Skip to content

Legal Tech / Contract review & due diligence

ThoughtRiver

ThoughtRiver Ltd · HQ GB · founded 2016 · Last checked 2026-09-03

Visit website

Last checked = the date we last re-opened the vendor's published pages. Facts are what the vendor documents, not what it claims in marketing.

Pre-signature contract review using 5,250+ pre-trained legal concepts with risk scoring and a Word add-in; hosted on Azure UK. Its DPA lists 'ML training' as a processing purpose for customer data.

Category
Contract review & due diligence · pre-signature contract review, risk scoring, Word add-in
Built for
In-house legal, Mid-sized firms
Model providers (disclosed)
ThoughtRiver own LLM
Data residency options
UK
Pricing
per-seat · Enterprise from £30,000; Professional from £15,000
Markets
UK
Last checked
03 Sept 2026

What the vendor documents

Recorded from the vendor's own trust, privacy and terms pages. "Not disclosed" means we found no public statement, not that the control is absent.

No training on customer data
documented nosource
SOC 2
not disclosedsource
ISO 27001
documented yessource
ISO 42001
not disclosedsource
Zero retention with model providers
not disclosedsource
DPA offered
documented yessource
Private deployment
not disclosedsource

What the public documentation states

ThoughtRiver's homepage and pricing page describe pre-signature contract review for in-house and SME legal teams, with a Word Add-in and a 28-day free trial. The pricing page says ThoughtRiver built its own LLM and publishes Professional from £15,000 per year and Enterprise from £30,000 per year. Its security page states ISO27001 certification, certificate 21188-ISMS-001, Azure hosting in a single specified region, encryption at rest, SSO and MFA. The data-processing page lists Microsoft Azure in the UK, Twilio SendGrid in the US and Okta in the EU; the security page also says it does not use external processors. The terms say Derivative Data and Training Data may be used to improve platform output. The privacy notice, last updated July 2026, says free-trial email uploads are purged every 24 hours. The homepage states a >90% accuracy example, but the audit found no method.

In the vendor's words

“we’ve built our own LLM”
Pricing page
“We are ISO27001 certified”
Security page
“We do not use external processors for your data.”
Security page
“less than 3 minutes with >90% accuracy”
Homepage

Not disclosed on public pages

"Not disclosed" records that no public statement was found where we looked, on the date shown. It does not assert that the control, term or figure is absent.

Not published on the pages we read on 2026-09-06: SOC 2, ISO 42001, private deployment terms, zero-retention terms, seat minimum, minimum paid term, terms last-updated date, and the method behind the >90% accuracy statement. A law-firm procurement or DPIA process would normally ask for those points to assess client-confidentiality exposure, processor controls, financial commitment, GDPR Article 28 terms, and supervision of contract-risk outputs.

Questions to put to the vendor

  1. Which statement governs processing of uploaded contracts: the data-processing list naming Microsoft Azure, Twilio SendGrid and Okta, or the security page statement that no external processors are used?
  2. Which customer data can become Derivative Data or Training Data under the terms, and can a customer opt out?
  3. What region is assigned to a UK customer under the single specified region hosting statement?
  4. What method produced the homepage's >90% accuracy figure for supply-agreement review?
  5. Are SOC 2 or ISO 42001 reports available under NDA?

Accuracy evidence

Related incidents

No incidents are recorded for this tool as of 2026-09-03.

Ownership · ISO 27001 certificate 21188-ISMS-001; 'Private Model Option' listed.

Sources

Report an issue with this record →

Cite this record

SafeLegalAI Legal Tech Tools, "ThoughtRiver", safelegalai.com/tools/thoughtriver (last checked 2026-09-03, accessed 2026-10-07). Data: CC BY 4.0.

Documented facts, side by side

Facts from both vendors' pages in one table; never a ranking. All comparisons.

Also in Contract review & due diligence

SafeLegalAI is a research publication, not a law firm. Nothing here is legal advice, and no lawyer–client relationship arises from reading it. Rules change; always check the official document linked on each record and take advice on your own situation. Researched and drafted with AI assistance; verified against primary sources and edited by SafeLegalAI. The linked official documents are the record — our summaries are not the law and are not legal advice.

Vendor, product, court and regulator names and logos are the property of their respective owners and are used solely to identify the product, body or document referred to; SafeLegalAI claims no rights in them. SafeLegalAI is not affiliated with, endorsed by, sponsored by or approved by any listed vendor, except where a record is labelled an affiliated product. Facts are recorded from vendors' published pages on the date shown; "not disclosed" means not found on the pages read, not that the vendor lacks it. No ranking, rating, review, recommendation or warranty is implied. Mark owners who prefer a text-only reference, and vendors seeking a correction, may write to the report page. Trade mark and quotation policy.