Glossary
This glossary explains, in our own words, the terms our profiles and comparisons use for data handling, security, legal sources and how we assess tools. It is not legal advice and does not state what the law requires.
- Last verified:
- Last updated:
Which terms do we use?
Audit log
A record of who did what in a tool and when, such as sign-ins, changes to settings and access to documents, that administrators can review or export.
Where it matters:
Benchmark
A fixed set of tasks that a publisher runs on many AI models or products and grades the same way, so that their results can be compared. We do not test tools ourselves: three of our criteria rest on published benchmarks, and every score names and links the benchmark it comes from.
Where it matters:
Case law
Decisions of courts, and of some tribunals, that show how the law is applied. For a legal AI tool, what matters is which courts' decisions it covers, how far back and how soon new decisions are added.
Where it matters:
Data processing agreement
Short form: DPA
A contract in which a vendor that handles personal data on its customer's behalf sets out what it may do with that data: for which purposes, with which subprocessors, under what security measures and what happens to the data when the contract ends. Vendors also call it a data processing addendum. Our profiles say whether a vendor publishes one and for which plans.
Where it matters:
Data residency
Where customer content is kept and handled. We separate storage, where files, prompts and outputs are saved, from processing, where they are worked on, including by the AI model. A tool can store data in the EU and still process some requests elsewhere, so our profiles record the two separately.
Where it matters:
Inference
The step in which an AI model takes a request and produces an answer. Where inference runs matters for data handling, because the request, and any documents sent with it, are processed wherever the model runs.
Where it matters:
ISO/IEC 27001
An international standard for information security management. A certificate means an accredited auditor has checked the vendor's security management system against the standard. Check what the certificate's scope covers: it may not include every product or location.
Where it matters:
Knowledge graph
Legal sources stored together with the links between them: each statute kept with its earlier wordings, and court decisions and preparatory works linked to the statutes they apply or explain. An AI assistant can then follow the links instead of searching each source separately. Our score for Finnish legal sources rests mostly on these links.
Where it matters:
Legal source connector
A service that adds a body of legal sources, such as legislation and case law, to an AI assistant the user already has, usually through MCP. The connector supplies the sources; the assistant writes the answer. We score connectors on the sources they add and leave workflow fit to the assistant's own profile.
Where it matters:
Model Context Protocol
Short form: MCP
An open standard for connecting AI assistants to outside tools and data sources. A legal source connector built on it lets an assistant search, for example, a legal database while it answers.
Where it matters:
Preparatory works
The documents written while a law is being drafted and passed, such as the government's bill, committee reports and official inquiry reports. In Finland the government bill is a hallituksen esitys (HE). Lawyers consult them to understand what a provision is meant to do.
Where it matters:
Retention
How long a vendor keeps customer content, and whether the customer can set that period or delete content. Some vendors keep content for a fixed period for abuse monitoring even when the customer deletes it.
Where it matters:
SCIM provisioning
Short form: SCIM
A standard way for an organisation's identity provider to create, update and remove user accounts in a tool automatically. SCIM stands for System for Cross-domain Identity Management.
Where it matters:
Single sign-on
Short form: SSO
Signing in to a tool with the organisation's own identity provider, such as Microsoft Entra ID or Okta, instead of a separate password. It lets the organisation enforce its own sign-in rules and remove access in one place.
Where it matters:
SOC 2 Type II
A report by an independent auditor on a service provider's security controls and how they worked over a period, usually several months. A Type I report covers only a single point in time. Vendors usually share the report under a non-disclosure agreement.
Where it matters:
Subprocessor
A company a vendor engages to process customer data for it, such as a cloud host or the provider of the AI model behind the tool. Many vendors publish a list of their subprocessors with the country each one processes data in, which is often the clearest public sign of where data goes.
Where it matters:
Training on customer content
Using customers' prompts, documents or outputs to train or improve an AI model. Business plans often exclude it by contract, while some consumer plans allow it unless the user opts out. Our profiles record what each plan says.
Where it matters: