Skip to content

Legal Tech / Contract lifecycle (CLM)

Conga CLM (Conga AI)

Conga · HQ US · Last checked 2026-09-11

Visit website

Last checked = the date we last re-opened the vendor's published pages. Facts are what the vendor documents, not what it claims in marketing.

Revenue lifecycle and CLM suite; its AI Addendum bars training foundation models on customer data and names Azure OpenAI, Google text recognition and Zuva as AI providers.

Category
Contract lifecycle (CLM) · CLM, CPQ, revenue lifecycle
Built for
In-house legal
Model providers (disclosed)
OpenAI, Google, Zuva
Data residency options
US, EU, AU
Pricing
enterprise
Markets
US, EU, OTHER
Last checked
11 Sept 2026

What the vendor documents

Recorded from the vendor's own trust, privacy and terms pages. "Not disclosed" means we found no public statement, not that the control is absent.

No training on customer data
documented yessource
SOC 2
documented yessource
ISO 27001
documented yessource
ISO 42001
not disclosedsource
Zero retention with model providers
not disclosedsource
DPA offered
documented yessource
Private deployment
not disclosedsource

What the public documentation states

Conga's CLM pages describe contract lifecycle software for in-house teams and state an AI extraction claim, "Extract key text and table data accurately." The Artificial Intelligence Addendum says customer inputs may generate outputs, Conga is responsible for selecting and managing AI systems, and Conga does not use Customer Data to train third-party foundational models such as Azure OpenAI GPT. The trust and compliance page says Conga uses Microsoft Azure OpenAI Service and that token inputs do not alter or train back-end LLMs. The subprocessor list names Microsoft Corporation for AI Powered Contract Analysis in the United States, Germany and Australia, Zuva in the United States and Europe for Embeddable AI, and Google LLC in the United States for Text Recognition. The DPA says Conga encrypts Customer Data at rest and in transit, gives breach notice within 48 hours of becoming aware, and maintains annual certification of compliance with ISO 27001 and SOC 2 Type 2 standards. Pricing is quote-based: the pricing page says "Get Conga Pricing" but no concrete amount was published. The audit found an accuracy claim but no method.

In the vendor's words

“Conga does not use Customer Data to train third-party foundational models (e.g., Azure OpenAI GPT).”
Artificial Intelligence Addendum
“within 48 hours of becoming aware”
Conga Data Processing Addendum
“Conga performs daily backups of Customer Data and retains such data for thirty (30) days.”
Conga Data Processing Addendum
“All Customer Data, including Personal Data, is encrypted at rest and, in transit, using TLS encryption technology.”
Conga Data Processing Addendum

Not disclosed on public pages

"Not disclosed" records that no public statement was found where we looked, on the date shown. It does not assert that the control, term or figure is absent.

Not published on pages we read on 2026-09-11: concrete list price, seat minimum, minimum term, free trial, privacy or terms update dates, private deployment option, ISO 42001 statement, SSO/SAML, zero-retention terms, and the method behind the product-page accuracy claim. A law firm procurement or DPIA review would normally ask for those points to document client confidentiality controls, retention risk, processor obligations under GDPR Art. 28, and supervision of AI output.

Questions to put to the vendor

  1. Which Microsoft, Zuva, and Google subprocessor entries apply to Conga CLM for our tenant, and in which countries?
  2. Does the AI Addendum permit training of customer-specific models within a tenant, and how is approval recorded?
  3. What retention applies to prompts and outputs outside the DPA backup term?
  4. What test set and measurement method support the product-page text extraction accuracy claim?
  5. Can Conga provide ISO 42001 status and SSO/SAML control details?

Accuracy evidence

No published accuracy or hallucination evaluation found as of 2026-09-11.

Related incidents

No incidents are recorded for this tool as of 2026-09-11.

Ownership · Private-equity owned (not verified this pass). AI Addendum requires customers to validate outputs.

Sources

Report an issue with this record →

Cite this record

SafeLegalAI Legal Tech Tools, "Conga CLM (Conga AI)", safelegalai.com/tools/conga-clm (last checked 2026-09-11, accessed 2026-10-07). Data: CC BY 4.0.

What the vendor has announced, dated

  1. Conga status: Investigating Issue Impacting email functionality on Conga Platform · Status-page incident
  2. Conga names Ian Wathen Chief Financial Officer · Leadership

First-party statements from the vendor's own pages, as dated; "announced" is not "in use today". This month across all vendors · release timeline.

Documented facts, side by side

Facts from both vendors' pages in one table; never a ranking. All comparisons.

Also in Contract lifecycle (CLM)

SafeLegalAI is a research publication, not a law firm. Nothing here is legal advice, and no lawyer–client relationship arises from reading it. Rules change; always check the official document linked on each record and take advice on your own situation. Researched and drafted with AI assistance; verified against primary sources and edited by SafeLegalAI. The linked official documents are the record — our summaries are not the law and are not legal advice.

Vendor, product, court and regulator names and logos are the property of their respective owners and are used solely to identify the product, body or document referred to; SafeLegalAI claims no rights in them. SafeLegalAI is not affiliated with, endorsed by, sponsored by or approved by any listed vendor, except where a record is labelled an affiliated product. Facts are recorded from vendors' published pages on the date shown; "not disclosed" means not found on the pages read, not that the vendor lacks it. No ranking, rating, review, recommendation or warranty is implied. Mark owners who prefer a text-only reference, and vendors seeking a correction, may write to the report page. Trade mark and quotation policy.