CasePeer vs Filevine: how they compare in 2026

Artificial intelligence is present, named and real, and it is peripheral to what the product is, which is the C band. The AI is 8am IQ and it resolves to exactly two named features on the pricing matrix, a Writing Assistant and a Translation Assistant, described on the vendor's own AI page as living inside notes, tasks and text messages to correct grammar, simplify language, shift tone between professional, empathetic and assertive registers, and translate between English, Spanish and Arabic. That is a communications aid layered on a case management platform whose value plainly stands without it. Two facts settle the grade rather than the marketing. The Basic tier ships with no AI at all, so a buyer can and does receive the product with the models removed; 8am IQ appears only on Pro and Advanced. And the platform's own account of what it is for, on the page it writes for machine readers, leads with case grading, medical treatment tracking, lien resolution, settlement distribution and KPI reporting, with 8am IQ appearing as one line in a fourteen-item capability list. Recorded and expressly not credited: the AI-heavy work in this product class reaches the customer through third parties, the integration catalogue naming EvenUp, Novo and Practice AI for demand letters and case summaries and Arctrieval for records retrieval. Those are other vendors' models and the ground rules put them on the other side of the arrow. Verified 12 September 2026.

The AI portfolio is the widest in this pull and the platform beneath it is a complete practice management system. Twelve or more distinct AI products are named and separately marketed: MedChron for medical chronologies, DemandsAI for demand letters, Depo CoPilot for live deposition assistance, Depo Summaries, AIFields, AI Doc Review, AI Data Mapping, ValidationAI, ImmigrationAI, Leads AI, Ask LOIS, LOIS for Word and the LOIS Console. AI has its own top-level navigation entry and its own free tier. Several of those are the engine of a capability a firm actually buys, most obviously the medical chronology and the demand letter, which are the two most labour-intensive documents in a personal injury practice. What sits underneath is the business Filevine sold before any of it: matter management, document management and assembly, intake and lead conversion, billing and time-keeping, e-signature, analytics and deadline generation. Strip the models out and every one of those remains and the firm keeps running. The commercial structure confirms the reading, with the AI products sold as packages and extensions on top of a core platform rather than as the platform itself.

Accuracy is asserted without measurement and the grounding claim is made without any described method, which is the C band. R15 governs how heavily this reads, and the note says so first: the product generates no legal authority. 8am IQ rewrites the user's own text and translates it, so the limbs about primary authority, openable citations and citator status do not bite on this product class, and it is not being penalised for lacking them. What does bite is the accuracy claim, and there is one. The vendor's AI page answers the question of trust with a grounding assertion, that every response points back to its source so the user can check it before anything goes out, and nothing published describes what a source means for a tone rewrite, how it is surfaced, or how a user would follow it. Against that, the governing agreement is markedly less confident than the marketing: Terms of Service Part III states that 8am IQ may produce errors, omissions or inaccuracies, that 8am does not warrant or guarantee the accuracy, completeness or reliability of any Output, and that the customer is solely responsible for evaluating accuracy before relying on it. R37 rule 1 gives that to the agreement, and the gap between the two is recorded here rather than resolved. R40 keeps the floor off D: the accuracy content is not a bare no-hallucination claim, because a contractual limitation and an express review requirement sit behind it. No accuracy figure, test set, error rate or evaluation is published. Verified 12 September 2026.

Grounding is claimed consistently across products and no measurement is published anywhere. The pricing page describes Ask LOIS as returning grounded, traceable answers, LOIS for Word as producing source-linked recommendations, AI Drafting as delivering fact-level accuracy and human-verified output, and Depo Summaries as carrying page and line references, and the free LOIS Explore tier is described as drafting content with every result cited to source. A legal research capability with an opinion reader sits alongside it, so a user can open the authority rather than take the citation on trust. The failure modes are named in the agreement rather than in a footnote, and that is rare: output may be incomplete, may contain factual or legal errors or omissions, may reflect biases present in training data, and substantially similar inputs may produce different output. What is absent is any number. Searched the AI features page, the pricing page and the subscription agreement on 31 Aug 2026 and located no accuracy figure, no test set, no evaluation and no error rate, set against a marketing claim on AIFields inviting buyers to stop struggling with AI hallucinations. One hedge belongs in the record: MedChron's verifiable output is described as pointing back to source documents when applicable, which is not the same as always. The individual product pages were not opened.

