Canopy vs Phaselaw: how they compare in 2026
Canopy and Phaselaw both use their own models to find personal data in piles of documents, but they are rarely weighed against each other because they answer different events. Canopy works after a breach, listing the people a company must notify. Phaselaw answers a subject access or records request by redacting what must be withheld. Phaselaw publishes more about the product around its models. It prices by annual document volume with unlimited seats and names customers including the NHS and HMV. It says customer data never goes to third party AI, and it logs every redaction decision with its reason. Canopy's strength is depth of automation. Hundreds of models find personal and health information in any file type, deduplicate the affected people and run first level review with confidence scores. It hosts in five regions, from the United States to Australia.
Which one fits
Choose Canopy if
- You have had a breach and must find everyone affected. Canopy's models detect personal and health information in compromised data of any file type without normalization, consolidate records into a deduplicated list of affected people, and produce an impact assessment report.
- You must notify under several regimes at once. Canopy exports notification lists for GDPR, HIPAA, FERPA and other duties, and its Auto Review runs first level review with confidence levels that tell managers which documents need a second look.
- The breached data must stay in its jurisdiction. Canopy runs separate instances on AWS in the United States, Canada, the European Union, the United Kingdom and Australia, with data held in a virtual private cloud in the customer's jurisdiction.
Choose Phaselaw if
- You must answer a subject access or public records request. Phaselaw ingests documents, emails, chats and images, removes duplicates, threads email and suggests redactions across more than 50 categories of personal data, applying one decision across a whole case.
- The regulator may question your response. Phaselaw logs what was found, who reviewed it and why each redaction was made, and exports a summary of the exemptions and review decisions applied.
- You want pricing that does not grow with your team. Phaselaw charges by annual document volume with unlimited seats, onboarding, training and support included, and US or UK hosting in every plan.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Canopy says hundreds of machine learning models detect personal and health information in any file type, deduplicate records into unique affected people and build the notification list. Auto Review carries out first level review itself, using what Canopy calls a proprietary ensemble of generative AI and large language models. Without the models there is little left to sell.
The models drive the core task inside a platform that would still work without them. Phaselaw's own models flag more than 50 categories of personal data as suggested redactions. An AI search feature added in August 2026 turns a request written in plain language into a structured search the reviewer can see and edit. Ingestion, deduplication, email threading, format conversion, redaction across a whole case, exemption tracking and export are document processing and workflow that a team could run by hand.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Detection is more precise than ediscovery keyword and regex searching, Canopy's site says, and Auto Review avoids the hallucinations of generic language models. Auto Review adds Intelligent Confidence Scoring and reprocessing driven by human corrections. Case studies report hours saved and records consolidated, and the Wotton + Kearney study reports a 15 percent faster PII review. No detection rate, error rate or test set is published. The product does not cite legal authority.
Accuracy is asserted, not measured. The customer pages say Phaselaw surfaces personal data automatically so nothing gets missed, and the changelog reports that name detection became significantly more accurate with fewer false positives. No detection rate, error rate, test set or comparison is published. What the models produce can be checked at the source: suggested redactions appear in place on the document for a reviewer to keep or redact, and the AI search shows the exact query it built. The product does not cite legal authority.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Auto Review is described as replacing the first level review team, and its confidence level reporting tells review managers which documents need a second look in quality control; in Data Breach Response, people review the documents the models flag. The law firm page says classifications are validated by humans, and a hospital PHI case study limits human effort to quality control. Nothing states a limit on sending a notification list without human review.
