DeepJudge vs Midpage: how they compare in 2026

There is no content asset and no conventional product underneath. Unlike the other research records in this lane, DeepJudge licenses nothing and publishes nothing of its own: the material it works on belongs entirely to the customer and stays in the customer's systems. What DeepJudge supplies is the retrieval itself, described as intent-based search that understands content, context and relevance, with automatic classification into a taxonomy and near-duplicate and redline detection across collections the vendor describes as billions of unstructured and structured data points. Strip the models out and what remains is a set of connectors and a permissions synchroniser, which is plumbing rather than something a firm would buy. The founders' own framing, that search rather than models is the wedge, is a claim about which machine learning matters, not a claim that machine learning is peripheral. Verified 2 September 2026.

The artificial intelligence is the product. Midpage is a legal research and brief generation platform where retrieval, synthesis and drafting are all model driven; there is no underlying workflow or document management system that would remain if the models were removed. The company was founded in 2022, after the generative wave rather than before it, and the product is distributed both standalone and as an integration inside ChatGPT, which is a distribution model only an AI native product can have.

Grounding is structural rather than asserted: every result is a document the firm already holds, in its own system, which the user can open and read in full, so the verification path is the shortest of any record in this pull. The retrieval method is described at a working level, covering intent-based search, automatic taxonomy classification, near-duplicate and redline detection, and multi-level combination of client, matter, document and people data. Section 4(j) of the subscription terms places a contractual obligation on the customer to verify, including through human review, the accuracy, reliability and appropriateness of the AI features. What is absent is measurement. No accuracy figure, evaluation, test set or benchmark appears anywhere, and nothing addresses hallucination in the workflow and agent layer, which is where generated text rather than retrieved documents is produced. The one published number nearby is a satisfaction measure, that 90 per cent of users report finding results faster than with existing tools, which is not an accuracy claim. Verified 2 September 2026.

Independently measured accuracy with a published methodology and published per criterion figures, the second such record on the index. Midpage submitted its standalone research product to the 2025 Vals Legal AI Report legal research study, run by an outside evaluator. The evaluator published its rubric and weights in advance: accuracy at 50 percent, authoritativeness at 40 percent, appropriateness at 10 percent, across 200 United States legal research questions sourced from attorneys at named firms including Reed Smith, Fisher Phillips, McDermott Will and Emery, Ogletree Deakins, Paul Hastings, and Paul Weiss. Midpage scored 78 percent accuracy, 74 percent authoritativeness and 70 percent appropriateness, a 76 percent weighted aggregate, beating the lawyer baseline by 7 points on accuracy and 6 on authoritativeness. Those figures sit on the evaluator's own site and are checkable by an outsider without reference to any vendor claim. The evaluator also published the failures, which is why this is a strong A rather than a marketing one: it recorded three cases where Midpage returned no response at all due to technical issues, and eight cases where it explained it could not locate supporting documents. Also recorded from the same source: all evaluated systems, this one included, underperformed a generalist model when asked to survey all fifty states for a single statute, and struggled on multi jurisdictional questions generally.

The human review requirement is contractual and the excluded uses are unusually explicit. Section 4(j) requires the customer to verify the accuracy, reliability or appropriateness of AI features through human review, and the same clause prohibits use in judicial decision-making by judges, in the professional activities of lawyers serving as arbitrators, mediators or other alternative dispute resolution neutrals, and in any use restricted under the EU Artificial Intelligence Act. Naming the roles that may not use the product is rarer and more useful than the usual disclaimer. What is not published is the operating boundary. The workflow layer is described as agentic reasoning that executes complex multi-step tasks, retrieving from multiple sources and taking actions, and the customer builds those workflows itself using a low-code builder, so the threshold at which a workflow acts without a human is set by the firm and described nowhere. Governance of agents is offered as a capability without any account of what the governance controls are. Verified 2 September 2026.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. No published position was located on what the system does unaided, what a lawyer must review, where a workflow stops, or what the vendor commits to when an output is wrong. The evaluator's report records that the product sometimes explained it could not locate supporting documents rather than answering, which is observed behaviour rather than a published oversight model, and it was not treated as one. Rebuttable with a single link to any published statement on human review.

Sixteen firms are named on the home page, spanning global elite practices including Freshfields, Greenberg Traurig, Holland and Knight and Gunderson Dettmer, United States mid-market firms including Cozen O'Connor, ArentFox Schiff and Vorys, Swiss and Austrian practices including Homburger, Lenz and Staehelin, Wenger Vieli, Advestra, Schoenherr and CMS Switzerland, and one in-house function at SBB. Three named individuals speak on the record with title and firm, including two chief innovation officers. Figures are published: 65 hours saved per user per year on searching, 85 per cent adoption within two months, 23 queries per user per day, fourfold return in the first year, and 90 per cent reporting faster results. One figure is properly attached, with a named M&A partner at Homburger stating that more than 80 per cent of the firm's legal professionals had incorporated it into their workflow. What holds this below A is that the headline figures are aggregate and carry no method or measurement basis, and no dates appear on the home page; the individual customer story pages were not opened this pass. Verified 2 September 2026.

