Brightflag vs SimpleLegal: how they compare in 2026
Brightflag and SimpleLegal both review outside counsel invoices with machine learning trained on legal invoices, and both sell to corporate legal departments. Brightflag, owned by Wolters Kluwer since June 2025, classifies every invoice line by phase and activity with a supervised model and checks it against the department's billing guidelines. Lines the model is unsure of go to Brightflag's own analysts. Ask Brightflag answers spend questions on Anthropic's Claude, invoice summaries run on an AI21 Labs model, and Brightflag states ISO 27001, SOC 1, SOC 2 and ISO 42001 certification. SimpleLegal, owned by Onit, is a midmarket platform whose InvoiceAI looks for block billing, vague descriptions, nonworking travel and work by the wrong staff class, and feeds its findings into the rules engine. Onit says more than 550 legal departments run $5.2 billion of annual spend through it. It positions SimpleLegal for teams that want spend control without an enterprise implementation. Neither lists a price.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Brightflag was founded in 2014 on machine learning that reads legal invoices, and that model sits at the center of the product. A supervised model, refined on labeled invoice text for more than a decade, reads every line item narrative and classifies it by phase of work and activity on an extended UTBMS framework. A rules engine then checks each line against the customer's billing guidelines and flags violations, rate discrepancies and duplicate entries before a reviewer opens the invoice. Generative features sit on top of that core. AI invoice summaries arrive in approval emails, Ask Brightflag answers questions about spend data, spend forecasts predict budget overruns, AI built vendor profiles support panel management and RFPs, and generative AI produces matter summaries. Workflow, budgets, accruals, matter management and reporting surround the AI, and approved invoices flow to accounts payable. Without the classification model, Brightflag would be a conventional electronic billing system.
SimpleReview supplies AI invoice review within SimpleLegal's broader matter and spending system. Machine learning and natural language processing interpret billing narratives, identify errors and recommend attention to lines that conventional rules can miss. The model distinguishes identical words describing different work, such as shipping a package versus preparing litigation involving the shipping company. Intelligent Invoice Workflows separately apply configured billing rules and route approvals. Matter intake, budgets, accrual reminders, vendor records and reporting remain useful without AI. SimpleReview's customer terms expressly permit training and benchmarking with customer data. Unity is an upgrade destination with additional AI functions, rather than an automatic entitlement of every SimpleLegal account.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Flags in Brightflag trace to evidence a reviewer can open. Each flag ties an invoice line to the billing guideline rule it breaks, and the reviewer sees both on the invoice review page. Brightflag's internal analysts supervise the classification model, reviewing cases where it is not yet confident in its interpretation and feeding corrections back to it. Ask Brightflag answers only from the organization's own spend data, and a filter explainer shows how it interpreted each question, so a user can check that the results match the query. Users report a wrong answer with a thumbs down for Brightflag's team to investigate. The generative AI terms say outputs are produced probabilistically, may not always be accurate and should not be relied on as a sole source of truth. Brightflag's FAQ says LEDES and PDF invoices are processed with equal accuracy, and the figures it publishes are savings and returns from a Forrester study rather than accuracy rates.
SimpleReview evaluates submitted invoice narratives and flags particular billing lines for review. Its machine learning and language processing add context to fixed billing rules, with a postage example illustrating why a keyword alone can produce a false flag. Invoice detail and summary PDFs remain accessible through the API, and reviewers can inspect the underlying financial record. No current test set, false-positive rate or independently reproducible accuracy result accompanies this explanation. A complete account of how every AI flag links to its supporting rule is also unavailable. Onit's AI terms warn that output can be inaccurate, biased or hallucinated and place verification with the customer; the illustrative example is not an evaluation.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
In Brightflag the AI reviews and a person, or a rule the customer sets, approves. Invoices route by matter, value or practice area to designated approvers, and approving from an email summary does not bypass workflow rules. Customers can configure automatic approval for invoices that meet set criteria, and the FAQ says most customers auto approve invoices under $5,000 with no guideline violations, which can be about 30 percent of invoices. Invoices that fail set criteria can be rejected automatically. Flagged lines go to the customer's reviewers, and lines the model is not confident about go to Brightflag's own analysts. Approved invoices flow to accounts payable, and approvals sit in an audit trail. The MCP connector is read only, so approvals, edits and rejections happen inside Brightflag. The generative AI terms leave the customer to decide where human review is appropriate and bar using the features to automate decisions with a legal or material impact on an individual.
