---
title: "LEGALFLY (LegalFly BV)"
url: "https://ailawframework.com/software/legalfly"
type: "software_profile"
site: "AI Law Framework"
id: "legalfly"
vendor: "LegalFly BV"
category: "Legal-specific"
segment: "Contract review and CLM"
confidence: "medium"
last_reviewed: "2026-09-21"
---

# LEGALFLY (LegalFly BV)

> European enterprise legal operating system for in-house teams: contract review, research, drafting, compliance monitoring and governed workflows, with pre-analysis anonymisation.

Canonical page: https://ailawframework.com/software/legalfly  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Order-form SaaS (managed), single-tenant in a chosen Azure region, single-tenant plus on-prem anonymisation, or private-cloud/hybrid/on-prem as marketed. General Terms 24 April 2025 plus a separate DPA that is not published.

## Capabilities

- Legal research
- Contract drafting
- Contract review and redlining
- Clause libraries and playbooks
- Due-diligence document review
- Document summarisation
- Knowledge search
- Compliance monitoring
- Translation
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, Private cloud, On-premises, Hybrid |
| Hosting regions | European Union / EEA, United Kingdom, Another named location |
| Australian region | No |
| Model providers | Anthropic, OpenAI |
| Assurance | ISO 27001, SOC 2 Type II |
| Training on customer content | No |
| Retention | Controller privacy (1 March 2026) has no numbered SaaS retention. Trust centre lists a Data Retention and Disposal Policy (request-only). Post-termination deletion is not in the public General Terms. |
| Integrations | Microsoft Word, Microsoft Outlook, Okta, Azure AD, Google Workspace, Slack, Microsoft Teams |
| Legal content coverage | Home: Discovery answers grounded in verified case law and legislation across 130+ jurisdictions; playbooks by contract type and jurisdiction. Australian coverage is not specifically evidenced. |
| Pricing | Fees are set in the Order Form, invoiced in EUR (annual in advance unless the order says otherwise). No public price list. |
| Australian presence | Unknown. Company page lists Ghent, London and Dubai. Security/trust language is EU, UK and Middle East. No Australian region or named Australian customer found. |
| Website | https://www.legalfly.com |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Order-form enterprise SKUs | Public claim only | LegalFly BV, Veldstraat 88/301, 9000 Ghent, Belgium. General Terms 24 April 2025 apply to Order Forms unless a signed deviation exists. DPA is a referenced document, not published on the site. Modules include Discovery, Review, Draft, Legal Radar, Agent Studio. | Which modules and deployment SKU are on our Order Form, and will the DPA be attached before go-live? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — Company](https://www.legalfly.com/company); [LEGALFLY — home](https://www.legalfly.com) |
| SaaS, single-tenant Azure, on-prem anonymisation | Public claim only | Security page: SaaS; single tenant in a preferred Azure region; single tenant plus on-prem anonymisation so identifiable data stays in the customer environment. FAQ also claims private cloud, hybrid and full on-premise. Company: Ghent, London, Dubai. | Which deployment and Azure region will we buy, and is an Australian Azure region available? | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — Company](https://www.legalfly.com/company) |
| Review, research, agents | Public claim only | Home: contract review against playbooks, Discovery research, drafting, regulatory Legal Radar, due-diligence multi-review, knowledge, document repository, Agent Studio workflows from email/Slack/Teams with approval steps. Pre-analysis anonymisation is the headline control. | Which agents and anonymisation level are enabled by default on our tenancy? | [LEGALFLY — home](https://www.legalfly.com); [LEGALFLY — Security](https://www.legalfly.com/security) |
| 130+ jurisdictions claimed | Public claim only | Home: 110+ jurisdictions in one banner and 130+ in Discovery copy, with playbooks by jurisdiction. Australian primary-law completeness is not evidenced. | List Australian sources (courts, consolidations) actually in Discovery, if any. | [LEGALFLY — home](https://www.legalfly.com) |
| EUR Order Form; Belgian law | Public claim only | Fees in EUR on the Order Form; annual advance invoices unless otherwise stated; Agoria indexation; 30-day fee-increase notice with 15-day termination right; 60-day non-renewal notice for yearly terms; Belgian law and Ghent courts; liability cap of fees in the prior 12 months. | Confirm seats, term, cap and whether we can negotiate Australian law/forum. | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| SSO, Word, Outlook, collaboration | Public claim only | Security: Okta, Azure AD, Google Workspace; SAML 2.0, OIDC, OAuth; ABAC, MFA, session governance. Site nav: Word add-in and Outlook add-in. Home: workflows from email, Slack or Teams. | Which integrations are in our Order Form, and do they honour source-system permissions? | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — home](https://www.legalfly.com); [LEGALFLY — Company](https://www.legalfly.com/company) |
