DISCO vs iCONECT: how they compare in 2026
DISCO is a cloud platform built around generative review, while iCONECT is a review platform a buyer can run almost anywhere. DISCO hosts everything on AWS and folds Cecilia AI into one product: cited answers about the evidence, timelines drafted from a complaint, deposition summaries and Auto Review. Auto Review tags up to 32,000 documents an hour against instructions the team writes, and it gives a reason for each suggestion. DISCO bills on processed data and adds no charge for Cecilia. iCONECT, sold since 1999, can sit on a firm's own servers, in its own cloud account, with a hosting partner or in iCONECT's SaaS on Azure. Its review AI leans on continuous active learning and Oversight, which looks for errors in human tagging. Generative tools summarize, classify and redact, and the breach product sends documents to a model the customer picks. DISCO suits a litigation team that wants a fast first pass written from its own review protocol. iCONECT suits a team or service provider that must control where review runs and wants breach work on the same platform.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models drive a core layer on a platform that works without them. DISCO Ediscovery covers upload, filtering, review and production, and Cecilia AI arrived in 2023, about a decade after the company was founded. Cecilia Q&A, single document Q&A, summaries, definitions and Auto Review's first pass classification run on language models. DISCO now sells unlimited Cecilia AI inside its per GB rate, so the generative features come with every matter on the platform.
Machine learning runs core review and breach response work on a document review platform that would still function without it. iCONECT's eDiscovery product is built around processing, an Elasticsearch index, deduplication, redaction and production. The models sit in several core capabilities: continuous active learning through Sentio technology; Oversight, which the vendor says is included in standard eDiscovery licensing and finds false negatives and false positives in reviewer tagging; AI email threading; and AI assisted identification and extraction of personal information in the cyber data mining product, where users can send documents to a model of their choice. Generative AI features listed on the eDiscovery and law firm pages add document summaries, classification by content or legal relevance, entity redaction, image description, transcription and translation. The vendor describes itself as a data intelligence AI platform, and in August 2026 announced an integration with eDiscovery AI that is still under development. Without the models, a full review and production system remains.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Cecilia Q&A answers only from the customer's evidence, with citations, and Auto Review gives an explanation for every tagging decision so a reviewer sees why each classification was made. Auto Review tracks recall and precision inside the product, and DISCO's AI consulting team advises on sampling and validation. DISCO says Auto Review delivers precision and recall 10 to 20 percent above human reviewers. No test set, date, evaluator or method accompanies that figure, so an outsider cannot check or reproduce it.
The Oversight post of 17 May 2024 says the tool reaches a level of precision once thought unattainable and helps teams rectify discrepancies, with no recall, precision, elusion or validation figures and no test set. The cyber data mining page says each extracted data element is linked through audit trails to its original source file, creating a defensible chain of custody, which lets a reviewer trace a notification entry back to the document. How the generative features are grounded is not described: whether a document summary cites passages, how classification by legal relevance is validated, or how automatic privilege redaction is confirmed. No error rate or statement on invented content is published.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Auto Review suggests tags with an explanation for each, and the team moves to quality control on those suggestions. Customers choose whether to run Auto Review themselves, refining tags with Tag Tuner, or to have DISCO's Managed Review team run the project, including privilege review. Recall and precision are tracked in the product so a team can validate the review before relying on it. Cecilia answers cite the evidence they draw on. No threshold at which a document must go to a person, and no limit on what Auto Review decides unaided, is published.
The Oversight post of 17 May 2024 says a subject matter expert, attorney or experienced reviewer seeds a model with as few as fifty documents, and that Oversight reports tagging errors for the team to correct. The cyber data mining page lets a team define its criteria so that verification, whether manual or automatic, fits its needs, and says GenAI reviews are used where appropriate. The eDiscovery page says redaction, including of an entire document because of privilege, can happen automatically, and that document classification sorts documents by legal relevance automatically, with no review step described for either. Nothing states what the generative features may not be used for, when a person must check their output, or what happens when a classification or redaction is wrong. For the generative features, review is a setting the customer chooses.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
CS Disco's annual filing, a regulated document, reports 1,549 customers including 330 large customers and a 98 percent dollar based net retention rate at 31 December 2025. Named customer material is published too. A Perkins Coie associate is quoted on Auto Review, and a story on Rhoades McKee describes DISCO's professional services on an inherited multi jurisdiction case. Auto Review is said to deliver precision and recall 10 to 20 percent above human reviewers, with no test set, date or method given. No named customer is paired with dated figures and a method a reader can assess.