A written commitment that the models work alongside a supervising professional, with real review surfaces and a real firm-level control, short of the full structure. The commitment is contractual rather than promotional, which is worth more: Terms of Service Part III provides that 8am IQ does not provide legal advice, that the customer may not rely on any Output as a substitute for professional judgment or human review, and that the customer is solely responsible for evaluating Output before relying on it. The IQ Usage Policy repeats it in operative terms, that all outputs should be reviewed and resources verified. The review surface is inherent and adequate: the assistant proposes text inside a note, task or message that the user edits and sends, so nothing reaches a client without a person pressing send. The genuine control, and the strongest thing on this row, is that availability of 8am IQ is governed by a firm-wide setting managed by the Account Owner, which the agreement expressly directs the firm to configure in accordance with its own policies and any applicable professional or ethical obligations. What holds it off A is that the control is binary and firm-wide. Nothing lets a firm permit the assistant to lawyers and withhold it from intake staff or case managers, both of whom are named users of this platform and both of whom draft client communications in it. No threshold, confidence signal or class-of-work boundary is published, and what happens after the system is wrong is answered only by a disclaimer. Verified 12 September 2026.

The review obligation is written into the contract and it is specific about the act required. Section 3.2 of the subscription agreement makes the subscriber solely responsible for reviewing, verifying and determining whether and how to use any output, and then names what that means: independently confirming citations and legal conclusions before relying on output or sharing it with any third party, including a client or a judicial body. Few vendors name the court as the audience. It is reinforced by an AI Acceptable Use Policy incorporated into the agreement and governing permitted and prohibited uses of AI-enabled features, by a product page describing AI drafting as producing human-verified output, and by outputs described as structured for human review with hyperlinks into the underlying material. What is not published, checked across the AI features page, the pricing page and the full agreement on 31 Aug 2026: no abstention behaviour, no confidence or uncertainty indicator surfaced to the user, no threshold at which a feature declines, and no route to report or correct a wrong output. The agreement discloses non-determinism, that similar inputs may produce different output, which is honest and is a warning rather than a control. The AI Acceptable Use Policy was not opened and is the rebuttal route.

Named customers with full attribution and no figures attached to any of them, which is the B band in its own terms. Three testimonials on the pricing page carry a named individual, that person's role and their firm: the founder of Josh Jones Law, P.A., a co-founder of Sam and Ash, LLP, and the founder of Oscar A. Garza Law. Under R122(2) that is named customer evidence rather than outcome evidence, and it is counted here as attribution. What is absent is the other half. Not one figure is attached to a named firm on the surfaces read, no deployment is dated, and no result is quoted with a basis, so a reader learns who uses the product and nothing about what changed for them. Two things are recorded and expressly not credited, because they are a different kind of thing. Review-platform aggregates are published in quantity, including G2 at 4.7 across 188 reviews and Capterra at 4.8 across 216, and satisfaction scores are not deployment evidence. And the statistics on the AI page, that 69 per cent of legal professionals use AI for work and 38 per cent save one to five hours a week, are industry survey findings about the profession rather than measurements of this product, which the page does not claim they are. The case studies library at the testimonials page is published and was not opened; under R25 it corroborates rather than carries a grade resting on the attributed testimonials already read, and it is the artifact that would move this row if its studies carry dates and a stated basis. Verified 12 September 2026.

Volume claims stand where customer outcomes should be, on the surfaces read. What is published: approximately 100,000 demand letters drafted by Filevine customers every month, a claim to host the largest and most accurate repository of personal injury case management data in the world, and a case study headline naming an individual, a shareholder said to have brought 125 active cases under control and recovered his evenings. The agreement carries a customer reference clause permitting Filevine to use a subscriber's name and logo, with a withdrawal right, which tells a buyer the logos are consented to rather than assumed. What was not established is any measured outcome attributable to a named organisation: the case study headline gives a person and a caseload figure without naming the firm, and no other quantified result was located on the pages read. This is the weakest-evidenced row on this record and the limit is worth naming precisely: a dedicated customers and case studies library exists at a public URL and was not opened on 31 Aug 2026, and it is the obvious home for named, quantified deployments. Anyone revisiting this record should open it first.