The models suggest and a reviewer decides, with real review surfaces. A Suggested Redactions page lets a team keep or redact each item, or a whole category, across a case before opening documents; cases carry assigned reviewers and approvers, document statuses and resolvable comments; undoing a redaction across a case shows how many will change and asks for confirmation; and a Case Activity page logs who did what and when. The vendor states that its AI features are clearly labeled and that their suggestions are displayed and editable by all users. Nothing states a limit on exporting before suggestions are reviewed, or what the product does when it misses personal data.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
A Wotton + Kearney case study names the firm and quotes Kieran Doyle, its Head of Cyber, Privacy and Technology: 76.77 GB of PST files, more than 829,000 documents, 15 categories of PII and a 15 percent faster PII review. An Intevac privacy audit study quotes IT Director Brenda Thrasher: a 10 GB PST, more than 110,000 emails and documents, and 3.5 hours to the first PII report. An unnamed hospital study reports 6,600 PDFs reviewed in 15 days for an incident affecting over 150,000 people. Other case studies, gated behind download forms, report one review team saving 2,000 hours, one partner finishing review in about a third of the time and saving its client over $300,000, and 4.28 billion entities consolidated to 3 million unique people, with no customer named. Listed partners are cyberSuite, DWF, Elevate, Emergence Insurance, Epiq, Incident Response Solutions Limited, KLDiscovery and Wotton + Kearney. A partnership expansion to the UK and APAC on 5 February 2025 claimed review up to 60 percent faster.
Named customers, one with a figure, none measured. The home page shows logos including the NHS, Labor, Museum Wales, YMCA, HMV, the Raspberry Pi Foundation, the Guinness Partnership and Depaul, and quotes Tash Whitaker, DPO of Whitaker Solutions Ltd., on subject access work falling from 10 days to 3, and Paul Byrne, CEO of Propelfwd, a data protection consultancy in the Channel Islands, on subject access and freedom of information work. The site's headline figures, 92% less time per request, over 95% of requests delivered on time and more than 10 million documents redacted, give no basis or date.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The Privacy Notice, last updated 14 November 2023, says Canopy processes client data only as a litigation support service provider on its clients' instructions and that employees sign confidentiality agreements, and the security pages describe encryption and a virtual private cloud in the customer's jurisdiction. No customer agreement is published. Nothing says whether customer data trains Canopy's models: Canopy's home page says the platform gets smarter with every project, the law firm page says human validated classifications help the algorithms continuously improve, and Auto Review learns from human corrections. Privilege is not addressed.
Strong commitments appear in marketing, and none in the published terms. The product and customer pages say each client gets isolated processing and data never crosses between cases. They say data stays in the region the customer chooses and is never shared with third party AI, and that access to cases is granted only where needed. The Terms of Use, which govern the product, contain no confidentiality clause, and no page says whether customer documents are used to train or improve Phaselaw's own models. Privilege and work product are not addressed.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The software produces the lists breach counsel rely on to advise clients on notification duties, but nothing states that it gives no legal advice or addresses counsel's review of its output.
For a disclosure tool the professional question is review: whoever signs a disclosure answers for what it leaves in and what it takes out. The law firm page puts that question itself, asking what happens if something is missed when your name is on the disclosure, and answers that personal data is surfaced automatically so nothing gets missed. The Terms of Use provide the service as is and disclaim responsibility for the accuracy of results. Nothing states that exemption and redaction decisions remain the reviewer's judgment, or that the product gives no legal advice.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
No AI governance position, accountable owner, testing before release, or finding on how detection performs across document types, languages or regions is published.
Principles are published, not a governance framework. The August 2026 release of the AI search feature says governance, security and privacy come first for all AI features, and commits to labeling AI features and showing their suggestions for users to edit. Administrators can switch individual detectors on and off. No accountable owner, testing before release, or finding on whether detection performs evenly across the kinds of personal data and documents it handles is published.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Safeguards on Canopy's site run to encryption at rest and in transit, a virtual private cloud within the customer's jurisdiction, tenant administrator permissions, penetration testing and staff security training. The Privacy Notice, last updated 14 November 2023, does not say how long case data is kept or how it is deleted. No subprocessor list or incident notification commitment is published; the trust center requires a login.
The product pages describe access to cases granted only where needed, single sign on over OAuth2, OIDC and SAML 2.0, SOC 2 Type II and annual third party penetration testing. The changelog adds a case activity log and optional protections against attempts to infer the text under a redaction. The Privacy Policy says personal data is kept as long as necessary to provide the service. Nothing states how long uploaded case documents are kept or how they are deleted. No named subprocessor list or incident notification commitment is published outside the trust center, which is linked from the site footer.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
No customer agreement is published, so nothing states Canopy's liability, warranties or indemnities.
