EvenUp vs Supio: how they compare in 2026

The models are the entire product, and the company was built around a proprietary dataset to feed them. Piai is named as EvenUp's own AI engine, and the vendor's central technical claim is that it is trained on a large dataset specific to personal injury rather than adapted from a general model. Every deliverable is model output. Medical chronologies are generated from raw records with treatment timelines and ICD extraction, demand letters are generated end to end, case valuations come from a settlement repository, and analytics sit on top of the extracted data. Remove the models and nothing remains but a document store the firm already had. Independent review material reaches the same conclusion, describing it as a vertical drafting engine trained on injury cases rather than a general legal assistant.

Supio was founded in 2021 to build this product, with no earlier product to attach models to. CaseAware AI is named as its proprietary technology, described as distinguishing facts from opinions across large volumes of records, which is a claim about what the model does. Every deliverable is generated: chronologies from raw medical records, demand letters, case economics ledgers, litigation drafts and deposition analysis. Supio Agent, launched in the first half of 2026, is directed by natural language instruction rather than configured through forms, an agentic design rather than an assistant added to a case system. Without the models there is no product, only a connection to case management systems the firm already owns.

Grounding is built into the deliverable, and the vendor publishes no measured figure. Medical chronologies carry citations back to source documents, so a reviewer can check any entry against the underlying record, which suits output that is a factual account of someone's treatment. Demand packages cite comparable verdicts from the settlement repository, so the valuation argument traces to named prior outcomes, and a Thomson Reuters and Westlaw integration supports legal citation. There are two gaps. Two accuracy figures circulate in third party material and neither is published in vendor material with a method attached: that chronologies capture over 90 percent of relevant medical information on first pass, and that demands are 69 percent more likely to reach policy limits. Neither comes with a sample, baseline or definition. And nothing says what the system does when a record is illegible, contradictory or missing, which in medical record work is the common case.

Grounding is built in, with no published measurement. Citations point to the page of the source document for any claim in a demand, the right level of detail for medical records, where one treatment note in a 400 page file may be the evidence. Checking is also built into the workflow: for high value cases, human experts verify medical bill totals and damage calculations before delivery, targeting the arithmetic most likely to be wrong and most costly if it is. Nothing measured is published: no extraction accuracy, recall on treatment events, error rate on bill totals, or evaluation of CaseAware's separation of facts from opinions. Nothing says what happens when records are illegible, contradictory or incomplete. The one circulating figure, 80 or more hours saved per case, measures speed, not accuracy, and independent material reporting it notes that most such figures come from vendor marketing.

Oversight is sold as a product tier, which makes it visible rather than aspirational. Demands are offered in tiers from instant AI generation through Express Demands to an expert reviewed tier, where an in house team checks the document before delivery. Independent material notes that the human quality step adds turnaround time, a trade off made visible in the pricing structure. Output is consistently positioned as a draft that requires attorney review. The mechanics are not published: nothing says what the in house reviewers check or against what standard, or what distinguishes the tiers beyond speed. No confidence indication is given on generated content, and nothing describes the instant tier, where no human sits between generation and the attorney's inbox.

Oversight varies with case value, and this is published plainly. For high value cases, human experts verify medical bill totals and damage calculations, so the human check targets the numbers that drive settlement. The agentic layer works on the attorney's explicit instructions. Published examples show the lawyer specifying what to emphasize and asking the system to recheck a medical bill total, which keeps the attorney in the loop by design. Every output is presented as a draft with linked sources for checking. The boundaries are undefined: nothing says what makes a case high value enough for expert review, what the experts check or against what standard, whether generated content carries any confidence signal, or what Supio Agent may do unattended once instructed.

Outcome claims are specific and named firms appear, but the best available source flags the whole class as vendor supplied. Lundy Law is reported to have increased output from about 30 to about 110 demand packages a month after adopting AI tooling without adding staff, and J. Chrisp Law to have reclaimed 80 hours of paralegal time per case. Those are named firms with quantified operational change. The vendor claim that demands are 69 percent more likely to reach policy limits is the most consequential figure, because it speaks to case outcome rather than throughput, and it carries no method, comparison group or sample. The independent guide reporting these figures says most such benchmarks come from vendor marketing and that results depend on case complexity and record volume. The adoption story is credible and consistently reported, but none of it is published as a vendor case study with a method.