Substantive published commitments readable before signing, failing the limb R33 makes decisive. What is met, and met contractually in the parent agreement that this product's own footer adopts as its terms: no training on customer content, expressly and in unusually complete words, covering models developed by the vendor and by third parties alike; a stated position on what the third-party model provider may retain, which is the limb most records in this corpus never reach, the agreement providing that the LLMs used to deliver 8am IQ may retain IQ Content for up to thirty days and may not train on it; and an access model documented at the level a firm configures, with user permission groups, granular user permissions, two-factor authentication and role-based access control. The limb that fails is privilege and work product, and it fails completely. Neither the agreement, the AI page, the security material nor the machine-readable company page addresses attorney-client privilege or work product at all, on a platform that holds the entire case file of a contingency practice including medical records, treatment histories and settlement negotiations. R33 makes that limb sufficient on its own to hold the record at B. Two further gaps are recorded: nothing describes segregation between matters or between users inside one firm beyond the permission model, and no retention period is stated for case content, the agreement deferring to a Data Retention policy whose period is not published. Verified 12 September 2026.

Substantive published commitments on confidentiality and training use, in the agreement, short of matter-level segregation. The training position is the most carefully drafted in this pull: Filevine engages third-party AI providers under written agreements prohibiting them from using subscriber data to train or improve their models, and under which they do not retain subscriber data beyond the applicable request, with a single named exception for temporary retention for abuse-monitoring or trust-and-safety purposes. Naming that exception rather than leaving it implicit is the mark of a drafter who expected the clause to be read. Ownership is stated clearly, with the subscriber owning its data including output generated from it, and subscriber data defined as confidential information under a mutual confidentiality clause surviving seven years, with trade secrets protected indefinitely. A separate clause commits Filevine not to reduce its confidentiality or security commitments mid-term without written consent. Tenant separation is addressed obliquely, in a provision stating that other subscribers' queries and output are not the subscriber's data. What is missing is the matter-level question: nothing describes a wall between two matters inside one firm, which for a plaintiff practice running adverse cases is the live issue. The Security Addendum and Data Protection Agreement are published and were not opened.

A real published position that reaches further than most records at this grade, including into supervision, and stops short of A on one limb that matters on this product. What is published, all of it readable before signing and all of it in instruments this product's own footer adopts: the platform is stated to be for legal, accounting and other client-based professionals located in the United States and Canada, which answers both who may subscribe and the jurisdictional boundary; the vendor states that it does not provide legal advice and is not engaged in the practice of law; the customer is required to use the platform in compliance with any rules of professional conduct applicable to its profession; and unauthorized practice is named as a prohibited activity twice, in the Terms of Service and again in the IQ Usage Policy, which bars engaging in the unauthorized practice of law or offering tailored legal advice without a qualified person reviewing the information, and adds that the models are not fine-tuned to provide legal advice and should not be a sole source of it. That is the supervision dimension addressed rather than omitted, which is what usually separates B from C here. The limb that fails is who may operate the tool. Availability of 8am IQ is a single firm-wide switch held by the Account Owner, with no per-role or per-user control, on a platform whose named users include intake specialists and case managers and whose assistant drafts messages that go to clients. A firm cannot give the assistant to its lawyers and withhold it from its non-lawyer staff. Nothing on CasePeer's own marketing estate addresses professional responsibility at all. Verified 12 September 2026.

The most complete advice-line clause located in this pull, and no engagement with the authorities behind it. The agreement states that Filevine is not a law firm or provider of legal advice and that use of output does not create an attorney-client relationship, repeats in the disclaimer that Filevine is not a law firm and does not provide legal advice, and then goes further than any comparable clause by specifying the professional act required: the subscriber must independently confirm citations and legal conclusions before relying on output or sharing it with any third party, including a client or a judicial body. That names the duty, the object of the duty and the audience, which is the competence and supervision dimension most vendors omit. An AI Acceptable Use Policy is incorporated into the agreement and controls permitted and prohibited uses of AI features. What holds this below the top band: no bar or ethics authority is named anywhere located, including ABA Formal Opinion 512, and no jurisdictional limit on the product's output is stated, which matters for a platform serving immigration, criminal defence and prosecution work across every state. The AI Acceptable Use Policy was not opened on 31 Aug 2026 and is the rebuttal route.

