--- title: "SpotDraft (SpotDraft)" url: "https://ailawframework.com/software/spotdraft" type: "software_profile" site: "AI Law Framework" id: "spotdraft" vendor: "SpotDraft" category: "Legal-specific" segment: "Contract review and CLM" confidence: "medium" last_reviewed: "2026-09-21" --- # SpotDraft (SpotDraft) > Contract lifecycle management on Google Cloud. SOC 2 Type II claimed. Storage regions listed as US, EU, India and Middle East — not Australia. No public no-training clause on the security page. Canonical page: https://ailawframework.com/software/spotdraft Last reviewed: 2026-09-21 Site index for agents: https://ailawframework.com/llms.txt Plan covered: SpotDraft CLM (security page 17 Oct 2025). AI modules need to be listed on the order. AU region is not among the published storage regions. ## Capabilities - Contract drafting - Contract review and redlining - Clause libraries and playbooks - Document automation ## Key facts | Fact | Value | | --- | --- | | Deployment | SaaS | | Hosting regions | European Union / EEA, United States, Another named location | | Australian region | No | | Assurance | SOC 2 Type II | | Training on customer content | Unknown | | Integrations | Microsoft 365 (SSO), Google Workspace (SSO) | | Pricing | No public list prices. Demo-led. | | Australian presence | Unknown. AU not in the published regional storage list (US, EU, India, Middle East). | | Website | https://www.spotdraft.com/ | ## What the research found | Topic | Status | Finding | Open question | Sources | | --- | --- | --- | --- | --- | | productPlan | Public claim only | CLM platform. Security page last updated 17 Oct 2025. Trust Center at trustcenter.spotdraft.com. | Confirm Business/Enterprise SKU and AI features on the order. | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | deployment | Public claim only | GCP. Primary/backup servers in the EU (Netherlands). Personal data stored in selected regions: US, EU, India, Middle East — not transmitted outside those locations (vendor). Australia not listed. | Can we select EU-only, and is there an AU region? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | features | Public claim only | CLM: drafting, repository, audit logs, version history, SSO, roles. AI features not detailed on the security page. | Which AI contract-review features are enabled? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | jurisdiction | Not confirmed | No AU region on the security page. | AU hosting or customers? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | licence | Not confirmed | No public list price. | Quote? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | integration | Public claim only | SSO via O365/Google OAuth, SAML (Okta/AD), zero-touch provisioning. Word/CLM integrations not specified here. | Entra SAML and Word add-in? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | support | Not confirmed | Not specified. | SLA? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | qualityEvidence | Not confirmed | No legal-AI accuracy study. | Accuracy on our templates? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | taskFit | Not confirmed | Fit for in-house CLM. Privileged matter needs the DPA and region choice. | Which contract types? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | clientAuthority | Not confirmed | Counterparty portals may exist. | Client-facing e-sign/AI? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | modelProvider | Not confirmed | Not named on the security page. | Name LLM providers. | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | subprocessors | Not confirmed | GCP named. Full list not on the page. Vendor DPAs claimed for scoped-data vendors. | Published subprocessor list? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security); [SpotDraft privacy policy](https://www.spotdraft.com/privacy) | | trainingUse | Not confirmed | Security page does not state no-training. Privacy policy records support calls for training/quality. | Does SpotDraft or any LLM train on our contracts? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security); [SpotDraft privacy policy](https://www.spotdraft.com/privacy) | | feedbackUse | Not confirmed | Support recordings may be analysed for training (privacy). | Disable support-call recording on our tenant? | [SpotDraft privacy policy](https://www.spotdraft.com/privacy) | | retention | Public claim only | Data classified by sensitivity; retention policy exists but periods not stated. | Contract and log retention periods? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | deletion | Not confirmed | Secure disposal mentioned for GCP. Customer deletion SLA unknown. | Certified deletion on exit? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | humanAccess | Public claim only | Least privilege, unique IDs. | Staff access to contracts logged? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | accessControl | Public claim only | SSO, SAML, roles by contract type/entity/department, contract-level permissions, audit logs. | SSO-only demo. | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | encryption | Public claim only | AES-256 at rest; unique per-contract keys in HashiCorp Vault backed by Google Cloud KMS; FIPS-140 claimed; TLS not versioned on the extract except GCP comms. | TLS 1.2+ and CMK option? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | assurance | Public claim only | SOC 2 Type II (blog + badges); ISO/GDPR/HIPAA badges on the security page. GCP's ISO/SOC cited separately. Reports via Trust Center, not inspected. | Current SOC 2 Type II scoped to the CLM and AI. | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security); [SpotDraft SOC 2 Type 2 announcement](https://www.spotdraft.com/blog/soc2type2-compliance); [SpotDraft Trust Center](https://trustcenter.spotdraft.com/) | | contract | Not confirmed | Not inspected. | MSA, DPA, cap, forum? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | transfers | Public claim only | Regions US, EU, India, Middle East. No AU. Primary EU Netherlands. | APP 8 if we pick EU or US. | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | incidents | Public claim only | Formal incident-response process, regular exercises. Clock not stated. | Breach notice timeline? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | changes | Not confirmed | Security page dated 17 Oct 2025. | Notice of region or LLM change? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | exit | Not confirmed | Not specified. | Export then deletion? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | connectors | Public claim only | OAuth to Microsoft/Google identity. Other CLM connectors not listed here. | Enabled integrations? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | webSearch | Not confirmed | CLM. Confirm AI does not browse the web. | Web search off? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | actionControl | Not confirmed | Sends contracts to counterparties. | Human confirm before send? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | | humanReview | Public claim only | Audit logs and version history. | Export logs 12 months? | [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) | ## Notes T3. Training and DPA not on the security page. No AU region. ## Sources - [SpotDraft security (updated 17 Oct 2025)](https://www.spotdraft.com/security) (checked 2026-09-21) - [SpotDraft SOC 2 Type 2 announcement](https://www.spotdraft.com/blog/soc2type2-compliance) (checked 2026-09-21) - [SpotDraft Trust Center](https://trustcenter.spotdraft.com/) (checked 2026-09-21) - [SpotDraft privacy policy](https://www.spotdraft.com/privacy) (checked 2026-09-21) A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.