Blee vs Luthor: how they compare in 2026

The models drive the capability the vendor leads with, on a review workflow that would run without them, which is the B band. The AI pre-reads every submission and flags regulatory risks, missing disclosures and unsubstantiated claims, and in monitoring scans live sites, social channels and partner content for outdated claims and missing disclosures. Around that sit submission intake, routing to reviewers, approvals and an audit trail of versions and decisions, which function as a review workflow without the models. Verified 18 September 2026.

The models are the mechanism, not a feature bolted to a workflow tool. Content goes in — text, images, video, audio, SMS, social posts, PDFs and live URLs — and the system classifies it, flags performance claims, guarantees, missing disclosures, testimonials, unsupported assertions, off-brand language and personally identifiable information, then says which rule was hit and what to change. The vendor describes natural language processing for context, machine learning classification and large language models for the written output. The approval routing and the audit trail exist to carry that output rather than the other way round, and the published case for buying is that human review alone cannot enforce every policy at the volume AI-generated content now arrives in. One qualification a buyer should hold: part of the enforcement is plainly rule-based — banned phrases, trigger words, required disclosure lines — and nothing published separates what the rules catch from what the models catch. Read on the home page platform and policy library sections, both solutions pages, the Financial Services page and the 19 June 2026 guide. Verified 20 September 2026.

Grounding is documented, with each flag tied to the rule and source behind it, short of accuracy figures an outsider can test, which is the B band. The Content Reviews and Financial Services pages say every flag arrives with its rule, its location on the asset and an explanation, and is checked against the customer's source of truth, with a worked example of an APR in an ad compared with the customer's stated rate under Regulation Z; the life sciences page shows each claim beside the exact supporting passage from the customer's approved references. The rule sets are built by the vendor's legal engineers from named regulations and the customer's guidelines. The FAQs say Blee typically reaches 85 to 95 per cent flagging accuracy against 50 to 60 per cent for a general-purpose model, with no test set, sample or definition of accuracy, and no failure modes are named. Flagged for sampling. Verified 18 September 2026.

Accuracy is asserted repeatedly and measured nowhere. The PCM Encore case study of 28 October 2025 puts review accuracy at 64% before and up to 96% after, described as accuracy with zero critical defects; the Regional Bank study of 8 December 2025 reports 86% of advertising issues self-corrected by the field and licensing errors near zero. Neither gives a sample, a period, a method, or a definition of what a correct review is, and nothing anywhere addresses the failure that matters most in a product like this, which is the violation the system does not flag. A 98.4% detection rate and a 99.2% figure sit inside product mockups on the home and Legal & Compliance pages next to invented assets, so they describe the interface rather than a result. What is real is the grounding: every review shows what was flagged, which rule applied and the reasoning behind it, and the bank study shows that explanation reaching the person who has to fix the ad. A figure an outsider could test is what this row is short of. Verified 20 September 2026.

A categorical limit on the AI is published for the step that matters, with the review surfaces and the route to a human described, which meets the A band under R124(2). The consumer brands FAQ answers whether a person still approves or the AI decides with 'A person always decides': Blee runs the first pass and approval stays with legal, regulatory and brand reviewers, and the life sciences FAQ says the same of medical, legal and regulatory reviewers. The Content Reviews page sets out the route: an AI first pass, marketing fixing the clear-cut issues it flags, routing to the right reviewer, each flag shown with its rule, its location on the asset and an explanation, and the reviewer's approval clearing the asset to publish, with every decision logged; in life sciences each claim is shown beside the supporting passage from the approved references. Nothing states a confidence threshold, and monitoring flags are routed to the person responsible without a stated review step. Flagged for sampling. Verified 18 September 2026.

The review point is described and it sits with people, short of a full control structure. The AI runs the first pass; assets come back approved, needing review or escalated, and each review carries provenance showing what was flagged, which rule applied and the reasoning. The Regional Bank study of 8 December 2025 describes the tightest version in production: the field could fix findings and re-upload until an ad passed, and only compliance could override a finding. Role-based permissions, multi-factor authentication and single sign-on are published, and every action is logged. Two things hold this where it is. The override rule and the risk thresholds that drive escalation are the customer's own configuration — escalation criteria and risk thresholds are listed among the things a customer encodes — rather than a limit the vendor places on its own product. And nothing published says what the system does at the point it cannot tell, or what happens after a review turns out to be wrong. An auto-approve control appears in a product mockup on the Marketing Teams page and is described nowhere in text. Verified 20 September 2026.

A named, dated deployment with figures but no method, which is the B band. The May 2025 Rocket Mortgage case study reports initial review time falling from 72 to 24 hours, 14 hours a week saved against about 50 hours a week of manual review before, and review done with a third of the previous staff time, without saying how these were measured. Attributed testimonials come from NerdWallet's Chief Legal Officer, Marqeta's marketing compliance officer, Betterment's and Greenlight's chief compliance officers and a Rocket Mortgage analyst, and further case studies announce partnerships with Betterment, NerdWallet and Public. The 65 per cent review-time reduction in the funding release is not tied to a customer. Verified 18 September 2026.

Two dated deployments are published with figures, and the figures do not entirely agree with each other. PCM Encore, an employee-owned fiduciary wealth manager in Bellevue with more than $1.2 billion under management and over 50 client families, is named and its Chief Compliance Officer is quoted: weekly reviews up from 6, accuracy from 64% to up to 96%, median turnaround from three business days to roughly four hours, live in three days (28 October 2025). A regional mortgage lender, unnamed, reports reviews 82% faster, 86% of issues corrected by the field before compliance saw them, NMLS and licensing errors near zero, and more than 60 custom rules built (8 December 2025). Neither states a method or a measurement window. The bank study headlines 82% faster and its own text says about 70 per cent; PCM Encore's weekly figure reads 45 on one page and 46 on another; the same customer quote appears in two wordings across the site. Three further logos and two anonymous testimonials carry no figures. Verified 20 September 2026.

Specific published commitments on how AI providers handle customer content, short of contractual confidentiality or a privilege position, which holds this at the bottom of the B band. The security page states that enterprise agreements with third-party AI providers ensure zero retention and no training on customer data, that data sits in a segregated database on AWS, and that access is set per user or role with SSO and SAML. These are policy statements: the Terms of Service contain no confidentiality clause protecting customer content, the Financial Services FAQ says the model tunes to each firm's risk posture from its team's decisions, and privilege and work product are not addressed. Flagged for sampling. Verified 18 September 2026.

Real written commitments, with the confidences peculiar to legal work left unaddressed. The Terms of 07.11.25 carry a mutual confidentiality obligation with reasonable care and the ordinary exceptions, leave the customer owning its data outright, and commit to deleting all customer data within thirty days of termination. The security page adds AES-256 at rest and TLS 1.2+ in transit with keys held in a rotating key management service, per-organisation isolation with data never co-mingled across customers, access confined to authorised users within the account, and a statement that submitted content is not retained by model providers. Three things keep this short of the top. Privilege and work product are never mentioned, on an estate that sells to legal teams. No model provider is named, so the retention commitment made on their behalf cannot be checked against anyone. And the training position lives on a policy page while the Terms grant a licence to use customer data to provide and improve the Services. Verified 20 September 2026.

A real position on what the tool is and who decides, short of an advice-line statement or supervision guidance, which is the B band. The consumer brands and life sciences FAQs say a person always decides, that approval stays with the customer's legal, regulatory and brand (or medical) reviewers, and that the system supports their judgement and does not replace it. What is missing: no surface says flags are not legal advice, although the AI explains the reason for each flag to marketing staff so they can fix straightforward issues before legal or compliance reviews the asset, and nothing addresses how reviewing lawyers should supervise that first pass or which jurisdictions' rules are covered only on request. The Terms of Service disclaim warranties generally. Flagged for sampling. Verified 18 September 2026.

Nothing published addresses the advice line, on a product whose whole function is telling people what a regulation requires. The Regional Bank study of 8 December 2025 sets out the shape: a loan officer or a marketer uploads an ad and the system returns pass or fail, the rule that was hit and what to change — Regulation Z trigger terms and the disclosures they require, the loan officer's and company NMLS identifiers, state licence lines, the Equal Housing legend, wording in builder co-marketing that could imply a referral arrangement. The home page shows the same thing, calling a return guarantee a FINRA 2210 problem and offering the disclosure to add. No statement that this is not legal advice appears anywhere, including the Terms of 07.11.25, which disclaim warranties and outcomes and say nothing about advice. Nothing addresses the competence or supervision of the lawyer or compliance officer who owns the judgement, and no jurisdiction limit is named. Checked the home page, both solutions pages, the Financial Services page, the security page, the Terms, the Privacy Policy and both case studies on 20 September 2026. Verified 20 September 2026.

A customer-facing configuration process is described without a governance mechanism, which is the C band. The vendor says its legal engineers build each customer's rules from regulations, internal guidelines and risk tolerance, that the model tunes to the customer's decisions, and that each flag is explained. No accountable owner, pre-release testing regime or disclosure of uneven performance across content types, languages or media is published. Verified 18 September 2026.

No governance position is published about this vendor's own models. There is no statement of who inside Luthor owns model behaviour, nothing on what is tested before a change ships, and nothing on whether output differs across content types, channels, or the populations an advertisement reaches. The estate publishes a good deal of governance material aimed the other way: guides telling regulated firms how to govern AI agents used in marketing review, test the AI, define reviewer authority, require a rationale for overrides, monitor drift and preserve evidence. That is advice to buyers about their own programmes, not a commitment about the product they would be buying. The one mechanism on the product side is the provenance carried on every review, which shows a reader what was flagged and why; that is an output explanation rather than governance over the model, and it is recorded on the oversight row. Read across the home page, the security page, both solutions pages and the resources library. Verified 20 September 2026.

Most of the ground is covered in published policy, short of a readable subprocessor list or a retention period for content, which is the B band. The security page states AES-256 encryption at rest, TLS in transit, a segregated database on AWS, zero-retention agreements with AI providers, least-privilege access by user or role, WORM storage meeting SEC and FINRA requirements where needed, and regular third-party penetration testing. The Privacy Policy commits to notify a personal data breach within 15 days and to delete personal information within 60 days of a request. How long Blee keeps submitted content and review records is not stated, and the list of third-party service providers in the Terms and Privacy Policy is an image that could not be read. Verified 18 September 2026.

Most of the ground is covered in published detail, with one clear gap. The security page states AES-256 at rest and TLS 1.2+ in transit with automatic key rotation, per-organisation data isolation, role-based access with multi-factor authentication and single sign-on through OAuth or SAML, immutable audit logs of who did what and when retained to the SEC's 17a-4 requirements, automated vulnerability scanning, DDoS protection and continuous monitoring, and a documented incident response plan with severity levels, escalation paths and notification of affected customers within regulatory timeframes. Processing and storage are stated to be in the United States. The Terms commit to deleting all customer data within thirty days of termination. The gap is the subprocessor list: none is published, and the vendor's own trust centre records zero subprocessors and zero documents. Nothing states how long submitted content is held during the term. Verified 20 September 2026.

Liability is addressed only by standard limitation, which is the C band. The Terms of Service disclaim all warranties including accuracy and reliability, exclude indirect and consequential damages, cap liability at one times the payments received, require the customer to indemnify Blee with no indemnity running the other way, and send disputes to individual arbitration with a class waiver and a one-year limit on claims. Nothing addresses a missed flag or an incorrect one. A signed Master Services Agreement supersedes these terms and is not published. Verified 18 September 2026.

