Private by Design Contract AI (India, 2026)

Contracts are among the most sensitive documents a company holds. They contain pricing, terms you would never share with a competitor, personal data about counterparties, and positions you take in negotiations. So the question in-house counsel ask before putting any of that through an AI tool is the right one: is this safe? This page sets out the real privacy questions to ask of any AI contract tool, explains the one that matters most, and describes how Adira answers them. ## The question that matters most: does it train on your data? The single most important privacy question is whether the tool uses your contracts to train its AI model. This is different from whether the tool stores your contracts, which every tool does. Training means your confidential terms become part of a model that other customers also use, and in the worst case could influence outputs they see. It is the difference between a locked filing cabinet and a filing cabinet whose contents get photocopied into a shared book. Adira does not train on your contract corpus. Your documents are used to do your work and to build your own company persona within your workspace; they are not fed into the underlying model as training data for anyone else. This matters more than almost any other feature, because a tool that trains on your corpus has turned your confidential contracts into a shared asset, however well it is otherwise secured. When you evaluate any vendor, get this in writing. "We take privacy seriously" is not an answer. "We do not train our models on your data" is. ## The other questions to ask No-training is necessary but not the whole picture. A complete privacy evaluation covers several more points. - Encryption. Is your data encrypted in transit and at rest? Adira encrypts in transit and at rest.

• Access control. Can you control who inside your own organisation sees what? Adira has role-based access controls, so a junior, a partner and an external collaborator can have different access.
• Enterprise controls. For larger organisations, can you get single sign-on, audit logs, and control over where data is stored and how long it is kept? Adira's Enterprise tier adds SSO and SAML, audit logs, and data residency and retention controls.
• Sub-processors and the model provider. Who else touches the data? Adira is built on Anthropic's Claude for its AI, so the model provider is a named frontier lab, not an anonymous "AI partner," and the no-training commitment covers the corpus.
• Deletion. Can you get your data back and have it deleted when you leave? This should be a clear contractual right. A tool that can answer all of these plainly is treating privacy as architecture. A tool that answers vaguely is asking you to trust a brochure. ## Where India's DPDP law fits Indian teams have a specific obligation to think about. The Digital Personal Data Protection Act, 2023 (DPDP) governs how personal data is handled in India. Contracts routinely contain personal data: names, contact details, sometimes financial or identifying information about individuals. When you put a contract through any processor, including an AI tool, you remain responsible for that personal data, and you need to know the tool handles it in a way consistent with your DPDP obligations. The practical implications are to understand what personal data your contracts contain, confirm the tool processes it under appropriate safeguards, and keep control over retention and deletion. Adira's privacy posture, encryption, role-based access, no training on your corpus, and Enterprise residency and retention controls, is built to support this, though your own DPDP compliance remains your responsibility and you should take your own advice on it. Adira's published privacy policy also states coverage of GDPR, UK GDPR and other regimes for cross-border work. ## The honest limits Two honest points. First, on certifications. Formal certifications such as SOC 2 and ISO 27001 are a useful external signal, and where a tool holds them with a date, that is worth confirming. The honest position is to state a security posture plainly and not to claim a certification that is not held; ask any vendor, including Adira, for the current certification status in writing rather than assuming it from marketing. Second, no tool removes your own duties. Using a private-by-design tool does not transfer your obligations as the data fiduciary under DPDP, or your duty of confidentiality to your clients. The tool should make compliance easier and give you the controls to meet your duties; it does not meet them for you. Treat strong privacy architecture as a necessary foundation you build your own controls on, not as a reason to stop thinking about privacy. ## How the field compares Mature enterprise CLM vendors such as Ironclad, Icertis, LinkSquares, Evisort and DocuSign CLM generally have strong enterprise security programmes and published certifications, which is a real strength and reflects their enterprise customer base. The distinction to probe across the whole field, including them, is the training question specifically: for any AI feature, ask whether your contracts are used to train models and get the answer in writing. Security certifications and no-training commitments are related but different, and a tool can be strong on one and quiet on the other. Adira's position is no training on your corpus, encryption in transit and at rest, role-based access, and Enterprise SSO, audit and residency controls; you can read its policy at Adira. ## A short checklist before you upload a confidential contract - Does the tool train its model on my data? (It should not.)
• Is data encrypted in transit and at rest?
• Can I control internal access by role?
• For Enterprise, do I get SSO, audit logs and data residency and retention control?
• Who is the model provider, and is it named?
• Can I get my data deleted on exit?
• What is the current SOC 2 or ISO status, in writing?
• Have I accounted for the personal data in my contracts under DPDP? If a tool passes this checklist, it is safe in the ways that matter. If it stumbles on the training question, no other strength makes up for it. ## Bottom line AI contract review can be safe for confidential contracts, but safety is specific, not a slogan. The question that matters most is whether the tool trains its model on your corpus; Adira does not. Beyond that, ask about encryption, role-based access, Enterprise SSO, audit and residency controls, the named model provider, and deletion rights, and account for personal data under India's DPDP Act. Confirm certifications in writing rather than assuming them. Strong privacy architecture is the foundation; your own duties as a data fiduciary and to your clients remain yours.