Independent benchmark performance stands where deployment evidence would go. The strongest evidence attached to this vendor is measured test set performance from an outside evaluator, which is real and unusual but is not a production outcome: it shows how the system performs on 200 constructed questions, not what changed at a firm that adopted it. Searched the vendor site, the product pages and third party coverage on 29 Aug 2026 and located no named customer, no case study pairing an organisation with figures and a date, and no assessable deployment method. The evaluator does record that the study questions were sourced from attorneys at named firms, but those firms contributed test material rather than being disclosed as customers, and the two must not be conflated.

Four of the five limbs are met, and the segregation limb is met better here than by any other record in this pull. Section 5(b) of the subscription terms provides that DeepJudge does not use customer data to train the AI or machine learning models underlying the services, which is a contractual prohibition naming the thing rather than a policy statement. Segregation is the product's architecture rather than a claim about it: access permissions are continuously synchronised with the firm's source systems so that existing ethical walls are maintained, which is the matter-level requirement a firm buyer needs, and section 5(e) adds that customer authored workflow logic will not be disclosed or incorporated into the service provided to any other customer. Retention and deletion are stated, with customer data deleted within sixty days of termination. The position on model providers is answered structurally, since the firm selects the models and the hybrid deployment clause discloses exactly when processing leaves the firm's own infrastructure. The limb that fails is privilege and work product handling: neither term appears anywhere, and ethical walls address conflicts rather than privilege. Verified 2 September 2026.

CORRECTED 29 Aug 2026 during the trust portal sweep. Previously graded D on the finding that nothing at all was located on how client confidences are handled. That was wrong: the vendor publishes a security page which was not reached in the original pass, and it answers two of the three limbs this axis tests more precisely than most records here. Training is addressed at both layers and in the negative: Midpage does not use customer data to train or fine tune AI models, and its agreements with AI model providers do not permit those vendors to train on Midpage customer data. Retention is published with actual periods rather than in general terms: web app data including user queries, uploaded materials and generated outputs is held while an account remains active and deleted within 60 days of account deletion or a valid deletion request; for plugins and integrations no submitted queries, uploads or outputs are stored at all, though those workflows may share queries with model providers who may retain them for up to 60 days. Disclosing the model provider retention window rather than only its own is unusually candid. Encryption is specified as AES-256 at rest and TLS 1.2 or higher in transit, and subprocessors are contractually required to maintain measures no less protective. Controls are stated to be independently validated through an annual SOC 2 Type II audit. Held at B rather than A because the third limb is unaddressed: no segregation model between customers, users or matters was located, and attorney client privilege and work product are not treated directly.

This is the most complete professional responsibility position located in the pull, and all of it sits in the operative agreement. Section 4(j) states that DeepJudge is not a law firm and does not engage in the practice of law and that the customer acknowledges it is not relying on the services for legal advice. It states who may use the product and, unusually, who may not, prohibiting use in judicial decision-making or other activities performed by judges, and in the professional activities of lawyers serving as arbitrators, mediators or other alternative dispute resolution neutrals. It reaches competence and supervision through a positive obligation rather than a disclaimer, requiring the customer to verify the accuracy, reliability or appropriateness of the AI features including through human review. And the legal boundary is stated twice: section 4(a) confines use to compliance with the obligations applicable where the customer and its users are located, and section 4(j) excludes any use prohibited or restricted under the EU Artificial Intelligence Act, naming the instrument. The coverage limb that asks about jurisdictional reach of legal content does not bite on a product that searches the firm's own documents rather than any jurisdiction's law, and is recorded here as inapplicable rather than failed. No bar or law society guidance is engaged, which is recorded on the signal rather than here. Verified 2 September 2026.

The stated audience is litigators and law students, which is a lawyer and trainee population rather than a consumer one, and the vendor is explicit about it. That student audience is worth recording: it is the first record on the index whose published audience includes people who are not yet admitted, which is a professional responsibility question of a different shape rather than a UPL problem. Searched the vendor site, the product pages and third party coverage on 29 Aug 2026 and located no published position on the advice line, no treatment of competence or supervision duties, and no jurisdiction limits. Recorded at C because the audience is stated clearly while the position is not.

