Exterro vs iCONECT: how they compare in 2026
The choice between Exterro and iCONECT is mostly a choice about who runs discovery. Exterro sells a data risk management platform to corporate legal, privacy and IT teams that want legal hold, collection, forensics, privacy requests and review under one license. Its single instance storage keeps each document once across matters, so privilege calls and redactions carry over, and annual review licensing comes with unlimited users and no hosting charge. Exterro Intelligence runs agentic workflows that carry out and record tasks while a person approves the decisions, and Exterro Assist answers questions with citations to check. Exterro says 40% of the Fortune 100 use it. iCONECT is narrower and more portable: a review platform for eDiscovery, breach data mining and governance that installs locally, runs in a customer's cloud, sits with a hosting partner or comes as SaaS. Its learning tools rank documents and quality check human review, and its generative features summarize, classify and redact. Exterro suits a corporation building discovery in house around its own data, and iCONECT suits firms and providers that run review for many clients.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Exterro's AI runs through the platform, but the product beneath it was built first and still works without it. Smart Labeling learns from a reviewer's labels on a sample set and applies them across a document pool, and image and video recognition have been part of the platform for more than a decade. Context Insights maps custodians and communications, and Smart Summarization, translation and transcription speed up review. Exterro Assist, launched in August 2025, added agents that answer questions over collected data, classify documents and draft reports. Subpoena Manager runs subpoena intake and routing on agents. Legal hold, preservation, collection, processing, production, privacy requests and forensics all run as workflow software, and the AI makes those workflows faster rather than defining them.
Machine learning runs core review and breach response work on a document review platform that would still function without it. iCONECT's eDiscovery product is built around processing, an Elasticsearch index, deduplication, redaction and production. The models sit in several core capabilities: continuous active learning through Sentio technology; Oversight, which the vendor says is included in standard eDiscovery licensing and finds false negatives and false positives in reviewer tagging; AI email threading; and AI assisted identification and extraction of personal information in the cyber data mining product, where users can send documents to a model of their choice. Generative AI features listed on the eDiscovery and law firm pages add document summaries, classification by content or legal relevance, entity redaction, image description, transcription and translation. The vendor describes itself as a data intelligence AI platform, and in August 2026 announced an integration with eDiscovery AI that is still under development. Without the models, a full review and production system remains.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Exterro Intelligence results carry source references back to the collected documents, and the audit trail links each step to its data, so a reviewer can open what an answer rests on. A validation agent checks the accuracy and integrity of retrieved information. Exterro publishes throughput rather than accuracy: 40,000 documents an hour for classification, 100,000 an hour of preprocessing for questions, and tasks up to 400 times faster than manual work. In a global insurer's three week trial that Exterro describes, investigators compared summaries, timelines and citations with native documents. No precision, recall or error rate is published for classification, labeling, summaries or answers. In ediscovery the costly error is a responsive document culled by mistake, and no recall figure addresses it.
The Oversight post of 17 May 2024 says the tool reaches a level of precision once thought unattainable and helps teams rectify discrepancies, with no recall, precision, elusion or validation figures and no test set. The cyber data mining page says each extracted data element is linked through audit trails to its original source file, creating a defensible chain of custody, which lets a reviewer trace a notification entry back to the document. How the generative features are grounded is not described: whether a document summary cites passages, how classification by legal relevance is validated, or how automatic privilege redaction is confirmed. No error rate or statement on invented content is published.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Autonomy is where Exterro is heading, and it sets limits in the same breath. Subpoena Manager, launched in May 2026, uses agents to take in subpoenas from any channel, extract deadlines and matter details, route requests, follow up and drive preservation, collection and review. Legal staff give the final approval on each action. ARMOUR's autonomy ladder lets a team raise automation in steps, from manual work to conditional and then high autonomy. Exterro Intelligence agents classify content against relevance, reason and confidence thresholds, and a validation agent checks retrieved information and flags problems. Every action lands in the audit trail with chain of custody. What an agent may do without approval at each level, and where the thresholds sit, is not published.
The Oversight post of 17 May 2024 says a subject matter expert, attorney or experienced reviewer seeds a model with as few as fifty documents, and that Oversight reports tagging errors for the team to correct. The cyber data mining page lets a team define its criteria so that verification, whether manual or automatic, fits its needs, and says GenAI reviews are used where appropriate. The eDiscovery page says redaction, including of an entire document because of privilege, can happen automatically, and that document classification sorts documents by legal relevance automatically, with no review step described for either. Nothing states what the generative features may not be used for, when a person must check their output, or what happens when a classification or redaction is wrong. For the generative features, review is a setting the customer chooses.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The Hanover Insurance Group is a named Exterro customer. Its eDiscovery and information governance lead reports saving at least 75% a case on average, and more than $2 million over 12 months, by running discovery in house and tracking external against internal costs. A North American real estate company cut documents by 68% before review and those sent to outside counsel by 97% on one matter. A global insurer's three week ARMOUR trial covered 650GB, including a fraud investigation of 200,000 documents reviewed in an afternoon and a subject access request cut from about 60 hours to a few. IDC named Exterro a Leader in its 2025 eDiscovery MarketScape and a Major Player for data privacy compliance software. Exterro reports more than 2,700 organizations as customers, with its Fortune 100 share given as 40% on its review pages and 50% on its legal and security pages. The Hanover figures rest on its own cost tracking, and none of the results carries a date.
