Legal-specific · General-purpose assistants · Medium confidence
Wordsmith AI · Wordsmith in-house assistant on AWS (EU default, US optional), including agents, MCP and the public ToS/DPA. DPA PDFs on Vanta require access.
General-purpose legal/in-house assistant using OpenAI, Anthropic and Gemini under ZDR, with SSO.
Opens a private software assessment of Wordsmith for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | European Union / EEA, United States |
| Australian region | No |
| Model providers | OpenAI, Anthropic, Google Gemini, Azure OpenAI |
| Assurance | SOC 2 Type II |
| Training on customer content | No |
| Retention summary | Terms: delete or return customer content within 30 days after the Contract expires. Security FAQ: permanent deletion on demand and on termination; custom retention policies. Model providers under ZDR. Privacy: basic customer records kept 6 years after they cease being customers. |
| Integrations | Microsoft Word, Slack, Microsoft Teams, Outlook, Gmail, iManage, SharePoint, Google Drive, MCP, Okta, Microsoft Entra ID, Google Workspace |
| Pricing summary | No public price list. |
| Legal content coverage | Not a licensed Australian primary-law product on the pages reviewed. |
| Australian presence | No — EU default / US optional AWS residency; no AU region stated. Contracting entity is Wordsmith AI Ltd (England and Wales). Site language switcher includes Australia; that is not an AU hosting region. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Products include contract review, drafting (Blueprints), assistant, agents, reports, repositories, research and intake. Built for in-house teams, not law-firm billing. Confirm which modules are on the Order Form.
Ask: Which plan includes SSO, agents and MCP, and which models?
Public claim only
Hosted on AWS; EU data residency by default, US available. No Australian region described.
Ask: Can we obtain ap-southeast-2, or only EU/US?
Public claim only
Integrations and product nav: contract review and redlining in Word, playbook drafting, AI assistant, agents that handle inbound Slack/Teams/email, repositories over iManage/SharePoint/Google Drive, research and intake. Agents can finish routine NDAs without lawyer involvement if so configured.
Ask: Which of review, agents, intake and MCP will be on?
Public claim only
Wordsmith AI Ltd, company 15250293, England and Wales. Contract governed by England and Wales law; exclusive courts of England and Wales. Not a licensed Australian primary-law product. Research feature exists; corpus jurisdictions are not specified on pages reviewed.
Ask: Does Research cover Australian law, and will we sign under English law?
Record the practical work needed to introduce and maintain the software.
Public claim only
Pricing page has no seat price. FAQ: limited reports on a free trial; full reports need a Pro or Enterprise conversation. White-glove implementation for enterprise. Terms: fees per Order Form; liability cap is the higher of £10,000 or Fees in the prior 12 months.
Ask: Provide an itemised quote (AUD/GBP) and confirm the liability cap in the Order Form.
Public claim only
Integrations: Microsoft Word redlines, Slack and Teams Ask Legal, Outlook/Gmail, iManage, SharePoint, Google Drive, MCP/API (CRM, notes, spreadsheets), Zapier/n8n, plus named MCP examples Slack, Notion, Confluence, HubSpot, Jira, Ironclad. SSO via Okta, Azure AD, Google Workspace on the security page.
Ask: List connectors on our tenant and the data each receives.
Public claim only
Pricing FAQ: customer support to all paying customers; white-glove implementation for enterprise. Terms: services with reasonable care and skill; no uptime warranty. Status page linked as status.wordsmith.ai (not scraped).
Ask: Provide the Sev-1 SLA and security@ escalation path.
Compare complete work at the required quality, including checking and correction.
Not confirmed
Not documented on the pages reviewed in this pass.
Ask: Provide current contractual evidence for this control.
Not confirmed
Agents FAQ: routine NDAs can turn around without involvement; sales-contract agent sends ready-to-send replies except red-line cases; privacy agent can handle routine assessments end-to-end. Terms: outputs are not advice; obtain professional advice before acting.
Ask: Which agent types will be allowed to send without a lawyer click, and what is typical review time on the rest?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Agents receive requests in Teams, Slack, email or wherever the business asks. Enabling those channels is the customer's authority decision. Privacy: personal data in a prompt is shared with the model.
Ask: What disclosure do requesters see, and can we keep agents internal-legal-only?
Public claim only
Uses OpenAI, Anthropic (Claude) and Google (Gemini) via paid enterprise APIs under ZDR.
Ask: Can we disable a provider?
Public claim only
Vanta subprocessors page (read 2026-09-21): Amazon Web Services (cloud), Microsoft Azure / Azure OpenAI (cloud), Pinecone (vector database), CloudConvert (document management), DeepL (translation API). Listed as 5 of 5 results. Security FAQ also names OpenAI, Anthropic and Google Gemini enterprise APIs under ZDR — those three are not rows on the Vanta table.
Ask: Reconcile OpenAI/Anthropic/Gemini with the Vanta five, and provide change-notice terms.