One binding governance commitment is published and everything around it is missing. Section 4(j) of the subscription terms makes compliance with the EU Artificial Intelligence Act a contractual restriction on use, naming the instrument and excluding the administration-of-justice applications the Act treats as high risk, which is more than a principles page and is enforceable by the customer. The workflow layer is also sold partly on governance, offering to build, deploy, orchestrate and govern AI agents. What no published material supplies is any content behind either. No responsible AI page exists, no governance framework, no individual or function named as accountable for model behaviour, no account of what is tested before a release ships, no certification such as ISO 42001, and nothing at all about uneven output across matter types, practices or populations. ISO 27001 and SOC 2 Type II are security attestations, which this axis treats as a different subject. Checked the home page, product page, security page, subscription terms and privacy policy on 2 September 2026. Verified 2 September 2026.

Submitting to independent evaluation is the governance act on this record, and it is a real one. Midpage was one of only four systems that agreed to be measured and named in the Vals legal research study, in a field where the evaluator and trade press both recorded that major vendors declined to participate and at least one participated but withheld permission to publish its results. Agreeing to publication including your own failure cases is a meaningful accountability position. But it is a point in time evaluation rather than a management system. Searched the vendor site and third party coverage on 29 Aug 2026 and located no AI governance framework, no AI management certification, no named owner of model governance, no pre release testing regime, and nothing on uneven output across matter types, parties or populations.

Amended 2 September 2026 under R42, after the data processing addendum version 1.1 of May 2026 was supplied by the operator; it had defeated both direct fetch and search on the original pass and this row was then graded B on three of five elements with two expressly not credited. All five are now established and specific, so the grade moves to A. Retention and deletion: section 3(a) of the subscription terms deletes all customer data including training data and customer models within sixty calendar days of termination, and DPA clause 11 adds prompt destruction or return on request, extending to data held by subprocessors, with confirmation of destruction. Access control: permissions continuously synchronised from source systems on least-privilege principles, access restricted to authenticated users, configurable audit logging, indexing controls over what is crawled at all, and DPA Annex 2 adding multi-factor authentication, role-based access control, centralised event logging and segregated pre-production and production environments. Subprocessors: Annex 3 names five entities with purpose and location, and clause 5 requires equivalent written terms, due diligence, vendor liability for their acts, thirty days notice before a new subprocessor processes anything, and an objection right with termination without liability. Incident practice: clause 7 commits to notice without undue delay and in any event within seventy-two hours of discovery, covering breaches at subprocessors as well as at DeepJudge, with the definition at 1.13 expressly including unauthorised internal access, plus cooperation so the customer can meet its own regulator and data subject duties. Encryption is TLS 1.2 or later in transit and AES-256 at rest, with annual penetration testing and controls audited for SOC 2 Type II. Clause 3.4 adds a purpose limitation binding subprocessors: no selling or sharing, no processing for other purposes, no retention or disclosure outside the direct business relationship, and no combining customer personal data with data from other sources.

CORRECTED 29 Aug 2026 during the trust portal sweep. Previously graded D on the finding that no retention period, deletion control, access control detail, encryption statement, subprocessor list, hosting disclosure or incident practice was located. The vendor's security page supplies most of that. Published: AES-256 encryption at rest and TLS 1.2 or higher in transit using industry standard algorithms; a stated retention and deletion practice with a 60 day outer bound following account deletion or a valid deletion request; zero storage of queries, uploads and outputs for plugin and integration workflows; disclosure that model providers may retain submitted queries for up to 60 days; a contractual flow down requiring subprocessors to maintain security measures no less protective than the vendor's own; and independent validation of the whole control set through an annual SOC 2 Type II audit. Additional detail on service providers and data handling is available on request. Not located as of 29 Aug 2026, and why this is B rather than A: a named subprocessor list as distinct from the contractual flow down, a hosting provider or region disclosure, and an incident or breach notification practice.

The whole allocation of loss is published, specific, and mutual, which is rare in this corpus. Section 7(a)(ii) caps each party's total aggregate liability at the fees paid to DeepJudge in the twelve months before the event giving rise to it, and names four express exceptions that sit outside the cap: the customer's payment obligations, breach of the use restrictions at section 4(e), fraud or wilful misconduct, and infringement of intellectual property rights. Section 7(a)(i) excludes indirect and consequential damages symmetrically for both parties, with the same carve-outs. Section 7(b) gives the customer a real indemnity running the right way, with DeepJudge defending third-party claims that the services or underlying software infringe intellectual property rights, and setting out the remedies in order: procure the right to continue, modify or replace to become non-infringing, or terminate the affected portion. There is also a service commitment a buyer can hold: section 1(a)(iii) sets a 99 per cent quarterly uptime target with downtime defined and six named exclusions. What is not offered is any warranty on output, since section 6 disclaims accuracy and completeness, and no insurance is mentioned. Verified 2 September 2026.

Searched the vendor site navigation, the product pages and third party coverage on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer terms of service was located as published on the property. Recorded as a pure absence on the surfaces reached. The exposure is worth naming: this is a litigation research product whose output is authority bound for filings, in a market where the published sanctions record for fabricated citations is growing, and nothing published addresses who bears the loss.