| Support access to Customer Data | Public claim only | General Terms 4.2: if the customer requests assistance, a support member may be granted access to End User accounts and Customer Data, subject to confidentiality and the DPA. No published hours or severity SLA. | What are support hours, severity targets, and can we forbid standing support access? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| No independent benchmark found | Not confirmed | No Vals AI, Stanford RegLab or other independent hallucination benchmark was found on pages reviewed. Marketing claims of grounded research were not audited here. | May we run a scored trial on our playbooks and Australian clauses? | [LEGALFLY — home](https://www.legalfly.com) |
| In-house legal ops, not unsupervised advice | Public claim only | Terms 10.2: the SaaS is a tool for professionals; it does not provide legal advice; the customer must verify outputs. Fit is contract review, research and workflow automation with human approval steps. | Which workflows will require a lawyer approval step before anything leaves the tenancy? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — home](https://www.legalfly.com) |
| Anonymisation and client consent | Not confirmed | Security: documents anonymised before processing, with adjustable levels and term whitelists. Trust: inference providers process pseudonymised content unless the customer enables processing without anonymisation. That disable switch is a residual disclosure. | Will anonymisation stay on, and do we have a client-disclosure for residual identifiers and EU processing? | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| Anthropic and OpenAI | Public claim only | Trust centre subprocessors: Anthropic and OpenAI as AI inference providers, zero retention, no training, pseudonymised content unless the customer disables anonymisation. Azure is the cloud infrastructure provider. | Name the models and regions on our tenancy, and can we pin one provider? | [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| Trust-centre list | Public claim only | Trust centre names Microsoft Azure (cloud), Auth0 (identity), PostHog (product analytics), Anthropic and OpenAI (inference). Change-notice and objection rights are not on that page; they may sit in the unpublished DPA. | Provide the dated list with locations, 30-day notice and a right to object, including PostHog's data. | [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| No training without consent; trust says never | Not confirmed | General Terms 5.2: Customer Data will not be used to train the SaaS Solution without Customer's consent (24 April 2025). Trust centre: data is never used to train AI models. Controller privacy (1 March 2026) says anonymised contract content is kept to enhance services. Default is no training unless consent is given. | Confirm in the DPA that neither LegalFly nor subprocessors train on our identifiable or anonymised Customer Data, and that we will not be asked to consent. | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — Trust Center](https://trust.legalfly.com/); [LEGALFLY — Privacy Policy (1 March 2026)](https://www.legalfly.com/legal/privacy-policy) |
| Aggregated quantitative data | Public claim only | Terms 5.4: LegalFly may collect, use and disclose quantitative data derived from use for industry analysis, benchmarking, analytics, marketing and other business purposes, in aggregate form only, not identifying Customer or Customer Data. Terms 6.3: Feedback (excluding Customer Data) is licensed to LegalFly perpetually. | Can document text or prompts appear in aggregated analytics, including PostHog? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| Policy exists; periods not public | Not confirmed | Trust centre lists a Data Retention and Disposal Policy as a requestable document. Controller privacy: retain as long as necessary for the collection purpose. No numbered SaaS chat/document schedule in the General Terms. | State default retention for documents, embeddings, logs and backups on our SKU. | [LEGALFLY — Trust Center](https://trust.legalfly.com/); [LEGALFLY — Privacy Policy (1 March 2026)](https://www.legalfly.com/legal/privacy-policy); [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| Not in public Terms | Not confirmed | General Terms describe access loss on termination but do not number production or backup deletion. DPA is referenced as the processing contract. Controller privacy offers a deletion right for website/account data. | On exit, will you delete production and backups within 30 days and certify, as the DPA will say? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — Privacy Policy (1 March 2026)](https://www.legalfly.com/legal/privacy-policy) |
| Support access on request | Public claim only | Terms 4.2: support may access End User accounts and Customer Data when the customer requests assistance. Trust: access reviews, least privilege, termination of access. Isolation per client is claimed on the security page. | Is support access ticket-scoped, logged, time-limited and customer-approved each time? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — Trust Center](https://trust.legalfly.com/); [LEGALFLY — Security](https://www.legalfly.com/security) |
