Altumatim vs Relativity: how they compare in 2026

There is no product here without the models. altumatimOS is sold as multi-agent AI that reads a dataset for responsiveness, privilege and confidentiality, writes redactions, produces privilege logs and assembles the facts of a case; the eDiscovery page's own claim is a review that thinks for itself, with no prompt engineering required because the agents interpret the criteria and iterate their own instructions. Strip the agents out and what remains is document storage and an export. Verified 20 September 2026.

The models are the engine of a core capability layered on a platform that would function without them. RelativityOne is an end to end ediscovery system covering legal hold, preservation, collection, processing, review, production and analytics, and it has sold for two decades. The aiR suite of five generative products sits on top of that and drives substantial capability rather than peripheral features, which is why this is not a C. Worth recording precisely because it distinguishes this record from the AI native vendors: technology assisted review has existed in this platform for years, so the generative layer is the newest of several model based capabilities rather than the first, and third party analysis characterises the aiR features as evolutionary within that lineage. Sixth B on this axis.

Accuracy is treated as something to measure rather than promise, and the measurements belong to each customer rather than to the public record. The AI governance page says answers are grounded in the customer's own documents through the vendor's retrieval techniques and carry citations to sources in the dataset, and that review quality is validated against human-reviewed control sets using precision, recall and F1, reported per project and refined until results meet the threshold the customer sets, with every iteration logged. The eDiscovery page shows the same measures in the product. What is not published is a figure an outsider can test: the numbers on the site belong to individual matters, no benchmark or test set is described, and no failure mode is named. Verified 20 September 2026.

Grounding is real and documented through an explainability mechanism, short of published measurement. The vendor states that aiR for Review surfaces impactful content backed by transparent rationale and that aiR for Privilege explains every decision, so each output carries a stated basis a reviewer can inspect against the document rather than a bare classification. The suite is described as designed to be transparent, reviewable and defensible, with safeguards derived from published AI Principles. That is a documented verification surface tied to specific documents. Searched the aiR product pages, the artificial intelligence overview, the corporate data solutions pages and the learning centre on 29 Aug 2026 and located no accuracy figure, no precision or recall number, no hallucination rate, no test set, no published evaluation methodology and no independent benchmark participation. A partner published case study describes predictions as highly accurate, which is a customer's characterisation rather than a measurement and was not treated as evidence.

What the system does alone, what stops it, and how a lawyer checks it are all published. The review runs as a named pipeline: criteria, control set creation, control set review, full run, confidence-scored results with explanations, production. A team validates a balanced control set to build the gold set that directs the full review, and the agents iterate their own instructions until they hit the F1 threshold the team defines, with each iteration logged so the standard applied is visible. Every determination, including redactions, can be agreed, disagreed with or overridden before export, and the vendor states the position plainly: AI recommends, lawyers decide, and every mission-critical step is human-validated. Verified 20 September 2026.

A real published commitment with documented review surfaces and an explicit control philosophy, short of published thresholds. The vendor's AI Principles state the aim of technology that is clear, fair and gives customers the utmost control, and the aiR suite is described as transparent, reviewable and defensible. The review surface is concrete: every decision carries a rationale, and aiR for Privilege predictions are positioned to guide counsel's second pass review rather than to replace it. The vendor also invests in operator competence in a way no other record here does, running a certification programme covering generative AI and individual aiR products, with published guidance on building, testing and trusting prompts. Third party analysis states the product does not make autonomous privilege designations and that a human reviewer still makes every privilege call, which corroborates the position without being vendor material. Not located as of 29 Aug 2026: a published threshold at which a document routes to a human, and what the vendor commits to when an output is wrong.

The results are measured and the customers are not named. Three matters are described on the homepage with figures: an AmLaw 200 firm acting for a Fortune 500 company facing more than 10,000 complaints, reporting 75 per cent cost savings; a Fortune 200 company's regulatory analysis, reporting 94 per cent time saved with explainability for every decision; and an AmLaw 10 firm reading carbon copies and microfiche, reporting 99 per cent precision and recall on handwriting and checkboxes. None of the three identifies the customer or dates the work, and no method is given for how the savings were calculated. A published white paper reports retrieval accuracy and indexing figures for structured data. Verified 20 September 2026.

Named customers and a specific, checkable adoption figure, short of vendor published outcome numbers. Adoption is quantified precisely rather than vaguely: 192 of the Am Law 200 firms and more than 110 legal service provider partners use RelativityOne, which is a figure a reader can test against the published Am Law list. Named organisations are published as aiR success stories including Alvarez and Marsal, Cimplifi and Gilbert and Tobin, with Alvarez and Marsal stated to have used aiR for Review, aiR for Privilege and aiR for Case Strategy on a single complex matter. Quantified results exist but sit in partner published material rather than vendor material: a Relativity Gold Partner published a case study covering 30,000 documents analysed with aiR for Privilege and 610 hours saved in privilege review, with auto generated log descriptions replacing a manual process. That is a named scope, a named figure and a described method, and it is recorded here as partner published rather than treated as the vendor's own evidence.