Integration is not a feature of this product, it is the product, and the depth is documented accordingly. The systems named are the ones firm work actually lives in: the document management system, email, SharePoint, OneDrive, HighQ, intranets and experience management and metadata systems. What moves is described in both directions. Documents are crawled and indexed in place with no migration and no uploading, so the firm's data remains in its source system; permissions travel the other way, continuously synchronised from those systems into the index; and the firm decides through indexing controls what is crawled at all. What a firm must configure is set out contractually rather than left to implementation: section 1(d) requires continued access to the customer databases named on the order form, requires a named technical contact, and warns that withholding access degrades the service, while the on-premises clause makes the customer responsible for meeting stated hardware and configuration requirements. The platform also exposes governed access to other AI systems through the Model Context Protocol and publishes an open agent handoff specification. Verified 2 September 2026.

One integration is named and none is documented, and the one named is unusual. The product is accessible inside ChatGPT through what the evaluator describes as a bespoke integration, which is a distribution channel into a general purpose assistant rather than a connection into a firm's own systems. Searched the vendor site, the product pages and third party coverage on 29 Aug 2026 and located no legal document management connector such as iManage or NetDocuments, no practice management or court filing integration, no Microsoft Word add in, and no documentation of what the ChatGPT integration passes or what an administrator configures. For a product whose buyers are litigators inside firms, the absence of any firm system connector is the notable gap.

Three deployment models are defined in the agreement itself, with the consequence of each spelled out, which is the most complete treatment of this axis in the pull. Cloud deployment hosts the services in a cloud hosting location named on the order form. On-premises deployment runs inside the customer's own infrastructure, with DeepJudge granted access to install and maintain, and the customer responsible for stated system requirements. Hybrid deployment is defined precisely as on-premises with certain processing, expressly including model processing, occurring outside the customer's infrastructure, and the clause states plainly that customer data may be processed in the cloud hosting location and that model processing may involve transfer of customer data outside the customer's systems. That is processing separated from storage, stated by the vendor rather than inferred, and it names the one circumstance in which an on-premises customer's data leaves. The security page adds that the customer runs its choice of model in its choice of residency. The limitation worth recording is that no specific regions are enumerated: residency is selectable and designated on the order form rather than published as a list. Verified 2 September 2026.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026, and ran targeted searches for security or infrastructure documentation without reaching any. Nothing was located on the deployment model at all: no tenancy statement, no hosting provider, no region, no residency option, and no statement of where processing happens. The product is evidently cloud delivered and reachable through a browser and through ChatGPT, but that is inference from how it is sold rather than a published position, and inference earns nothing on this axis.

Corrected 2 September 2026 under R42, after the data processing addendum version 1.1 of May 2026 was supplied by the operator. The original note stated that no penetration test or vulnerability assessment programme was described and called that unusual alongside two certifications. That was wrong and the document corrects it: Annex 2 records annual penetration testing, and states that controls are audited for SOC 2 Type II. The grade does not move. Two attestations are claimed and one carries its scope, with SOC 2 Type II stated as covering security, availability and confidentiality and ISO 27001 certification stated as covering the information security management system, which is more than most records in this pull offer. What the top band asks for is still absent from every surface a prospect can reach: no auditor is named, no certificate number, issue date, report date or coverage period is published, and there is no trust centre or portal. The route to evidence is a customer route rather than a public one. DPA clause 9 sets it out: certifications and audit reports or written questionnaires are made available first, and a customer audit is permitted only where those cannot demonstrate compliance, at the customer's expense, once per calendar year, with no access to systems, hosting sites or infrastructure. That is a real entitlement for a signed customer and not accessible evidence for a buyer still deciding, which is what keeps this at B.

CORRECTED 29 Aug 2026 during the trust portal sweep, superseding an earlier correction in the same session. The row was first graded D on the basis that no attestation was located anywhere, then raised to C when a customer of this vendor, GC AI, published that Midpage is SOC 2 Type II compliant. Both readings were working around the fact that the vendor's own security page had not been reached. It has now. The vendor states directly that its controls are independently validated through an annual SOC 2 Type II audit, which supplies the cadence as well as the standard, and states that on request it can provide SOC 2 documentation, questionnaire responses and additional detail on service providers and data handling. That is a published request route to substantive diligence material rather than a sales gate. The earlier observation that a buyer should not have to learn a vendor's security posture from a competitor's blog no longer applies and is withdrawn: the vendor publishes it itself. Short of an A because no coverage period, audit scope, report date or named auditing firm was located, and no trust portal exists, the route being a request to the vendor.