SimpleReview identifies suspect billing entries while the department's reviewers make final decisions on the flagged lines. Intelligent Invoice Workflows handle a different layer: customers can configure rules to highlight, reject or adjust entries and build approval routes for their teams. Progress indicators and timestamps show invoice status, and approvers can see why they were included. Instacart describes adding a second approver when an invoice includes work another colleague commissioned. These controls provide an actual review surface and responsibility assignment. The product does not specify an AI confidence threshold that halts processing, a universal approval requirement for every automatic adjustment, or a model-error escalation and rollback procedure.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Named customers and figures fill Brightflag's success stories. In the nine months after switching, SMBC's Americas division saved $2.7 million by applying its discount agreements and outside counsel guidelines consistently. It also saved more than 300 labor hours by replacing a Word and email matter opening process with a request form. Lufthansa raised outside counsel guideline compliance by 5 percent in a single quarter and now assigns budgets to more than 80 percent of its matters, up from 20 percent. Syngenta recouped the equivalent of 10 percent of its gross legal spend in the first half of 2021, and Dropbox spends two days less on accruals each month. Each figure is the customer's own account, without a stated method. A Forrester Total Economic Impact study commissioned by Brightflag found a 387 percent return over three years for a composite organization and a 4 percent average saving from billing compliance.
Instacart's case study identifies Veronica Yu, Legal Process Manager, and describes the move from manual invoice tracking to a central repository with practice-group reporting. It attributes approximately 10% identified legal spending savings to SimpleLegal, reports payment to outside counsel in 15 days or less on average, and contrasts two or three clicks for executive reports with more than two hours previously. Yu also describes assigning a second approver for work commissioned by a colleague. The case has no dated measurement window, sample size or calculation method. Its outcomes cover the overall electronic billing and reporting workflow, with no figure isolating the separate contribution of SimpleReview's AI.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Brightflag's generative AI terms address training for its generative features. Customer data is not transferred to the third party model developers, who cannot and do not use inputs or outputs to train their models, and Brightflag will not fine tune the model instances it operates. Brightflag's own classification model, refined since 2014 on labeled text from actual legal invoices, sits outside those terms, and Brightflag does not name the source of that text. Vendor benchmarking uses data aggregated across Brightflag customers. Data is encrypted at rest with AES 256 under AWS Key Management Service and in transit with TLS 1.2 or higher. Access runs through SAML single sign on, SCIM provisioning and four client roles, from ordinary users who see only their own matters and invoices to administrators, and access can be limited to set IP ranges. Brightflag staff reach customer data only as needed under a role based access policy. Ask Brightflag answers only from the organization's own legal spend data, which its help article presents as keeping that data confidential. The security page and the generative AI terms treat customer data as confidential without separate treatment of privilege or work product.
The services agreement treats Customer Data as confidential, limits access to personnel and agents with a need to know, and requires reasonable protective care. SimpleReview's specific terms nevertheless permit analysis, AI training, benchmarking and improvement using that data. Externally shared results generally must be anonymized, aggregated or not recoverable, but named timekeepers, classifications, firms, rates, matter types and other law-firm data have a benchmarking exception. The API limits matter and invoice lists to records accessible to its user. The agreement provides 30 days for export after termination, followed by deletion under the applicable retention policy. Privilege preservation, AI context isolation and precise third-party model retention remain unresolved.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Outputs are not legal, tax or other professional advice or a substitute for it, and may not always be accurate, under Brightflag's generative AI terms. The customer decides whether outputs suit its use case and where human review is appropriate. The terms bar using the features as a general purpose chatbot, to automate decisions with a legal or material impact on an individual, or for anything that does not directly support the platform's primary functions. Brightflag sells to corporate legal departments, and Ask Brightflag is open only to administrator and overview roles. The billing rules it applies come from the customer's own outside counsel guidelines rather than from Brightflag. The terms set no jurisdiction limits for a product that reviews invoices from firms in many countries.
Onit's services agreement expressly states that the company is not a law firm and offers no legal advice, recommendations or representation. SimpleReview's own product terms repeat that it supplies no legal advice and disclaim guarantees for invoice-review results. Customers must review AI output and obtain professional advice when appropriate. The intended users are corporate legal and legal operations teams managing matters, firms and spending, with finance and submitting firms participating in the workflow. AI use is restricted to legitimate internal business purposes, and materially consequential decisions about individuals are prohibited. The terms do not map these controls to lawyers' competence duties, individual licensing jurisdictions or a client-consent workflow.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Certification to ISO/IEC 42001, the standard for AI management systems, appears on Brightflag's FAQ. An article on its site by Michael Dineen, its director of data science, updated in April 2026, says it is among the first legal technology providers to meet the standard. The article says Brightflag has built the standard's principles into its AI product development and internal governance. The FAQ says each AI feature is designed with a confidentiality, privacy and security focused approach. Its security page, which lists ISO 27001, SOC 1 and SOC 2, does not include ISO 42001, and no certifying body, certificate date or scope appears on the open pages. The article lists bias detection and mitigation among the standard's requirements, and Brightflag reports no testing or bias results of its own. The article commits Brightflag to protecting customer data, deploying AI that is transparent, auditable and trustworthy, and improving its AI systems in line with legal and ethical standards. Governance is presented through the certification, without a named owner inside Brightflag.
