Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
ThoughtRiver Limited (England and Wales 10007469; Cambridge Research Park). Public Terms plus DPA and Privacy. Products: Lexible review, playbooks, Lexible Assistant auto-redline, Word add-in. Professional vs Enterprise on the pricing page. 28-day free trial. Terms links for AUP, Back-up Policy and Privacy and Security Policy did not resolve to separate URLs in the scrape.
Ask: Confirm the Order is ThoughtRiver Limited, which SKU (Professional/Enterprise) and modules (Assistant, Word, SSO, iManage) are in scope, and that the public Terms are the contract.
Deployment model
Public claim only
SaaS at <region>.thoughtriver.review. Security: data in Azure data centres in a single specified region; DPA names Microsoft Azure / UK for infrastructure including uploaded contracts. Professional and Enterprise both advertise a private database instance. No on-premises option found.
Ask: Confirm our tenancy is Azure UK (or name the region), whether the private database instance is a dedicated Azure subscription, and whether any other region is available.
Product features in scope
Public claim only
Upload via email, drag-and-drop or Word add-in; playbook risk flags; auto-redline (Lexible Assistant); collaboration in Word/Outlook/Teams; custom AI playbooks. Home: 5,250+ pre-trained concepts; platform page: 4,150+ lawyer-built concepts. FAQ: proprietary LLM plus multiple AI models; generative editing that mimics drafting style.
Ask: Which of Assistant, custom playbooks, Word add-in and generative editing are on our Order, and which concept-count figure applies?
Governing law and Australian coverage
Public claim only
Terms clauses 19–20: England and Wales law; exclusive English courts. No Australian law option. Azure listed as UK. No named Australian customer.
Ask: Will you accept Australian law or a non-exclusive Australian forum for an AU buyer, and is Azure UK the only hosting option?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who is controller, and client-matter authority
Public claim only
Privacy: ThoughtRiver is controller of customer/prospect data and processor of data processed through the service for a customer. DPA: Customer is controller; ThoughtRiver is processor. Terms 10.1: Customer owns Customer Data. Licence allows use as an integrated component of managed services to the Customer's legal-services clients.
Ask: Confirm the DPA is incorporated, we remain controller of uploaded contracts, and managed-services use is allowed if we are a law firm.
Foundation-model provider
Public claim only
FAQ/pricing: proprietary LLM branded Lexible; also 'combining multiple AI models' without naming them. Abbyy Vantage (EU) converts PDFs/scans to DOCX and may see personal data in uploaded contracts. No OpenAI/Anthropic/Google name on the pages read. Customer cannot pick the model.
Ask: Name every model that will see our contracts (Lexible and any third-party LLM), their regions, and whether Abbyy OCR is in or out.
Subprocessors and subprocessors list
Not confirmed
DPA table: Azure (UK, including uploaded contracts); Twilio/SendGrid (US, name/email for password reset); Okta (EU, login/MFA); Abbyy Vantage (EU, contract contents for OCR); Zoho Desk (EU, support, may include contract data). Security page: 'We do not use external processors for your data.' Those statements cannot both be true for Abbyy/Zoho. No 30-day objection process was found.
Ask: Reconcile 'no external processors' with the DPA table, confirm Auth0 vs Okta, and give 30-day objection plus a current dated list.
Training and secondary use of customer content
Public claim only
Terms 11.3: Customer is deemed to grant an irrevocable, perpetual, worldwide, royalty-free licence over Licensed Data (Training Data and anonymised contract text, excluding customer risk policies) for ThoughtRiver and all customers for platform usage, review, analysis and benchmarking. DPA annex: processing includes ML training and feature enhancement. FAQ: patented anonymisation before any model. Exit (15.4.3) is subject to 11.3 — Licensed Data is not destroyed with Customer Data.
Ask: Delete or narrow clause 11.3 and the DPA ML-training purpose so our contracts (even anonymised) are not used to train shared models or for cross-customer benchmarking.
Feedback and evaluation use
Public claim only
ThoughtRiver Processing Data is statistical, textual correlative and activity-based data used to improve intuition, accuracy and sophistication of the Platform, and is excluded from Customer Data. Labelled Training Data may be labelled by ThoughtRiver and/or the Customer; IP in it sits with ThoughtRiver. Terms 16.7: ThoughtRiver may refer to the Customer's usage on its website and in marketing.
Ask: Can Processing Data, labelling by ThoughtRiver staff, and public customer-name rights be contracted off for our account?
Retention of prompts, documents and logs
Public claim only
Privacy: retain only as long as necessary; ask DPO@thoughtriver.com for periods. No public day-count for contracts, prompts or backups. Back-Up Policy is referenced but was not a separate readable URL. Licensed Data under 11.3 is perpetual.
Ask: State retention for contracts, redlines, prompts, Processing Data, Abbyy/Zoho copies and backups, and confirm Licensed Data is not retained if we strike 11.3.
Deletion and certified erasure
Public claim only
Trial: if the customer terminates during the free trial, uploaded Customer Data is permanently deleted at trial end. Paid: on expiry ThoughtRiver shall destroy Customer Data unless the customer pays for return; 11.3 rights survive. DPA: delete or return Personal Data unless backed up or law requires retention — backups are an explicit carve-out. No certificate-of-deletion clause.
