Key Takeaways

  • Law firms rejected AWS outright during Legora's early sales cycles because their IT teams already maintained security approvals for Microsoft 365.
  • Legora cut third-party APIs like ElevenLabs entirely because every extra external service expands the Data Processing Agreement (DPA) and stalls enterprise sign-off.
  • CTO Jacob Lauritzen avoided fine-tuning general models for years, waiting until open weights models matured enough to win on narrow tasks by beating frontier models on cost and latency.
  • Model routing at Legora tracks models along a Pareto frontier based on speed, cost, governance, and regional availability rather than locking into a single model family.

Procurement Dictates Architecture in Regulated Markets

When Jacob Lauritzen co-founded Legora to build legal AI workflows, engineering preferences took a backseat to procurement realities. Most software teams default to AWS. When Legora pitched large law firms, the response was immediate. “All of our infrastructure is on Azure,” (play from 28:53) Lauritzen said. “Primarily for this reason because like when we started law firms were like AWS. No. Like no way. We don't trust AWS.” (play from 28:56)

The objection had nothing to do with technical limits. Law firms ran their email and document systems on Microsoft 365. Their compliance teams had already vetted Microsoft security policies. Putting the entire stack on Azure let Legora pass vendor risk reviews that blocked AWS and Google Cloud. “Microsoft is an approved vendor in their mind and so we had to host everything on Azure,” (play from 29:21) Lauritzen explained. Law firms have softened on public cloud infrastructure over the past two years, but matching the customer's existing compliance footprint removed months of security reviews.

Guard the Data Processing Agreement and Model Routing

The same friction that pushed Legora onto Azure dictates how the company handles third-party APIs. Modern AI developers love chaining niche APIs for voice, transcription, and data parsing. Legora avoids them. "No ElevenLabs for DPA reasons," Lauritzen noted. “Our data processing agreement has very few vendors on it because we need to keep it super tight on where any data goes.” (play from 31:33)

Every external API on your subprocessor list creates another compliance review. In enterprise legal sales, adding an outside vendor to touch confidential client files will pause the deal. If an API provider cannot meet enterprise legal security standards, the entire software contract stops.

Instead of assembling a patchwork of AI services, Legora routes model calls directly. Lauritzen focuses on “bringing our clients along on the Pareto frontier and the map of all the models and what they're good at and their latency and their cost and their governance and their regional availability.” (play from 30:14)

That same logic kept Legora from rushing into fine-tuning. Instead of attempting to fine-tune generalist models for complex legal work, Legora relied on frontier models. Lauritzen only began post-training recently: “We haven't fine-tuned any models up until now. I think now in the past few months open weights models have become extremely capable and so we will do it for certain tasks where we think there's a huge delta between what a frontier model can do at the cost and latency versus what we think a post-trained model can do.” (play from 53:13)

What to Do With This

Audit your subprocessor list before your next enterprise sales call. If you sell to legal, financial, or healthcare buyers, cut any third-party API that does not deliver core product value and can be handled by your base cloud provider. Every vendor you delete from your Data Processing Agreement removes a reason for procurement to say no.