The AI contract identifies inaccurate, biased and hallucinated output as risks, assigns review responsibility to customers and prohibits high-risk decisions that materially affect individuals. Sensitive inputs and publication of benchmarks require prior written approval. These are use restrictions and risk statements, rather than a SimpleReview testing or model-governance program. SimpleReview learns from historical billing information and customer data, which makes differences across matter types, timekeeper classifications and firm billing practices relevant to its recommendations. No named accountable model owner, release acceptance tests, subgroup performance findings or recurring bias-monitoring procedure is specified for that product. Onit's broader AI commentary stays general and does not set out those operational controls for invoice review.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Brightflag publishes its security controls and leaves several data handling terms to agreements it signs with each customer. Data retention and deletion are configurable to each customer's requirements, and the privacy notice keeps basic customer account data for six years after a relationship ends. Data is encrypted at rest and in transit, staff access follows a role based access control policy, and the platform is penetration tested by CREST certified testers and scanned for vulnerabilities continuously. Customer data is backed up to AWS data centers as part of business continuity. The privacy notice says all subprocessors, including AI subprocessors, are listed in Brightflag's data processing agreement and in its trust center, which Brightflag opens on request. Brightflag commits to notify customers and regulators of a suspected breach where the law requires it. Customers can track application actions in the product and request fine grained audit logs. Brightflag's 2021 announcement scoped its SOC 1 report to invoice approval and accruals management.
Onit's data processing addendum requires confidentiality, access controls, breach notification and cooperation, with return or destruction of personal data on the customer's written request subject to legal exceptions. Its security annex covers differentiated access, encrypted transfers, activity logs, separation of production and testing, and multifactor remote access. The subprocessor register separates the SimpleLegal services and names hosting, PDF processing, authentication, support and analytics providers. The agreement allows a 30-day export period after termination, then deletion according to the current retention policy, with backup and lawful recordkeeping exceptions. No fixed purge schedule for every copy or model-processing log is stated. SimpleReview's training permission also limits any inference of ephemeral processing.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
An intellectual property indemnity comes with Brightflag's generative AI terms. If a third party claims an output or a generative feature infringes its rights, Brightflag indemnifies the customer against damages finally awarded by a court, provided Brightflag can defend the claim. The indemnity excludes customer modifications, combination with other technology, customer inputs, known infringement, patented inventions in outputs and trademark use of outputs, and the terms state no cap. Otherwise the features and outputs are provided as is, with accuracy not warranted. Liability caps and exclusions for the platform sit in Brightflag's subscription agreement, which is signed with each customer and not published. The generative AI terms, last updated 6 March 2025, are incorporated into that agreement and take precedence over it for generative features.
The services agreement provides a warranty that the subscription will substantially match its functional description and a remedy process requiring notice within 30 days of discovering noncompliance. Uncured failures can lead to termination and a refund of unused fees. Onit also defends qualifying third-party intellectual-property claims, subject to exclusions for customer data, combinations, customer specifications and continued use after notice. Ordinary liability is capped at 12 months of fees under the relevant order; the intellectual-property indemnity is excluded from that cap. AI features and outputs are supplied as is, with no accuracy warranty or standard AI service levels. SimpleReview separately disclaims performance guarantees, leaving incorrect billing judgments outside a specific output warranty.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Each connection and what it does is named on Brightflag's integrations page. Approved invoices go to Coupa, Workday, NetSuite, Dynamics 365 and other accounts payable systems, with payment statuses returned to Brightflag, and the page also lists SAP Ariba, SAP S/4HANA and Oracle Fusion. The FAQ describes three finance routes, which are email with a cover page, CSV batch files over SFTP on an hourly, daily or weekly schedule, and the API. Integrations with iManage and NetDocuments link matters to document workspaces, and Jira tickets and Xakia intake submissions create matters. Okta and Microsoft Entra handle sign in and user provisioning. Law firms submit LEDES 1998B or LEDES 98BI version 2 files, PDF invoices or global e invoicing XML. An API and an MCP server connect AI tools such as Claude, Microsoft Copilot, ChatGPT and Gemini, and every role and access restriction set in Brightflag applies in the connected tool. The connector is read only, so approvals, edits and rejections stay in Brightflag.
SimpleLegal's REST API moves legal and finance records between systems. Integrations can create vendors, users, matters and payments; retrieve invoices and cost codes; update matter and vendor fields; and send approved invoices to accounts payable or an ERP for payment. The reference describes token authentication, JSON responses, pagination and field filters. Matter creation must satisfy the selected or default template, and integrations must retain the returned record because template rules can change submitted values. A matter flag controls availability to an installed IPfolio integration. Invoice responses include line allocations, currency conversion and approval status; payment creation can mark the invoice paid. This supplies object-level configuration and transaction direction, beyond connector names.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Hosting for Brightflag's cloud software is a multi tenant AWS environment, with data centers in Ireland, the United States and Australia. The data center follows the customer's location and where its data originates, and the privacy notice says a customer can choose to host platform data in the European Economic Area. Websites are hosted in the European Economic Area. Generative features run from Brightflag's own AWS environment, and the terms say data does not leave that environment. The region where generative processing runs for each customer is not stated. Customer data is backed up to AWS data centers for business continuity, a security operations center monitors the infrastructure, and Brightflag publishes a system status page.