The published position is a standard limitation clause, and it disclaims the exposure this product creates. Section 6 of the Terms of 07.11.25 provides the services as is, disclaims all warranties including fitness for a particular purpose, states that no particular outcome is guaranteed, excludes indirect, incidental, special, consequential and exemplary damages including lost revenue and goodwill, and caps total liability at the fees paid in the preceding twelve months. Carve-outs run the vendor's way and the customer's alike: personal injury or death, fraudulent misrepresentation, intellectual property infringement and anything that cannot be limited by law. No indemnity of any kind is offered to the customer, and nothing addresses the loss a buyer actually fears here, which is an advertisement that cleared review, went to the public, and drew a regulator. Warranty of effort is offered instead: commercially reasonable efforts to minimise errors and interruptions. Verified 20 September 2026.

Named connections with what they carry described, short of documentation, which is the B band. The industry pages say submissions arrive from Jira, Workfront, Wrike, WorkZone, Asana, Monday.com or the customer's own portal through APIs and webhooks, and that feedback appears inside Google Docs, Microsoft 365, Adobe Creative Cloud and Figma; partners and franchisees submit in their own spaces. The integrations pages list project management tools (Jira, Asana, Monday.com, Airtable, Notion, Workfront, Wrike), design and document tools (Figma, Adobe, Frame.io, Google Workspace, Microsoft Office), storage (Google Drive, Dropbox, OneDrive) and channels (Slack, Teams, Chrome and the major social networks) as logos. Integration documentation is offered in a meeting rather than published. Verified 18 September 2026.

No integration into the systems legal and compliance work already lives in is named anywhere on the estate. What is published is ingestion by format and channel — text, images, video, audio, SMS, social posts, PDFs, email drafts, rate sheets and live web pages — and monitoring of published content after it goes out. The Regional Bank study describes the position it replaced rather than one it connects to: reviews that had been running through email chains, Asana tasks, shared drives and design folders moved into Luthor's own upload and vault. No document management, matter management, marketing automation, social publishing or archiving system is named as a connection, no directional sync is described, and no developer or integration documentation is published. Immutable retention to the SEC's 17a-4 standard is offered inside the product rather than through an archiving partner. Read on the home page, both solutions pages, the Financial Services page and the two case studies. Verified 20 September 2026.

The hosting model and region are stated, without the AI processing location, which is the B band. The security page says data is stored in a segregated database built on AWS, and the Privacy Policy says Blee's servers or hosting partners are in the United States, with EU transfers under Standard Contractual Clauses. Where the third-party AI providers process content, and whether other regions are offered, is not stated. Verified 18 September 2026.

Both halves are stated plainly, and neither is offered as a choice. Tenancy: each organisation's data sits in a siloed environment, isolated from other customers and never co-mingled, with access limited to authorised users inside the account. Region: the security page says the platform runs on SOC 2 certified cloud infrastructure in the United States and that all processing happens in controlled environments with network isolation and continuous monitoring, so storage and processing are answered together rather than left apart. What is not published is any option. No single-tenant, private or on-premises deployment is described, no second region is offered, no cloud provider is named, and nothing says what changes between tiers, because no tiers are published. For a buyer with data outside the United States, the international transfer clause in the Privacy Policy points to standard contractual clauses and nothing further. Verified 20 September 2026.

A named attestation without scope, date or a published route to the report, which is the B band. The security page and site footer state SOC 2 Type 2 compliance and regular third-party penetration testing, and the page offers to walk buyers through security practices and share documentation in a meeting. No auditor, period, scope or trust centre is published. Verified 18 September 2026.

The vendor names a standard, and its two surfaces name different levels of it. Four product pages carry a SOC 2 Type II Compliant badge with a line that the company is independently audited and certified on a continuous basis, alongside GDPR compliance, SEC 17a-4 readiness and regular third-party penetration testing; the security FAQ says the SOC 2 Type II report goes to customers and prospective customers under an NDA, requested through the trust centre. The trust centre at trust.inc/luthor, linked from those same pages and read on 20 September 2026, records SOC 2 Type 1, two frameworks, and zero policies, zero subprocessors and zero documents behind a request-access button. Both are the vendor's own, both are recorded here with their surface and date. What a buyer can reach is a named standard at a stable address and a route to ask for the report. What is not published anywhere is the audit period, the scope of the examination or the auditor, and nothing on the portal is shown to be obtainable. Verified 20 September 2026.