Liability is addressed only through a standard limitation clause. The Terms of Use provide the service as is and exclude indirect damages, including those for accuracy of results. They cap Phaselab's liability at the greater of $100 or the fees paid in the twelve months before a claim, and require the customer to indemnify Phaselab against claims arising from its use of the service. Nothing stands behind a missed redaction or a redaction that goes too far.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Entity and notification lists export in formats suited to different jurisdictions, and Canopy's DFIR page offers processing templates built in advance by region, regulation and sector. No connection to a review platform, case management or other practice system is published.
Documents arrive by upload, including ZIP archives, PST and MBOX mailboxes and Slack exports, and the enterprise page says no integrations are required. No connection to a document management, case management, email or records system was found. Single sign on is supported for login, which is identity rather than a practice system.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The software runs on AWS with separate instances and logins for the United States, Canada, the European Union, Germany, the United Kingdom and Australia, more regions on request, and data resides in a virtual private cloud within the customer's jurisdiction. Canopy says it is available in 26 countries and can be up in any supported region within 48 hours. Since 8 July 2026, Auto Review computation for Australian data runs in Australia, and the data does not leave the country. Elsewhere, where model processing runs is not stated separately, and no other deployment option is offered.
Region and processing are stated for a single hosted service. The pricing page includes US or UK data hosting in every plan, and customer pages say data is isolated in the region the customer chooses and never leaves that country. The August 2026 release says AI search queries are processed only in the country of deployment, inside Phaselab's own AWS environment. Each client's processing is described as isolated, without saying whether infrastructure is dedicated or shared, and no option on premises or in a private cloud is published.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Canopy says it maintains ISO 27001 certification and regularly runs third party penetration tests. The trust center linked from the footer requires a member login, and no certificate, scope or date is published on the public pages.
The product and customer pages state SOC 2 Type II certification, annual third party penetration testing and GDPR compliance. No auditor, scope or date is given on those pages. A trust center is linked from the site footer.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Canopy describes hundreds of patented machine learning models, continuously trained, using clustering algorithms, neural networks and natural language processing, and announced U.S. Patent No. 12,596,938 on 7 April 2026. Auto Review is "Enhanced with a proprietary ensemble of GenAI and large language models (LLMs)", and Canopy says its agentic approach outperforms generic language models. No model, provider or architecture is named, and no notice of changes is committed.
The architecture is described without the models. The pages refer to Phaselaw's own models detecting more than 50 categories of personal data and say customer data is never shared with third party AI. The August 2026 release adds that AI search queries are processed only by Phaselab in its AWS environment, with no subprocessor added. No model, base model or architecture detail is named, and no commitment to tell customers when the models change is published.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No price, unit or tier is published; every route to a price is a demo request.
The unit and structure are published; the figure is not. The pricing page says price is based on the annual volume of documents processed, with no charge per user, unlimited seats, and full platform access, onboarding, training and support included with no add ons. The calculator on that page estimates savings rather than price, and every route to a figure is a quote or a demo. A pilot on the customer's own data is offered in place of a free trial.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Digital forensics and incident response firms, review and legal service providers, law firms and cyber insurers are the audiences on Canopy's site, which covers ransomware and business email compromise and names GDPR, HIPAA and FERPA notification duties across its hosting regions. Epiq acquired Canopy on 25 September 2026: Canopy joins the Epiq AI agentic suite through Epiq Service Cloud, former COO Adi Elliott becomes VP Product Management, Cyber, and its engineers join Epiq AI for Cyber. The site footer still names Canopy Software, Inc. What data types, languages or jurisdictions it does not handle is not stated.
Buyers and request types are set out, short of the limits. The site addresses enterprise privacy, legal, HR and compliance teams, privacy consultants and law firms handling disclosures for clients, and public sector bodies, and covers subject access requests, freedom of information and public records requests, and personnel records, with US or UK hosting. It describes itself as built for subject access work rather than for litigation evidence review. Supported file types are listed; volume limits, the languages and jurisdictions its detectors cover, and the requests it does not handle are not stated.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
No customer agreement is published on the home, product, About or security pages, in the site map or at the /terms and /terms-of-service addresses, and the Privacy Notice takes no position on training. The product pages say Canopy's models are continuously trained without saying on what data, and Auto Review learns from human corrections.