Releases on iCONECT's site record that ProFile Discovery selected the platform for its law firm and corporate legal department environments (26 January 2021) and that Everest Discovery launched a cyber breach response service built on it (27 January 2025), with a quote from Everest's owner and president; other releases name Pictera Solutions, Right Discovery and Iota Analytics as customers. The Why iCONECT page names NASA and the FDIC among users. The law firm page presents seven large matters, among them the Vioxx, Yasmin and Pradaxa litigation, Oracle v. SAP and the Columbia investigation, without naming the firm, iCONECT's role or a result. No case study with a measured result is published on the site.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The language models used in Cecilia never train on or learn from customer data and usage, DISCO says, and do not retain customer data after a query. The models behind Auto Review are prohibited from training on or retaining customer data after processing, and model vendors must hold SOC 2 Type 2 or ISO 27001 certification. Data is encrypted in transit and at rest. The data processing addendum binds DISCO to confidentiality, breach notice and deletion or return of personal data on termination, and notice of subpoenas or other orders seeking personal data. No position on privilege or work product as such, and no separation between users or matters inside a customer, is published.
The only legal documents on the site are a terms of use (31 July 2024) and a privacy policy (June 2024), both written for the website. No customer agreement, data processing addendum or statement on training with customer documents is published. The eDiscovery and law firm pages cite SOC 2 certification, rigorous data protection and handling protocols and controlled access, and the SOC 2 Type 2 report on the SaaS platform covers the confidentiality criterion. The cyber data mining page lets users send documents to a model of their choice, including models from OpenAI, Microsoft and Google, and nothing published states what those providers may keep or use. The platform can be deployed on premises, which keeps documents in a firm's own environment, but nothing addresses privilege handling, segregation between matters, or what happens to documents sent to a model.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The buyers are law firms, corporate legal teams and government legal teams, with no consumer product, and DISCO analyzes collected evidence rather than giving advice. Auto Review instructions can be written with DISCO's AI consulting team, and its Managed Review team can run a first pass review and handle privilege review, which places vendor staff inside the customer's review method. Nothing published addresses advice versus tooling, the supervising lawyer's responsibility for a review DISCO's team runs, competence duties or jurisdiction limits.
The terms of use say information on iCONECT's pages is distributed on the understanding that the authors are not rendering legal, accounting or other professional advice. That sentence governs website content, not the review platform. The product classifies documents by legal relevance, redacts for privilege and summarizes documents for law firms, corporations, public sector organizations and service providers, and nothing published states that its output is not legal judgment, that a supervising lawyer must review it, or how it fits a lawyer's competence and supervision duties. No ethics opinion or court decision on technology assisted review is named.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Every Auto Review tag suggestion carries an explanation, and Auto Review tracks recall and precision inside the product so a team can validate a review. DISCO's AI consulting team advises on sampling, validation and defensibility. The annual filing discusses AI related operational and regulatory risk beside cybersecurity, privacy compliance and reliance on third party model and cloud providers. No AI governance framework, AI principles, ISO 42001 certification, named owner of model governance or prerelease testing regime is published. Nothing addresses uneven output across matter types, parties or populations, for a product that classifies up to 32,000 documents an hour.
The platform page and a post of 10 May 2024 describe iCONECT's path as a responsible adoption of generative AI that enhances the platform without compromising data integrity or security. No person is named as accountable for model behavior, and no testing before release, evaluation results or principles are published. The SOC 2 Type 2 report covers information security controls and not the conduct of the models. Nothing addresses uneven output across languages and document types in classification by legal relevance or personal information identification. Users choosing between models from OpenAI, Microsoft and Google for personal information identification are not told how iCONECT evaluated them.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
DISCO's data processing addendum commits to notice of a personal data breach without undue delay, with assistance afterward, and on termination DISCO deletes or returns customer personal data or provides a way to do so. Its subprocessor list names each provider with function and country, and customers have 14 days to object after the list is updated. The language models behind Cecilia and Auto Review do not train on or retain customer data after processing, and every model vendor must hold SOC 2 Type 2 or ISO 27001 certification. Data is encrypted in transit and at rest on AWS. No period is stated for keeping case documents, Cecilia prompts or generated output, and retention under DISCO's own document retention policies is reserved.