A published governance framework with real substance, short of testing results and a named owner, which is the B band. The framework is the 8am IQ Usage Policy, updated 19 August 2025, a standalone dated instrument that names CasePeer IQ expressly, is incorporated into the Agreement by the Terms of Service, and carries a stated enforcement ladder from a request to change through suspension or termination of the account. Its content is a real acceptable-use regime rather than a principles page: it prohibits use of 8am IQ for illegal activity, for hateful, harassing or violent content, for malware, for activity carrying high risk of physical or economic harm including automated determinations of eligibility for credit, employment or public assistance, for fraud and deception, and for high-risk government decision-making in law enforcement, criminal justice, migration and asylum. Three of its prohibitions are squarely bias and rights provisions: no facial recognition of private individuals, no classifying individuals based on protected characteristics, and no biometric identification or assessment. Alongside it the Tool Terms function as governance in their own right, carrying the no-training covenant, the thirty-day model retention limit, the human review requirement and the firm-wide availability control. What A asks for is absent. Nobody inside the vendor is named as accountable for AI, nothing is published about what is evaluated before an IQ feature ships, and no testing results or findings are disclosed. The honest limit on the whole row is recorded: this framework governs what the customer may do with the tool, not what the vendor does when building it, and nothing addresses whether the assistant's output is even across the populations a personal injury practice serves, which matters on a product whose translation feature is aimed at clients who do not read English. Verified 12 September 2026.

The first vendor in this pull to address bias at all, and it does so twice. Six AI principles are published and named: Fairness, stated as fighting against the threat of bias in its legal AI tools so the technology works for all legal professionals and their clients; Reliability and safety; Privacy and security; Inclusiveness, framed around building tools across practice areas and fostering equity in the profession; Transparency, committing to explain how the AI works in understandable language; and Accountability, committing to take full responsibility for the impact of the technology. More importantly the point is repeated where it binds, with the agreement disclosing that output may reflect biases present in training data, which is a contractual acknowledgement rather than a marketing sentiment. Governance has real apparatus around it: an AI Acceptable Use Policy incorporated into the agreement, a commitment to maintain a list of permitted models for use in AI-enabled features, and a clause preventing Filevine from reducing confidentiality or security commitments mid-term without consent. Named roles exist in a Head Legal Futurist and a Legal Futurist. What is absent is testing: no pre-release evaluation regime is described, no result of any kind is published, no bias audit or fairness measurement appears, and the Fairness principle is a single sentence. Owner accountability is implied by role rather than assigned.

Substantive published policy covering most of the ground, missing the subprocessor list and a vendor-side incident commitment, which is the B band and its two named examples exactly. What is published is specific and, on the AI side, better than this corpus usually sees: prompts and outputs are addressed directly rather than left to a general privacy policy, the agreement stating that the LLMs used to provide 8am IQ may retain IQ Content for up to thirty days, that it will not be used to train any model, and that inputs and outputs may be reviewed by aggregated human and automated means to monitor accuracy, safety and performance. Access control is documented control by control: encrypted connections with multi-factor authentication for production access, network segmentation, unique authentication for production datastores, role-based access, two-factor authentication for all users, a documented password policy, centralized log management with automated alerting, annual third-party penetration testing with SLA-bound remediation, and background checks on all employees. Deletion is addressed, customer data being deleted or de-identified after the applicable retention period on departure, with export and deletion rights preserved. Two gaps hold it at B. No subprocessor list exists for the platform or for the AI: the only third parties named anywhere in the agreement are payment processors, and the LLM providers behind 8am IQ are never identified. And there is no commitment by the vendor to notify the customer of a breach of the vendor's systems; the agreement's data incident regime runs the other way, obliging the customer to notify within 24 hours and reserving to 8am the sole right to decide whether any notice is given. No retention period is stated for case content itself. Verified 12 September 2026.

The Data Protection Agreement, last updated 14 Jan 2026 and read in full, closes the two gaps that held this row down. All five elements this axis asks for are now published and specific. Retention: personal information is retained for the duration of performance of the Services, and on termination or expiry Filevine will destroy it or return it if the subscriber so directs in writing. Deletion: where law compels retention Filevine must notify the subscriber in writing with the documents involved, the legal basis, and a specific timeline for destruction once the requirement ends, and it commits to certify in writing that destruction is complete within thirty days of completing it. Access control: access is limited to employees who require it and to the parts they strictly require, under confidentiality commitments, with privacy training and background checks where lawful. Subprocessors: each is engaged under a written agreement with obligations not less protective than the DPA, the current list sits in Annex C, a subscribe-by-email mechanism gives notice of new ones, the subscriber may object within ten business days on reasonable grounds, and Filevine is liable for a subprocessor's acts as if it had performed them itself. Incident practice: Filevine will notify the subscriber promptly and without undue delay on becoming aware of a security breach, describing the categories of information affected, the approximate number of data subjects, the steps taken to investigate and remedy, and a named contact, with phased disclosure permitted and Filevine bearing the reasonable costs. One softness rather than a gap: the notification duty is expressed as promptness rather than a fixed number of hours. The Security Addendum was not opened.