The commitments are specific, they are written for this buyer, and they sit on published pages rather than in a contract a customer can read before signing. The AI governance page states that customer data is never used to train models, that foundation-model processing runs under enterprise agreements prohibiting retention and training by the providers, that answers are grounded in the customer's own documents, and that data is returned or deleted at the customer's direction when a matter ends. The security page adds physical separation of client datasets, encryption in transit and at rest, role-based access with logging, and customisable retention. The Terms of Use cover the website only and say that the platform is governed by separate signed agreements, which are not published, so none of this is readable as a term. Privilege itself is handled as a review task, with dual-analysis privilege detection and generated logs, rather than as a stated position on privilege and work product in the data Altumatim holds. Verified 20 September 2026.

Substantive published commitments including one control no other record on this index discloses, short of the training and retention limbs. The distinctive element is specific and consequential: the vendor states it has opted out of the abuse and harmful content monitoring offered by Microsoft, so that no unauthorised users have access to raw inputs or outputs. Abuse monitoring is the standard route by which provider staff may review customer prompts, and opting out of it is the single most concrete confidentiality decision disclosed anywhere in this pull. Alongside it: a privileged access management solution and a classification schema dictating how confidential data is handled, and a vendor risk management team reviewing Azure's security and privacy posture at least annually to validate controls are operating effectively. Two gaps hold this off an A. No statement on whether customer content may be used to train models was located, either at the vendor or provider layer. No retention or deletion terms were located. Both matter for a platform holding entire document universes for live matters.

The vendor addresses the duties its buyers carry, in its own words and under its own heading. The AI governance page says using AI does not suspend a lawyer's duties and maps the product to three of them: competence, through transparent metrics and grounded citations a lawyer can explain rather than simply trust; confidentiality, through no-training commitments, zero-retention processing, encryption and segregation; and supervision, through human-in-the-loop workflows that keep review decisions attributable to the team with a record of what was validated and by whom. The Terms of Use state that website content is not legal advice and creates no attorney-client relationship. What is absent is any jurisdiction statement and any treatment of who may operate the review in the first place. Verified 20 September 2026.

The audience is professional and the position is unstated. Users are law firms, corporate legal departments, government and regulatory response teams, and legal service providers, with no consumer surface located, and the product is a review and investigation platform rather than an advice tool, so the advice line question arises less sharply than for a research or drafting product. Searched the aiR product pages, the artificial intelligence overview, the data solutions pages and the learning centre on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties as professional obligations, and no jurisdiction limits. Worth recording as adjacent rather than as credit: the vendor runs a substantial user certification programme, which addresses operator competence as a commercial and training matter rather than as the professional duty it also is.

A published framework with real substance, short of the things that would let a buyer audit it. The AI governance page sets out three commitments (no training on customer data, processing under provider agreements that bar retention and training, and lawyers retaining control of every determination), then walks the data's life from ingestion into a SOC 2 Type II environment through grounded answers, human validation and deletion at the customer's direction, and states that review quality is measured against human-reviewed control sets and reported per project rather than asserted in the abstract. Nobody inside Altumatim is named as accountable for model behaviour, nothing describes what is tested before a release ships, and nothing addresses whether performance is uneven across document types, languages or custodians, which a vendor reporting precision and recall is well placed to answer. Verified 20 September 2026.

A published governance framework with real substance, short of testing results, a named owner and any bias disclosure. Relativity AI Principles are published as a standing document and the vendor states they guide everyday decision making toward technology that is clear, fair and gives customers the utmost control, with aiR safeguards described as inspired by them. The vendor states directly that it recognises the value AI can create along with its risks and commits to processes that are thoughtful, disciplined and trusted, which is an acknowledgement of risk rather than an unqualified capability claim. Governance is also operationalised through vendor risk management, with an annual in depth review of the underlying platform provider's security and privacy posture. Not located as of 29 Aug 2026: an AI management certification such as ISO 42001, published pre release testing results, a named accountable owner for model governance, and anything on uneven output across matter types, parties or populations. The word fair appears in the principles without any published work behind it, which is the gap this axis exists to mark.

Most of the ground is covered and the gaps are at the edges. The security page publishes encryption in transit and at rest, physical segregation of client datasets, role-based access with all access from source data to results logged and routinely audited, perimeter defences, third-party vulnerability assessments and penetration testing, 24/7 monitoring with a dedicated incident response team, and customer-controlled retention policies; the AI governance page adds that data is returned or deleted at the customer's direction at the end of a matter. The service providers named in the Privacy Policy (Google, Microsoft, LinkedIn, Calendly, Adobe) relate to the website and marketing rather than to document processing, no model provider is named, and no breach notification timeline to customers is published. Verified 20 September 2026.