Company milestones are well evidenced, and customer outcomes are not. Supio has raised about $85m to $91m across three rounds: a $25m Series A on leaving stealth in August 2024 and a $60m Series B in April 2025 led by Sapphire Ventures, with investors including Thomson Reuters Ventures, Mayfield, Greylock and Menlo Ventures. A strategic partnership with Thomson Reuters, expanded in 2026, is meaningful outside validation, since that company is also an investor. Supio Agent launched in the first half of 2026. No law firm is named in the material located, and there is no case study with a method and no usage figure. The one outcome claim, 80 or more hours saved per case when combining chronologies with demand letters, has no baseline, sample or definition, and independent material notes that such figures generally come from vendors. Funding is not evidence that the product works.

Confidentiality evidence here rests on a health specific credential. The product takes in complete medical records, billing statements and treatment histories for injured claimants, so the confidential material is not only the client's legal matter but a third party's protected health information. Against that sit an independently assessed HIPAA attestation validating safeguards for PHI and a SOC 2 Type 2 examination whose scope includes confidentiality and privacy as well as security and availability. The vendor also says it supports customers handling sensitive information through contractual, technical, organizational and compliance measures, which acknowledges the business associate relationship a plaintiff firm needs. Nothing addresses legal professional privilege or attorney work product. A demand package is work product and the case strategy in a valuation is privileged, but the published posture covers health data protection and general security without reaching the legal side at all.

Health privacy credentials are broad, and legal privilege is not addressed. The vendor states SOC 2 Type II certification and compliance with HIPAA, PHIPA and GDPR. PHIPA, Ontario's Personal Health Information Protection Act, governs health information custodians in Canada. Naming it alongside Canadian data centers shows the vendor addressed a specific regional health privacy law rather than treating HIPAA as enough everywhere. For a platform holding complete medical records of injured claimants, protecting a third party's health information under the right law is the core confidentiality question, and it is answered. Nothing addresses legal professional privilege or attorney work product, although demand strategy, case economics ledgers and litigation drafts are work product.

Not located in vendor material. The product generates the demand letter a firm sends to an insurer, which is an advocacy document making legal and valuation arguments on a client's behalf, and it generates the case valuation that shapes settlement advice. Independent material states consistently that output is a draft requiring attorney review, and that framing is not published as a vendor published position. Nothing addresses the supervising attorney's duty over machine drafted advocacy, the professional responsibility of relying on a machine generated valuation when advising a client whether to settle, or any bar guidance. The gap matters more here than on a research tool because the output goes out under the firm's name to an adverse party.

Not located. The platform drafts demand letters sent under the firm's name to adverse insurers, produces litigation drafts, and generates case economics that inform settlement advice to an injured client. Nothing published addresses the supervising attorney's duty over machine drafted advocacy, the professional responsibility dimension of relying on generated damage calculations when advising a client whether to accept an offer, or any bar guidance. The human expert verification tier is a quality control mechanism operated by the vendor rather than a statement about the attorney's own professional obligations.

Nothing published about how the models are governed or evaluated. No AI policy, no model card, no bias or fairness testing, no evaluation methodology or result, no accuracy monitoring, no drift statement, no named governance body and no ISO 42001. The untested risk on this product is specific and serious: case valuation is generated from a settlement repository of past outcomes, and historical personal injury settlements carry the demographic and geographic patterns of who was compensated well and who was not. A valuation engine trained on that history can reproduce those patterns for a new claimant while presenting the result as a data backed figure, and nothing published indicates whether that has ever been examined.

Nothing is published about how the models are governed, evaluated or monitored: no AI policy, model card, bias or fairness testing, evaluation method or result, accuracy monitoring, drift statement, named governance body or ISO 42001. The product produces case economics ledgers and damage calculations that shape what an injured claimant is told their case is worth. Any systematic tendency in how the models weigh treatment, life impact or pain and suffering evidence would fall on claimants rather than on the firm, and nothing indicates it has been tested. CaseAware is named for separating facts from opinions in medical records, an interpretive judgment about clinical documents, and nothing indicates that judgment has been evaluated.