Public claim only
Terms cl 3.2.1: Wordsmith will not train any generative AI large language model or any other machine learning models with the Inputs. Security FAQ: ZDR with OpenAI, Anthropic and Google Gemini enterprise APIs; prompts/outputs not stored by providers. Privacy: prompts shared with those models on a no-training basis.
Ask: Confirm cl 3.2.1 also binds Azure OpenAI, Pinecone and DeepL, and attach the DPA.
Public claim only
Security FAQ: Wordsmith does not use customer data to train its AI models or improve the platform for other customers. Privacy: website/customer records may be used per that policy; product prompts are shared with models on a no-training basis.
Ask: Does the signed DPA prohibit using prompts, ratings or traces to improve shared systems?
Public claim only
Security FAQ: custom retention policies; permanent deletion on demand. Terms: delete or return content within 30 days after expiry. Privacy (controller records): basic customer information kept 6 years after they cease being customers. Model providers: ZDR / prompts not stored.
Ask: State default days for chats, uploads, embeddings and logs versus the 6-year customer-record clock.
Public claim only
Terms cl 10.6: upon termination, Wordsmith will delete or return (at the customer's request) all content of the Customer and its users within 30 days after the Contract has expired. Security FAQ: data can be permanently deleted at any time; on termination all customer data is permanently deleted.
Ask: Will you certify deletion including Azure OpenAI, Pinecone, CloudConvert and DeepL?
Public claim only
Security: internal access follows least privilege. Privacy: access limited to those with a genuine business need; duty of confidentiality. Vanta overview mentions Slack-based user authentication for Wordsmith's own systems — that is a vendor-staff control, not a customer SSO description.
Ask: Who can read our matters, from which countries, and can we see access logs?
Public claim only
OIDC and SAML 2.0 with Okta, Azure AD, Google Workspace; MFA and RBAC for enterprise.
Ask: Is SCIM included?
Public claim only
TLS in transit, AES-256 at rest.
Ask: Does AES-256 cover embeddings and logs?
Public claim only
SOC 2 Type II and GDPR; annual independent pen tests; ISO 27001 in progress. Docs in Trust Center.
Ask: Provide current SOC 2 and pen-test summary.
Public claim only
Public Terms (Wordsmith AI Ltd): England and Wales law and courts; DPA and privacy incorporated by reference (Vanta resources URL). Two DPA versions on Vanta (before / from 3 September 2026) are request-access, not extracted. Liability cap: higher of £10,000 or 12 months' Fees. Cl 3.2.1: will not train generative or other ML models with Inputs.
Ask: Provide the DPA effective 3 September 2026 and confirm the cap for confidentiality/privacy claims.
Public claim only
EU default, US available. Australia not offered on the security page.
Ask: APP 8 analysis for EU/US inference.
Public claim only
Security FAQ: formal incident response plan; confirmed breach — notify affected customers within 72 hours or as required by law. Privacy: notify where legally required (no hour count). Incident Response Plan on Vanta is request-access, not extracted. Not restated as a numbered ToS clause in the extract reviewed.
Ask: Is 72 hours in the signed DPA, and any incidents in 24 months?
Public claim only
Vanta publishes a five-row subprocessor list. No subprocessor or model change-notice period was found in the public Terms extract. DPA text is request-access.
Ask: What notice before a new model or processor, and can we object under the 3 September 2026 DPA?
Public claim only
Terms cl 10.6: delete or return all customer and user content within 30 days after expiry. Security FAQ: permanent deletion on termination. Export format is not specified.
Ask: What export format do we receive, and certified deletion within those 30 days including subprocessors?
Not confirmed
Optional Word, Slack, Teams, mail, iManage, SharePoint, Google Drive, MCP (CRM, Jira, Ironclad, Zapier, n8n). MCP can query CRM, log to spreadsheets and trigger workflows. Enabling them is the customer's choice.
Ask: List every connector and MCP tool on our workspace.
Not confirmed
Not documented on the pages reviewed in this pass.
Ask: Provide current contractual evidence for this control.
Not confirmed
Agents FAQ: an agent receives a request, retrieves context, applies the playbook, drafts a response or redline, and routes for approval or sends — all without human intervention at each step. Routine low-risk work can be end-to-end with no human in the loop; the team sets autonomy per agent. MCP can trigger workflows across platforms.
Ask: Which agent/MCP actions can send email or write to Slack/CLM without a second Legal confirmation?
Public claim only
Terms cl 9.3: outcomes are general information, not advice; no solicitor-client relationship; obtain professional or specialist advice before taking or refraining from any action on the basis of outputs. Pricing FAQ: AI can make mistakes; reports need to be checked; citations offered. Agents still allow no-human-in-the-loop for routine work if configured that way.
Ask: Can we force every agent output to a named lawyer queue before send, including NDA Agent?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI general-purpose assistants tools Australia