The eDiscovery and law firm pages cite SOC 2 certification, regular security training and penetration testing, workstation and server security, data protection and handling protocols and controlled access, and the platform page cites encryption, access controls, regular security audits and adherence to GDPR and HIPAA standards. The SOC 2 Type 2 audit of the SaaS platform, completed on 22 September 2025 by A-LIGN, covers security, availability, processing integrity, confidentiality and privacy. The cyber data mining page says ingestion, extraction, review and modification actions are logged with audit trails. The privacy policy (June 2024) covers the website and not data processed in the platform. No retention period, deletion commitment, breach notice timing, subprocessor list or statement on what model providers keep when documents are sent to them is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
DISCO's terms and conditions indemnify the customer against third party claims that the technology offerings or documentation infringe United States intellectual property rights, with the usual exclusions. DISCO warrants that each technology offering conforms in all material respects to its documentation, and that professional services are performed in a professional and workmanlike manner, with correction or termination as the remedy. Each party's liability is capped at the fees paid or payable under the order in the 12 months before the claim. A separate data protection cap of twice the general cap covers breaches of data protection obligations. Fraud, wilful misconduct, negligence causing death or injury and indemnification obligations sit outside the caps. The AI supplementary terms exclude AI services from any service level agreement, and no insurance position is published.
No customer agreement, license terms or SaaS terms are published. The terms of use (31 July 2024, California law) disclaim liability for direct, indirect, special, incidental or consequential damages arising from the website and its content; they do not govern the software. No indemnity, warranty, cap or allocation of risk is published for missed documents, wrong classifications, failed redactions or errors in personal data extraction, on a product used to decide what is produced to an opposing party and who is notified after a breach.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
DISCO Hold connects to a customer's systems, and the high speed uploader moves enterprise data straight into the platform. DISCO publishes guidance on Google Workspace collection through Google Vault and on migrating data from other ediscovery providers. A DISCO API is published for connecting the platform to a firm's other systems, and the subprocessor list names Box and Dropbox as file transfer tools. The consolidated integrations page now returns a not found page, and no documentation per integration sets out what moves, in which direction or what an administrator configures.
iCONECT's release of 10 June 2021 says its Ligl integration, available then, lets organizations identify, hold, preserve and collect enterprise documents in Ligl, process and cull them, and push relevant documents to iCONECT for review. The cyber data mining page lets users send selected documents to a model of their choice, including models from OpenAI, Microsoft and Google. The partners page shows Microsoft, Nuix, LexisNexis, Sentio, Opus 2 and Heureka Software as technology partners, as logos without descriptions, alongside more than 25 hosting partners. An integration with eDiscovery AI was announced on 24 August 2026 as under development, with availability to follow. The platform page says iCONECT integrates with the most common applications in its three markets, without naming them. Nothing describes connections to a firm's document management, matter management or litigation support systems, and no integration documentation is public.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
DISCO runs in the cloud on AWS, which its subprocessor list places in the United States, Ireland and Canada. Microsoft Azure and Google appear as further hosting providers in the United States, and OpenAI processes in the United States and the EU. The platform was designed to operate in the cloud, with AWS used to minimize data footprint and strengthen privacy controls. The data processing addendum sets out transfer mechanisms for data leaving the EEA, the UK and Switzerland. No customer choice of region, tenancy model or private deployment is described.
The eDiscovery page offers on premises, hybrid, cloud and SaaS deployment. The post of 19 July 2024 on system architecture describes in house deployment, cloud deployment on Microsoft Azure, Google Cloud, AWS or other providers, and hosting through iCONECT's network of legal service providers. The release of 23 August 2023 launching iCONECT SaaS says it runs on Microsoft Azure. A firm can therefore keep the platform and its documents on its own infrastructure. Not stated are where iCONECT's SaaS stores or processes data, which regions are available, and whether SaaS customers are separated at the tenant level. Nor is it stated where documents go when they are sent to a model from OpenAI, Microsoft or Google for personal information identification, or whether the generative features work in an on premises deployment.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
DISCO undergoes an annual SOC 2 Type 2 audit covering security, availability and privacy, holds ISO 27001 certification for the technical and operational delivery of its service, and commissions penetration testing. Data is encrypted in transit and at rest on AWS, and DISCO states GDPR compliance. The security page links a trust center at trust.csdisco.com, and the data processing addendum points to it for the subprocessor list. Customers can use two factor authentication, expiring passwords and single sign on through SAML, and a vulnerability reporting route is published. The auditing firm and the SOC 2 coverage period are not stated on the public pages.
