Case Status vs Quilia: how they compare in 2026

Case Status was a client portal before it was an AI product. Real time case status, the branded app without passwords, secure messaging, document upload, stage videos and review prompts triggered by NPS scores are conventional software, and the sync with the case management system is an integration. On top sits a named set of model features sold individually: Agentic AI Translation, Agentic AI Case Summary, Agentic AI Response and Prioritization, an AI Triage Agent, AI Automation Agents and Client Sentiment Tracking. Without them the product still works as a communication and status system.

The models do the work the firm is buying, on a product that would still stand without them. Without the AI, Quilia is a competent client app: a mobile file where an injured client logs visits and pain scores, uploads records and photographs, signs documents and messages the firm, synced both ways with the case management system. What the AI adds is the part a firm cannot staff. It reads each upload, extracts the provider, dates and treatment details, classifies images, files everything in order, and tracks treatment against what is on file to surface gaps. The case assistant, which reads a client their own file and records spoken answers, is not yet generally available. Read on the artificial intelligence, document management and HIPAA pages and in the privacy policy.

No accuracy figure, evaluation, test set or error rate is published, and nothing describes how a drafted reply is grounded in the case record. Agentic AI Translation renders a firm's message into another language for a client who cannot check it against the original, and Agentic AI Case Summary condenses a matter for a lay reader. Accuracy is not asserted and grounding is not claimed. Case Status also publishes a page for each AI feature.

No accuracy figure is published, and the checking mechanism is concrete. Nothing the AI extracts reaches the case file on its own. It presents what it found to the client, the client confirms it, and the confirmation carries a receipt that can be undone for ten minutes. Every structured item therefore traces to a document the client uploaded and the client's own confirmation of it, grounding a reader can follow. The release testing described for the assistant is a method without results. No error rate or sample is published, and nothing covers what a wrong extraction costs if the client confirms it anyway.

The home page says Case Status uses case context to suggest responses that staff can review and send in seconds, which puts a person between the model and the client on the drafting path, and Agentic AI Response and Prioritization ranks messages by urgency for staff rather than acting on them. The product also markets AI Automation Agents and claims that up to 80% of routine client communication is handled automatically, which implies some messages reach clients without review of each one; nothing published reconciles the two or says which categories run unattended. No threshold, escalation route or statement of what happens after a wrong message is sent is published.

The strongest controls sit on a feature that is not yet generally available. On the live product the structure is clear: extracted data is proposed rather than written, the client confirms each item and can undo it, and everything lands in the firm's case management system where the legal team works. The case assistant ℚ adds categorical limits, stated as product constraints rather than model instructions, and the firm's phase label is withheld from the model entirely so it cannot leak one. The vendor describes ℚ as rolling out to firms rather than in general use, and an announced control is not yet an operating one.

Pond Lehocky is named on the home page with close to 15,000 active clients using the app across its workers compensation and social security disability departments, and a before and after review figure with a stated window: 4.6 with 417 reviews before, and 4.8 with more than 3,000 reviews within 24 months. Shawn Lehocky, Chief Executive Officer at Pond Lehocky Giordano, appears on record. Three growth case studies are identified only by practice and city: an SSD firm in Charleston WV that doubled caseload in a year, a PI firm in Chicago at 40% growth year over year, and a large PI firm in Kansas City with a 35% increase in case velocity. The firm count reads 600 plus in the page header and more than 500 in the body.

Named firms and a survey figure are both published, and never joined. Five law firms are named with the people who spoke for them, among them Brian Riley and Liz Lasslett of Kurtz Riley Law Group and Brandon Hewitt of Michigan Auto Law. Dean Tingey of Tingey Injury Law Firm gives the most specific account, that the product found treatment gaps the firm had been leaving money on. Separately the vendor reports that 82% of clients would recommend their attorney because of Quilia, from 568 clients surveyed, and labels it a survey rather than a selected quote. The sample size is given; the date, the question wording and how respondents were chosen are not. No named firm is attached to a figure for what changed, and no dated case study exists on the site. A named customer calls the product affordable for what the firm gets.

The security commitment page describes multiple layers of encryption, least privilege development, mandatory two factor authentication, background checks and ongoing security training, and the GDPR section states that Case Status acts as a data processor for law firms. No law firm customer agreement is published; the only agreement on the site is the End User Terms of Use binding the firm's clients. Nothing addresses training on client content, matter or tenant segregation, or privilege and work product, though the platform carries attorney client communications by its own description. The privacy notice grants the app access to contacts, microphone, calendar, reminders, SMS messages and continuous location, and nothing published explains why a case status app needs them.

The written commitments are strong, and one published sentence sits badly against the product. The Terms carry mutual confidentiality surviving three years, with trade secrets protected for as long as they qualify, and the customer owns its data. Policy pages rule out training on customer data, separation is enforced in the database, and a Business Associate Agreement is available. Against that, the AI disclosure tells users they are responsible for ensuring that what they put into the app does not contain confidential, sensitive or privileged information, on a product built to collect medical records. Privilege and work product are named only in the clause disclaiming responsibility for outside AI assistants a firm connects. Section 16.1 of the Terms assigns all rights in Resultant Data to the vendor.

