The contract that keeps working after it's signed.
Approve it, stamp it, dispatch it, sign it, certify it — then track what it obligates you to and when it comes back around for renewal. Every step writes to a tamper-evident chain, so "what actually happened" is never a matter of who remembers correctly.
One record, six stages, no spreadsheet on the side
Every contract moves through the same pipeline — and every stage it passes through is a real, tested operation, not a status label someone forgot to update.
Illustrative playback of five real contracts moving through the pipeline — the outcomes shown (escalation, idempotent retry, watermarking) are real, tested backend behavior, replayed here rather than queried live.
Sequential, escalating, or delegated — per step
An approval step never has just one way to move forward.
- 1Dept. Sub-AdminPreferred severityApproved
- 2Legal OpsMedium severityApproved
- 3Tenant AdminHigh severityPending
Each step's required approver is resolved from a real authority grant — re-checked from the database on every call, never trusted from the button that was clicked.
This codebase has no manager/reporting-line concept yet, so "the tenant admin" is the honest default escalation target — not a real org-chart walk.
Delegation never rewrites who was actually accountable — the original assignee stays on the record even while someone else decides.
Alerts anchored to the due date, not "soon"
Every obligation's alert date is computed as due date − its own notice period — never a hard-coded 30 days, which is how deadlines quietly get missed in spreadsheets.
- The correction this was built to make. An earlier version anchored alerts to the due date itself — a real bug caught and fixed by an integration test, now asserted directly so it can't silently regress.
- Escalation, the same honest default. A renewal decision left unresolved escalates to a fixed "Legal Ops" seat when one is configured, or the tenant admin when it isn't.
- No scheduler exists. The alert, overdue, and escalation sweeps are pure functions an external cron job calls periodically — stated plainly rather than implying a background service that isn't there.
A deviation doesn't just get logged — it gets decided
When a clause departs from the playbook, that's recorded with a severity, and it moves through a real decision path before anyone acts on it.
Recording that a deviation exists and how severe it is, is real and enforced. Automatically finding it in a document's text is not built yet — a person still identifies it.
The rest of the console
Every contract, obligation, and signer tied to one counterparty, on one screen — with bulk amendments for changes that touch a dozen agreements at once.
A real tool-using agent over your contract data. It can only ever see what you could see through the ordinary UI — the same visibility check runs before every tool call.
Suggested metadata and obligation candidates, each with the model's own confidence attached — never presented as fact, nothing written until a person confirms it.
Real outbound webhooks, HMAC-signed, delivered off the request path so a slow subscriber never slows down the action that triggered it.
A genuine tenant-to-tenant round trip — decrypted document plaintext and an embedded chain-verification result, not a stub.
A rendered certificate proving this system computed this exact content at this moment — stated as a self-issued attestation on the certificate itself, not an independent trusted timestamp.
Reliable because it's built to survive being checked
Every durable action writes an entry to a tamper-evident audit chain — each entry cryptographically linked to the one before it.
Per-tenant document encryption
Every tenant's documents are encrypted under their own key, with real rotation mechanics — not one shared key protecting everyone.
Tenant isolation on every query
Every database access runs through one tenant-scoped path — isolation is enforced by the database itself, not every call site remembering to filter correctly.
Idempotent, retried, never doubled
Every vendor call is wrapped in retry-with-backoff and idempotency keys, so a network blip retries safely instead of stamping a document twice.
Step-up MFA where it matters
Approving above "preferred" severity requires a fresh MFA challenge — gated on the action itself, not just whether a button is visible.
Legal hold & retention, enforced
A hold means a document stays no matter what a retention schedule says — enforced by a dedicated deletion executor.
A public, checkable chain
Chain verification isn't a private admin tool — a public endpoint re-walks a tenant's audit chain and confirms nothing has been altered.
Roadmap
Said outright, the same way the rest of Xirag's product docs work.
Some vendor integrations are mocked, clearly marked as such
Stamping authority, per-tenant key management, and Aadhaar eSign/DSC each sit behind a real interface with a Mock/Dev implementation until the corresponding vendor is empanelled. Everything around each seam — retry, idempotency, certificate attachment, evidence capture — is real and tested; only the vendor call itself is standing in.
No DOCX round-trip, redlining, or negotiation yet
A final contract is stored as an opaque document today. A canonical editable document model, in-app redlining, and templates all depend on that being built first — deliberately deferred until there's a real counterparty document corpus to build it against.
Deviation matching is human-flagged, not auto-detected
Recording that a clause deviates from the playbook — and how severe it is — is real and enforced. Automatically finding that deviation in a document's text is not built yet.
No legacy contract migration or OCR
Bringing in years of existing contracts as searchable, structured records needs a real OCR vendor — that gate hasn't been opened yet.
Every stage, provable. Every step, checked.
One console for the whole lifecycle — not a spreadsheet quietly out of sync with the PDF.
Open Xirag CLM Just need a signature? See Xirag eSign →