SimpleLegal operates as a hosted service. Onit's subprocessor register specifically assigns SimpleLegal, SimpleReview, CounselGO and Unity to Amazon Web Services in the United States, including AWS PDF processing. Affinda converts portal PDFs in Australia, while Auth0 supplies authentication in the United States. The register also lists global Onit service affiliates and an all-platform OpenAI service with United States and worldwide processing, so some operations may run abroad even though core hosting sits in the United States. Germany hosting options belong to a separate Onit platform table and cannot be assumed for SimpleLegal. For this product, Onit describes no customer-operated deployment, no dedicated tenancy and no feature-by-feature map of inference locations.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
ISO/IEC 27001:2013 certification and annual SOC 1 Type 2 and SOC 2 Type 2 reports appear on Brightflag's security page, with SOC 2 covering security, availability, processing integrity, confidentiality and privacy. Its FAQ adds ISO/IEC 42001, which the security page does not list. Encryption keys are managed in AWS Key Management Service. The certificates, independent test reports and security and privacy policies sit in a trust center that Brightflag opens to prospects and customers on request. The open pages give no auditor, report period or certificate date. The security page still cites the 2013 edition of ISO 27001, whose transition period to the 2022 edition ended in October 2025. Penetration tests come from CREST certified testers. Employees take mandatory security and privacy training when they join and during employment, and Brightflag runs regular phishing simulations. It states compliance with GDPR, CCPA and CPRA. Brightflag acts as a data processor for personal data in the platform, and Ireland's Data Protection Commission is its supervisory authority.
Onit's security material describes independent audits against SSAE-18 SOC 2 Type 2 and other security standards. It also describes encrypted transport, daily backups, restricted project access, managed virtual private clouds, hardened systems, monitoring and logged administrative activity. The data processing addendum adds contractual access, transfer and audit obligations. The trust center offers assurance reports on request. Onit does not give SimpleLegal's audit coverage period, auditor or system scope. Consequently, the corporate audit statement does not identify which SimpleReview components or AI providers were examined. Separate attestations for sibling products do not settle that question, and HIPAA wording alone is not a signed BAA.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Invoice summaries run on AI21 Labs' summarization model and Ask Brightflag on Anthropic's Claude, per Brightflag's generative AI terms. Both run from Brightflag's AWS environment, data does not leave that environment, and the model developers receive no customer data. The terms say the models may change from time to time and ask customers to check the terms periodically, while Brightflag's promise of notice covers material changes to the terms themselves. The terms, last updated 6 March 2025, list two features, and Brightflag now also markets generative matter summaries, AI built vendor profiles and Ask Brightflag on the invoice review page. Users agree to AI21's Responsible Use Policy and EULA, Anthropic's Usage Policy and Commercial Terms, and AWS's Responsible AI Policy and service terms. Invoice classification runs on Brightflag's own supervised model. No model versions are given.
The subprocessor register names OpenAI as an all-platform provider for natural-language or code generation. Its SimpleLegal section names AWS PDF processing, Affinda for PDF conversion and Maven AGI for support questions, alongside hosting and authentication services. SimpleReview itself is described as machine learning and natural language processing for invoice context, without model versions or a precise assignment of each provider to that feature. Google Gemini is identified for Spend Agent and Unity in separate sections; whether it also powers SimpleReview is left open. Onit can replace or deprecate AI models without materially reducing core functionality. Subprocessor objection rights do not amount to advance notice of every model-version change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
How Brightflag charges is set out in its FAQ without figures. Customers pay a fixed one time implementation fee and an annual subscription based on their annual outside counsel spend, and quotes are sized to that spend. Upgrades, maintenance, support, ongoing training, additional users or vendors, storage, bandwidth and custom reports carry no extra charge. Average implementation takes six weeks for first time buyers and ten weeks for replacement buyers, according to a Forrester Total Economic Impact study. The same study is the source of the savings figures on Brightflag's pages, including roughly $160,000 a year from billing compliance. Brightflag has no pricing page.
The core SimpleLegal subscription requires an order and quoted scope. Product terms include 1 TB across production, development and test environments unless the order differs, with additional storage charged at $600 per month per TB. A separate Legal Vendor Billing arrangement may charge submitting firms annually according to invoice submissions, using prior activity and an estimate for a new connection. The customer subscription can change if those vendor fees are unpaid or spending falls below expectations. Implementation follows a statement of work, with reimbursable expenses. Default annual renewals require 45 days' notice; AI fair-use enforcement can add overages after warning. Onit gives no core user prices, standard implementation amounts or SimpleReview allowances.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Corporate legal departments buy Brightflag, from high growth companies to global enterprises with complex, multi jurisdictional operations. Its FAQ names technology, financial services, healthcare, manufacturing, energy, consumer goods and education among the industries it serves. Its stories cover SMBC, Lufthansa, Syngenta, Dropbox, Docker, AIB, Ocado and Ironclad. The buyers are in house legal and legal operations teams and their finance counterparts. Brightflag has offices in Dublin, New York and Sydney, hosts data in Ireland, the United States and Australia, and runs tax workflows for North America, Europe and Asia Pacific. The product covers outside counsel spend, matters, vendors, budgets, accruals and reporting. Contract drafting and legal advice sit outside it, and law firms take part only as vendors submitting invoices.