The Terms of Use and Privacy Policy are published, and neither says whether customer documents are used to train or improve Phaselaw's models. The Privacy Policy reserves a right to use aggregated, deidentified or anonymized data to analyze, build and improve the service. That right never names training and is framed around the personal data Phaselab collects as controller rather than the documents customers upload. The product pages say data is never shared with third party AI, which answers a different question.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The Privacy Notice says client data is processed on clients' instructions but states no retention period for breach data, review decisions or generated lists, and the product and security pages state none either.
For the AI search feature released in August 2026, the vendor states that searches, results and intermediate processing steps are not logged or retained. That is the product's only free text AI input. No retention period is published for uploaded case documents, redactions or review decisions, which are part of the case record.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Access is set in Canopy's own permission model, maintained by the customer's tenant administrators, covering who can see data and who can export entity lists; each customer's data sits in a virtual private cloud in its jurisdiction. Nothing describes separating individual matters within a tenant or inheriting permissions from another system.
Access is set per case in Phaselaw's own permission model, which the customer maintains; cases carry assigned reviewers and approvers. The law firm page says each case is separate, each client gets isolated processing, and data never crosses between cases, so a firm can work for several clients at once. No inheritance of permissions from a document management system is described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The Privacy Notice says Canopy does not disclose personal information to third parties except as required by law in response to lawful requests by public authorities, including for national security or law enforcement. Nothing addresses notifying the customer, and no customer agreement is published.
The Privacy Policy lists meeting legal obligations, including court orders and other legal process, among the purposes for which Phaselab may share personal data with third parties. Nothing addresses whether the customer is told of such a request, and nothing addresses requests for the case documents a customer uploads, for which Phaselab describes itself as processor.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Canopy works on each customer's breached data. Notification rules are said to vary by jurisdiction and industry, but the product and law firm pages identify no source of those rules.
Provenance questions narrow to the customer's own uploads and exemption choices. The product works on the documents each customer uploads. Exemption reasons are chosen by the customer, and no body of law behind them is identified.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product does not cite legal authority, and nothing on the product or law firm pages addresses checking authority for later treatment.
Redaction and disclosure work gives treatment checks nothing to attach to. The product does not cite legal authority, and nothing addresses checking authority for subsequent history.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Auto Review reports a confidence level for its first level review decisions, through what Canopy calls Intelligent Confidence Scoring, and Canopy says this tells review managers which documents need a second look in quality control. No path in which the system declines to classify a document is described.
The August 2026 release of the AI search feature describes two behaviors. When asked for a search the system does not support, it returns an error explaining the problem instead of a guess. When it translates an ambiguous request, it shows a warning explaining what it did. Both are illustrated with screenshots. No confidence indicator or equivalent behavior is described for the models that suggest redactions.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin records no case naming Canopy, and no court order, opinion or disciplinary record naming the product is on the public record. This is a statement about the public record rather than a finding about the product.
The AI Hallucination Cases database kept by Damien Charlotin holds no entry naming Phaselaw as the tool used.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Nothing on the home, law firm, review and LSP or About pages or in the Privacy Notice engages with lawyers' professional or ethical obligations or names any ethics opinion.
Data protection and public records law frame the product, while lawyers' own professional duties sit outside that frame entirely. The site refers to data protection law, the Information Commissioner's Office and public records laws, but no material engages with lawyers' professional or ethical obligations or names any ethics opinion.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Canopy is licensed by incident response and review providers who bill the breached organization for the work; law firms reach it through those partners and advise the client on the results. It does not sit in a lawyer's own time billing, and nothing addresses how its use is reflected in legal fees.
The law firm page claims 92% less time per request and frames the saving as protected margin on work for a fixed fee. Nothing addresses work billed by the hour or what a client is told about review assisted by AI. For the enterprise and public sector teams that make up much of the customer base, no client is billed for the work.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The security, product and review and LSP pages and the Privacy Notice publish no subprocessor or model provider list and no client facing disclosure material; the trust center requires a member login.
