Casepoint vs Reveal: how they compare in 2026

CaseAssist Active Learning learns from reviewers' decisions to put likely relevant documents first, and the vendor ties its claim of 95 percent faster identification to it. Generative features add chat over customer data, summaries and automatic classification. Without the AI, a full eDiscovery platform remains: legal hold, collection from Microsoft 365, Teams, Slack and Google Vault, processing of more than 600 file types, review, production, FOIA work and hosting at government authorization levels. The AI is bundled at no extra cost rather than sold on its own, and the vendor leads with security and unified workflow, with AI third.

NexLP and its data science team became Reveal AI, Brainspace brought visual analytics and concept search, and Reveal 11 was released as the integration of Brainspace, Reveal AI and Reveal Review into one platform. Capability spans supervised and unsupervised learning, deep learning and natural language processing, with a library of more than 30 reusable prebuilt models, custom models customers train, predictive scoring, concept clustering, translation and transcription, sentiment analysis, and generative review on aji, the review engine generally available since 30 September 2025, alongside the earlier Ask feature. The review tool was assembled around the models, and most of the product depends on them.

Generative answers use retrieval augmented generation over the customer's own data, with source citations, so a reviewer can open the document behind an answer. The agreement names five limits of its AI: training data quality, errors from vague prompts, nuance and sarcasm in language, factual inaccuracy, and lack of common sense. Casepoint IQ describes sample validation before a full agent run, reviewer approval and recall and precision reporting, without publishing a general accuracy figure. The terms also bar customers from sharing benchmark results without written consent.

aji, Reveal's generative review engine, gives reasoning inside the document for every generative rating and citations in the text on positively rated documents, which the documentation frames as opening the AI black box. It also ships a two stage measurement workflow. A Calibration Review compares the reviewing attorney's own coding decisions against generative ratings on the same sample and reports an Agreement Rate, and a low rate sends the user back to refine the definition. An optional Validate stage then runs against a larger random set drawn outside the calibration sample to confirm the ratings hold. Every figure is produced by the customer on its own matter and none is published. No vendor accuracy figure, precision or recall number for the prebuilt models, aji or Ask, hallucination rate, test set or independent benchmark is published. Reveal calls its predictive scores accurate without publishing a number.

Casepoint states that its technology should amplify human judgment, not replace it, and the agreement commits to human in the loop AI features. Every generative feature is optional, and the customer controls adoption. Reviewers get source citations on generated answers, and transparency logs are said to record every AI decision. Active learning is supervised by design, since reviewers' own calls train it. The agreement also tells customers not to rely solely on output for anything with material consequences. No threshold at which a feature declines to answer, no behavior when the data does not support a result, and no route for reporting a wrong output is described.

Much of the AI is trained by the customer. A user builds custom models as easily as creating a tag, trains them through batches the AI selects, evaluates effectiveness after each training round, and uses interactive simulations to decide when training is sufficient. That leaves the decision on whether a model is good enough with the customer and gives them the instrument to make it. Predictive scores prioritize review rather than replacing it, and Ask returns supporting materials alongside its narrative answer. Nothing published sets a threshold at which a model is fit to rely on, says what Ask does unaided, or states what Reveal commits to when an output is wrong.

Marriott International, Mayo Clinic, the West Virginia Office of Technology, Kramer Levin, Beveridge & Diamond, Larkin Hoffman and Lewis Roca are named as customers, with named people and titles. Lewis Roca, an Am Law 200 firm, is tied to a measured result: more than 90 percent less document review time from the analytics and AI. Other case studies report a 57 percent cut in discovery related costs at a Fortune 500 construction company, faster FOIA responses at a major defense agency, and a migration of up to a petabyte at a federal regulator. Casepoint states more than 250 government agencies and about 80 percent of federal agencies as customers. Most measured results name a category rather than a customer.

