only). Post-termination deletion is not in the public General Terms. |
| Integrations | Microsoft Word, Microsoft Outlook, Okta, Azure AD, Google Workspace, Slack, Microsoft Teams |
| Pricing summary | Fees are set in the Order Form, invoiced in EUR (annual in advance unless the order says otherwise). No public price list. |
| Legal content coverage | Home: Discovery answers grounded in verified case law and legislation across 130+ jurisdictions; playbooks by contract type and jurisdiction. Australian coverage is not specifically evidenced. |
| Australian presence | Unknown — Company page lists Ghent, London and Dubai. Security/trust language is EU, UK and Middle East. No Australian region or named Australian customer found. |
Define the configuration, people, information and tasks being assessed.
Public claim only
LegalFly BV, Veldstraat 88/301, 9000 Ghent, Belgium. General Terms 24 April 2025 apply to Order Forms unless a signed deviation exists. DPA is a referenced document, not published on the site. Modules include Discovery, Review, Draft, Legal Radar, Agent Studio.
Ask: Which modules and deployment SKU are on our Order Form, and will the DPA be attached before go-live?
Public claim only
Security page: SaaS; single tenant in a preferred Azure region; single tenant plus on-prem anonymisation so identifiable data stays in the customer environment. FAQ also claims private cloud, hybrid and full on-premise. Company: Ghent, London, Dubai.
Ask: Which deployment and Azure region will we buy, and is an Australian Azure region available?
Public claim only
Home: contract review against playbooks, Discovery research, drafting, regulatory Legal Radar, due-diligence multi-review, knowledge, document repository, Agent Studio workflows from email/Slack/Teams with approval steps. Pre-analysis anonymisation is the headline control.
Ask: Which agents and anonymisation level are enabled by default on our tenancy?
Public claim only
Home: 110+ jurisdictions in one banner and 130+ in Discovery copy, with playbooks by jurisdiction. Australian primary-law completeness is not evidenced.
Ask: List Australian sources (courts, consolidations) actually in Discovery, if any.
Record the practical work needed to introduce and maintain the software.
Public claim only
Fees in EUR on the Order Form; annual advance invoices unless otherwise stated; Agoria indexation; 30-day fee-increase notice with 15-day termination right; 60-day non-renewal notice for yearly terms; Belgian law and Ghent courts; liability cap of fees in the prior 12 months.
Ask: Confirm seats, term, cap and whether we can negotiate Australian law/forum.
Public claim only
Security: Okta, Azure AD, Google Workspace; SAML 2.0, OIDC, OAuth; ABAC, MFA, session governance. Site nav: Word add-in and Outlook add-in. Home: workflows from email, Slack or Teams.
Ask: Which integrations are in our Order Form, and do they honour source-system permissions?
Public claim only
General Terms 4.2: if the customer requests assistance, a support member may be granted access to End User accounts and Customer Data, subject to confidentiality and the DPA. No published hours or severity SLA.
Ask: What are support hours, severity targets, and can we forbid standing support access?
Compare complete work at the required quality, including checking and correction.
Not confirmed
No Vals AI, Stanford RegLab or other independent hallucination benchmark was found on pages reviewed. Marketing claims of grounded research were not audited here.
Ask: May we run a scored trial on our playbooks and Australian clauses?
Public claim only
Terms 10.2: the SaaS is a tool for professionals; it does not provide legal advice; the customer must verify outputs. Fit is contract review, research and workflow automation with human approval steps.
Ask: Which workflows will require a lawyer approval step before anything leaves the tenancy?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Security: documents anonymised before processing, with adjustable levels and term whitelists. Trust: inference providers process pseudonymised content unless the customer enables processing without anonymisation. That disable switch is a residual disclosure.
Ask: Will anonymisation stay on, and do we have a client-disclosure for residual identifiers and EU processing?
Public claim only
Trust centre subprocessors: Anthropic and OpenAI as AI inference providers, zero retention, no training, pseudonymised content unless the customer disables anonymisation. Azure is the cloud infrastructure provider.
Ask: Name the models and regions on our tenancy, and can we pin one provider?
Public claim only
Trust centre names Microsoft Azure (cloud), Auth0 (identity), PostHog (product analytics), Anthropic and OpenAI (inference). Change-notice and objection rights are not on that page; they may sit in the unpublished DPA.
Ask: Provide the dated list with locations, 30-day notice and a right to object, including PostHog's data.
Not confirmed
General Terms 5.2: Customer Data will not be used to train the SaaS Solution without Customer's consent (24 April 2025). Trust centre: data is never used to train AI models. Controller privacy (1 March 2026) says anonymised contract content is kept to enhance services. Default is no training unless consent is given.
