Legal-specific · Drafting assistants · Medium confidence
Legora AI · Contracted workspace and chosen storage region (EU, US or Asia-Pacific/Australia). Word/Outlook add-ins, Legal Research, Portal, Agent, web search, DeepL and Beta Features need separate enablement review.
Collaborative legal AI (aOS) for drafting, redlining, tabular review, research and agent workflows, aimed at law firms and in-house teams.
Opens a private software assessment of Legora for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | European Union / EEA, United States, Australia |
| Australian region | Yes |
| Model providers | Microsoft, Amazon Web Services, Google, OpenAI |
| Assurance | SOC 2 Type II, ISO 27001, ISO 42001 |
| Training on customer content | NoTraining on customer content source, checked 2026-10-10 (opens in a new tab) |
| Retention summary | Enterprise packages let the subscriber set retention periods. After termination, a 30-day retrieval window then secure deletion of remaining Subscriber Content, with written certification on request (GTCs). |
| Integrations | Microsoft Word, Microsoft Outlook, NetDocuments |
| Pricing summary | No public rate card. A consumption-based pricing article exists; amounts, seat minimums and overage were not extracted from the page as at 2026-09-20. Fees sit on the order form under the GTCs. |
| Legal content coverage | Legal Research page emphasises comprehensive US federal and 50-state primary law hosted on Legora, plus content partnerships including Wolters Kluwer. Australian primary-law collections were not named on that page as at 2026-09-20. |
| Australian presence | Yes — Sydney office reported by Lawyers Weekly. Legal terms hub has an AU region. Asia-Pacific subprocessor schedule lists Microsoft and AWS hosting in Australia; AI-model rows for APAC are often EU/APAC rather than Australia-only. Named Australian adopters in that article: MinterEllison and Allens. |
A later research check disagrees with a value already on this profile. The published value is unchanged.
Define the configuration, people, information and tasks being assessed.
Public claim only
The legal hub offers EU, UK, US and AU term packs. GTCs licence a stated number of users and specified services on the order form. Word/Outlook add-ins, Legal Research, Portal, Agent, DeepL translation and Beta Features are separate product surfaces. Web-search subprocessors are listed as processing Subscriber Content.
Ask: Which order-form modules, storage region (EU, US or APAC/Australia) and Beta Features will be enabled, and which remain off?
Public claim only
Security Measures: production data is replicated across independent Microsoft Azure locations. The subprocessor list has separate EU, United States and Asia-Pacific tables; APAC lists Microsoft and AWS hosting with data residency Australia, and other AI/infrastructure rows as EU/APAC. Standard offering is multi-tenant SaaS, not on-prem.
Ask: Record the contracted Azure/AWS region for our tenancy and whether model inference, backups and support access stay in that region.
Public claim only
Public pages describe aOS, Word and Outlook add-ins, Editor, mobile app, Tabular Review, Workflows, Legal Research, Portal, Monitors, Agent and Lists. The Agent is described as planning, executing, reviewing and delivering work; Portal is a collaboration surface.
Ask: List the generally available versus beta surfaces in our licence and which administrators can disable.
Public claim only
Legal Research claims parallel multi-jurisdiction investigation, ranking by authority and verification against primary law, with comprehensive US federal and 50-state coverage hosted on Legora. Wolters Kluwer is named. Australian collections were not listed on that page.
Ask: Which Australian primary-law sources are in our workspace, how current are they, and how is negative treatment shown?
Record the practical work needed to introduce and maintain the software.
Public claim only
GTCs: fees are on the order form; unused prepaid fees are not refunded on termination without cause; remaining term is payable on early termination without cause. No public unit price. A consumption-based pricing blog URL exists; rates were not recovered from the scrape.
Ask: Provide an itemised year-one and year-two quote for our user count, stating seats versus consumption units, overage, support and any auto-renewal or uplift.
Public claim only
Word add-in is advertised for agentic drafting, redlining and playbooks inside Microsoft Word. An Outlook add-in product page exists. A newsroom item describes a deeper NetDocuments partnership. Permission inheritance after DMS transfer was not demonstrated in public text.
Ask: Demonstrate Word/Outlook round-trip in our tenancy and whether NetDocuments or other DMS permissions are checked at query time.
Not confirmed
Intercom is listed as a customer-support subprocessor processing ticket content in EU, US or EU/APAC depending on the table. EU-based and US-based technical workforces are claimed. No public support SLA, Australian-hours coverage or security-contact path was found beyond legal@legora.com for termination notices.