Published on the dedicated trust site and in product documentation: customer managed encryption keys, so a customer can hold its own key material; Customer Lockbox, a default on control restricting the vendor's own system administrators from accessing customer workspaces unless the customer explicitly grants it, which is a strong and specific limit on vendor side access; client domains providing data separation between clients; Security Center, a monitoring application shipped to customers; SIEM integration giving customers access to their own security logs; and round the clock monitoring by the named in house security team, Calder7. Also published: privileged access management, a classification schema for confidential data, the opt out from Microsoft abuse and harmful content monitoring, and annual vendor risk review of Azure. That is a substantive published policy covering most of what this axis asks. Not located as of 29 Aug 2026: a stated retention period or deletion control for customer data, prompts or aiR outputs, and a named subprocessor list. Those two absences are what hold this at B rather than A.

Nothing published says who bears the loss if a review goes wrong. The Terms of Use, last updated September 2026, apply to the public website only and say so: access to altumatimOS is governed by separate written agreements between Altumatim and its customers, and those agreements are not published. The website terms disclaim all warranties, cap liability at one hundred dollars and require the user to indemnify Altumatim, but none of that reaches a missed responsive document, an incorrect privilege call or a redaction that fails. The site also states that product descriptions are not a binding offer and that features, terms and performance are defined exclusively in customer agreements. Checked the terms, the privacy policy, the security and AI governance pages and the three product pages on 20 September 2026. Verified 20 September 2026.

Searched the aiR product pages, the artificial intelligence overview, the corporate and data solutions pages and the learning centre on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer agreement or master terms was located on the surfaces reached. Recorded as a pure absence on those surfaces. The shape is worth naming for this vendor specifically: aiR for Privilege exists to reduce the risk of inadvertent production of privileged material, which is among the most consequential errors in litigation, and nothing published addresses who bears the loss if a privileged document is produced on the strength of an AI prediction. Rebuttable with one link.

No integration into the systems a litigation team already runs was located. The workflow is self-contained: documents are ingested, reviewed and exported as production packages with privilege logs, and the platform can be deployed on the customer's own infrastructure. Nothing names a review platform, document management system, matter management system or eDiscovery processing tool it connects to, no API or developer documentation exists, and no import or export format is specified. Checked the homepage, the eDiscovery, investigation, litigation and OS pages, the security and AI governance pages, the terms and the privacy policy on 20 September 2026. Verified 20 September 2026.

Real integrations exist, are named individually, and target the systems evidence actually lives in. Named as out of the box integrations for collections: Microsoft, Google, Slack and Box, with in place preservation from what the vendor calls the top productivity platforms, which is the integration that matters most for defensible legal hold. A published .NET Platform API for RelativityOne is documented through the learning programme, and the platform is explicitly built for shared working across internal teams, outside counsel and service providers, with more than 110 legal service provider partners in the ecosystem. Not located as of 29 Aug 2026: a consolidated integrations index page, per integration documentation of what moves in which direction and what an administrator configures, and legal document management connectors such as iManage or NetDocuments.

The deployment choice is stated clearly and the geography is not. The eDiscovery page offers three options and says what changes between them: on premises for complete data sovereignty with the customer controlling storage and processing, cloud for scale, and hybrid configurations that keep sensitive data on premises while using cloud compute. The security page names Google Cloud and AWS as the underlying infrastructure with dedicated virtual private clouds and network segmentation. No region is named for the cloud option, and the Privacy Policy says information is stored and processed in the United States and any other country where Altumatim, its group companies or its providers maintain facilities. Verified 20 September 2026.

The hosting platform is named and residency is not addressed. RelativityOne is stated to be built on Microsoft Azure, and the vendor adds a substantive point about that choice, that it is the same platform chosen by global regulators, alongside an annual vendor risk review of Azure's security and privacy posture. Naming the hosting provider and evidencing ongoing oversight of it is more than several records here manage. Searched the aiR pages, the artificial intelligence overview, the data solutions pages and the learning centre on 29 Aug 2026 and located no named regions, no customer selectable residency, no tenancy model, and no statement of where processing happens as distinct from where data is stored. For a platform serving 192 of the Am Law 200 across international matters, published residency options would be expected and none was located on the surfaces reached.