The product generates and translates messages to represented clients, who cannot judge whether what arrives is legal advice. The home page, security commitment page, privacy notice, Terms of Use and its Limitation on Liability subpage carry no disclaimer of any kind, no statement that AI drafted or translated content is not legal advice, no requirement that a firm tell its client about AI involvement, and no reference to ABA Formal Opinion 512 or any state bar guidance. The End User Terms address the reader as a client and disclaim liability rather than explain what the technology does. Case Status also publishes a page for each AI feature.

The advice line is drawn on the surface a non lawyer actually sees. The End User License Agreement of 10 March 2026, which the injured client accepts before using the app, says the user shall not rely on the app or its output as legal advice or represent to anyone that it is. It says the app gives no legal advice and creates no attorney client relationship, that the user should consult a qualified attorney, and that the app is prone to error and output should be reviewed. The product draws the line again in behavior, with the case assistant declining questions of fault and case value. The product is sold across the United States, and nothing names a state limit or addresses the firm's duty to supervise what the assistant tells its clients.

No responsible AI page, named owner accountable for the AI, testing regime before release or ISO 42001 or equivalent is published. The security commitment page names a Chief Technology Officer, Charles Lane, and the privacy notice names a Data Protection Officer, Andy Seavers, both in information security and privacy roles. Nothing addresses whether sentiment scoring, urgency ranking or translation quality behaves evenly across languages or client groups, and the product's clients include immigration and workers compensation claimants writing in languages the firm may not read.

A testing regime is published, with no owner and no findings attached. Before a change to how the case assistant writes can ship, the exact inputs real cases produced are replayed against the new wording. Every resulting message is scored on a fixed rubric: whether it is specific to that client's file, whether each sentence stands on its own read cold, and whether it crossed any published limit. The scorer is run against itself, so its own noise is measured and a small gain is not mistaken for a real one. That is auditable in shape and goes beyond a principles page. Nobody inside the company is named as its owner, and what the replays have found is not published. Nothing at all addresses whether output differs across client populations, languages or injury types, on a product whose users are often in pain, new to the process, and served in more than one language through automatic translation.

Published: multiple layers of encryption, least privilege, mandatory two factor authentication, password and lockout policies, employee background checks, ongoing security training, AWS hosting, and continuous compliance monitoring through Secureframe. No subprocessor list, incident or breach notification practice or retention period is published. Under the heading on how long information is kept, the privacy notice of 17 July 2025 says no purpose in the notice will require keeping personal information for longer than, and the sentence ends without a number. Deletion is promised once no legitimate business need remains, with an exception for backup archives.

Access, infrastructure and incident practice are covered in detail, and the end of the data's life is not. Encryption runs in two layers, AES-256 at the database and AES-256-GCM at the application layer for integration credentials and session data, with TLS 1.3 in transit. Multifactor authentication is enforced. Backups run daily with recovery to a point in time, tested restores and stated recovery objectives. An incident response procedure is run by a named mix of security, legal and technical staff, with supervisory notification inside 72 hours and notice to affected users. Infrastructure subprocessors are named. No retention period is stated for case content, deletion follows an account termination request with exceptions, and the AI providers are not named.

The Limitation on Liability subpage excludes liability for damages of any kind under any legal theory arising from use or inability to use the service, direct or indirect, whether in negligence or contract and even if foreseeable, and names personal injury, pain and suffering, emotional distress, loss of data and loss of goodwill among the excluded categories. There is no cap, because there is no fee: these are End User Terms binding the law firm's client, in a product sold into personal injury, workers compensation, disability and mass tort practice. No agreement with the firm, indemnity, warranty on output or insurance position is published.

Limitation and disclaimer handle liability, and the exposure the product creates is pushed outward. The Terms of 22 May 2026 cap the vendor's total liability at the fees paid in the month before the event for monthly payers, or twelve months for annual payers. They exclude consequential and indirect damages both ways, apply the caps to negligence and even where remedies fail of their essential purpose, and provide the services as is with implied warranties disclaimed. No indemnity runs to the customer. The license agreement the injured user accepts asks them not to hold the vendor liable for any loss from relying on app output. Errors from an outside AI assistant a firm connects are put on the firm. A service level exists: 95% availability measured yearly, with credits as the sole remedy, capped at 5% of fees and claimable only within 24 hours. That answers downtime, not a wrong extraction on a case file.

Thirteen case management platforms are listed with individual integration pages: Clio, Litify, MyCase, Neos by Assembly, Filevine, CASEpeer, SmartAdvocate, SmokeBall, PracticePanther, CoCounselor, Meruscase, Docketwise and Salesforce. Case Status describes itself as the communication layer living inside the case management platform, with staff working where they always have and everything syncing automatically, and one published customer account describes it running inside Litify in a frame. The home page does not describe what syncs, in which direction, or what a firm must configure.