Ask: What is the maximum time to delete including backups and Abbyy/Zoho copies, and will you issue a deletion certificate that includes Licensed Data if 11.3 is off?
Vendor staff access to matter data
Public claim only
DPA: authorised persons committed to confidentiality; processing includes customer support. Zoho Desk may receive personal data in uploaded contracts. Professional Services are a dedicated legal-content and workflow team configuring the Platform. Cambridge HQ. No ticket-only/MFA staff-access description.
Ask: Is staff access MFA-gated, ticketed and logged, which countries' staff can see contracts, and can Zoho support access be limited to metadata?
SSO, MFA, roles and audit logs
Not confirmed
Security: Auth0 for SSO and MFA; only email addresses passed. DPA: Okta, Inc (EU) for login/MFA. Pricing: SSO on Enterprise only, not Professional. No public SCIM or exportable audit-log page.
Ask: Which IdP (Auth0 or Okta) is in production, is SSO/MFA on Professional, and can we export audit logs?
Encryption in transit and at rest
Public claim only
Security: encrypted at rest with a unique key per account; TLS 1.2 in transit (internet and internal); WAF. Algorithm (e.g. AES-256) not named. Not in the Terms body.
Ask: Confirm TLS 1.2+ in production, at-rest algorithm, key custody in Azure UK, and whether customer-managed keys are available on Enterprise.
SOC, ISO and other audits
Public claim only
Security: ISO 27001 certified, certificate number 21188-ISMS-001. FAQ: held certification for many years. Certificate unread. No SOC 2 claim found. DPA: customer audits on reasonable notice at the customer's expense.
Ask: Provide the current ISO 27001 certificate (scope including Lexible, Abbyy and Azure UK) and say whether a SOC 2 exists.
Contract, DPA, liability and indemnity
Public claim only
Public Terms: as-is; no warranty that output is accurate (8.1.3); liability cap = Fees during the Order Term (£1,000 in trial), excluding profits/data loss; IP indemnity for copyright in the Platform only. England and Wales. DPA is short (no 72-hour number; ML training in scope). Order Form prevails on conflict. Variation requires signed writing (16.2) but several policies are 'as amended from time to time'.
Ask: Negotiate: strike 11.3, raise the cap, add an accuracy/IP indemnity for AI output, 72-hour breach notice, and freeze policies except on 30 days' notice.
Cross-border transfers and residency
Public claim only
Azure UK for contracts. DPA allows transfer/storage outside the EEA with safeguards. SendGrid/Twilio US for name/email on password reset (EU SCCs and UK Addendum). Abbyy and Zoho in the EU. Okta listed as EU. Security 'single specified region' vs these extra-UK processors. No Australian region. Privacy Act 1988 is not named in the DPA's Data Protection Law list.
Ask: Map every flow of contract text (Azure region, Abbyy, Zoho, any LLM) and add APP 8 wording if we proceed from Australia.
Breach notification
Public claim only
DPA §3: notify without undue delay of a Personal Data Breach affecting the Customer's data; cooperate on mitigation at the Customer's reasonable cost. No 72-hour number. Security: coordinated incident management; 24x7 SOC. Unsuccessful-attempt carve-out is not defined.
Ask: Write a 72-hour (or faster) customer-notice SLA, including the notification email, and confirm it covers contract-content incidents not only GDPR Personal Data.
Unilateral term and product changes
Public claim only
Terms 16.2: variation of the Agreement needs signed writing. AUP, Back-up Policy, DPA, Privacy and Security Policy and SLA are each 'as amended from time to time'. Fees may be updated before renewal. No 30-day subprocessor-objection right.
Ask: Will material AI-provider, hosting-region, 11.3 or liability changes require 30 days' written notice and a right to terminate without penalty?
Export, termination and lock-in
Public claim only
Access ends immediately. ThoughtRiver destroys Customer Data unless the customer gives written notice to return a copy and pays reasonable expenses. 11.3 Licensed Data is carved out of destruction. Open API may help export during the Term. No format or day-count for return. Auto-renew unless 45 days' notice.
Ask: On termination, in what formats and within how many days can we export contracts, playbooks and redlines, at what cost, and is Licensed Data excluded from that export/destruction?
PMS, DMS and agent connectors
Public claim only
iManage, HighQ, Microsoft 365, Power BI, Open API. Email ingest. No MCP/ChatGPT connector found. Lexible Assistant applies playbook redlines inside the product.
Ask: Which connectors are on our Order, and can Assistant send a redlined draft to a counterparty without a further click?
Open-web search and browsing
Not confirmed
No page in this pass described Lexible browsing the open web. Review is of uploaded contracts against playbooks/concepts.
Ask: Does any generative feature send matter text to an open-web search index, and can that be disabled?
What the tool may do without a click
Public claim only
Auto-redline and playbook application are the main automated actions. Terms 9.1: customer is solely responsible for results and for decisions taken (automated or not). No MCP described.
Ask: Which Assistant actions require in-product confirmation before a markup is treated as the firm's position or sent onward?
Required lawyer review before client use
Public claim only
Terms 8.1.3 and 9.1: predictive technology will make mistakes; customer assumes sole responsibility for results and decisions; no warranty that output meets requirements. No clause requiring a lawyer to approve redlines before counterparty send.
Ask: Contract that Lexible/Assistant output is not legal advice and must be lawyer-reviewed before a counterparty or client receives a mark-up.