SimpleLegal serves corporate legal departments that need electronic billing, matter management, vendor coordination and reporting in one system. Intake templates, tasks, practice-area assignments, budgets, accruals and cost allocations support department administration across internal and external matters. Finance teams receive approved invoices and payment information, while firms use the vendor portal to submit bills and collaborate. The product supports more than 170 currencies and describes a customer base exceeding 550 corporate legal departments. Onit distinguishes this offering from its more configurable OnitX enterprise platform and provides a migration path to Unity. Supported practice workflows are administrative and financial; Onit sets no detailed jurisdiction, language or organization-size boundaries, and legal research is not its stated function.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Brightflag's Supplemental Terms of Use for Generative AI Features, last updated 6 March 2025, are incorporated into each customer's subscription agreement and take precedence for generative features. Under them, customer data is not transferred to the third party model developers, who cannot and do not use inputs or outputs to train their models. Brightflag will not use customer data to fine tune the model instances it operates.
The terms cover invoice summaries on AI21 Labs' model and Ask Brightflag on Anthropic's Claude. Brightflag's own classification model, refined since 2014 on labeled text from actual legal invoices, sits outside them, and Brightflag does not name the source of that text. Vendor benchmarking uses data aggregated across Brightflag customers. The terms also bar customers from using the features to build competing products or train competing AI models.
SimpleReview's product terms expressly allow customer data to support analysis, AI engine and model training, benchmarking, and improvement of offerings. Results shared externally generally must be anonymized, aggregated or not recoverable, but the benchmarking exception includes timekeeper names, classifications, firm names, rates, matter types and other law-firm data. The general agreement also permits aggregated and anonymized product improvement.
Its narrower restriction on third-party models training for others does not erase the SimpleReview permission. The terms give no standard customer opt-out from that specific training right.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Brightflag's security page says data retention and deletion are configurable to each customer's requirements, and that its retention management keeps records no longer than needed. The privacy notice keeps basic customer account data for six years after a relationship ends, for tax and legal purposes, and profile and support data for the life of the account. The generative AI terms set no separate period for invoice summaries or Ask Brightflag questions and answers, which run inside Brightflag's AWS environment.
Deletion at the end of a contract is governed by the subscription agreement and data processing agreement Brightflag signs with each customer.
Customer records remain in the service for the subscription, followed by a 30-day export period after termination. Deletion then follows Onit's current retention policy, without a fixed deadline covering all copies. Backup, legal and reasonable internal recordkeeping exceptions remain. The data processing addendum provides return or destruction on written instruction, subject to legal exceptions. AI terms say Onit need not retain or recreate output unless the feature expressly supports retention and it is enabled. That is not a promise that prompts, outputs, derived training data or provider logs are immediately purged.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Four standard client roles make up Brightflag's own permission model. Ordinary users see only matters where they are a participant or internal matter lead, and invoices for those matters or in their approval workflow. Department overview users see only the departments in their profile, overview users see all matters and invoices without admin settings, and administrators see everything and manage configuration. Matter teams control which members can access each matter, and a user without access to a workroom asks the customer's Brightflag administrator to be added.
Email approval works only for invoices at the reviewer's own stage of the approval process. Ask Brightflag is open only to administrator and overview roles, and the MCP connector applies every role, access restriction and data boundary configured in Brightflag. iManage and NetDocuments integrations link matters to document workspaces.
The API returns only matters and invoices accessible to the authenticated API user. Its log interface distinguishes administrator, finance, power-user and filtered roles, while matter configuration includes an assigned lead and approval responsibility. An IPfolio availability flag controls whether an installed connection can access a particular matter. These are SimpleLegal's own access and sharing controls, requiring administration within the platform.
Nothing describes inheritance of an external document system's ethical walls, or whether every SimpleReview training and inference context follows the same matter restrictions.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Under the privacy notice, Brightflag may disclose any information to government officials as necessary to comply with laws and orders if compelled. It may answer a request where it believes, in its reasonable discretion, that the request is lawful and disclosure reasonably necessary. It may also disclose personal data to respond to subpoenas, court orders or legal process. The notice states no commitment to tell the customer when that happens.
Brightflag acts as a processor for customer data in the platform, and any notice term would sit in the subscription agreement and data processing agreement it signs with each customer, which stay off its website. Brightflag issues no transparency report.
The services agreement requires reasonable advance notice of legally compelled disclosure when the law allows it, together with cooperation at the customer's expense to obtain confidential treatment. Disclosed material remains confidential between the parties. The data processing addendum adds prompt notice of governmental or third-party requests for personal data unless notification is prohibited. These contractual obligations are more specific than the privacy policy's discretionary notice wording.