Liability is addressed only through a limitation regime that disclaims the exposure this product creates, which is the C band, and the drafting is unusually explicit about doing so. What is published and precise: total cumulative liability is capped at the net fees earned by the vendor during the three-month period immediately preceding the event giving rise to the claim; indirect, incidental, special, consequential, exemplary and punitive damages and loss of profits, revenue, goodwill, use and data are excluded; claims must be commenced within one year; and the platform is supplied as is and as available with all warranties disclaimed, including any warranty that information or documentation provided through it will be accurate, complete or compliant with applicable law. The AI-specific provision is the sharpest and it points the same way: the agreement states that 8am will not be liable for any damages arising out of or related to errors or inaccuracies in Output, the customer's use of or reliance on Output, or any interruption or failure of 8am IQ. There is no indemnity running to the customer at all. The only indemnity in the agreement runs the other way, the customer indemnifying the vendor, and it extends to compensating the vendor for personnel time if the vendor must respond to a subpoena relating to the customer's account. Recorded and not credited, because it is not a published position with any scope a buyer could rely on: a certificate of insurance is listed among the resources at the trust centre, available on request. No service level, no warranty of output, no indemnity and no insurance terms were located. Verified 12 September 2026.

The first A on this axis in the pull, and it is earned on four separate limbs rather than one strong clause. Indemnity: Filevine will defend the subscriber against third-party claims that the services infringe a United States patent or copyright or misappropriate a trade secret, and will indemnify for damages, costs and fees awarded or agreed, with named remedies of procuring the right to continue, modifying the services, or terminating and refunding. Cap: total liability is limited to the greater of the fees paid in the twelve months before the claim or two hundred thousand dollars, which is a floor rather than a ceiling for smaller subscribers and is the highest published floor located in this pull. Carve-outs: the cap expressly reaches claims arising from a security breach affecting subscriber data caused by breach of the Security Addendum or the DPA and from breach of confidentiality obligations, gross negligence and intentional misconduct sit outside the limitation where law prohibits limiting them, and the infringement indemnity sits outside the cap entirely. Insurance: the agreement commits Filevine to maintain industry-standard insurance from carriers rated A minus, VI or better by A.M. Best, which is a stated quality floor and the only insurance commitment located in any agreement in this pull. Alongside those sit an affirmative warranty that the services will substantially conform to documentation, not knowingly infringe and comply with applicable law, and a 99.0 per cent uptime commitment with a published three-tier credit table. Output itself carries no warranty and is carved out of the indemnity, which the note records so the picture is complete.

Real integrations, named individually and grouped by what they do, short of the depth an implementer could work from. The pricing matrix names twenty-one connectors by name as a tier-differentiated feature list, and the machine-readable company page groups them by function with a line on each: LawPay for payments; QuickBooks Online, Milestones and Lead Docket for practice operations; EvenUp, Novo and Practice AI for AI-generated demand letters and case summaries; Arctrieval for medical and billing record requests; Case Status, Hona, Kenect and RingCentral for client communication, calling and fax; Dropbox, Google Drive, Microsoft Word and OneDrive for documents; Google and Outlook calendars; and Zapier. Direction is described for the few where it matters most, Novo syncing completed documents back to case files and Arctrieval syncing records and provider details directly to cases, and the LawPay relationship is deeper than an integration, being a sister brand embedded for IOLTA-compliant trust handling. API Access is published as a named Advanced-tier feature and flagged as new. What holds it off A is documentation. No public API reference for CasePeer was located; the developer portal on the parent's estate documents the payments and merchant referral APIs and is not this product's interface, and crediting it here would be the one-fact-two-axes error. For most connectors nothing states what objects move, in which direction, or what a firm must configure, and the vendor describes its API library as growing rather than as a specified surface. Verified 12 September 2026.