Ask: Confirm in the DPA that neither LegalFly nor subprocessors train on our identifiable or anonymised Customer Data, and that we will not be asked to consent.
Public claim only
Terms 5.4: LegalFly may collect, use and disclose quantitative data derived from use for industry analysis, benchmarking, analytics, marketing and other business purposes, in aggregate form only, not identifying Customer or Customer Data. Terms 6.3: Feedback (excluding Customer Data) is licensed to LegalFly perpetually.
Ask: Can document text or prompts appear in aggregated analytics, including PostHog?
Not confirmed
Trust centre lists a Data Retention and Disposal Policy as a requestable document. Controller privacy: retain as long as necessary for the collection purpose. No numbered SaaS chat/document schedule in the General Terms.
Ask: State default retention for documents, embeddings, logs and backups on our SKU.
Not confirmed
General Terms describe access loss on termination but do not number production or backup deletion. DPA is referenced as the processing contract. Controller privacy offers a deletion right for website/account data.
Ask: On exit, will you delete production and backups within 30 days and certify, as the DPA will say?
Public claim only
Terms 4.2: support may access End User accounts and Customer Data when the customer requests assistance. Trust: access reviews, least privilege, termination of access. Isolation per client is claimed on the security page.
Ask: Is support access ticket-scoped, logged, time-limited and customer-approved each time?
Public claim only
Security: SSO (Okta, Azure AD, Google Workspace), SAML/OIDC/OAuth, ABAC, MFA, session governance. Trust: user access reviews, access-control and termination policy, least privilege, restricted admin access.
Ask: Will SSO+MFA+SCIM be in our Order Form, and how are ethical walls configured?
Public claim only
Security FAQ: documents anonymised before processing and encrypted at rest and in transit. Trust: enterprise-grade encryption in transit and at rest; Encryption and Key Management Policy listed. Algorithms and BYOK are not specified on the public pages.
Ask: Confirm algorithms, key custody and whether customer-managed keys are available on our SKU.
Public claim only
Security and trust centre: ISO 27001 (trust lists ISO27001:2022) and SOC 2 Type II; annual independent penetration testing; 2026 pen-test report requestable; Secureframe monitoring. Reports themselves were not inspected.
Ask: Provide current ISO 27001 and SOC 2 Type II reports under NDA, with scope and dates.
Public claim only
General Terms 24 April 2025: Belgian law, Ghent courts, 12-month fee cap, as-is style warranty limits, customer must verify outputs. Article 12: parties shall conclude a DPA before processing starts. Public DPA URL was not found.
Ask: Attach the current DPA (APP 8, 72-hour notice, audit, no-training, subprocessors) to our Order Form before any matter data is uploaded.
Public claim only
Single-tenant is in a preferred Azure region. Trust subprocessors include US-headquartered OpenAI/Anthropic processing pseudonymised content. Controller privacy: transfers outside the EEA use adequacy, SCCs with TIA, BCRs or certification. No Australian region.
Ask: Map every country of storage and inference on our SKU, including when anonymisation is off.
Not confirmed
Trust centre lists an Incident Response Plan, tracking of incidents, and lessons-learned. No 72-hour customer-notification commitment appears in the public General Terms.
Ask: State the contractual notification period for a personal-data breach affecting our tenant.
Public claim only
LegalFly may modify General Terms with prior written notice (including email). Customer may terminate within 15 days of that notice; otherwise the new terms take effect on the date specified. Subprocessor-change notice is not in the public Terms.
Ask: Will subprocessor changes get 30 days' notice and a right to object, in the DPA?
Not confirmed
On termination, user rights end and unpaid fees are due. Export format, certified deletion and a 30-day wind-down are not in the public General Terms.
Ask: What export formats are available, and will you certify deletion of production, backups and provider copies?
Public claim only
Agent Studio workflows can trigger from email, Slack or Teams. Word and Outlook add-ins are listed. Connectors may send matter text outside the tenant if enabled.
Ask: List every connector on our Order Form and how we disable outbound send.
Not confirmed
Discovery is described as grounded in verified case law and legislation. Whether agents may browse the open web was not stated.
Ask: Can agents perform open-web search, and can we disable it?
Public claim only
Home: conditional logic routes work and escalates; approval steps keep legal in control. That is a configurable workflow, not a contractual prohibition on unattended actions.
Ask: Which agent actions require human approval by default on our tenancy, and can they send email unattended?
Public claim only
Terms 10.2: customer bears full responsibility for verifying accuracy of outputs; the product is not legal advice. Anonymisation FAQ: customers can whitelist terms to preserve context, which increases residual identifiers.
Ask: Will we require lawyer review of every outbound contract mark-up before it leaves the system?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI contract review and clm tools Australia