A service provider partner publishes an account of the full platform in use, covering legal hold, processing, early case assessment, review, Reveal AI and Brainspace, and an attributed practitioner testimonial appears on the vendor site. Corporate history is documented with checkable specifics, including a $250m investment from K1 Investment Management and a sequence of named acquisitions. None of that is a deployment outcome. No named customer paired with figures and a date, no case study with a method that can be assessed, and no adoption count appears on the platform pages, the why Reveal page, the blog or the resources index.

Confidential information, as the agreement defines it, includes attorney work product, attorney client privilege, personal data and health data. A separate AI clause makes AI inputs and outputs customer data and confidential information, limits their use to running the service, and commits AI features to enforce the customer's access and matter permissions. It also prevents retrieval across tenants or matters and logs administrative access. Casepoint staff may review AI inputs or outputs only for customer requested support or a security incident, with time limited, audited access. Remote support needs the customer's own enablement and multi factor authentication. Another clause gives Casepoint a transferable license over customer data and usage data to improve its products, and the AI clause carves out only AI inputs and outputs.

Reveal publishes a security and data privacy white paper addressing the Ask feature and the use of generative AI, behind a form. It commits to the confidentiality and integrity of customer data, backed by ISO 27001 and SOC 2 Type 2 certification. Private deployment inside the firewall is offered as an architectural answer to confidentiality, letting an organization keep discovery data inside its own perimeter with integration to internal authentication and logging. Granular audit logging and role based access controls are published. Reveal's own buyer guidance lists whether documents are used to train third party AI models among the questions to put to a vendor, and its public pages state no position of its own on that. Retention terms are not published either.

Customers are told not to rely solely on any output, including AI output, for anything with material consequences or that affects anyone's rights, under Casepoint's agreement. It makes the customer responsible for the completeness, accuracy and content of the results it relies on. Human in the loop is a stated commitment, and the vendor says technology should amplify human judgment. No bar or ethics authority is named, including ABA Formal Opinion 512, no jurisdiction limits are stated, and nothing addresses the duties of the reviewers who act on the output. The product has no consumer facing surface.

Users are law firms, corporate legal and compliance teams, government and alternative legal service providers, with no consumer offering. The product analyzes collected evidence rather than giving advice, so the question of where advice begins arises less sharply than for a research or drafting tool. The platform pages, the why Reveal page, the blog and the Academy pages publish no position on advice versus tooling, no treatment of competence or supervision duties as professional obligations, and no jurisdiction limits, although translation and transcription across multiple languages imply work across borders. Reveal Academy runs user certification courses across platform functions, which addresses operator competence as a commercial matter rather than as a professional duty.

TRUST, the AI framework, has five principles, and Casepoint's terms turn several of them into commitments. The terms limit how AI inputs and outputs may be used, restrict staff review of them, require AI features to respect the customer's access and matter permissions, and require logging of administrative access. Transparency logs are said to record every AI decision. Customers above a stated spend get an annual audit right over privacy and security controls. No fairness testing, testing regime or accountable owner is published, and nothing addresses whether review ranking can be uneven across custodians, languages or document types.

Reveal states three pillars of an AI pledge, Trust, Knowledge and Security, and publishes guidance on choosing generative AI tools. That guidance lists questions for a vendor: whether documents train third party models, how access controls and audit logging work, how data residency is handled and what certifications a vendor holds. No AI governance framework, AI management certification such as ISO 42001, named owner of model governance, testing regime before release, or account of uneven output across matter types, parties or populations appears on the platform pages, the why Reveal page, the blog or the trust center. Reveal ships more than 30 prebuilt models that categorize documents by human behavior, including harassment and discrimination, and publishes nothing on how those models were validated or how they behave across populations.

Casepoint commits to written notice within seventy two hours of a validated security incident, with updates on cause, mitigation, impact and remediation. On termination it exports all customer data in a common format within a seven day window, and states that copies may persist on backup media. Access controls include role based access, zero trust networking, encryption in transit and at rest, and no standing remote support access. Staff face ten year criminal background checks and OFAC screening. Disaster recovery plans are tested every year. The agreement promises a subprocessor list, and none is published.