iCONECT's release of 29 September 2025 says A-LIGN completed a SOC 2 Type 2 audit of its SaaS platform on 22 September 2025 covering security, availability, processing integrity, confidentiality and privacy, and the home page carries an A-LIGN badge. No audit period is stated, no trust center is published, and the report is offered neither for download nor on request. The eDiscovery and law firm pages add regular penetration testing and security training, and the platform page claims adherence to GDPR and HIPAA standards without any certification behind them.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
DISCO's subprocessor list names Writer and OpenAI as large language model providers, Writer in the United States and OpenAI in the United States and the EU, and Pinecone as the vector database. AWS, Microsoft Azure and Google are named as hosting providers. The data processing addendum gives customers 14 days to object after the list is updated on DISCO's trust center. Model vendors must hold SOC 2 Type 2 or ISO 27001 certification and may not train on or retain customer data. No model or version is tied to a particular feature.
The cyber data mining page lets users send selected documents for personal information identification to a model of their choice, including models from OpenAI, Microsoft and Google. The platform page says iCONECT integrated Sentio technology, which carries its continuous active learning, and acquired AI source code from Ayfie in 2021. Nothing published names the model behind document summaries, classification, image description, transcription or translation, states whether iCONECT or the customer holds the model provider relationship, says where those models run, or commits to notice when a model changes.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
DISCO publishes its unit and structure without a figure. Its pricing page bills on processed data at a rate per GB, with no additional charge for unlimited use of Cecilia AI on the platform. The per GB rate includes filters, Cecilia Q&A, single document Q&A, document summaries, definitions, timelines and deposition management, and a feature table sets out what is included. The rate itself comes through a quote. The annual filing records the 2026 move to usage based pricing.
The law firm page offers flexible pricing with monthly or annual terms, the Why iCONECT page describes predictable pricing through monthly and yearly plans, and the release of 23 August 2023 launching iCONECT SaaS describes Price Protect, which applies discounts automatically as data volume grows without renegotiating the contract. That points to data volume as a driver and term length as a choice, without stating the unit, the rate or what the generative features add. No price, rate per gigabyte, user fee or tier is published, and every route to a number runs through a demo request.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
DISCO sells to law firms, corporate legal teams and government, with dedicated material for IP litigation, construction litigation, plaintiffs and a pro bono program. Its annual filing counts 1,549 customers, including 330 large customers, at 31 December 2025. The platform spans the ediscovery lifecycle with hold, ediscovery, review, timelines, deposition management and case building, and pricing is quoted for customers across the United States, the United Kingdom, Europe and parts of Asia. Firm size segmentation, language coverage and any statement of what the platform is not built for are not published.
The site addresses law firms, corporations, public sector organizations and service providers, each with its own page, across three products: eDiscovery, cyber data mining for breach response, and data governance. The law firm page covers litigation, investigations and responsive actions, the cyber data mining page covers breach notification work for incident response professionals, and the release of 24 August 2026 names law firms, corporations, legal service providers and public sector organizations as customers. Named users include NASA and the FDIC. What is not stated is which languages the generative features and personal information identification support, which privacy regimes the breach tools are built around beyond references to GDPR and HIPAA, and which deployment options carry the generative features.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
According to DISCO's AI page, the language models used in Cecilia never train on or learn from customer data and usage. The Auto Review page adds that its models are prohibited from training on or retaining customer data after processing. Both statements address the model layer, and the terms and conditions and AI supplementary terms contain no training clause. Nothing addresses whether DISCO itself trains or tunes any model on customer content.
No customer agreement, license terms or data processing addendum is published, and no page states a position on training with customer documents. The terms of use (31 July 2024) and the privacy policy (June 2024) cover the website only. Oversight's matter model is seeded by the customer's own reviewers with its own documents, which is not vendor training, and the cyber data mining page lets users send documents to models from OpenAI, Microsoft or Google with nothing published on whether those providers may train on them.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Auto Review's language models may not retain any customer data after processing, and every model vendor must hold SOC 2 Type 2 or ISO 27001 certification. On termination, the data processing addendum has DISCO delete or return customer personal data, subject to retention its own policies or the law require. No period is stated for how long DISCO keeps case documents, Cecilia prompts, generated answers or the explanation attached to each tag suggestion, and no customer setting for that window is described.