Real integrations exist and are named, with the depth left to a page that was not opened. The most substantive is LOIS for Word, which puts drafting and standards-enforced redlining inside Microsoft Word with source-linked recommendations, so the AI reaches the application where the document is actually written rather than requiring a trip to a separate system. Microsoft 365 integration is reported, DataBridge is published as a package extension giving secure real-time access to Filevine data, Vinesign has a public API for embedding e-signature into other workflows, and the platform advertises native and partner integrations as a purchasable extension. The agreement confirms API access is granted and makes the subscriber responsible for activity through it. Deposition scheduling includes court reporter booking and automated Zoom link generation, which is an operational integration into how the work is actually run. What is not established is what any of these move, in which direction, or what a firm must configure: the dedicated integrations and API page was not opened on 31 Aug 2026, and no developer documentation, endpoint list or connector catalogue was read. Nothing was located for iManage, NetDocuments or e-billing.

Cloud delivery is stated outright and neither the tenancy model nor the region is published, which is the C band. What is published is the host and the backup practice: the pricing matrix carries securely hosted with AWS and automated rolling backups as named security features, and the pricing FAQ repeats that data is hosted and backed up with Amazon Web Services in a certified environment. Naming the cloud provider is infrastructure, and under the ground rules infrastructure is not tenancy and not residency, so it lifts this record off D by making delivery explicit rather than implied and does no more than that. Everything the band asks for above that is absent from every surface read. No region or availability zone is named, no residency option is offered or refused, and nothing addresses whether a firm's data can be held in a particular country, which is a live question for a platform sold in both the United States and Canada under an agreement that names both. No tenancy model is described, so a buyer cannot learn whether the deployment is multi-tenant or isolated, and nothing distinguishes where data is stored from where it is processed. The processing question has a specific edge here that nothing answers: the agreement discloses that the LLMs behind 8am IQ may hold prompts and outputs for up to thirty days, and never says where those models run. One retrieval fact belongs on the record and does not carry the grade: the trust centre at trust.8am.com is Vanta-hosted and returned page metadata with no body to this index's fetcher on the date shown, a documented persistent limit rather than a fault of the site. Verified 12 September 2026.

Reading the Data Protection Agreement supplied the processing location and the cross-border framework that were missing. Delivery is cloud, hosted on Amazon Web Services, which the vendor names on both the case management page and the pricing FAQ, and separate United States and Canadian login domains imply a distinct Canadian instance. The DPA adds what the marketing did not. Annex A identifies the data importer as Filevine, Inc. at 1260 Stringham Avenue, Suite 600, Salt Lake City, Utah, so a European or British subscriber can see which entity in which jurisdiction receives its data, and a Data Protection Officer is named as the contact point. Cross-border transfers are governed rather than assumed: the European Commission's Standard Contractual Clauses and the UK Information Commissioner's international data transfer addendum are both incorporated, with the operative provisions completed, the docking clause disapplied, and competent supervisory authorities enumerated for EU member states, the United Kingdom via the ICO, and Switzerland via the Federal Data Protection and Information Commissioner, with the CNIL as the default. Government access requests are to be notified to the subscriber only, not the data subject. What is still not published is the residency choice itself: no list of available regions or data centre locations, no option a subscriber can select, no tenancy model, and no statement distinguishing where data is stored from where model inference runs, which matters because third-party AI providers process subscriber data. The Security Addendum was not opened.

Certification is real, named and current, and the evidence behind it is not reachable without a request, which is the B band. Two attestations are claimed in the vendor's own voice and named with specificity rather than displayed as badges: SOC 2 Type 2, stated to be currently attested with the report available through the trust centre, and PCI DSS v4.0.1 compliance through the embedded LawPay payment integration, alongside IOLTA trust accounting compliance by the same route. Around them sits a control inventory published in unusual detail for a record at this grade, covering infrastructure, application access, operational security including annual third-party penetration testing with SLA-bound remediation and annual control self-assessments, and personnel and governance controls including background checks, confidentiality agreements, an annual board briefing on cybersecurity and privacy risk, and a whistleblower channel. C does not fire: these are explained claims answering direct questions, not unsupported marks on a page. R16 is satisfied in the crediting direction and by both connectors, the parent's agreement naming 8am CasePeer expressly as a covered Practice Management Solution, and this product's own footer linking the parent's trust centre as its Security surface. What is missing for A is the evidentiary apparatus and a reachable route to it. No auditor is named, no report period or observation window is given, and no certificate or report number is published. The trust centre is Vanta-hosted and returned metadata with no body to this index's fetcher, so the access flow could not be observed; the vendor's own description is that the SOC 2 report, the PCI attestations, a security questionnaire and a certificate of insurance are available upon request. R5 governs where the portal cannot be read: describe what was seen and grade the lower tier. Verified 12 September 2026.