Reveal publishes ISO 27001 certification with a 2025 audit completed and the certified products listed, SOC 2 Type 2 with documentation available to enterprise clients, CSA STAR and GDPR compliance, granular audit logging and role based access controls built into the platform, end to end encryption, support for data residency requirements in regulated jurisdictions, and private deployment inside the customer's firewall. A SafeBase trust center at a stable URL carries the security posture and a route to request documentation. Its published control set includes defined and implemented breach notification processes and policies reviewed at least annually. No retention period or deletion control for customer data, prompts or Ask outputs is stated, and no subprocessor list is named.

The general cap is the fees paid under the relevant order in the six months before a claim. A higher cap of five times annual fees, plus direct damages, applies to confidentiality breaches, data breaches, gross negligence and willful misconduct. Personal injury, fraud and anything that cannot be excluded by law are carved out. Casepoint defends and indemnifies against claims that the software infringes a copyright in the United States or misappropriates a trade secret, with named remedies. The software is warranted to perform substantially as documented for sixty days, services are warranted as workmanlike, and uptime is committed at 99.5 percent with service credits. No warranty attaches to AI output, the agreement puts accuracy on the customer, and no insurance position is published.

Reveal publishes SaaS terms with an intellectual property indemnity, a liability cap of fees paid in the preceding 12 months and broad exclusions including data loss and security breaches. The terms disclaim accuracy warranties and require claims within one year. Reveal does say it works to make costs clear and predictable, framing the problem as an unexpected bill reaching a partner or client, which concerns commercial risk to the customer rather than liability for output.

Microsoft 365, Microsoft Teams, Slack and Google Vault are collected in place without manual export, through connections into the systems where data lives, with more than 600 file types in processing. An API automates collection from those platforms. The MCP Server connects a customer's own approved AI systems to the platform. No iManage or NetDocuments integration is named, nothing covers matter management, ebilling or court filing, and no public API documentation is published. The terms restrict use of APIs Casepoint does not support.

The main published statement concerns private deployment, where the architecture is said to allow deep integration with internal authentication controls, logging frameworks and enterprise security policies. That is integration at the identity and audit layer rather than the file layer. Processing handles more than 900 file formats, which reduces the ingestion problem a connector would otherwise solve. No integrations index, no named connector for collection sources such as Microsoft, Google, Slack or Box, and no API documentation appears on the platform pages, the why Reveal page, the blog or the resources index.

Deployment comes three ways, hosted by Casepoint with 99.5 percent uptime, installed by the customer or a third party under named conditions, and in separately certified government environments. SOC 1, SOC 2, SOC 3, ISO 9001, ISO 27001 and NIST apply to the commercial offering, and GovRAMP, FedRAMP Moderate and High and Department of Defense Impact Levels 4 to 6 to certain environments. Residency is committed for export controlled data, which stays in environments Casepoint controls in the United States, with no replication abroad and access only by American persons. No region list for the commercial offering, tenancy model, or split between where data is stored and where it is processed is published. A Canada government offering appears in the navigation with no residency statement.

Three deployment models are published: cloud, hybrid, and private deployment inside the firewall, where discovery data stays within the organization's own perimeter. Private deployment is an area of active investment rather than a legacy option. Reveal announced it had expanded that investment by 50 percent on stated enterprise demand, and published material on how it works, covering secure infrastructure, scalable performance, consistent compliance inside the firewall and integration with internal authentication and logging. Data residency is addressed directly as support for residency requirements in regulated jurisdictions, and Reveal's own buyer guidance tells readers to insist on data locality options because data sometimes must stay within a region or country. The available cloud regions and the tenancy model for the hosted option are not published.