Releases on iCONECT's site record that ProFile Discovery selected the platform for its law firm and corporate legal department environments (26 January 2021) and that Everest Discovery launched a cyber breach response service built on it (27 January 2025), with a quote from Everest's owner and president; other releases name Pictera Solutions, Right Discovery and Iota Analytics as customers. The Why iCONECT page names NASA and the FDIC among users. The law firm page presents seven large matters, among them the Vioxx, Yasmin and Pradaxa litigation, Oracle v. SAP and the Columbia investigation, without naming the firm, iCONECT's role or a result. No case study with a measured result is published on the site.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Confidentiality binds both parties under the agreement, which limits Exterro's use of customer data to providing the subscription. Either party may disclose under a court order or law only with prompt notice where the law allows. Exterro states that customer data does not train its models and that Exterro Assist runs inside the platform with no external access. Review flags potentially privileged documents during processing and builds the privilege log as review proceeds. Its single instance store keeps one copy of each document, so a privilege or redaction call made in one matter follows the document into every other matter. Outside counsel get role based access to specific matters. The no training statement is not in the agreement, and nothing describes how privileged material is walled off from privacy and IT users on the same platform.
The only legal documents on the site are a terms of use (31 July 2024) and a privacy policy (June 2024), both written for the website. No customer agreement, data processing addendum or statement on training with customer documents is published. The eDiscovery and law firm pages cite SOC 2 certification, rigorous data protection and handling protocols and controlled access, and the SOC 2 Type 2 report on the SaaS platform covers the confidentiality criterion. The cyber data mining page lets users send documents to a model of their choice, including models from OpenAI, Microsoft and Google, and nothing published states what those providers may keep or use. The platform can be deployed on premises, which keeps documents in a firm's own environment, but nothing addresses privilege handling, segregation between matters, or what happens to documents sent to a model.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Twice in its agreement, Exterro states that it does not practice law or give legal advice, and it disclaims any warranty that the software will assure legal compliance. Buyers are corporate legal, compliance and IT teams, law firms and government, and the AI is sold as review and workflow support with human approval on decisions. Exterro's guide for legal teams on AI in the courtroom says ethical duties and the rules of privilege and evidence still apply to AI generated material. Nothing addresses a supervising lawyer's duties over classification, culling or agent actions, or limits on use by jurisdiction.
The terms of use say information on iCONECT's pages is distributed on the understanding that the authors are not rendering legal, accounting or other professional advice. That sentence governs website content, not the review platform. The product classifies documents by legal relevance, redacts for privilege and summarizes documents for law firms, corporations, public sector organizations and service providers, and nothing published states that its output is not legal judgment, that a supervising lawyer must review it, or how it fits a lawyer's competence and supervision duties. No ethics opinion or court decision on technology assisted review is named.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
ARMOUR, short for Autonomous Risk Management, Orchestration and Unified Response, is Exterro's framework for agentic work. It sets out a six level autonomy ladder that moves a team from manual tasks to conditional and then high autonomy at its own pace. Exterro describes its AI capabilities as tested in real world use and keeps human approval on decisions, and it publishes analysis of the EU AI Act for customers. No AI policy, testing method, accuracy or bias result, model card or named owner for AI governance is published, and Exterro holds no AI management certification such as ISO/IEC 42001. Classification and culling decide what a reviewer sees, and nothing describes how uneven results across custodians, languages or file types are tested.
The platform page and a post of 10 May 2024 describe iCONECT's path as a responsible adoption of generative AI that enhances the platform without compromising data integrity or security. No person is named as accountable for model behavior, and no testing before release, evaluation results or principles are published. The SOC 2 Type 2 report covers information security controls and not the conduct of the models. Nothing addresses uneven output across languages and document types in classification by legal relevance or personal information identification. Users choosing between models from OpenAI, Microsoft and Google for personal information identification are not told how iCONECT evaluated them.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Under its agreement, Exterro commits to commercially reasonable security for customer data and to prompt notice of a data breach, with each party paying for a breach it causes. A customer can ask for its data in a standard format within 30 days of termination, and Exterro takes no responsibility for keeping it beyond 45 days. Exterro names four subprocessors in its trust center, each with function and region. AWS hosts data in the United States, the EU or Canada as the customer selects and runs AI processing for Exterro Assist through AWS Bedrock. Google Cloud hosts Exterro managed AI infrastructure in the United States and the EU, and Microsoft Azure hosts in the United States. Snowflake holds analytics and legal hold archives for customers hosted in AWS in the United States. Restricted production access and data retention and classification procedures are listed among the controls, and incident statements are posted, the latest on 5 October 2026. No retention period is stated for data or AI output during a subscription, and no notice period applies to subprocessor changes.
