Intapp

The Clearwater shape, and the contrast with the rest of this record is the point. Strip the models and DealCloud remains a purpose built private capital relationship and deal platform, Conflicts still checks conflicts, Walls still enforces information barriers, Time still captures time and Billstream still bills. That is a company founded in 2000 with most of its revenue intact.

Celeste is a genuine agentic layer with its own runtime, but it sits on top of that portfolio rather than constituting it, and Applied AI is a set of signals over an existing customer relationship system. C and built, on the same reasoning as the other long established platforms with a real embedded inference line.

Clears the bar set by the decision token precedent, and does it with a bright line rather than a claim. The mechanism is named, positioned in the execution path, and carries a stated default: reads execute inside each user's own permissions without prior approval, and every write that creates, modifies or deletes data in a connected system requires explicit user approval before execution. Permissions are enforced at the connector level and carried through every execution step.

Material non public information, insider lists and information barriers are checked before every playbook run, including playbooks published outward through the interoperability protocol, and the check happens before data reaches any third party surface. Scheduled playbooks act on behalf of a named user with a delegated subset of that user's permissions and no credential elevation.

Playbooks constrain the agent to approved tools, deterministic tools perform fixed operations over the firm's own data, and the agent stops and asks for clarification when a match is ambiguous rather than guessing. Administrators control what is published and new playbooks can be tested before release.

Real mechanism, published plainly. Playbooks define goals, guardrails and approved tools; deterministic tools perform fixed operations grounded in the firm's own data rather than generated ones; the agent halts and requests clarification on an ambiguous match instead of resolving it silently; content safety screening filters inputs and outputs; playbooks can be tested before release to users.

The vendor also publishes a product terms disclaimer and tells users plainly to evaluate outputs for their own use case, which is the honest form of a claim this index usually sees as an unfalsifiable absolute. Held off A because none of it is model documentation: no accuracy or error rate, no validation report, no benchmark, no drift policy and no statement of how playbook behaviour is monitored once released.

One named client with a named executive quoted on the selection, a private equity firm with 6.5 billion dollars under management, plus a named advisory firm cited on the product page. Industry voted awards for deal origination in credit in both United States and European programmes, decided by thousands of practitioner votes rather than purchased, which is a real if soft independent signal.

Held at B because no named client is joined to a quantified outcome, and the one quantified figure located, a pipeline expansion percentage over six months, is attached to an unnamed fund on the vendor's own blog. Banked check that has moved four evidence grades elsewhere in this sweep: a client stories library is published as a separate filtered resource collection and was not swept here.

Meets the reference bar set by the financial data major, point for point. The pooled corpus question is answered explicitly and in the negative: client data is never used to train models and never shared across firms, and prompts are never shared or combined across tenants.

The architecture is named (playbooks, skills, connectors, a context engine over the firm's own terminology, curated knowledge hubs that preserve existing access controls, and ethical wall enforcement inside the agent runtime). Data sources are enumerated by connector. Model hosting policy is stated, with each provider's models named against its hosting platform. Supplier posture is stated, with both model providers bound by contractual use limits and deletion commitments.

Lifecycle terms are stated, with data held for the agreement plus a retention window then permanently deleted, and prompts and outputs excluded from training. The one respect in which it trails the reference: the retention and purge windows are described rather than given as specific figures.

Comprehensive and verifiable rather than asserted. Two privacy specific certifications are held and downloadable, covering privacy protection for personal information processed in the cloud and a privacy information management system, alongside a global recognition certificate for organisations acting as processors. A complete sub processor list, a data processing addendum and a separate vendor addendum are all published. Residency is stated concretely by region.

Retention and deletion terms are stated. Tenant isolation is implemented across products and prompts are never shared or combined between tenants. The model providers themselves are bound by contractual use limits and deletion commitments, which extends the posture one layer down the supply chain, a step almost nothing in this index takes.

Six current certifications, each verifiable in one click: the information security standard, its cloud controls extension, its cloud privacy extension and its privacy information management extension, all four downloadable from the assessing firm's public certificate portal; a cloud security alliance registry certification linked to its public registry entry; and a global privacy recognition for processors certificate.

Add independent third party penetration testing to a named scheme at least annually, encryption specified as advanced encryption standard at 256 bits at rest and transport security at version 1.2 or higher in transit with federally validated key stores, content safety screening on inputs and outputs, and continuous pipeline and artefact scanning.