Ask: Provide support hours for Australia, severity response times, the security contact, and whether ticket bodies are stored in Australia.
Compare complete work at the required quality, including checking and correction.
Not confirmed
No independent published hallucination or Vals Legal AI Report result for Legora was found in this pass. The Legal Research page claims verification against primary sources; the security FAQ says every output can be traced to source data and prompt. That is a vendor claim, not a scored benchmark.
Ask: Run our de-identified Australian documents in our tenancy and disclose error types, citation accuracy and checking time against a lawyer baseline.
Public claim only
The product is aimed at bounded legal work: Word drafting/redlining, playbooks, tabular extraction for M&A and litigation, research over hosted primary law, and agent-run workflows. GTCs state Output is not legal advice and the subscriber must evaluate accuracy, including by human review.
Ask: Which of our named tasks will run only over our documents, which will use hosted primary law, and which may call web search?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Public claim only
GTCs: Output shall not be viewed as legal advice; Legora is not a law firm. The subscriber must have a valid legal basis to provide Personal Data. Portal is a collaboration product; public pages do not document matter-level exclusion for outside-counsel guidelines. DPA: do not put Personal Data other than technical contacts in support tickets.
Ask: Can administrators exclude named clients or matters, and what client-ready description of data use will you provide for engagement letters?
Public claim only
The 6 July 2026 list names Microsoft, AWS, Google and OpenAI as AI-model providers, with residency columns EU/EEA, US, Australia (hosting) or EU/APAC depending on the table. DeepL is optional translation. Customer ability to pin or disable a provider is not described. A listed legal entity location does not prove the inference endpoint.
Ask: Identify the models and inference regions used for our enabled features, whether we can disable providers, and notice of model change.
Public claim only
Dated list (6 July 2026) with EU, US and Asia-Pacific tables, including Intercom (support), Linkup and (US) Exa Labs for web search, and turbopuffer. DPA: 30 days from posting to object; Legora may not engage the new sub-processor before that period ends; flow-down of materially the same obligations; if an objection cannot be resolved the subscriber may have a path under the DPA discussion clause.
Ask: Confirm we receive subprocessor notices (not only a web update), that no-training and residency flow down, and our termination right if an objection fails.
Public claim only
GTC 8.3.3: Legora will not use Subscriber Confidential Information to train or fine-tune AI models, nor allow subcontractors to do so. Security page: will not use your data to train or fine-tune any AI models. Confidential Information includes Subscriber Content (Input and Output).
Ask: Confirm the signed clause covers prompts, outputs, uploads, embeddings and telemetry, and that no Beta Feature changes it for our tenancy.
Public claim only
GTC 8.3.1–8.3.2: Legora may use feedback without restriction but not so as to identify the subscriber; Usage Data may be used to develop, improve, support and operate Services and must not include Subscriber Content; sharing of Usage Data is limited to confidentiality or aggregated anonymised form.
Ask: Confirm edits, thumbs and prompt logs are Subscriber Content, not Usage Data, and are not used to train.
Public claim only
Security page: set and manage data retention periods. Security Measures: during the DPA term, Personal Data is subject to retention instructed by the subscriber. Zero-data-retention at each model provider is not stated. Backup copies of production data are taken every four hours.
Ask: List default and available retention for prompts, uploads, embeddings, outputs, logs and backups in our region, and whether model-provider ZDR applies.
Public claim only
GTCs: during the term or within 30 days after termination, Legora will on request assist retrieval in a standard machine-readable format; on written request it shall delete Subscriber Content; after that 30-day period remaining content is securely deleted unless law requires otherwise; written certification on request. DPA: delete or return before expiration, with written notice of measures on request. Security FAQ: data and dedicated storage are permanently deleted after contract end, with an export opportunity first.
Ask: Confirm matter-level deletion, backup purge lag, subprocessor flow-down including model stores, and that the certificate is issued without chasing.
Public claim only
Security page: access to customer data is granted to engineers only with written customer approval for support-related issues; Legora will never access data without explicit written consent. Security Measures: personnel will not process customer data without authorisation and must sign confidentiality agreements. Support tickets via Intercom can contain Subscriber Content if users paste it.
Ask: For our tenancy, is support access ticket-gated and customer-visible in logs, and can we forbid Intercom from receiving matter content?
Public claim only
Security page and Security Measures: SAML 2.0 SSO on subscriber request; 'all common Single-Sign-On protocols'. Access control is described as built on Zanzibar. SCIM, mandatory MFA at tenant level, and ethical-wall synchronisation from a DMS were not found in the public pages reviewed.