The eDiscovery and law firm pages cite SOC 2 certification, regular security training and penetration testing, workstation and server security, data protection and handling protocols and controlled access, and the platform page cites encryption, access controls, regular security audits and adherence to GDPR and HIPAA standards. The SOC 2 Type 2 audit of the SaaS platform, completed on 22 September 2025 by A-LIGN, covers security, availability, processing integrity, confidentiality and privacy. The cyber data mining page says ingestion, extraction, review and modification actions are logged with audit trails. The privacy policy (June 2024) covers the website and not data processed in the platform. No retention period, deletion commitment, breach notice timing, subprocessor list or statement on what model providers keep when documents are sent to them is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Exterro's master subscription agreement, updated June 2025, is public and sets out what Exterro stands behind. Exterro defends the customer against third party claims that the software infringes a patent, copyright or trademark, with the usual exclusions, and can secure a license, modify or replace the software, or end its use. It also defends claims arising from its own breach of confidentiality or of applicable law. Production software is warranted to run without a defect that causes a material failure against the documentation. The remedy is a fix or workaround, then termination with a refund of prepaid fees if the defect persists 30 days after notice. Liability is capped at $1,000,000, and breaches of security or confidentiality and the IP indemnity sit under a separate cap of $3,000,000. Exterro carries general liability and cyber insurance in commercially reasonable amounts. The agreement disclaims any warranty that the software is accurate or error free, and no term addresses AI output on its own.
No customer agreement, license terms or SaaS terms are published. The terms of use (31 July 2024, California law) disclaim liability for direct, indirect, special, incidental or consequential damages arising from the website and its content; they do not govern the software. No indemnity, warranty, cap or allocation of risk is published for missed documents, wrong classifications, failed redactions or errors in personal data extraction, on a product used to decide what is produced to an opposing party and who is notified after a breach.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Exterro's connector library reaches more than 190 sources across email, chat, collaboration tools, cloud storage, endpoints and business applications, and works on data in place without exports or copies. Each listed connector states what it does. Microsoft 365 covers holds and collection across Exchange, OneDrive, OneNote, SharePoint Online and Yammer, and Google Workspace covers Gmail, Drive, Calendar, Cloud Storage and Vault. Slack and Teams capture threads and shared files in context, and Box, Dropbox, Amazon S3, Salesforce and SharePoint on premises are listed the same way. Connectors use modern authentication, granular scopes and role based controls, run delta sync and throttling, report health in one console and log every action against the matter. Exterro says it can build a missing connector in about two weeks. Configuration steps and field level detail are not published.
iCONECT's release of 10 June 2021 says its Ligl integration, available then, lets organizations identify, hold, preserve and collect enterprise documents in Ligl, process and cull them, and push relevant documents to iCONECT for review. The cyber data mining page lets users send selected documents to a model of their choice, including models from OpenAI, Microsoft and Google. The partners page shows Microsoft, Nuix, LexisNexis, Sentio, Opus 2 and Heureka Software as technology partners, as logos without descriptions, alongside more than 25 hosting partners. An integration with eDiscovery AI was announced on 24 August 2026 as under development, with availability to follow. The platform page says iCONECT integrates with the most common applications in its three markets, without naming them. Nothing describes connections to a firm's document management, matter management or litigation support systems, and no integration documentation is public.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Exterro sells hosted software that it runs and on premises software that the customer deploys, and its comparison material adds private cloud, hybrid and managed options. Its trust center places hosting in AWS regions in the United States, the EU and Canada, as the customer chooses. Google Cloud adds the United States and the EU, and Microsoft Azure the United States. AI processing for Exterro Assist runs through AWS Bedrock and on Exterro managed infrastructure in Google Cloud. A FedRAMP Moderate authorized cloud serves United States government customers. Which region runs AI processing for a given hosting region, and what differs between hosted, private cloud and on premises editions, is not published.