The standout, and it belongs in the credential presentation catalogue as a new positive shape: the vendor volunteers that security review responses for its other products do not automatically cover the agentic product, because that product runs as its own deployment with dedicated compute, data stores and access controls. No buyer would think to ask, and the answer stops an existing attestation being over credited. One blemish recorded: the service organisation control reports are labelled certifications, which is the wrong noun, since that examination produces an attestation report rather than a certificate.

No licence, no supervised test of the product by a financial regulator and no programme enrolment. The company is a public reporting issuer, which brings disclosure obligations to securities regulators about the business, but that is corporate status rather than supervision of the product, and this index has consistently declined to read one across to the other. Membership of a government cloud assessment programme is disclosed with the status stated precisely as a member actively pursuing verified offering status, which is honest and is not yet standing.

Nothing published on fairness testing, protected group analysis or performance variation, and this is the one large gap in an otherwise exceptional disclosure record. Context that lowers the stakes without closing them: the decisions here are deal sourcing, target recommendation, relationship scoring and generated outreach, not consumer credit or identity, so the consumer protection exposure is far lower than for most of this index. What remains is still real.

Recommendation systems that rank which companies and which people a capital allocator sees shape which businesses get funded and which founders get a meeting, and a model that scores relationship strength from communication history will reflect whatever patterns sit in that history.

No route for an affected party and no published allocation of responsibility for a wrong output. Worth stating the shape precisely, because it is instructive: the vendor does publish a dedicated product terms disclaimer for generated output, and a disclaimer is the exact inverse of recourse. It allocates risk toward the user and away from the vendor, in a record that is otherwise unusually generous with commitments. Every genuine commitment on this record runs to the paying firm through contract, and nobody outside that contract has standing.

The most complete model supply chain disclosure located in this index, and it sets a new bar for the axis. Two model providers are named, each with its model family named, each mapped to the platform hosting it, one on Amazon Bedrock and one on Azure. The product is stated to be model agnostic with administrators selecting from supported models through an admin console and no lock in to either provider. Both providers are bound by contractual use limits.

Routing follows the hosting providers' configurations. Resilience is disclosed at the same layer, with multiple providers spread across availability zones and automatic failover so the inference layer has no single point of failure.

Set this against the standing pattern that building permits silence: almost every vendor in this index that assembles its own inference names no provider at all, and this one names the provider, the model family, the host, the selection mechanism and the fallback.

Specific and named rather than asserted: connectors reach the vendor's own portfolio plus Microsoft 365, Snowflake and the open web, identity federates through Okta or Microsoft Entra as system of record over the two standard federation protocols, connections use authenticated interfaces without storing credentials, and named market data providers are embedded directly in the deal workflow.

The most interesting property is outward rather than inward: playbooks are published as governed skills through the Model Context Protocol, and the firm's ethical walls and permission controls travel with them into third party assistant tools.

Held off A on a deliberate reading of this axis: the systems integrated are the productivity, data and identity stack rather than the institution's books and records, and no fund accounting, administration or core platform is named as a certified connector.

The most complete residency disclosure located in this index. The application runs on Microsoft Azure; the language models are hosted on Amazon Bedrock for the Anthropic models and on Azure for the OpenAI models; United States client data is stored at rest on United States infrastructure and European client data at rest on European infrastructure; cross region movement is addressed directly and bounded by the data processing addendum; four separate regional application instances are published; a full sub processor list is public; retention runs for the agreement plus a stated retention window before permanent deletion.

On premises deployment is stated plainly as not available, which is honest negative disclosure rather than silence. Resilience is described too, with multiple model providers across availability zones and automatic failover so there is no single point of failure at the inference layer.

No price, tier, unit or pricing basis published for any product, with everything routed to a demo request. One genuine commercial commitment is published and is worth recording because it is rare in this index: a financially backed uptime service level of 99.9 percent, with a premium support option. A service level is a contractual promise rather than a price, so it does not move this grade, but it is more than most vendors here will commit to in public.

Among the most granular segmentation in the index. Within financial services the vendor publishes a separate solution page for ten private capital sub segments (private equity, venture capital, private credit and leveraged finance, hedge funds, growth equity, fund of funds, multi strategy, family offices, private wealth, limited partners), for investment banking and advisory with placement agents as its own sub market, and for real assets split four ways across equity investors, credit investors and lenders, developers and limited partners.

Buyer roles run from deal teams and investor relations to compliance, risk and finance. Operations are global, with offices across three regions and four separate regional application instances. The honest limit, recorded rather than deducted: this is the deal side of finance, with no retail banking, insurance or payments footprint.