No subprocessor or model provider list is published outside the trust center: the Privacy Policy names categories of service provider and Stripe, and the changelog names AWS. The trust center is linked from the site footer.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The regulator, not a court, usually receives this work. The product and law firm pages describe an impact assessment report and defensible detection, but nothing records which decisions the models made and which a person verified, or addresses disclosing AI use.
No court sits in the path of most of this work; the body that asks is the regulator. The enterprise page says that if the Information Commissioner's Office challenges a response, every decision is logged, showing what was found, who reviewed it and why each redaction was made. Exemption reasons are tracked per redaction, and a Case Activity page logs activity from September 2026. A spreadsheet summary export records exemptions applied, duplicates, redundant emails, decisions that documents are out of scope, and errors.
Files marked out of scope show whether a person or deduplication removed them. Nothing records which redactions began as model suggestions.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Practice Systems Integration Depth
- Primary Law Corpus Provenance
- Good Law Verification
- Bar Guidance Alignment
- Outside Counsel Guideline Readiness
Product updates
The latest logged changes from each vendor, newest first, each linked to its source.
Canopy
-
Acquisition / corporate
Epiq acquired Canopy, maker of the patented Data Breach Response platform and the agentic Auto Review feature that automates first level data mining review.
Source
Phaselaw
-
Safety / governance
Phaselaw now surfaces black outs and improperly created redactions already present in uploaded documents as suggested redactions, so a reviewer makes an explicit decision on each one inside the redaction workflow.
Source -
Product / capability
Phaselaw added a Case Activity page that logs significant events in a case: case creation, status and deadline changes, uploads, and document status changes.
Source -
Product / capability
Full page redaction was reworked so users select one or more pages to redact in a single action, mirroring area redactions, instead of redacting only the visible page.
Source
In summary
Canopy
Canopy, from Canopy Software, Inc. of Reston, Virginia, is data breach response software used by review providers, forensics and incident response firms, breach counsel and cyber insurers. Hundreds of its own machine learning models find personal and health information in compromised data of any file type and produce an impact assessment. It deduplicates affected people and exports notification lists for GDPR, HIPAA and FERPA, with Auto Review handling first level review. According to the AI Legal Index, Canopy hosts on AWS in five regions and states ISO 27001.
Phaselaw
Phaselaw, from Phaselab, Inc. of New York, is a document review and redaction platform for subject access, freedom of information, public records and personnel records requests. It ingests documents, emails, chats and images and removes duplicates. Its own models suggest redactions across more than 50 categories of personal data, with an AI search a reviewer can see and edit. According to the AI Legal Index, Phaselaw prices by annual document volume, hosts in the US or UK and states SOC 2 Type II. It shows customers including the NHS, HMV and YMCA. It offers a pilot on a customer's own documents instead of a free trial.
Questions buyers ask
Are Canopy and Phaselaw the same kind of product?
Not quite. Both find personal data in documents with their own models, but Canopy is used after a data breach to identify and notify affected people. Phaselaw answers subject access and public records requests by redacting what must be withheld. Phaselaw publishes more around its models, including its pricing basis, named customers and a log of every redaction decision. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Do Canopy and Phaselaw send data to outside AI providers?
Phaselaw states that customer data is never shared with third party AI and that its AI search queries are processed only in its own AWS environment in the country of deployment. Canopy describes its hundreds of models as its own and patented, without naming any provider. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
How is Phaselaw priced?
By the annual volume of documents processed, with unlimited seats and full platform access, onboarding, training and support included, and US or UK hosting in every plan. A quote or demo comes first, and a pilot on your own documents is offered instead of a free trial. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Can a law firm use Canopy directly?
Canopy addresses law firms, which typically reach it through the review and legal service providers that license the software, alongside forensics firms and cyber insurers. Phaselaw has a dedicated page for privacy consultants and law firms handling disclosures for clients, with each client case isolated from the others. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Three points to weigh. Canopy publishes no customer agreement, and law firms usually reach it through partner review providers. Phaselaw's terms cap its liability at the greater of $100 or a year's fees and require the customer to indemnify it. Both trust centers are gated. Neither vendor reviewed this page.