Definely

Definely suite, legal drafting suite, Microsoft plugin suite

Manage complex legal documents and review complex legal documents with accurate contract review, and sensitive information handling, minimise error risk with Microsoft plugins to access relevant definitions, access relevant references, and reduce information search time. Improve proofreading processes and minimise drafting mistakes to deliver compliant documentation.

Features

• Draft legal documents, Collaborative legal drafting, context preserving drafting
• Automated legal proofreading, instant proofreading checks with smart proofreading engine
• AI-assisted legal drafting, context aware legal drafting, automated legal drafting
• Microsoft word plugin, native word integration, secure Microsoft word integration
• Contract change tracking, secure contract review, automated clause identification
• OCR enabled clause extraction, pdf conversion or scanned legal documents
• Secure remote access, remote access control for distributed legal teams
• Configurable legal workflows, legal workflow management for public sector documentation
• Integrated legal compliance, legal compliance monitoring, compliance compare tools
• Centralised repository, secure legal document storage, single source of truth

Benefits

• Instantly access definitions, identify errors, maintain context, and improve automation
• Access defined terms directly within active legal documents
• Highlight draft inconsistencies across multiple connected documents
• Update cross-references automatically during contract editing
• Convert scanned PDFs into searchable, editable legal text
• Detect clause conflicts during drafting and proofreading processes
• Identify missing references and unused defined terms instantly
• Track document amendments to maintain full version history
• Integrate structured legal data across document management systems
• Reduce manual review time through automated document analysis

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at nathan@definely.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

774565684611158

Contact

Nathan Killick
+447751201047
nathan@definely.com

About your service

• Service categories:

  Applications

  Content workflow and management

  • Document

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Microsoft Word plugin [LOCAL BUILDS] / Microsoft Word plugin, Document Management System (DMS) [CLOUD BUILDS]
• Cloud deployment model: Private cloud
• Service constraints: Our service requires supported and updated client operating systems and vendor-supplied software. Occasional IT resources may be needed for upgrades, with supplier access granted only when necessary and with management approval. All production updates require formal authorisation. Planned maintenance or outages are communicated in advance. Hardware must be maintained to ensure availability and integrity.
• System requirements:
  • CPU: Intel i5 or better (Intel i7+ recommended)
  • Memory: 8 GB or better (16 GB+ recommended)
  • 256 GB or better (minimum 500 MB of available storage)
  • Operating System: Windows 10 or 11 (Home or Professional)
  • Microsoft Office: Microsoft Office 2019 or later (including Microsoft 365)
  • .NET Framework: 4.8 or higher is required.

User support

• Email or online ticketing support: Yes
• Support response times: Our company provides email and online ticketing support from 08:00 to 20:00 GMT on UK business days. Support is available via email, online ticket system, telephone, or remote access for technical and product queries. Response times apply only during business hours; requests made at weekends may be delayed and are handled at our discretion outside core hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Our company provides email and online ticketing support from 08:00 to 20:00 GMT on UK business days. Support is available via email, online ticket system, telephone, live chat, or remote access for technical and product queries. Response times apply only during business hours; requests made at weekends may be delayed and are handled at our discretion outside core hours.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We get users started through a structured onboarding process that combines technical setup with hands-on learning. Our solution engineers handle the initial deployment of the Microsoft Word plugins to ensure they work seamlessly within your environment. Users then gain immediate access to the Definely Academy for on-demand online training and documentation. To ensure long-term success, we provide dedicated commercial support through live workshops and account management tailored to your team's specific drafting workflows. While standard onboarding is included in the subscription, any bespoke or additional training requirements that may incur extra costs will be detailed in pricing documentation and can be negotiated. This approach ensures your team can quickly manage complex legal documents and minimise drafting mistakes from day one.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • DocX
  • Online meetings
  • Email
  • PNG
• End-of-contract data extraction: We do not store extractable, or reusable, or non-proprietary format to be extracted when the contract ends. Data portability is not supported and there is no process or support for direct data retrieval or export by users at contract termination.
• End-of-contract process: At the end of the contract, user access to our service is promptly removed. Ongoing support can cease immediately after access is terminated. Confidentiality obligations remain in force after contract completion. Data cannot be extracted by users and there is no direct process for data retrieval or export. Details about data deletion or return may be outlined in the contract.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We tailor onboarding to customer expectations, assisting with information security, onboarding plan, guidance, technical support and training. These are done digitally and remotely to accommodate buyers.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • MacOS
  • Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Our typical service interface is a Microsoft Word plugin, allowing users to access features directly within Word. There is no internet-accessible self-service portal, but a real-time service status dashboard is available for all users.
• Accessibility standards: None or don’t know
• Description of accessibility: Definely was conceptualized to solve the "context loss" experienced by co-founder Feargus MacDaeid, a registered blind lawyer. Because screen readers and magnification make scrolling through 100-page contracts inefficient, he needed a way to access definitions and references without leaving his place. This led to a Microsoft Word plugin that displays information in-situ, ensuring context-preserving drafting that minimizes drafting mistakes and significantly reduces information search time for all users.
• Accessibility testing: Although our service has not achieved formal accessibility certification, users benefit from the familiar Microsoft Word interface, which supports many accessibility features such as keyboard navigation and screen reader compatibility. We offer DPI awareness settings for improved visual clarity and provide support for users experiencing difficulties. Detailed guides help with installation and troubleshooting, and our team is available to assist users with accessibility needs.
• API: No
• Customisation available: Yes
• Description of customisation: Buyers can request a logo, name and expected users for the product which are customisable. We also welcome feedback on specific customisation needs for future consideration. The system operates based on users' documents and does not support tailored models or interfaces.