Casepoint holds fourteen certifications and authorizations, each explained on its security page. They are FedRAMP High and Moderate, Department of Defense Impact Levels 4, 5 and 6 with DISA authorities to operate, GovRAMP, SOC 1 Type II, SOC 2 Type II, SOC 3, the SIG questionnaire, ISO 9001:2015, ISO 27001:2022, NIST 800-53, NIST 800-171 and the Data Privacy Framework between the EU and the United States. FedRAMP and DISA authorizations are assessed by third parties and listed by the authorizing bodies, so they can be confirmed without a sales call. The SOC 2 Type II is described as annual, covering all five Trust Services Criteria over twelve months. The agreement restates the set and says which apply to the commercial offering and which to certain environments. No auditor is named for the SOC or ISO work, and no report date is shown. Reports are available to customers on request.

Named credentials are ISO 27001, SOC 2 Type 2, CSA STAR and GDPR compliance. The trust center announces completion of the ISO 27001 audit for 2025 and lists the products certified, which shows what the certificate covers. A SafeBase trust center at a stable URL offers a self serve route to request security documentation, and SOC 2 Type 2 documentation is stated as available to enterprise clients. That is a request flow rather than a sales gate. The SOC 2 audit coverage period, the auditing firm for either certification and the ISO 27001 certificate expiry are not published.

Generative answers use retrieval augmented generation over the customer's own data. The agreement names machine learning, technology assisted review and large language models as the technologies in use. It commits Casepoint to license third party software properly, patch it, and keep a list of material third party components and subprocessors; that list is not published. No model, provider, version or inference location is named, and no notice is promised when a model changes. The separate MCP Server lets a customer connect its own approved AI systems.

Models are built in house through the Reveal AI lineage from NexLP, and there is a proprietary model library, custom models trained by customers and Brainspace analytics, all owned rather than rented. What sits behind the Ask generative feature is not published. The platform pages, the why Reveal page, the Ask resource page description, the blog and the trust center name no large language model or provider, say nothing about where generative processing runs, list no subprocessors, and make no commitment to notify customers when the supply chain changes. Reveal's own buyer guidance raises whether documents train third party AI models, which implies third party models are involved without saying whose.

The pricing page is titled Transparent Pricing and gives no price. It does publish the shape of the deal: a modular platform priced to the applications a customer takes, with no charge for products it does not use. The purchasable modules are named across the site, from eDiscovery and Legal Hold to FOIA, Casepoint AI and the MCP Server. The agreement adds billing mechanics. Fees are the greater of actual usage or the agreed cap, metered on data storage, processing and users. Terms run one year and renew automatically unless either side gives sixty days' notice. No rate, per gigabyte or per user figure, or starting price is published. The only route is a demo request.

Reveal's demo page offers pay as you go or subscription pricing with unlimited users and describes Ask as an add on. No rate or metering unit is published, and a quote requires a sales conversation. One published commercial statement addresses the buying experience without giving a figure: Reveal states it works with customers to make costs as clear and predictable as possible, framing the problem explicitly as the unexpected bill a practitioner has to take to a partner or client. That is an acknowledgment of the cost predictability problem in ediscovery rather than a disclosure of price.

By market Casepoint serves federal civilian, federal defense, state, local and education, Canada, and corporate enterprise. By team it serves corporate legal, government legal, FOIA and public records, audit and investigations, and IT and security, with a separate law firm page. Use cases include legal hold, investigations, litigation, eDiscovery, data subject access requests, third party subpoena responses, FOIA requests and congressional inquiries. It processes more than 600 file types from named sources. No excluded practice area, unsupported data source or volume limit is named on the platform, pricing or security pages or in the site navigation, and the Canada offering is not described.

Practice scope runs across the EDRM from preservation and collection through processing, early case assessment, review, analytics and production, with more than 900 file formats, translation and transcription across multiple languages, and an interface that can be localized. Investigation types are listed concretely through the model library, with more than 30 prebuilt models for recurring matters and harassment and discrimination named specifically. Segments addressed include law firms, corporate legal and compliance, and alternative legal service providers, and customers may run work themselves or through a provider. Segmentation by firm size, jurisdictional coverage stated as such, adoption figures and any statement of what the platform is not built for are not published.