Amended 2 September 2026 under R42, after the data processing addendum version 1.1 of May 2026 was supplied by the operator. The original note said that not one provider was named and that no change notification commitment existed. Both are corrected: Annex 3 names Microsoft Ireland Operations Ltd, Google Cloud EMEA Ltd and AWS EMEA SARL, each described as AI provider and cloud infrastructure with location customer selected, and clause 5 commits to at least thirty days notice before any new subprocessor processes customer data, with a right to object on reasonable data protection grounds and termination without liability if the objection cannot be resolved. The grade does not move, and the reason is the shape of what is named. The three entities are hyperscaler platforms rather than model vendors: no discrete model house appears anywhere in the list, no model is named, and no default is stated, so a reader learns which cloud estates the inference runs in but not whose model produced the output. Provider-level naming does not reach the top band and platform-level naming reaches it less. What is genuinely well disclosed is the architecture and the geography: DeepJudge states that its architecture is model-agnostic and that the customer chooses from and may combine any commercial or open-source models, running its choice of model in its choice of residency, and the hybrid deployment clause in the subscription terms discloses that model processing may involve transfer of customer data outside the customer's own infrastructure. Customer-selected location on all three AI providers corroborates the deployment position rather than adding to it.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. No model, provider, hosting location or subprocessor was located, and no commitment to notify customers of supply chain changes. The evaluator's report distinguishes Midpage's standalone research product from its ChatGPT integration, which tells a reader the product runs independently of that channel, but nothing published identifies what powers the standalone product. A buyer cannot determine from published material which company processes their research queries.

The unit and the structure are published in the subscription terms without any figure. Fees sit on an order form and are stated to be in United States dollars unless otherwise agreed. The term structure is set out: subscriptions renew automatically for successive one-year periods unless either party gives three months notice before the end of a term, invoices issue within ten days of the effective date and each subsequent term and are payable within thirty days, and late payment attracts the greater of five per cent per annum or the statutory maximum. Professional services are separated cleanly, provided only under a mutually agreed statement of work that becomes part of the agreement, which tells a buyer that implementation is priced apart from subscription. Most usefully, the consumption unit is published: section 4(g) sets a hosting threshold of 500,000 documents per user or 250 gibibytes per user, above which DeepJudge may seek volume reduction or charge at standard rates. What is absent is any figure, any tier, and any pricing page; the only commercial route on the site is Book Demo. Verified 2 September 2026.

Checked the vendor site navigation, the product pages and third party coverage on 29 Aug 2026. No pricing page was located, no rate is published, no unit of charge is stated and no tier structure appears. No free trial or self serve entry point was located on the vendor's own property, and no third party pricing figure was located either. Noted for a reader: the product being reachable through a ChatGPT integration may mean some access runs on that platform's commercial terms rather than the vendor's, which published material does not clarify.

Who buys this is evidenced rather than asserted, and the roster does the work: global elite firms including Freshfields, Greenberg Traurig and Holland and Knight, United States mid-market practices including Cozen O'Connor, ArentFox Schiff and Vorys, a technology-sector specialist in Gunderson Dettmer, Swiss and Austrian firms including Homburger, Lenz and Staehelin, Wenger Vieli, Advestra and Schoenherr, and an in-house legal and compliance function at SBB, so both private practice and in-house use are demonstrated. Geographic reach is stated as teams across North America and Europe serving clients worldwide. Practice areas are not enumerated, and on this product that limb does not bite in the usual way, because the platform searches whatever the firm already holds rather than covering any defined body of law. What is genuinely missing is the boundary: no firm size band is named, nothing states a minimum data estate or user count below which the product is not sold, and no statement describes where it stops. The clearest limits published are the prohibited users at section 4(j) rather than any positive statement of scope. Verified 2 September 2026.

Practice focus and jurisdictional coverage are both stated with real substance. The practice position is narrow and explicit: purpose built for litigators, with the evaluator independently confirming the product is focused on supporting litigator workflows and that its responses are tailored to the research questions litigation practice actually produces. Jurisdictional coverage is enumerated by court system rather than claimed broadly, spanning United States federal and state courts, tribal courts and military courts, plus statutes, regulations and selected administrative decisions. Naming tribal and military courts specifically is a level of precision no other record on this index reaches. Short of an A because the segment is described by practice type without addressing firm size, and because no statement of what the product does not cover was located, with the independently measured weakness on fifty state surveys and multi jurisdictional questions coming from the evaluator rather than the vendor.

Section 5(b) of the subscription terms is headed No Training and prohibits use of customer data to train the artificial intelligence and machine learning models underlying the services, except where the customer has given prior written consent. It names training and it names the models, which is what puts it in this value, and the consent carve-out is a variation mechanism rather than a product setting. Two adjacent permissions in the same agreement are narrow rather than swallowing it: section 5(c) permits Usage Data collection to improve the services and then defines Usage Data exhaustively as telemetry, listing hardware and storage usage, operating systems, cluster setup and health, uptime and response times, feature usage, interactions and error logs, adding that it is not shared with third parties; and section 5(e) permits reuse of generalised workflow patterns only where no customer data is copied or disclosed. Amended 2 September 2026 to record a tension in the data processing addendum version 1.1, supplied by the operator after this row was first written. Clause 3.4 limits processing to providing the services on written instructions, which points the same way as section 5(b), but Annex 1 describes the nature of processing as storage and other processing necessary to provide, maintain and improve the services, and no clause of the addendum addresses model training either way. The addendum is therefore neither a second prohibition nor a permission. The value continues to rest on section 5(b), which is the specific provision and the only one that names training, and a reader should weigh Annex 1's improvement language alongside it.