Nothing published states how long documents, extracted data, summaries or other AI outputs are kept, or when they are deleted, in the SaaS platform or by a model provider. The privacy policy covers website data only.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
DISCO describes no separation between users, teams or matters inside one customer and no ethical wall feature. Its published controls cover single sign on, two factor authentication and the vendor's own supplier and communications security. For a platform sold to large firms running concurrent matters, how access is screened between matters is not described.
Nothing describes walls between matters or teams, or how the generative features and continuous active learning are kept within a matter. The eDiscovery and law firm pages cite controlled access and the SaaS launch release mentions user setup and matter management, without describing how access is segregated.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Under DISCO's data processing addendum, each party must notify the other promptly in writing of any subpoena or other judicial or administrative order seeking customer personal data, to the extent the law allows. No transparency report is published. The clause covers personal data, which in an ediscovery collection runs through most of the documents a firm uploads.
No published agreement addresses legal demands for customer data held in the platform. The privacy policy (June 2024), which covers the website, says iCONECT may disclose a website user's name, city, state, telephone number and email address to law enforcement on a verified request without a subpoena; it does not reach documents processed in the platform.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
DISCO holds no primary law collection. Cecilia answers only from the customer's own evidence, and Auto Review classifies against tag descriptions written for each matter, so the source material is the documents collected in discovery. No vendor supplied legal content, license basis or update cadence applies.
iCONECT works on a customer's own documents and data and does not describe retrieval of case law or other legal sources; no outside body of legal sources applies.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
DISCO works on collected evidence rather than published case law, so its output cites documents, not authority. It describes no treatment signal and no check of later history.
The product does not cite legal authority, so no check of subsequent history applies, and none is described.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Nothing describes what Cecilia Q&A or Auto Review does when the evidence does not support an answer or a tag, or how uncertainty is shown to the reviewer. Cecilia answers only from the customer's evidence, with citations, and Auto Review explains each tagging decision.
Nothing published describes what the summaries, classification or personal information identification do when a document gives them no basis for an answer, or how low confidence is shown.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Damien Charlotin's AI Hallucination Cases database, which tracks court decisions worldwide on hallucinated AI content, has no entry naming DISCO or Cecilia. DISCO answers and classifies from a matter's collected evidence rather than from case law.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming iCONECT. iCONECT reviews, classifies and redacts a customer's own documents for eDiscovery and breach response rather than drafting filings.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
DISCO names no ethics opinion or bar guidance, including ABA Formal Opinion 512. Its Auto Review material speaks of defensibility, sampling and validation, but connects them to no rule of civil procedure or case law on technology assisted review.
The terms of use (31 July 2024) state that information on iCONECT's pages is distributed on the understanding that the authors are not rendering legal, accounting or other professional advice. The clause governs website content, not the review platform. No ethics opinion, bar guidance or court decision on technology assisted review is named on the product pages or in iCONECT's posts.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
DISCO claims its savings in review hours, saying Auto Review completes a first pass review in hours with precision and recall above human reviewers, at up to 32,000 documents an hour. It bills on processed data per GB with unlimited Cecilia AI included, so the AI cost a firm passes on follows data volume rather than review hours. Nothing published addresses how AI assisted review is recorded or billed per matter, or whether clients are told.
iCONECT's pages claim savings without addressing billing. The eDiscovery page says AI email threading and deduplication reduce the dataset and that AI automations eliminate repetitive steps, the Why iCONECT page displays a counter for ROI savings delivered, and a customer release quotes Everest Discovery on reducing costs. The platform is sold to law firms and to service providers whose review charges reach clients, and nothing published addresses how AI assisted review is billed or disclosed.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A published subprocessor list names each provider with function and country, including Writer and OpenAI as language model providers, Pinecone as the vector database and AWS, Microsoft Azure and Google for hosting. DISCO's terms and conditions, AI supplementary terms and data processing addendum sit beside it. Certifications are stated with scope, SOC 2 Type 2 across security, availability and privacy and ISO 27001 for service delivery, and a trust center sits at trust.csdisco.com.