No regular transparency report establishes actual request volumes, contested demands or the frequency with which notice has been legally barred.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The customer's own invoices, matters and billing guidelines are what Brightflag's AI works on, and Ask Brightflag answers only from the organization's own spend data. The vendor management page offers data aggregated across Brightflag customers, while advanced vendor management describes benchmarking and firm performance analysis built entirely from the customer's own invoice history. Brightflag's data science team developed the classification model over ten years on labeled text from actual legal invoices, and its patent covers that model.
The timekeeper rates report draws on Brightflag's database of billions of dollars of analyzed outside counsel spend, broken down by firm size and practice area. Brightflag does not say how that pooled data is anonymized or which customers contribute to it. No primary law collection sits behind the product.
SimpleReview works with legal billing narratives and historical invoice information, rather than a stated primary-law research collection. Its contextual analysis distinguishes similar words used for different billing tasks, and its terms authorize customer-data use for training and benchmarking. Those terms establish a use permission for supplied business records, not provenance or licensing of cases, statutes or commentary.
No jurisdiction-by-jurisdiction primary-law inventory, publisher license or legal-source update cadence is specified. The presence of matter and practice-area fields does not make the platform a case-law database.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Invoice review against billing guidelines, not case law citation, is Brightflag's work, so a citator sits outside the product. The rules it applies come from the customer's own outside counsel guidelines, and keeping them current is the legal team's work. Brightflag offers a sample set of outside counsel guidelines as a starting point. Its tax engine checks that the correct tax rates were applied when an invoice is submitted and sends the right tax code to accounts payable.
SimpleLegal evaluates invoices, timekeepers, spending and matter administration. Its review can identify billing issues and compare entries with configured rules, while the API exposes financial records and their approval state. None of these functions determines whether a cited judicial decision has been reversed or negatively treated. No citator connection, authority-status indicator or automated subsequent-history procedure is specified for SimpleReview.
Users managing a litigation matter still need a separate legal-research process to establish the current status of an authority used in legal advice or a filing.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Lines the classification model is unsure of follow a stated route in Brightflag. Brightflag's internal analysts act as expert supervisors, reviewing cases where the model is not yet confident in its interpretation and providing corrective feedback. Ask Brightflag shows how it interpreted each question through a filter explainer, and users report a wrong answer with a thumbs down for Brightflag's team to investigate. Ask Brightflag is open only to administrator and overview roles.
Its help article asks users to confirm that results match the query, such as checking that only rejected invoices appear when they asked for rejected invoices. Brightflag's FAQ says LEDES and PDF invoices are processed with equal accuracy. Customers see flags, summaries and answers without a confidence indicator.
SimpleReview flags invoice lines for a human decision and uses context to reduce errors caused by fixed keywords. Its product terms disclaim performance guarantees, and the general AI terms warn about incomplete, biased or hallucinated output. These warnings do not describe a runtime refusal, confidence threshold or unsupported-answer route for the invoice model. The Counsel Exchange support assistant is restricted to how-to help and cannot answer questions about client data, a support boundary that says nothing about abstention in SimpleReview's billing judgments.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Brightflag or Ask Brightflag. Brightflag reviews legal invoices and produces flags, summaries and spend analysis rather than court filings.
No case naming SimpleLegal or SimpleReview as the source of fabricated legal citations was identified in the reviewed court-decision collection. The product's main AI workflow concerns invoice narratives and financial review rather than drafting briefs or retrieving authorities. That context limits what a citation incident would test; it leaves open whether the model produces unsupported conclusions. Onit's contract expressly recognizes hallucination and inaccuracy risks. A case attributed only to an unnamed AI tool cannot reliably be assigned to this product.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Professional conduct material from Brightflag is written for the client paying the bill. Its sample outside counsel guidelines, in a newly updated edition, add a clause giving the legal department visibility into outside counsel's use of AI. Its outside counsel AI strategy guide helps legal teams encourage good use of AI by firms, set guardrails and measure the effect on legal service delivery. The rules Brightflag enforces are the customer's contractual billing guidelines.
None of this material names a bar opinion, such as ABA Formal Opinion 512, or a professional rule on reasonable fees or billing for AI assisted work.
Onit's legal-operations community discusses verification as a professional duty, candor to courts and the risks of ungoverned AI use. Its August 2026 roundup also references cautions about agentic systems from Britain's Bar Standards Board. This is general professional-responsibility commentary, not a SimpleReview control mapping to a named ethics opinion. The customer contract separately requires review of output and disclaims legal advice.
No product-specific treatment links training permissions, client consent, billing review and supervisory procedures to the requirements of particular bar opinions across jurisdictions.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Brightflag is the payer's record of outside counsel fees. Its AI reads and classifies every invoice line, the rules engine flags breaches of the customer's billing guidelines, and reviewers approve, adjust or reject before approved invoices go to accounts payable. Customers can approve invoices automatically when they meet set criteria, such as invoices under $5,000 with no guideline violations. The tax engine itemizes tax jurisdictions, types and rates on each invoice, and each invoice is processed in one currency.
Budgets, accruals and forecasts track spend against plan, and approved invoices go to accounts payable by API, batch file or email. Lufthansa uses the auto reject function so that non compliant invoices no longer reach its in house lawyers. Brightflag's sample outside counsel guidelines include a clause on outside counsel's use of AI, and the guidelines a customer adopts are translated into rules the system checks.