Integration is documented rather than listed. Twelve case management and practice systems are named, each with its own page, among them Clio, Filevine and SmartAdvocate. The sync runs both ways: documents, treatment updates, confirmed extractions and client messages flow into the firm's case file, and matter data flows back. The firm invites a client with one click from inside its own system. What moves is scoped: the integration runs through the API only, stores no protected health information from the external system, and syncs case metadata, with integration credentials encrypted before storage. Setup is described as under 30 minutes for most integrations, with the vendor handling the technical configuration and guides published. Custom routes run through Zapier and an API, and a Model Context Protocol connection lets a firm point its own AI tools at its Quilia case data.

The security commitment page says Case Status runs on Amazon Web Services, chosen for scale and redundancy. The privacy notice says servers are in the United States and that information from users outside the US will be transferred to and processed there, which fixes a default location. No tenancy model, region option or separation of processing location from storage is published. The product's practice areas include immigration, so its users include clients outside the United States.

Tenancy and residency are both answered, and neither is a choice. The platform is shared, with separation enforced in the database itself. The privacy policy of 6 September 2026 says the servers are in the United States, and the vendor names the infrastructure providers that hold the data, with daily backups kept in geographically distributed storage. No single tenant or private deployment is offered, and there is no region selection. Nothing distinguishes where processing happens from where data rests, and where the AI providers process what is sent to them is not stated, since those providers are not named.

The security commitment page names the auditor, Modern Assurance, an independent third party accounting and auditing firm, states the scope as all five trust services criteria (security, confidentiality, availability, privacy and processing integrity), and gives completion dates: SOC 2 Type I in September 2023 and SOC 2 Type II in July 2024. HIPAA compliance is claimed on the basis that legal practices serve clients who are also patients, and Secureframe is named for continuous monitoring. There is no trust center or portal and no stated route to request a report. The most recent attestation stated dates from July 2024, and ongoing audits are expressed as an intention rather than a published later report.

No independent attestation of the vendor is published, and the vendor claims none. What it publishes, accurately, is that its infrastructure providers hold SOC 2: Supabase, Vercel and Expo are named as SOC 2 certified cloud providers. That is the hosts' attestation, and the vendor's own wording draws the distinction. HIPAA compliance is asserted in detail, with a Business Associate Agreement offered on request, but it is a legal obligation the vendor states of itself rather than an audit anyone performed. There is no SOC 2 or ISO report for Quilia, no penetration test summary, no trust center, no audit period or scope, and nothing a buyer can obtain without asking.

The product markets six separately named AI capabilities and a Data and Agentic AI solution page, and names no model, model provider, inference location or commitment to notify changes. No subprocessor list is published. AWS is named on the security commitment page as the host.

The commitments about AI providers are specific, and the providers are never named. The AI disclosure of 27 December 2025 says the vendor may work with various AI providers and models, selected against its security, privacy and performance standards, and that retention periods and handling practices vary by provider and will be disclosed. The privacy policy adds that data is not shared with AI providers for their own purposes and that AI processing is scoped to the case. None of that can be checked. No model, version or provider appears anywhere on the site, nothing says where inference runs, and the promise to disclose practices by provider is written in the future tense. The infrastructure providers are named, so the omission is specific to the AI layer. Nothing commits to telling customers when a model or provider changes.

No pricing page, tier names, packaging structure, unit of charge or figure is published; the navigation, footer and resource menus carry no pricing entry, and every commercial route is a demo booking, a tour or a calendar link.

The shape of the bill is published in the agreement, and the numbers are not. The Terms set out a case tier with a case limit, overage and excess user fees, monthly or annual payment, notice periods for fee changes and cancellation, and a pro rata refund of unused time. Fees themselves are stated in an order form. All of that can be read before any sales contact, while no rate, tier size or implementation figure can be learned without a demo.

Eight practice areas each have their own page describing the work: personal injury, workers compensation, immigration, employment, disability, mass tort, estate planning and criminal, all high volume matters where a client waits a long time with little news. No segmentation by firm size, in house or government position, or statement of where the product stops is published. The customer evidence points to plaintiff and claimant firms of varying size.

The practice boundary is stated, and the firm boundary is not. The vendor says the product is built for personal injury and workers' compensation first, that collecting client information and structuring it into the case file applies to other case types, and that it expands on firm demand. A firm in another practice area is told to ask where it fits today. That is a limit a buyer can act on rather than a claim of universal coverage. Within personal injury the coverage is specific, from motor vehicle claims and claims heavy with treatment across several providers to intake checklists and clients with more than one case. No statement of firm size or type is made. The named reference firms are small and midsize plaintiff practices, and nothing covers high volume or mass tort inventories beyond an integration with systems that serve them. Use in house or in government goes unmentioned.