Reading the Data Protection Agreement moved this row. The certification claim was always broad, covering SOC 2 Type II, SOC 3, HIPAA, CJIS, HITECH and GDPR, with a structured security page reached from the platform navigation under governance and risk, industry compliance, access and identity security, and data protection. What was missing was any way for a buyer to get behind it, and the DPA supplies that contractually. Filevine commits to retain an independent third party at least once per year to audit its data processing practices and its information technology and information security controls for the facilities, infrastructure and systems used to process personal information, which is a stated scope and a stated cadence. On the subscriber's written request it will make the relevant audit reports available for review, subject to confidentiality, which is a route to the report rather than a promise of one. It commits to address any issues or exceptions raised in those audits through a management corrective action plan. If it has not conducted an audit in the past year, or declines to share the reports, the subscriber acquires a direct audit right on 21 days' notice, extending to records, systems, facilities and meetings with relevant personnel. And separately it agrees to respond in writing to a subscriber security questionnaire once a year, within six weeks of receipt. What is still absent is the paperwork a buyer would ideally see without asking: no auditor is named, no report date or coverage period is published, and the certification claims themselves carry no scope statement. The security page and Security Addendum were not opened.

The vendor confirms that large language models sit underneath and identifies none of them, which is the C band. The agreement is candid that models are involved and vague about whose: the Tool Terms state that 8am IQ is enabled via large language models and that the LLMs used to provide it may retain IQ Content for up to thirty days. No model is named, no version is given, no provider is identified, nothing states where inference runs, and no commitment to notify customers when any of it changes was located. There is no subprocessor list anywhere on either estate that would answer the question by another route; the only third parties named in the agreement are payment processors. The sharper point on this row is a contradiction between the marketing and the agreement, and R37 rule 1 resolves it against the marketing. The AI page tells a buyer there is no third-party AI. The agreement tells the same buyer that the LLMs the vendor uses may retain their content for thirty days, and separately prohibits the customer from using IQ Content to improve any AI system whether developed by the vendor or a third party. Read together the agreement contemplates third-party models, and a buyer relying on the page would be wrong about who processes their clients' case notes. One adjacent disclosure is recorded and expressly not credited to this vendor's own supply chain, because it answers a different question: the Tool Terms name Claude as an example of a third-party service that is not an 8am AI feature and is governed by the customer's own agreement with that provider. Verified 12 September 2026.

The agreement confirms third-party models are in the stack and never says whose. Section 3.1 states that AI-enabled features use artificial intelligence including models provided by third-party AI providers, and section 4.3 commits Filevine to maintaining a list of permitted models for use in those features. A commitment to maintain a list is not a commitment to publish one, and no model, provider or version was located on any page read on 31 Aug 2026. One tension belongs on the record: the AI principles page states that Filevine's AI is proprietary, while the agreement describes models provided by third-party AI providers, and nothing published reconciles the two. What is disclosed instead is the contractual treatment of those providers, which is strong on its own terms, prohibiting them from training on subscriber data and from retaining it beyond the applicable request except temporarily for abuse monitoring. No change-notification commitment specific to models was located, though the general update clause requires thirty days' notice for material changes and bars reduction of security or confidentiality commitments mid-term. A Subprocessors page is published at a public URL and was not opened; it is the most likely place a provider is named and could move this grade.