No subprocessor list or disclosure material for a client's AI terms is published. The cyber data mining page names OpenAI, Microsoft and Google as model choices for one feature, which is not a list of the providers that process customer data, and the SOC 2 report is not offered for download or on request.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Each Auto Review tagging decision carries an explanation on the document it concerns, and recall and precision are tracked in the product. The basis for a first pass review can therefore be reconstructed document by document. Cecilia answers carry citations to the evidence. No single export combines the model used, the sources retrieved and the human check, and no model is named for any feature.
The cyber data mining page says ingestion, extraction, review and modification actions are logged with audit trails that link each extracted data element to its source file, creating a defensible chain of custody for regulatory inquiries and legal review. Oversight produces reports of tagging errors, and the law firm page lists reviewer productivity reporting. Nothing records which model produced a summary or classification, and no export for disclosing AI use or validating continuous active learning to a court is described.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Ethical Walls and Matter Segregation
- Primary Law Corpus Provenance
- Good Law Verification
- Refusal and Uncertainty Behavior
Which one fits
Choose DISCO if
- Your bottleneck is first pass review. Auto Review codes up to 32,000 documents an hour against tag descriptions your team writes, and Tag Tuner refines those descriptions before the full run.
- You want case strategy work next to review. Cecilia drafts a timeline from an uploaded complaint, summarizes depositions by chronology and topic, and answers evidence questions with citations.
- Predictable AI spend matters to your budget. DISCO bills on processed data by the gigabyte, and Cecilia use on the platform carries no additional charge.
Choose iCONECT if
- Client data cannot leave infrastructure you control. iCONECT installs on premises or in a hybrid setup, and it also runs in a firm's own Azure, Google Cloud or AWS account.
- Your practice handles data breach notification. The cyber data mining product turns breached files into a notification list and logs every extracted element against the file it came from.
- You offer review to clients of your own. Hosting partners run iCONECT for their customers, so a service provider can deliver it as part of its own service.
In summary
DISCO
DISCO is the cloud eDiscovery and litigation platform of CS Disco, Inc., an Austin company listed on Nasdaq. It covers collection, review, legal hold, timelines and deposition management on AWS. Cecilia AI adds cited answers about case evidence, one click document summaries and Auto Review for first pass coding with a written explanation per tag. According to the AI Legal Index, DISCO holds SOC 2 Type 2 and ISO 27001 certification and bars the language models it uses from training on or retaining customer data.
iCONECT
iCONECT Development, LLC has sold its review platform since 1999 to law firms, corporations, public sector bodies and the service providers that host it. Beyond eDiscovery, it covers cyber breach data mining and data governance. Machine learning runs through continuous active learning and the Oversight tagging check, while generative tools summarize, classify, transcribe and redact. According to the AI Legal Index, its Azure SaaS service holds a SOC 2 Type 2 report from A-LIGN, and no customer agreement is published.
Questions buyers ask
How do DISCO and iCONECT approach first pass review?
DISCO's Auto Review applies the team's tag descriptions with a generative model and writes a reason for every suggestion. iCONECT relies on continuous active learning, which reranks documents as reviewers code them, and Oversight flags likely tagging mistakes for correction. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Where does each platform keep case data?
DISCO is cloud native and hosted on AWS. iCONECT runs where the buyer decides: its own servers, its own cloud account, a hosting partner or iCONECT's SaaS on Microsoft Azure. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Does DISCO charge separately for Cecilia AI?
No. DISCO bills on processed data and includes unlimited Cecilia use on its platform. iCONECT sells monthly or annual terms with no published rates and does not list a separate charge for its AI features. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
What happens to client documents sent to a language model?
DISCO says the models behind Auto Review are barred from training on or retaining customer data after processing, and its model vendors must hold SOC 2 Type 2 or ISO 27001. iCONECT lets a team choose an OpenAI, Microsoft or Google model for breach extraction and publishes no term on training or retention. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Which one fits a breach response engagement?
iCONECT sells a cyber data mining product that extracts personal data, builds notification lists and keeps an audit trail to each source file. DISCO's tools center on litigation, with timelines, deposition summaries and review. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
DISCO is operated by CS Disco, Inc., listed on Nasdaq under the ticker LAW. iCONECT is made by iCONECT Development, LLC. Neither vendor reviewed this page.