CORRECTED 29 Aug 2026 during the trust portal sweep. Previously recorded as silent on the finding that no statement existed either way, with the note observing that the ChatGPT distribution channel added an unaddressed layer. The statement exists on the vendor's security page, which was not reached in the original pass, and it covers both layers. The vendor states it does not use customer data to train or fine tune AI models, and separately that its agreements with AI model providers do not permit those vendors to train on Midpage customer data. The second is a contractual constraint on third parties rather than a policy the vendor could revise alone. The distribution point raised earlier is also partly answered: the vendor distinguishes plugin and integration workflows, stating it does not store queries, uploads or outputs from them while acknowledging those workflows may still share submitted queries with model providers, who may retain them for up to 60 days. That is a candid account of what happens when the product is reached through another surface, and it is more than most vendors disclose about their own layer, let alone a partner's.

Amended 2 September 2026 after the data processing addendum was supplied by the operator; the original summary recorded that it could not be retrieved, and that sentence is withdrawn. Section 3(a) of the subscription terms sets a fixed post-termination period the customer cannot vary: DeepJudge deletes all customer data, expressly including any training data and any customer models, within sixty calendar days of termination taking effect, and the customer reciprocally deletes DeepJudge software and data within thirty days and confirms in writing. DPA clause 11 adds an on-request route, requiring prompt destruction or return of data including data held by subprocessors, with confirmation of destruction. Customer Data is defined broadly at section 1(d)(i) to cover data retrieved from the customer's own databases, anything users upload or enter as Inputs, and the corresponding Outputs, so prompts and answers fall inside both obligations. No in-term retention period is published for Inputs and Outputs, which is what keeps this off the customer-controlled values. What the customer does control is the footprint rather than the clock: documents remain in their source systems rather than being migrated, and indexing controls govern what DeepJudge crawls, indexes and makes accessible at all.

CORRECTED 29 Aug 2026 during the trust portal sweep, and this now reads as one of the two strongest retention disclosures on the index. Previously recorded as not addressed on the finding that no public material stated a period, a control or a deletion route. All three exist on the vendor's security page. Published: web app data, expressly including user queries, uploaded materials and generated outputs, is held while an account remains active and deleted within 60 days of account deletion or a valid deletion request, so the customer triggers deletion and a published outer bound applies to it; for plugins and integrations no submitted queries, uploads or outputs are stored at all; and model providers may retain submitted queries for up to 60 days, which is a disclosure about a third party's window that almost no vendor makes. Recorded at customer controlled on the same basis as GC AI, where deletion on demand was treated as control over how long data persists, and this record is stronger because a maximum is published alongside the right. Short of the top value because the zero retention path is a property of the plugin and integration surface rather than a setting a customer can select for the web app, which is the closest any record on this index has come to that value without reaching it.

This is the first record in the pull to reach this value, and it is the product's central architectural claim rather than an add-on. The quoted commitment continues that the synchronisation ensures adherence to least-privilege principles and maintains ethical walls, so the access model being enforced is the firm's own, evaluated against the source systems rather than reimplemented inside the vendor's product. Because documents are indexed in place and never migrated, the authority for who may see what stays with the document management system that already holds it. A customer confirms the effect in its own words on the customers page, describing permission-based search that ensures users only access authorised information. Two limits belong on the record. The published material does not state whether permission evaluation happens per user at query time or through periodic synchronisation, and continuously synchronized is compatible with either. And nothing describes what happens to the index in the interval after a permission changes at source.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. No vendor material addresses segregation of any kind: not between customers, not between users, not between matters. No document management integration was located whose permissions the product could inherit at query time. Noted for context: a research tool that retrieves from published primary law rather than from a firm's own repository raises this question less sharply than a product indexing client documents, though brief generation from uploaded material would raise it.

Section 8(b) of the subscription terms commits the party receiving a demand to give the other prompt notice where it is required by applicable law, regulation, court order or legal process to disclose the other's confidential information, and adds that it will request that everything so disclosed is treated confidentially. The commitment reaches customer material because section 8(a) defines Confidential Information to include customer data expressly. Asking the tribunal for confidential treatment is a step beyond bare notice and few records in this corpus offer it. The obligation is mutual rather than one-directional, and it survives termination. It is not the top value because no transparency report was located: nothing published records how many demands have been received or how they were handled. The website privacy policy separately permits disclosure in response to valid requests by public authorities without a notice commitment, but that document is scoped to website visitors rather than to platform data.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026, and ran targeted searches for published terms or a privacy policy without reaching one. No clause committing to notify a customer of a government or law enforcement request for their data was located, and no transparency report was located.

