Enterprise Legal Project

ITFA Form Research Agent

Researches vendor security and privacy documentation to answer the German Works Council's 14-question software-tool form — half of it automatically, so the review teams stop doing the requester's homework.

Status: Deployed
Platform: Glean
Department: Legal / IT / People
Form: 14 questions

Why it was built

Contentful spent eight months negotiating an IT Framework Agreement (ITFA) with its German Works Council. The agreement requires a 14-question form for every new software tool procurement — spanning legal, IT, and People domains: data processing, security controls, employee personal data, monitoring, deletion periods.

The bottleneck: requesters submitted incomplete, superficial, or inaccurate responses. The Legal, IT, and People teams spent their time chasing corrections or redoing the research themselves. The root cause wasn't laziness — the information exists publicly in vendor DPAs, trust centers, and security documentation, but requesters don't know where to look or what's being asked.

Before
Requester fills the form superficially. Review teams become researchers, not validators — hunting vendor DPAs and security docs manually to correct each submission. Every procurement delayed.
Reviewers redo research
Review-team member triggers the agent with a vendor domain. The agent researches DPA, trust center, sub-processors, and privacy policy, then answers the automatable questions with source links and confidence levels.
Research automated

What it does

A Glean agent operated by the review team, not the requester. Given a vendor domain and tool name, it locates the DPA, trust center, sub-processor list, and privacy policy, then produces a pre-populated Schedule 1 form with each answer backed by a source link and a confidence level.

The coverage map is where the real design work happened — deciding which of the 14 questions the agent can honestly answer, which need a human, and which sit in between:

CoverageCountQuestions
Agent55.3 safeguards · 5.5 personal-data categories · 5.6 location monitoring · 5.11 storage location · 5.13 deletion periods
Partial35.7 performance mgmt · 5.8 reporting · 5.12 DPA/TIA status
Human65.1 description · 5.2 risk assessment · 5.4 purpose · 5.9 roles · 5.10 timeline · 5.14 training

The honest line mattered. The agent doesn't pretend to answer everything. It answers the five it can source, flags the three it partially can, and hands the other six back to the people who actually know.

Why the DPA became the linchpin: The first versions tried to answer from public web search alone — and Lisa's team couldn't validate the output. The pivot came in v6: make the DPA a required input (paste, link, or upload), and scope web search to gap-filling only. Without the executed DPA, the agent is just guessing. With it, the privacy team can actually verify the answer. That single decision turned a research toy into a usable tool.

From PRD to v7.2

Seven iterations over eight weeks, each one correcting a real failure found in testing — not speculative polish.

V1 → v3: PRD, then Tyler's build, then Charlie's 6-step workflow with a golden example (Cursor) and targeted search areas.

v4: The pivot — the process is Google Doc-based, not Jira-based. Output became a pre-populated Schedule 1 document, not a ticket comment.

v5: Eval-driven fixes against Lisa's real test cases (Trellus, Vitally, Qualibooth) — quote attribution, source hierarchy, confidence-rating leak.

v6 → v7.2: DPA as required input, then the source-priority bug fix, then DPA file upload as a third input path.

Metrics & improvements

5 / 14
Questions fully automated
3 / 14
Partially handled
100%
Answers with source links
7
Build iterations
~$250
Recovered per request

Improvement: Review teams stopped being researchers and got back to validating. Every agent-produced answer ships with a source link and a confidence level, so the reviewer verifies instead of searches. The bar was explicit from the start: better than what the requester typically provides — not perfect.

ROI: Roughly an hour of vendor research recovered per request, at a ~$250/hr loaded attorney cost — ~$250 per ticket, scaled across the review team's volume.

← Back to Index