| SSO, ABAC, MFA | Public claim only | Security: SSO (Okta, Azure AD, Google Workspace), SAML/OIDC/OAuth, ABAC, MFA, session governance. Trust: user access reviews, access-control and termination policy, least privilege, restricted admin access. | Will SSO+MFA+SCIM be in our Order Form, and how are ethical walls configured? | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| In transit and at rest | Public claim only | Security FAQ: documents anonymised before processing and encrypted at rest and in transit. Trust: enterprise-grade encryption in transit and at rest; Encryption and Key Management Policy listed. Algorithms and BYOK are not specified on the public pages. | Confirm algorithms, key custody and whether customer-managed keys are available on our SKU. | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| ISO 27001 and SOC 2 Type II | Public claim only | Security and trust centre: ISO 27001 (trust lists ISO27001:2022) and SOC 2 Type II; annual independent penetration testing; 2026 pen-test report requestable; Secureframe monitoring. Reports themselves were not inspected. | Provide current ISO 27001 and SOC 2 Type II reports under NDA, with scope and dates. | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — Trust Center](https://trust.legalfly.com/) |
| Belgian GTCs; DPA not published | Public claim only | General Terms 24 April 2025: Belgian law, Ghent courts, 12-month fee cap, as-is style warranty limits, customer must verify outputs. Article 12: parties shall conclude a DPA before processing starts. Public DPA URL was not found. | Attach the current DPA (APP 8, 72-hour notice, audit, no-training, subprocessors) to our Order Form before any matter data is uploaded. | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| Azure region choice; SCCs in privacy | Public claim only | Single-tenant is in a preferred Azure region. Trust subprocessors include US-headquartered OpenAI/Anthropic processing pseudonymised content. Controller privacy: transfers outside the EEA use adequacy, SCCs with TIA, BCRs or certification. No Australian region. | Map every country of storage and inference on our SKU, including when anonymisation is off. | [LEGALFLY — Security](https://www.legalfly.com/security); [LEGALFLY — Trust Center](https://trust.legalfly.com/); [LEGALFLY — Privacy Policy (1 March 2026)](https://www.legalfly.com/legal/privacy-policy) |
| Plan exists; no public 72-hour SLA | Not confirmed | Trust centre lists an Incident Response Plan, tracking of incidents, and lessons-learned. No 72-hour customer-notification commitment appears in the public General Terms. | State the contractual notification period for a personal-data breach affecting our tenant. | [LEGALFLY — Trust Center](https://trust.legalfly.com/); [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| 15-day termination after term notice | Public claim only | LegalFly may modify General Terms with prior written notice (including email). Customer may terminate within 15 days of that notice; otherwise the new terms take effect on the date specified. Subprocessor-change notice is not in the public Terms. | Will subprocessor changes get 30 days' notice and a right to object, in the DPA? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| Access ends; export not specified | Not confirmed | On termination, user rights end and unpaid fees are due. Export format, certified deletion and a 30-day wind-down are not in the public General Terms. | What export formats are available, and will you certify deletion of production, backups and provider copies? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) |
| Email, Slack, Teams, Word, Outlook | Public claim only | Agent Studio workflows can trigger from email, Slack or Teams. Word and Outlook add-ins are listed. Connectors may send matter text outside the tenant if enabled. | List every connector on our Order Form and how we disable outbound send. | [LEGALFLY — home](https://www.legalfly.com); [LEGALFLY — Company](https://www.legalfly.com/company) |
| Discovery research; open web not stated | Not confirmed | Discovery is described as grounded in verified case law and legislation. Whether agents may browse the open web was not stated. | Can agents perform open-web search, and can we disable it? | [LEGALFLY — home](https://www.legalfly.com) |
| Approval steps in Agent Studio | Public claim only | Home: conditional logic routes work and escalates; approval steps keep legal in control. That is a configurable workflow, not a contractual prohibition on unattended actions. | Which agent actions require human approval by default on our tenancy, and can they send email unattended? | [LEGALFLY — home](https://www.legalfly.com) |
| Customer must verify outputs | Public claim only | Terms 10.2: customer bears full responsibility for verifying accuracy of outputs; the product is not legal advice. Anonymisation FAQ: customers can whitelist terms to preserve context, which increases residual identifiers. | Will we require lawyer review of every outbound contract mark-up before it leaves the system? | [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions); [LEGALFLY — Security](https://www.legalfly.com/security) |

## Notes

DPA is referenced but not published. Training: GTCs allow training with consent; trust centre says never; controller privacy mentions keeping anonymised contracts to enhance services. No Australian region. ISO/SOC reports requestable, not inspected.

## Sources

- [LEGALFLY — home](https://www.legalfly.com) (checked 2026-09-21)
- [LEGALFLY — Security](https://www.legalfly.com/security) (checked 2026-09-21)
- [LEGALFLY — Trust Center](https://trust.legalfly.com/) (checked 2026-09-21)
- [LEGALFLY — Terms & Conditions (24 April 2025)](https://www.legalfly.com/legal/terms-conditions) (checked 2026-09-21)
- [LEGALFLY — Privacy Policy (1 March 2026)](https://www.legalfly.com/legal/privacy-policy) (checked 2026-09-21)
- [LEGALFLY — Company](https://www.legalfly.com/company) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.