SimpleLegal's core workflow is the corporate buyer's legal fee record: invoice intake, timekeeper rates, billing rules, line adjustments, approvals, allocations and payment tracking. SimpleReview evaluates narratives for billing issues, while configured workflows can reject or adjust entries under the department's rules. Approvers inspect the underlying charges and can add colleagues to the review. The fee record captures the buyer's review of billed services and payment decisions.
It does not automatically identify whether outside counsel used generative AI to produce the work described in each charge.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The model providers a client might ask about are named in Brightflag's generative AI terms, attached to its help center article. AI21 Labs supplies the invoice summary model and Anthropic's Claude runs Ask Brightflag, both from Brightflag's AWS environment with no data passed to the developers. The privacy notice says every subprocessor, including AI subprocessors, is listed in Brightflag's data processing agreement and in its trust center, which Brightflag opens on request.
Users of the generative features also agree to each provider's acceptable use terms, which the terms list. Certificates, independent test reports and security policies sit in the same trust center.
Onit's public register identifies SimpleLegal-specific subprocessors, the all-platform OpenAI service, service purposes and countries. The customer agreement and data processing addendum provide confidentiality, request-notice, objection and processing provisions, while SimpleReview's terms expose its training and benchmarking permissions. These materials support review of the service's data handling before a firm submits invoice narratives.
A dedicated client-consent package or completed mapping to an outside counsel AI clause is not supplied. Enforcement of the buyer's billing guidelines is a separate product function and does not itself establish compliance with that buyer's AI restrictions.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Each invoice decision leaves a record in Brightflag. Flags tie each line to the guideline or rule it breaks, such as a billing rule violation or a rate discrepancy. Approval workflows record each approval, and customers can track application actions in the product and request fine grained audit logs. Brightflag's SOC 1 report, scoped in 2021 to invoice approval and accruals management, tests the controls behind that record.
Each invoice's approval workflow, with its approvers, is visible on the invoice, and email approvals follow the same workflow rules. Ask Brightflag shows how it interpreted each question, and the MCP connector is read only, so outside AI tools cannot change the record. The record covers billing decisions rather than a per document account of which model produced which output. Brightflag's output is invoice flags and spend analysis, which reach a court mainly in a fee dispute.
The API exposes invoice detail and summary PDFs, approver status and account logs that can be filtered by user, time, object and actions such as adjustment, approval, rejection and export. These records preserve parts of the underlying source and human review history for financial work. They do not provide a per-output certificate naming the model version, retrieved material and human verification of each AI conclusion.
SimpleLegal's normal workflow is department administration, so a court disclosure concerning later use in legal work would still require additional information beyond its invoice and activity records.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
Which one fits
Choose Brightflag if
- You want review to run off your own guidelines. Brightflag reads, codes and categorizes every line of every invoice narrative on an extended UTBMS framework and translates the department's outside counsel guidelines into rules it applies to each line. Each flag ties to the rule it breaks, and approval workflows route invoices by matter, value or practice area before approved invoices flow to accounts payable. Brightflag's analysts review lines the model is not yet confident about and feed corrections back to it.
- Your assurance review covers the AI as well as the platform. Brightflag's FAQ states ISO/IEC 42001 certification for its AI management system, alongside ISO 27001 and annual SOC 1 Type 2 and SOC 2 Type 2 reports. SOC 2 covers security, availability, processing integrity, confidentiality and privacy. The certificates and reports sit in a trust center Brightflag opens on request.
- You want named controls and named AI providers. Brightflag encrypts data at rest with AES 256 under AWS Key Management Service and in transit with TLS 1.2 or higher. SAML single sign on works with ADFS, Azure Active Directory, Google, Okta, OneLogin and Ping Identity, SCIM handles provisioning and removal, and access can be limited to set IP ranges. Its generative AI terms name AI21 Labs for invoice summaries and Anthropic's Claude for Ask Brightflag, both run inside its AWS environment.
Choose SimpleLegal if
- You want volume figures. Onit stated in May 2026 that more than 550 corporate legal departments process $5.2 billion of annual legal spend through SimpleLegal, a measure of invoices flowing through the system rather than seats sold. A customer quote cites savings of 10 percent of legal spend, and Onit reported an average of six figures in travel billing identified across customers.
- You want to know what the model looks for. Onit lists InvoiceAI's issue types as nonworking travel, block billing, vague or insufficient descriptions, administrative tasks billed improperly, improper invoice coding and work performed by the wrong staff class. Its findings feed the existing rules engine, so machine learning and fixed billing rules run together, and every flag attaches to an invoice line a reviewer can open against the billing guidelines. The models keep learning as invoice corrections are made.
- You do not want an enterprise implementation. Onit positions SimpleLegal for in house teams that need matter management, electronic billing and spend visibility without the implementation load of an enterprise system. It sets SimpleLegal apart from the enterprise platform in the same portfolio. Outside counsel work through the CounselGO portal, and Onit runs a trust center for its products on the Vanta platform, reachable without a sales conversation.