Data handling is credentialed and the training question is unanswered. The HIPAA attestation and the SOC 2 Type 2 privacy and confidentiality scope show that safeguards over protected health information have been independently assessed, which is real stewardship evidence. No statement is published on whether medical records, demand drafts, case files or settlement outcomes submitted by firms are used to train or improve Piai, how long client content is kept, or whether a firm can require deletion. The question is central for this vendor: its main technical claim is a proprietary model trained on a large personal injury dataset, and nothing published says where that dataset came from or whether customer matters continue to feed it. A credential covering how data is protected is not a statement about what it is used for.

Data handling is backed by several credentials, and the training question is unanswered. SOC 2 Type II, HIPAA, PHIPA and GDPR compliance show that safeguards over health and personal data have been addressed, and data centers in three countries suggest a deliberate design. Nothing says whether medical records, case files, demand drafts or deposition transcripts submitted by firms are used to train or improve CaseAware, how long client content is kept, or whether a firm can require deletion when a matter closes. GDPR implies rights for data subjects, but an injured claimant whose records sit in the platform is not a party to the customer relationship, which makes deletion harder to arrange. A credential about how data is protected says nothing about how it is used.

No published position is published on liability for AI output, warranty, service levels or remedy. The exposure is concrete here. A missed injury, a misread treatment date or an omitted provider in a generated chronology flows straight into a demand letter and can understate a claim, and an understated demand that settles is a loss the claimant never learns about. A generated valuation that anchors a firm low has the same effect. No published vendor position addresses any of it, so the risk sits with the firm and ultimately the injured claimant. Enterprise agreements govern this and are not public.

No published position located. Nothing was found on liability for AI output, warranty, service levels or remedy. The exposure is specific and asymmetric: an understated medical bill summation or a missed treatment event flows into a demand and can settle a claim below its value, and the person who bears that loss is the injured claimant, who is not a party to the contract between the firm and the vendor and has no visibility into how the number was produced. The vendor's own answer to this risk is operational, being human verification on high value cases, rather than contractual, and no contractual position is public.

One substantive integration is named, and the connections this buyer needs most are not. A Thomson Reuters and Westlaw integration supports legal citation inside generated demand packages, a real integration for a plaintiff drafting tool that gives the citation layer an established source. No case management system integration is published, and for a personal injury firm that is the connection that matters, since the practice runs on a case management platform holding intake, treatment tracking and deadlines. No API or export documentation is published either, and nothing describes how records get in or how a finished demand returns to the matter file. Independent comparisons in this market treat case management integration as a primary criterion, which makes its absence notable.

The integrations a plaintiff firm needs are named. Litify, MyCase and CasePeer are case management systems where plaintiff firms keep intake, treatment tracking, deadlines and the matter file. Westlaw Advantage is integrated for legal research through a strategic partnership with Thomson Reuters, giving generated documents an established citation source. Document management integration is stated in general terms. The vendor says the platform connects to a firm's case management, records and intake systems rather than replacing them. Depth is not documented: nothing says what moves in which direction for any named system, no authentication or permission detail or API documentation is published, and nothing says whether finished work returns to the matter file automatically.

Nothing is published. No hosting provider is named, no region or data residency commitment is published, and no single tenant or dedicated instance option is described. For a platform holding protected health information for injured claimants, where that data sits and how it is separated is a question a firm's compliance review would ask directly. The HIPAA attestation shows that safeguards were assessed without saying where the data sits. The Trust Center's request access route was not used and may hold residency detail.

A substantive residency statement is published. The vendor names data centers in the United States, the United Kingdom and Canada and pairs them with the matching health privacy regimes: HIPAA for the US, PHIPA for Canada, and GDPR. That suggests residency was designed around regulation, and it answers the first question a firm's compliance review asks about a vendor holding claimant medical records. The detail stops at the country list. No hosting provider is named, nothing says whether a customer can choose or is guaranteed a region, no single tenant or dedicated option is described, and nothing says whether processing, backup and model inference all happen in the same country as storage.