Checked the home page, product page, security page, subscription terms and privacy policy on 2 September 2026. No public material identifies any corpus, and none is claimed, because the product ships no content of its own. The material it works on is the customer's: documents retrieved from the customer's own document management system, email, SharePoint, OneDrive, HighQ, intranets and experience systems, indexed in place and never migrated. Section 1(d)(i) of the subscription terms makes that explicit, defining Customer Data as data retrieved from the customer's databases plus user inputs and generated outputs, and warranting that the customer has the rights to share it. The provenance and licensing risks this signal tracks therefore sit with the firm rather than with the vendor, and the honest record is that the question is not addressed rather than that a corpus was withheld.

Coverage is described by jurisdiction and court system with unusual precision, and the sources behind it are not identified. Published coverage spans case law from United States federal and state courts, tribal courts and military courts, plus statutes and regulations and selected administrative decisions. Enumerating tribal and military courts is more specific than any other coverage statement on this index. What is missing is provenance: searched the vendor site, the product pages and third party coverage on 29 Aug 2026 and located no named source or publisher, no licence or public domain basis, no completeness statement per court system, and no update cadence or lag. The word selected in front of administrative decisions is itself an undefined boundary. Recorded at the jurisdictions only value because coverage is stated while its basis is not.

Checked the home page, product page, security page and subscription terms on 2 September 2026. No public material addresses subsequent history, treatment flags or good law checking, and none is claimed. The product does not retrieve primary law at all: it searches the firm's own precedents, advice, negotiation history and work product, so a citator has nothing to operate on. The adjacent risk that does exist is different in kind and is not addressed either, namely whether a precedent surfaced from the firm's own archive still reflects current law, which the platform leaves entirely to the lawyer reading it. Recorded as not addressed with the reason rather than treated as a failure of a limb that does not bite on this product class.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. No material was located addressing whether authority returned carries a treatment signal, whether subsequent history is checked, or whether any commercial citator is licensed. The independent evaluator measured authoritativeness, defined as whether cited sources are relevant and valid and support the statements made, and scored this product at 74 percent. Validity in that sense means the source exists and supports the proposition, which is not the same as the source still being good law, and the two were not conflated. Second research product on the index to record this absence where it sits inside the product's design rather than outside it.

Checked the home page, product page, security page and subscription terms on 2 September 2026. Nothing describes what the platform does when it cannot ground an answer, and no confidence, relevance or grounding indicator is described as exposed to the user. The workflow layer is characterised as fully transparent, and the search results are documents the user opens, so the verification burden is placed on the reader rather than discharged by the system declining. Section 4(j) of the subscription terms puts that burden on the customer contractually, requiring verification of accuracy and reliability through human review, which is an allocation of responsibility rather than an account of system behaviour.

Abstention behaviour is observed and quantified by an independent evaluator rather than documented by the vendor, which is a first on this signal. The Vals legal research study recorded that in eight cases Midpage acknowledged it was unable to locate the right documents and explained why the available sources did not support an answer, rather than fabricating one, and the evaluator awarded partial credit for the quality of those explanations. Separately and distinctly, it recorded three cases of pure technical failure where no response was returned at all, which is a different thing from principled abstention and is not counted as such. Recorded at the weakest value because the vendor itself publishes nothing on this: searched the vendor site and product pages on 29 Aug 2026 and located no described no answer path and no confidence signal. A reader should weigh the observed behaviour, which is favourable, against the absence of any commitment that it will persist.

Searched the AI Hallucination Cases database maintained by Damien Charlotin, and reporting drawing on it, on 2 September 2026 on both the product name DeepJudge and the corporate name DeepJudge AG. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product. One structural note: the platform retrieves the firm's own documents rather than generating citations to primary authority, so the specific failure this signal tracks, a fabricated case reference reaching a filing, is not the failure mode this product creates. Its analogous risk is surfacing a superseded internal precedent, which no tracker records.

No court order, opinion or disciplinary record naming this product has been located as of 29 Aug 2026. Instrument searched: the AI Hallucination Cases database maintained by Damien Charlotin, which tracks court decisions worldwide involving AI generated hallucinated content and records the AI tool implicated where it is known. Also checked published 2026 sanctions summaries and secondary sanctions trackers. The entries located name filers, and in some rows other products, rather than this one. This is a statement about the public record on the date shown and not a clearance. The exposure is direct for this vendor: a litigation research and brief generation product produces exactly the material that reaches filings as cited authority.