A buyer can learn what this costs without entering a sales process, which is the A band, and the tier contents are published at a level of detail few records match. Rates: Basic at 79 dollars, Pro at 119 dollars and Advanced at 149 dollars, each per user per month, stated on the pricing page and repeated as a direct answer in the pricing FAQ. The unit is named and its consequences are explained, the vendor stating that there is no limit on how many attorneys and staff may use the platform and that the rate depends on the number of active users on the account. The structure is set out in a comparison matrix running to roughly seventy rows across nine groups covering case management, automation, intake and CRM, communication, security, administration, services, integrations and AI, with items marked as included, optional or add-on tier by tier, so a buyer can see precisely what a tier upgrade buys. What implementation adds is answered rather than left open: no long-term contract and no setup fee, tier changes in either direction at any time and prorated, cancellation at any time, guided implementation and live training included, with e-signature and data migration named as optional add-ons. The AI is priced honestly within that structure, 8am IQ being included with Pro and Advanced at no additional cost and absent from Basic, which is stated on the pricing page, in the FAQ and on the AI page alike. Two limits are recorded and neither displaces the grade. Add-on prices are not published, so the cost of e-signature and data migration is not knowable in advance. And the agreement reserves additional fees where usage exceeds thresholds identified in the pricing pages or an order form, without publishing the thresholds. Verified 12 September 2026.

The shape of the purchase is published in unusual detail and no figure appears anywhere. The pricing page sets out the full modular structure: a LOIS tier with seven named components, and four platform packages covering Matters, Intake, Depositions and Signatures, each broken into named features, plus five Matters extensions for analytics, deadline management, a client portal, data access and integrations. A buyer can therefore see exactly what is bought separately, which is the practical question in a modular product. A genuinely free tier is published with its limits stated, LOIS Explore, requiring no credit card, offering document upload and questioning, AI drafting with results cited to source, legal research and the opinion reader, and expressly excluding the case management connection. The agreement adds real commercial mechanics: interest at the lesser of 1.5 per cent per month on amounts more than ten days overdue, suspension rights at ten days, a ten-day window to dispute a charge or waive it, usage telemetry with retroactive invoicing at list rates if entitlements are exceeded, and non-refundable fees outside a warranty or breach termination. One cost disclosure is unusual and creditable: implementation, configuration and data migration are stated not to be provided by Filevine at all but by separate certified Implementation Providers under their own agreements and fees. What is nowhere published is a number, at any tier, and every route to one is a demo or a custom quote.

Who this product serves is documented precisely, with the boundary stated rather than implied, which is the A band. The segment is named and named exclusively: plaintiff-side personal injury and mass tort law firms, from solo practices to multi-location operations, a statement the vendor repeats as the organising claim of the product rather than as a marketing line. Roles are enumerated individually and the platform is priced and packaged around them, the audience being managing attorneys and firm owners, case managers and paralegals, legal intake specialists, and operations and firm administrators, each of which also appears as a persona the tiers are described against. Practice coverage is not asserted broadly but demonstrated through the data model, the published feature set being specific to the personal injury case lifecycle: medical treatment tracking and provider management, injury tracking, lien and letter-of-protection tracking, a settlement calculator with distribution and expense tracking, case grading, custom mass tort tracking and statute-of-limitations alerts. The limits are stated directly, which is the limb most records leave open. The vendor defines the product against generalist platforms in terms, saying that where generic legal platforms try to serve every practice area this one is purpose-built for plaintiff-side personal injury, and that generalist tools require firms to retrofit workflows. The agreement adds a jurisdictional boundary, the platform being for professionals located in the United States and Canada. R15 applies to the band's reference to in-house and government use: neither is applicable to a plaintiff contingency product and neither is claimed, and the record is not credited or penalised for them. Verified 12 September 2026.

The most extensively documented segment coverage in this pull, and no boundary anywhere. Seventeen dedicated segment pages are published across four dimensions. By practice area: personal injury, family law, mass torts, immigration, insurance defence, criminal defence and estate planning. By government tier: prosecutors, public defenders, states and municipalities, attorneys general, and federal agencies, which is the widest public-sector treatment located in the pull and is reinforced in the agreement by clauses addressing sovereign immunity, anti-indemnification statutes, constitutional limits on multi-year obligations, and FAR and DFARS commercial software designations. By corporate use: in-house counsel. By firm size: solo, small, mid-size and big law, each with its own page. Product coverage is equally specific, with ImmigrationAI stated to handle documents in 170 languages and Timely generating court deadlines for any jurisdiction in the country. What is absent is any statement of limits: no practice area, matter type, jurisdiction or scale is identified as unsupported, and the deadline claim of any jurisdiction in the country is asserted without a coverage table behind it. The individual segment pages were not opened on 31 Aug 2026.