Scope, currency and a self serve route are all published. A Trust Center at trust.evenuplaw.com describes security, privacy and compliance practices and offers a request access route to documentation rather than a sales gate. The attestation is named with its scope: a SOC 2 Type 2 examination covering security, availability, confidentiality and privacy, four of the five Trust Services Criteria. Currency is dated, with recertification announced in April 2026. Alongside it sits an independently conducted HIPAA compliance assessment and attestation, the credential this product needs given that it processes protected health information. The vendor correctly explains that HIPAA has no formal certification and that what exists is a third party attestation. The auditing firm is not named for either the SOC 2 or the HIPAA assessment.

Four regimes are named, none is evidenced, and there is no route to the underlying documents. The vendor states SOC 2 Type II certification and HIPAA, PHIPA and GDPR compliance, a set that matches its data center locations. No auditing firm is named, and no examination period, scope or certificate date is published, so currency cannot be established. No trust center, security page or self serve route to request documents is published, and nothing suggests a gated one exists.

Nothing located. Piai is named and claimed as proprietary, trained on a personal injury specific dataset, and that is a statement about ownership rather than about supply chain. No foundation model provider is named, nothing states whether third party models sit underneath Piai or process any part of the pipeline, no subprocessor list is published, and the Thomson Reuters and Westlaw integration establishes at least one external data relationship without any accompanying disclosure of what flows to it. For a product handling protected health information, the identity of every party in the processing chain is a question a firm's HIPAA business associate review asks directly and it cannot be answered from public material.

Nothing located. CaseAware AI is named and presented as the vendor's own technology, which is an ownership statement rather than a supply chain disclosure. No foundation model provider is named, nothing states whether third party models sit underneath CaseAware or process any part of the pipeline, and no subprocessor list is published. The Thomson Reuters and Westlaw Advantage integration establishes at least one external data relationship, and the stated three country data center footprint implies infrastructure providers, and none of those parties is identified. For a platform processing protected health information across three regulatory regimes, the identity of every processor is a question a customer's HIPAA and PHIPA diligence asks directly and it cannot be answered from public material.

No pricing is published at any level. Independent review material describes the model as charged per case rather than per seat, so cost scales with caseload rather than headcount, and notes that the platform pays off only at sufficient injury volume. None of that comes from the vendor: there is no price, range, per case figure or tier structure, and no indication of what a demand package costs. Every route is a sales conversation and an annual contract. The absence weighs more for contingency fee firms, which carry case costs themselves, because a per case charge comes directly out of a claimant's eventual recovery.

No pricing published at any level. No price, no range, no unit of charge, and no indication of whether the model is per case, per seat, per page of records processed or per demand produced, which matters because those scale very differently for a plaintiff firm and determine whether the cost is a case expense or firm overhead. Independent review notes the product is sold entirely behind a demo with no published pricing. Every route is a sales conversation. The absence carries the same additional weight noted on EvenUp: contingency fee firms advance case costs and recover them from a claimant's settlement, so undisclosed per case pricing is undisclosed cost to an injured person.

Depth in one practice area, stated plainly, with the boundary acknowledged. The vendor says it builds for plaintiff personal injury and nothing else, and independent review confirms it is not a general legal assistant. Within that scope coverage is deep. Inputs include police reports, medical records, billing statements, photographs and intake notes, and outputs include demand letters, chronologies, case valuations, negotiation preparation and caseload analytics, with a settlement repository supporting comparables by jurisdiction. Specializing in one practice is a design decision rather than a coverage failure. What is not described is the data behind the main differentiator. Nothing says how many verdicts or settlements the repository holds, which jurisdictions it covers, its date range, how often it updates, or whether it is deep enough in a given venue for a comparable to carry weight, which an attorney relying on that citation in negotiation needs to know.

The scope is deliberately narrow and stated honestly, with real depth inside it. The vendor says the platform is built only for plaintiff law and is of no use outside it, and independent review agrees. Within that scope it covers the whole case lifecycle: intake, medical chronologies, demand letters, case economics ledgers, litigation drafting, deposition analysis and firm analytics. Mass tort is named alongside personal injury, a different workload of thousands of claimants against common defendants. Coverage is not described at the level a buyer would check. Nothing says which record types, providers or formats ingestion handles, what jurisdictions the litigation drafting covers, or how deep the mass tort support is compared with single plaintiff work.