The certification is real and stated, with the supporting evidence still behind a conversation. The security page states SOC 2 Type II certification, describes it as formal validation of controls protecting client data, and says Altumatim works with a third-party security auditor using compliance software and real-time monitoring for continuous verification and evidence collection, alongside regular vulnerability assessments and penetration testing by outside firms. The auditor is not named, no report period or scope statement appears, there is no trust portal, and no route to obtain the report is published; the page invites buyers to bring their security team and procurement checklist to a demo. Verified 20 September 2026.

The certifications are named individually and with versions on the dedicated trust site at relativity.com/trust and its compliance and privacy page. Published there: ISO/IEC 27001:2022 certification, ISO/IEC 27018:2019 certification, FedRAMP Moderate ATO, HIPAA compliance, IRAP assessed at Protected, a SOC 2 Type II report, a SOC 3 report, and a Cloud Security Alliance CAIQ, alongside a published request route for compliance certificates. Naming ISO 27001 at the 2022 revision and 27018 at 2019 is precise, and the set is unusually broad, spanning the US federal authorisation, the Australian government assessment at Protected level, a healthcare framework and a standardised cloud control questionnaire. A SOC 3 report is a public summary report, which is a materially more open disclosure than SOC 2 alone. The vendor also names its in house security team, Calder7, publishes a Security Center monitoring application to customers, and offers SIEM integration giving a customer access to their own security logs. Short only of a published coverage period, report date and named auditing firm, none of which was located as of 29 Aug 2026.

The terms attached to the models are published and the models are not. The AI governance page says that where leading foundation models process customer data it happens under enterprise agreements carrying zero data retention and an explicit prohibition on training, which is a meaningful commitment about the supply chain without identifying anything in it: no model, version or provider is named, and nothing states which provider handles which part of the work. Google Cloud and AWS are named as infrastructure on the security page. No commitment to notify customers when the models behind a review change was located. Verified 20 September 2026.

The provider is identified, where the models run is stated, and the terms binding the relationship are described, short of naming the models themselves. Microsoft Azure is named as the platform the product is built on, and the vendor's disclosure about opting out of Microsoft's abuse and harmful content monitoring identifies Microsoft as the party that would otherwise have had access to raw inputs and outputs, which locates the generative processing in the Microsoft stack more precisely than most vendors manage. The relationship is governed rather than assumed: a vendor risk management team performs an in depth review of Azure's security and privacy posture at least annually to validate controls are operating effectively. Not located as of 29 Aug 2026: which specific models serve which aiR product, any subprocessor list beyond the platform provider, and any commitment to notify customers when the model supply chain changes.

No pricing information is published at any level, including the unit of charge. Checked the homepage, the eDiscovery, investigation, litigation and OS pages, the security and AI governance pages, the newsroom and blog indexes, the Terms of Use and the Privacy Policy on 20 September 2026: there is no pricing page, no tier, no per-document or per-gigabyte rate and no trial, and every route ends at a one-hour demo booking. The terms state that the features, terms and performance of the products are defined exclusively in written customer agreements. Verified 20 September 2026.

A real commercial term is published without a rate, and the term itself is unusual enough to record. The vendor states that aiR for Review and aiR for Privilege are included in the standard pricing and packaging for RelativityOne, so a buyer learns that two of the five generative products carry no separate charge, which is a meaningful commercial fact and one almost no vendor on this index discloses about its AI features. Flexible pricing models are referenced without being enumerated. Searched the aiR pages, the data solutions pages and the corporate pages on 29 Aug 2026 and located no rate, no unit of charge, no tier structure, and no published packaging for the remaining aiR products, aiR for Case Strategy, aiR for Data Breach Response and aiR Assist. Recorded at C on the strength of the published inclusion statement.

The work the platform covers is described in detail and the edges are left open. Three product lines are set out: eDiscovery through to production, investigations across relationships and timelines, and litigation support for case preparation, with compliance analysis appearing in the published matter descriptions. The buyers addressed are law firms, enterprises and government organisations, and the matters described run from a 10,000-complaint litigation to regulatory review to digitised microfiche archives, including the vendor's published work on reading spreadsheets and other structured evidence. What is not stated is any limit: no practice area, matter size, language or data type is named as outside the platform's scope. Verified 20 September 2026.

Segment and practice coverage is described with substance and quantified where it can be. Segments named: law firms with a stated 192 of the Am Law 200, corporations, government, and more than 110 legal service provider partners, with the platform explicitly designed as shared working space across internal teams, outside counsel and providers. Practice coverage is enumerated by product rather than claimed broadly, five aiR products each with a distinct purpose spanning document review, privilege, case strategy, data breach response and assistance, plus legal hold, preservation, collection, processing, production and analytics. Regulatory response is named down to the agency: EPA, DOJ, FDA, SEC and third party subpoenas. Not located as of 29 Aug 2026: firm size segmentation below the Am Law tier, jurisdictional or language coverage, and any statement of what the platform is not built for.