Ask: Confirm SAML SSO can be enforced with local passwords disabled, whether SCIM is available on our tier, and how matter walls are enforced in retrieval.
Public claim only
Security Measures and security FAQ: AES-256 (or equivalent) at rest; TLS 1.2 or higher in transit; backups encrypted in transit and at rest. BYOK is offered as an enterprise option. Coverage of embeddings, indexes and logs is not itemised.
Ask: Does at-rest encryption cover embeddings, indexes, logs and backups, and is BYOK on our tier?
Public claim only
Security page displays ISO 42001, ISO 27001 and SOC 2 Type 2 badges. GTCs require Legora to maintain ISO 27001 or a corresponding certification throughout the term. Security Measures cite ISO/IEC 27001:2022 with yearly audit. Semi-annual penetration tests covering full platform scope are claimed. Reports were not inspected. Trust Centre: https://security.legora.com/.
Ask: Provide current SOC 2 Type II and ISO 27001/42001 artefacts with scope, exceptions, and the latest penetration-test summary covering AI features.
Public claim only
Public EU GTCs: subscriber owns Subscriber Content; Service IP indemnity with Output/Input carve-outs; liability the greater of 12 months' fees or €250,000; Enhanced Claims (confidentiality or DPA) the greater of 2× fees or €500,000; Swedish law and SCC arbitration in Stockholm. A separate AU term pack exists on the legal hub but was not scraped in full in this pass. DPA liability follows the GTCs.
Ask: Will the AU pack apply, can the data-breach cap be raised, and is an Australian forum available?
Public claim only
Legal hub includes an AU region. APAC subprocessor table lists Microsoft and AWS hosting in Australia; several AI-model rows are EU/APAC or EU (OpenAI Ireland). DPA (US pack reviewed): Legora may not process outside EU/EEA or the US without consent, with consent deemed given if no subprocessor objection. Privacy policy states Site/Services personal data is transferred to EU/EEA facilities. Web-search subprocessors process Subscriber Content in EU or US.
Ask: For an Australian tenancy, list storage, inference, backups, support and web-search countries, and the APP 8 basis for each offshore hop.
Public claim only
DPA: inform the subscriber without undue delay and at the latest within 36 hours from becoming aware of a Personal Data breach, and assist with information reasonably required for the subscriber's notification duties. No public incident history was reviewed.
Ask: Confirm 36 hours runs from discovery, that subprocessor incidents flow through on the same clock, the notice address on our order form, and incident history for 24 months.
Not confirmed
GTCs allow Beta Features to change. Subprocessor changes are by updating the list with a 30-day objection window. No contractual advance-notice period for production model swaps was found in the GTC extract reviewed. Security Measures say Legora shall not decrease the security level during the term.
Ask: What notice and testing window apply to production model or prompt changes, and can we pin a version?
Public claim only
Thirty-day post-termination retrieval in a standard machine-readable format, then deletion and optional certification (GTCs). Early termination without cause still requires payment of remaining term fees. Public API documentation was not found in this pass.
Ask: Show a trial export of documents, chats, playbooks and audit logs, and confirm embeddings and backups are in the deletion certificate.
Not confirmed
NetDocuments partnership is described in the site map/newsroom. Word and Outlook add-ins are productised. A full connector catalogue, OAuth scopes and live ACL behaviour were not in the pages successfully scraped in this pass.
Ask: For each connector we will enable, what data leaves the source, are permissions live, and can we disconnect without residual copies?
Public claim only
Linkup Labs (EU and US tables) and Exa Labs (US table) are listed for web search processing Personal Data included in Subscriber Content. Whether web search is off by default is not stated. Those processors may be outside an Australian hosting region.
Ask: Confirm web search is off for our workspace, or if on, which query text leaves Australia and under which subprocessor.
Public claim only
The Agent product is described as planning, executing, reviewing and delivering work so lawyers focus on judgment. GTCs require human review of Output. A public list of autonomous actions (send, share, DMS write) and kill-switch behaviour was not found.
Ask: List every action an agent can take on email, DMS or the web in our configuration, which require per-action approval, and how we stop a running agent.
Public claim only
GTCs: subscriber is responsible for evaluating accuracy and quality of Output, including by using human review; Output is not legal advice. Security FAQ: every AI output can be traced back to the source data and prompt. Verification time on Australian documents is not published.
Ask: Show sample outputs for our tasks with per-statement source pinpoints and an exportable log of who approved each agent run.
Official pages reviewed for this profile, last reviewed 2026-09-20.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI drafting assistants tools Australia Compare with Harvey
