productPlan
Public claim only
CLM platform. Security page last updated 17 Oct 2025. Trust Center at trustcenter.spotdraft.com.
Ask: Confirm Business/Enterprise SKU and AI features on the order.
Legal-specific · Contract review and CLM · Medium confidence
SpotDraft
SpotDraft · SpotDraft CLM (security page 17 Oct 2025). AI modules need to be listed on the order. AU region is not among the published storage regions.
Contract lifecycle management on Google Cloud. SOC 2 Type II claimed. Storage regions listed as US, EU, India and Middle East — not Australia. No public no-training clause on the security page.
Opens a private software assessment of SpotDraft for one task, with this profile’s questions to hand.
Contract draftingContract review and redliningClause libraries and playbooksDocument automation
| Deployment | SaaS |
|---|---|
| Hosting regions | European Union / EEA, United States, Another named location |
| Australian region | No |
| Assurance | SOC 2 Type II |
| Training on customer content | Unknown |
| Integrations | Microsoft 365 (SSO), Google Workspace (SSO) |
| Pricing summary | No public list prices. Demo-led. |
| Australian presence | Unknown — AU not in the published regional storage list (US, EU, India, Middle East). |
Product and intended use
Define the configuration, people, information and tasks being assessed.
deployment
Public claim only
GCP. Primary/backup servers in the EU (Netherlands). Personal data stored in selected regions: US, EU, India, Middle East — not transmitted outside those locations (vendor). Australia not listed.
Ask: Can we select EU-only, and is there an AU region?
features
Public claim only
CLM: drafting, repository, audit logs, version history, SSO, roles. AI features not detailed on the security page.
Ask: Which AI contract-review features are enabled?
jurisdiction
Not confirmed
No AU region on the security page.
Ask: AU hosting or customers?
Adoption and implementation
Record the practical work needed to introduce and maintain the software.
licence
Not confirmed
No public list price.
Ask: Quote?
integration
Public claim only
SSO via O365/Google OAuth, SAML (Okta/AD), zero-touch provisioning. Word/CLM integrations not specified here.
Ask: Entra SAML and Word add-in?
support
Not confirmed
Not specified.
Ask: SLA?
Quality and human effort
Compare complete work at the required quality, including checking and correction.
qualityEvidence
Not confirmed
No legal-AI accuracy study.
Ask: Accuracy on our templates?
taskFit
Not confirmed
Fit for in-house CLM. Privileged matter needs the DPA and region choice.
Ask: Which contract types?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
clientAuthority
Not confirmed
Counterparty portals may exist.
Ask: Client-facing e-sign/AI?
modelProvider
Not confirmed
Not named on the security page.
Ask: Name LLM providers.
subprocessors
Not confirmed
GCP named. Full list not on the page. Vendor DPAs claimed for scoped-data vendors.
Ask: Published subprocessor list?
trainingUse
Not confirmed
Security page does not state no-training. Privacy policy records support calls for training/quality.
Ask: Does SpotDraft or any LLM train on our contracts?
feedbackUse
Not confirmed
Support recordings may be analysed for training (privacy).
Ask: Disable support-call recording on our tenant?
retention
Public claim only
Data classified by sensitivity; retention policy exists but periods not stated.
Ask: Contract and log retention periods?
deletion
Not confirmed
Secure disposal mentioned for GCP. Customer deletion SLA unknown.
Ask: Certified deletion on exit?
humanAccess
Public claim only
Least privilege, unique IDs.
Ask: Staff access to contracts logged?
accessControl
Public claim only
SSO, SAML, roles by contract type/entity/department, contract-level permissions, audit logs.
Ask: SSO-only demo.
encryption
Public claim only
AES-256 at rest; unique per-contract keys in HashiCorp Vault backed by Google Cloud KMS; FIPS-140 claimed; TLS not versioned on the extract except GCP comms.
Ask: TLS 1.2+ and CMK option?
assurance
Public claim only
SOC 2 Type II (blog + badges); ISO/GDPR/HIPAA badges on the security page. GCP's ISO/SOC cited separately. Reports via Trust Center, not inspected.
Ask: Current SOC 2 Type II scoped to the CLM and AI.
contract
Not confirmed
Not inspected.
Ask: MSA, DPA, cap, forum?
transfers
Public claim only
Regions US, EU, India, Middle East. No AU. Primary EU Netherlands.
Ask: APP 8 if we pick EU or US.
incidents
Public claim only
Formal incident-response process, regular exercises. Clock not stated.
Ask: Breach notice timeline?
changes
Not confirmed
Security page dated 17 Oct 2025.
Ask: Notice of region or LLM change?
exit
Not confirmed
Not specified.
Ask: Export then deletion?
connectors
Public claim only
OAuth to Microsoft/Google identity. Other CLM connectors not listed here.
Ask: Enabled integrations?
webSearch
Not confirmed
CLM. Confirm AI does not browse the web.
Ask: Web search off?
actionControl
Not confirmed
Sends contracts to counterparties.
Ask: Human confirm before send?
humanReview
Public claim only
Audit logs and version history.
Ask: Export logs 12 months?
Sources
Official pages reviewed for this profile, last reviewed 2026-09-21.
Related tasks
Related tools
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI contract review and clm tools Australia