Checked the home page, product page, security page, subscription terms and privacy policy on 2 September 2026. No public material engages with guidance from any professional body governing the product's users, and neither ABA Formal Opinion 512 nor any state bar, law society or Swiss or Austrian bar guidance is named, despite a customer base spanning United States, United Kingdom, Swiss and Austrian practices. DeepJudge does engage a named legal instrument, making compliance with the EU Artificial Intelligence Act a contractual restriction on use at section 4(j) and excluding judicial and alternative dispute resolution applications, but that regulates the technology and its deployment rather than setting out the professional obligations of the lawyers using it, which is what this signal records.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. No engagement with any named ethics opinion or professional guidance was located, including ABA Formal Opinion 512 and state bar guidance. Worth noting given the stated audience includes law students, where a published position on supervised use in an academic setting would be a natural place for such engagement and none was located.

Time savings are claimed with figures and nothing addresses the bill. The home page publishes 65 hours saved per user per year on searching, a fourfold return in the first year, and 90 per cent of users reporting they find results faster than with existing tools. No published material addresses how AI-assisted work is recorded, billed or disclosed to a client, and no per matter record of AI-assisted work was located. The gap has force here because the buyer is overwhelmingly private practice: the named roster is almost entirely law firms that bill clients for the time this product compresses, so the direction this signal assumes holds squarely. The platform does emit configurable audit logs, described as letting a firm monitor its usage of DeepJudge, but that is described as a security and oversight facility rather than a matter-level record of AI-assisted work.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. No per matter record of AI assisted work intended for fee purposes was located, and no guidance on billing, fee or client disclosure treatment was located. Distinct from most records on this index in that no time savings or efficiency claim was located either: the vendor's published positioning and the evidence attached to it are about research accuracy rather than speed, so there is no savings claim to weigh against the client's side of the equation. Recorded as not addressed rather than at the savings claims value for that reason.

Row completed 2 September 2026 under R7 and R26, from the DeepJudge data processing addendum version 1.1 of May 2026, supplied by the operator after it defeated both direct fetch and search. A current subprocessor list is published at Annex 3, naming five entities with purpose and location: Microsoft Ireland Operations Ltd, Google Cloud EMEA Ltd and AWS EMEA SARL, each described as AI provider and cloud infrastructure with location customer selected, plus Intercom for support in Dublin and Gong. Governance around the list is strong: clause 5 requires written agreements on no less restrictive terms, due diligence on each subprocessor, liability for their acts, at least thirty days notice before a new subprocessor begins processing, and a right to object on reasonable data protection grounds with suspension or termination without liability if unresolved. Clause 3.4 adds a purpose limitation binding subprocessors, barring selling or sharing, processing for other purposes, retention or disclosure outside the direct business relationship, and combining customer data with data from other sources. What stops this reaching the top value is the model provider limb. The three entities named as AI providers are the hyperscaler platforms, and no discrete model vendor appears anywhere. Under the rule that infrastructure alone never satisfies this signal, a firm using DeepJudge can tell its client which cloud estates process its content but not whose model saw it. That is partly a consequence of the model-agnostic architecture, where the firm selects the model itself, but the gap in what the firm can forward is real.

CORRECTED 29 Aug 2026 during the trust portal sweep. Previously recorded as not addressed, with the note stating a firm could not assemble a response to a client AI clause from anything published. That is no longer accurate. The vendor states that on request it can provide SOC 2 documentation, questionnaire responses, and additional detail on service providers and data handling, which is an explicit offer of the three artifacts a firm most often needs. Published without any request at all: an express no training commitment binding both the vendor and its model providers, retention periods including the model providers' own 60 day window, encryption specifics, and a contractual flow down requiring subprocessors to maintain measures no less protective. A firm could answer most of a standard client AI clause from the public page and obtain the rest through the stated route. Recorded at on request rather than the subprocessor value because no subprocessor list is published and no model provider is named, only the terms binding them.

Checked the home page, product page, security page and subscription terms on 2 September 2026. Nothing addresses judicial standing orders, disclosure of AI use, or certification that output was verified by a person. Configurable audit logging exists and would record who searched for what, but it is presented as a firm oversight and security facility and nothing describes an exportable per document record capturing which model produced which passage, what was retrieved and who reviewed it. The product class is relevant: the platform surfaces the firm's own documents rather than generating citations to authority, so the artifact a court would ask about is the work product built afterwards rather than the search itself.

Searched the vendor site, the product pages and third party coverage on 29 Aug 2026. Output carries citations to primary law by design, so what was relied on is visible in the work product, but no per document export covering model used, sources retrieved and human verification together was located, and no model is identified anywhere in published material so the model used could not be stated. Recorded at not addressed rather than partial record because nothing beyond the citations in the output itself was located. Noted for a reader: of all products on this index, this one's output is among the most likely to reach a court, which makes the absence of a disclosure trail more consequential here than for the contract vendors.