The vendor refers to third-party AI providers and customer-specific agents without identifying the models, which is the C band. The security page says enterprise agreements with third-party AI providers bar training and retention and that Blee builds AI agents specifically for each customer, and the Financial Services page contrasts Blee's tuned model with a general-purpose one. No model or provider is named: the LLM integration category lists Claude, ChatGPT, Gemini and Cursor as tools Blee reviews content from, not as the models it runs on, and the list of third-party service providers in the Terms is an image that could not be read. Nothing commits to notice of model changes. Verified 18 September 2026.

The vendor commits on behalf of model providers it never names. The security page states that submitted content is not retained by model providers or used for training, and describes model provenance among the layers it protects, but no provider, model or version appears anywhere on the estate, and nothing says where inference runs beyond the statement that processing happens on US cloud infrastructure. The architecture is described only in categories: natural language processing for context, machine learning classification, and large language models generating the written output. No subprocessor list is published and the trust centre records none, so the chain cannot be reconstructed from another surface either. Nothing commits to telling customers when a model or provider changes. For a buyer in a regulated industry the practical effect is that the zero-retention promise cannot be checked against the party who would have to keep it. Verified 20 September 2026.

No pricing information is published at any level, which is the D band. The Terms of Service say access carries a yearly subscription fee, which is a billing period rather than a unit of charge, and every product and industry page leads to a meeting or demo request. No tiers, units or rates are published. Verified 18 September 2026.

Nothing about cost is published, including the unit being charged. There is no pricing page and no pricing link in the footer; every route ends at a demo request, and the demo page offers help with pricing and plans without naming a plan. The ROI calculator models savings against what it calls the Luthor investment and says only that the investment varies by review volume, policy coverage, workflow complexity and implementation scope, which names the things that move the price and neither a rate nor a unit. The Terms of 07.11.25 refer to fees payable under an applicable Subscription Form for a subscription term, which fixes a billing period rather than a unit of charge, and the liability cap is expressed as the fees of the preceding twelve months without saying what those fees buy. No tier names, no feature splits, no implementation figure, and nothing on what an enterprise agreement adds. Verified 20 September 2026.

Segments and the regulatory frameworks covered are described with substance, short of stated limits, which is the B band. The vendor serves legal, compliance, risk and brand teams alongside marketing and operations, and its five industry pages name the rule sets it ships: for financial services UDAP and UDAAP, Regulation Z, Regulation DD, FDIC and NCUA advertising rules, FINRA Rule 2210, the SEC Marketing Rule and Regulation Best Interest; for insurance the NAIC model rules and all 50 states' advertising requirements, FCA financial promotions and Consumer Duty rules and ASIC guidance; for life sciences FDA promotional rules, the ABPI/PMCPA code and national codes in Germany, France, Italy, Spain and Singapore; for consumer brands FTC, NAD, ASA, FDA labelling rules and Proposition 65; for travel drip-pricing rules, the EU Package Travel Directive and ADA accessibility claims. Every page invites buyers whose regulation or market is missing to ask, saying it is covered or will be built, so no limit is stated. Verified 18 September 2026.

Who this is for is described with real substance, and where it stops is not. Two buyer pages name the users: legal and compliance teams who review, and the marketing teams whose work they submit. Four industry pages name the segments: asset managers, registered investment advisers and broker-dealers; banks and credit unions; mortgage and consumer lenders; and consumer-regulated industries including food, pharmaceuticals, alcohol and tobacco. The subject matter is equally specific — the SEC Marketing Rule, FINRA 2210, ADV Part 2, Regulation Z, NMLS and state licensing, RESPA, UDAAP and FTC advertising rules — and the named customers sit in three of the four segments. What is absent is the boundary. Nothing says which regimes are not covered, nothing describes the position of a law firm reviewing its own advertising, and the claim that rules can be configured for any regulatory framework is made without an example of one built outside the published list. Verified 20 September 2026.