In summary
Brightflag
Brightflag is a legal spend and matter management platform for corporate legal departments, founded in Dublin in 2014 and owned by Wolters Kluwer since June 2025. A supervised model, refined on labeled invoice text for more than a decade, reads every line of every invoice narrative and classifies it by phase and activity. A rules engine then checks each line against the department's billing guidelines before reviewers approve and accounts payable pays. Matter and vendor management, budgets, accruals, spend forecasts and reporting sit around it. Its generative AI terms name AI21 Labs for invoice summaries and Anthropic's Claude for Ask Brightflag, both run inside its own AWS environment, and give an intellectual property indemnity for outputs. Brightflag states ISO 27001, SOC 1 Type 2, SOC 2 Type 2 and ISO 42001 certification, and hosts data on AWS in Ireland, the United States or Australia.
SimpleLegal
SimpleLegal is a midmarket legal management platform for in house legal teams from Onit, covering electronic billing and invoice review, matter management and intake, vendor management, budgets, accruals, forecasting, reporting and document storage. Outside counsel work with the legal team through the CounselGO portal. InvoiceAI, introduced in 2021, uses machine learning trained on millions of legal invoice charges to find issues that billing rules miss, and keeps learning as invoice corrections are made. Onit stated in May 2026 that more than 550 corporate legal departments process $5.2 billion in annual legal spend through SimpleLegal, and it positions the product apart from its enterprise platform.
Questions buyers ask
Brightflag vs SimpleLegal: which is better for legal spend management?
Brightflag suits a department that wants a model trained on legal invoices, flags tied to its own guidelines, named AI providers, an AI management certification and finance system integrations from Coupa to Oracle Fusion. SimpleLegal suits a midmarket team that wants electronic billing, matter management and InvoiceAI review without an enterprise implementation, from a vendor that processes $5.2 billion of annual spend across more than 550 departments. From the AI Legal Index, based on each vendor's own published materials as of October 9, 2026. No vendor pays for placement.
Which one holds an AI certification?
Brightflag. Its FAQ states certification to ISO/IEC 42001, the standard for AI management systems. An April 2026 article by its director of data science, Michael Dineen, says it is among the first legal technology providers to meet the standard. Its security page lists ISO 27001, SOC 1 and SOC 2 without ISO 42001, and Brightflag names no certifying body, date or scope. Onit sets out no AI governance framework, principles or certification for SimpleLegal or InvoiceAI. From the AI Legal Index, based on each vendor's own published materials as of October 9, 2026. No vendor pays for placement.
What does the AI actually check?
Both check invoices against the department's own billing guidelines, and both tie each flag to an invoice line a reviewer can open. Brightflag's supervised model classifies every line by phase and activity, its rules engine applies the guidelines, and lines the model is unsure of go to Brightflag's analysts. SimpleLegal's InvoiceAI looks for named issue types, including nonworking travel, block billing, vague descriptions and work by the wrong staff class, and runs alongside the rules engine rather than replacing it. From the AI Legal Index, based on each vendor's own published materials as of October 9, 2026. No vendor pays for placement.
Does either publish how often the AI is wrong?
Neither publishes an accuracy rate, false positive rate, test set or evaluation. Brightflag's FAQ says LEDES and PDF invoices are processed with equal accuracy, and its figures come from a Forrester study of savings and returns. Onit's figures measure savings found, including an average of six figures in travel billing identified across SimpleLegal customers. A wrong flag reduces what a firm is paid, so the false positive rate matters most to the firms whose invoices are reviewed. From the AI Legal Index, based on each vendor's own published materials as of October 9, 2026. No vendor pays for placement.
What do Brightflag and SimpleLegal both leave unpublished?
Neither lists a price. Brightflag charges an implementation fee and an annual subscription sized to outside counsel spend, and SimpleLegal plans are quoted. Neither sets a fixed retention period for invoices, narratives or AI output, and neither publishes a liability cap. On hosting they differ, since Brightflag runs on AWS in Ireland, the United States or Australia and Onit states no hosting region for SimpleLegal. On models, SimpleLegal names no provider, while Brightflag names AI21 Labs and Anthropic's Claude. From the AI Legal Index, based on each vendor's own published materials as of October 9, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
SimpleLegal's InvoiceAI is trained on millions of legal invoice charges and keeps learning from customer corrections. Onit's 2021 announcements describe the models training on historical invoices and learning from new ones, without saying whose invoices those are, whether learning is pooled across customers or whether a customer can decline. Brightflag's generative AI terms bar its model providers from training on customer data, while its own classification model, refined since 2014 on labeled invoice text, sits outside those terms. Brightflag's generative AI terms give an intellectual property indemnity for outputs, and both vendors keep liability caps in agreements signed with each customer. A wrong flag reduces what a law firm is paid, and that firm has no contract with either vendor. Brightflag's security page cites the 2013 edition of ISO 27001, whose transition period to the 2022 edition ended in October 2025, and lists ISO 42001 only in its FAQ. Neither vendor reviewed this page.