Scaling

• Independence of resources: Our service architecture ensures isolation and consistent performance by offering both single-tenant and multi-tenant environments, with logical or physical segregation of user data and applications as needed. We maintain sufficient redundancy and capacity to prevent one user's demand from impacting others, and enforce internal security with VPNs and firewall rules to protect all resources. Our multi-tier application design separates session control, presentation, server-side validation, business logic, and database access, further enhancing resource isolation and stability. These measures guarantee that user performance remains unaffected by other users’ activity or demand.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide a real-time service availability dashboard showing uptime and system health at https://status.definely.com/. Our service maintains a documented uptime of 99.99%. Users’ local installations generate event logs for error tracking, which can be submitted with support requests. Administrator and user access events are recorded locally for audit purposes. No sensitive data is logged or shared automatically. The service dashboard displays current operational status but is not customisable by users. Specific usage or performance metrics beyond uptime and error logging are not provided.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: We protect data at rest through encryption of all physical media, physical access control complying with ISO 27001 and SOC2 Type 1/Type 2 standards, secure disposal of media, segregation and encryption of confidential information, internal VPN and firewall controls, and documented encryption policies and controls.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Data cannot be extracted by users and there is no direct process for data retrieval or export.
• Data export formats: Other
• Other data export formats: NA
• Data import formats: Other
• Other data import formats:
  • .docx
  • .pdf

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We guarantee 99.99% service availability as detailed in our Service Level Agreement. There are no service credits or compensatory fees for downtime. Availability is monitored and reported via our real-time service status dashboard. All details are referenced in our SLA or contract.
• Approach to resilience: Our service is designed for high resilience by leveraging AWS and Azure for hosting, with data replicated across multiple availability zones to ensure geographic redundancy. Load balancers distribute traffic across several instances, and autoscaling provisions new servers as needed. Databases are replicated in real time, with automated monitoring and alerts for failures. We maintain a documented disaster recovery and business continuity plan, conduct daily backups with regular integrity testing, and perform annual recovery exercises. The standalone solution architecture ensures customer operations can continue even during provider disruptions, supported by cybersecurity insurance and regular assessment of all technical and organisational measures.
• Outage reporting: Our service reports outages by immediately alerting critical systems administration personnel and notifying customers of any incidents impacting data security within 24 hours. All users can access a real-time service availability dashboard at https://status.definely.com/, which provides live updates on planned and unplanned outages. The dashboard is available to all customers but is not customisable. These combined measures ensure both administrators and end users are promptly informed of outages and service issues.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Other user authentication: We authenticate users using username and password, Single Sign-On (SSO) with identity federation (such as Google Workspace, Microsoft 365, Azure Entra ID), and mandatory two-factor authentication (2FA/MFA) on all systems where available. Remote connectivity, such as VPN, also requires 2FA/MFA. Some local installations use license-based authentication managed through our licence platform. Public key authentication via TLS client certificates and limited access over government networks are not used.
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted by user authentication, with permissions granted using role-based access control on a least-privilege basis. Authorisation processes and policies govern privileged accounts and ensure only necessary access is granted. Audit logs and annual access reviews, managed by designated officials, monitor compliance. Sensitive code and resources are kept in dedicated, restricted repositories. These combined measures prevent unauthorised access and enable thorough oversight of user activities.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: SOC 2 Type 2, GDPR
• Information security policies and processes: Our organisation enforces robust information security policies, including strict access control for authorised personnel, comprehensive data protection procedures, and defined incident response processes for prompt detection and management of security events. All staff complete mandatory security awareness training upon hire and annually. Third-party risk is managed through vendor policies. Senior management approves all policies, which are reviewed at least annually to ensure ongoing compliance with legal, regulatory, and contractual standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration and change management for our service follows a documented process, with service components tracked throughout their lifecycle via formal change control. All changes are submitted by authorised users, formally approved, tested, and reviewed before implementation. Scheduling minimises disruption, and rollback strategies are in place. Every change undergoes a security impact assessment through technical review to ensure ongoing system integrity and compliance with control procedures.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We conduct quarterly vulnerability scans and annual penetration tests, assessing and tracking high-priority threats to resolution. Remediation plans are created for identified risks, and patches are deployed according to severity, with progress reviewed in weekly IT meetings. Threat intelligence is sourced from vulnerability assessments, penetration tests, Microsoft Defender for Cloud alerts, and third-party security testing.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Our organisation uses continuous security monitoring, vulnerability scanning, and Security Monitoring Systems to promptly identify potential compromises. When a compromise is detected, it is managed according to our Incident Response Plan and Incident Management policy, both of which are regularly reviewed. Incidents are swiftly reported, assessed, and addressed to minimise impact, and affected customers are notified within 24 hours of discovery to ensure timely communication and response.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Our organisation maintains documented and approved incident management processes with pre-defined procedures for common events, as detailed in our Incident Response Plan. Users report incidents through established channels such as a dedicated portal, email, or helpdesk. All reported incidents are promptly logged and categorised. Affected customers receive incident reports detailing the event and resolution status within 24 hours of discovery via their preferred communication method. Our processes are regularly reviewed and updated to address evolving threats.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Pilot of the product, which can vary based on choice in products, for a two-week trial, usually accompanied by a contract.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2.5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 12.5%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 17.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BRITISH ASSESSMENT BUREAU
• ISO/IEC 27001 accreditation date: Monday 17 February 2025
• What the ISO/IEC 27001 doesn’t cover: NA
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications:
  • SOC 2 TYPE 2
  • GDPR

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at nathan@definely.com. Tell them what format you need. It will help if you say what assistive technology you use.