The eDiscovery page offers on premises, hybrid, cloud and SaaS deployment. The post of 19 July 2024 on system architecture describes in house deployment, cloud deployment on Microsoft Azure, Google Cloud, AWS or other providers, and hosting through iCONECT's network of legal service providers. The release of 23 August 2023 launching iCONECT SaaS says it runs on Microsoft Azure. A firm can therefore keep the platform and its documents on its own infrastructure. Not stated are where iCONECT's SaaS stores or processes data, which regions are available, and whether SaaS customers are separated at the tenant level. Nor is it stated where documents go when they are sent to a model from OpenAI, Microsoft or Google for personal information identification, or whether the generative features work in an on premises deployment.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Exterro holds ISO/IEC 27001:2022, SOC 2, FedRAMP Moderate authorization, TISAX, HITRUST e1 and UK Cyber Essentials. The ISO certificate, the 2025 SOC 2 Type II report and bridge letter, the 2026 HITRUST e1 certificate and a SIG questionnaire are released through an access request. Controls are listed by area, and incident statements are posted, such as the 5 October 2026 note on the Canny.io incident. FedRAMP Moderate status appears in the public FedRAMP marketplace. ISO 27001 certification was announced in January 2026, with CISO Anthony Diaz describing a risk based security management system under continuous audit. Reports come through the access request rather than as open downloads.
iCONECT's release of 29 September 2025 says A-LIGN completed a SOC 2 Type 2 audit of its SaaS platform on 22 September 2025 covering security, availability, processing integrity, confidentiality and privacy, and the home page carries an A-LIGN badge. No audit period is stated, no trust center is published, and the report is offered neither for download nor on request. The eDiscovery and law firm pages add regular penetration testing and security training, and the platform page claims adherence to GDPR and HIPAA standards without any certification behind them.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Exterro's subprocessor list names where its AI runs. AWS Bedrock processes Exterro Assist requests, and Exterro managed AI infrastructure is hosted on Google Cloud in the United States and the EU. Exterro says it owns every layer of its stack, that data is not transferred to, stored or processed by third party language model vendors, and that it does not wrap models such as OpenAI's. Smart Labeling and image and video recognition are older models built into the platform. The models used through Bedrock or on Exterro's own infrastructure are not named, and no notice is promised before the list changes.
The cyber data mining page lets users send selected documents for personal information identification to a model of their choice, including models from OpenAI, Microsoft and Google. The platform page says iCONECT integrated Sentio technology, which carries its continuous active learning, and acquired AI source code from Ayfie in 2021. Nothing published names the model behind document summaries, classification, image description, transcription or translation, states whether iCONECT or the customer holds the model provider relationship, says where those models run, or commits to notice when a model changes.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Exterro publishes the structure of its pricing without the figures. Its agreement bills subscriptions annually in advance in USD, on licensed rights rather than usage, and lets Exterro raise the annual fee at renewal by the greater of CPI or 6%. Exterro Review is sold with unlimited annual user licensing and single instance storage instead of per GB hosting fees. Subpoena Manager is priced on the volume of subpoenas processed, on demand or in bulk. At its August 2025 launch, Exterro Assist came with unlimited questions and topic classification for a customer's first matter up to 250GB. Modules are sold one at a time or as a suite, and no rate, tier price or implementation fee is published.
The law firm page offers flexible pricing with monthly or annual terms, the Why iCONECT page describes predictable pricing through monthly and yearly plans, and the release of 23 August 2023 launching iCONECT SaaS describes Price Protect, which applies discounts automatically as data volume grows without renegotiating the contract. That points to data volume as a driver and term length as a choice, without stating the unit, the rate or what the generative features add. No price, rate per gigabyte, user fee or tier is published, and every route to a number runs through a demo request.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Exterro serves corporate legal, compliance, privacy, security and IT teams, with editions for law firms, government and law enforcement. In discovery it covers legal hold, custodian interviews, preservation in place, collection, processing, early case assessment, review, production, subpoena response and public records requests. FTK covers forensic acquisition from endpoints, cloud sources and mobile devices. Governance and privacy modules handle data mapping, retention and defensible deletion, records of processing, assessments, data subject requests and consent. Industry editions name financial services and insurance, healthcare and life sciences, energy, technology, government and manufacturing. No jurisdiction list is given for the privacy modules, and nothing says which modules run on premises, in which region or under FedRAMP.
The site addresses law firms, corporations, public sector organizations and service providers, each with its own page, across three products: eDiscovery, cyber data mining for breach response, and data governance. The law firm page covers litigation, investigations and responsive actions, the cyber data mining page covers breach notification work for incident response professionals, and the release of 24 August 2026 names law firms, corporations, legal service providers and public sector organizations as customers. Named users include NASA and the FDIC. What is not stated is which languages the generative features and personal information identification support, which privacy regimes the breach tools are built around beyond references to GDPR and HIPAA, and which deployment options carry the generative features.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
According to Exterro's AI pages, Exterro Assist runs inside the platform with no external access to or training on customer data, and no customer data trains the models. The customer agreement does not mention training. It limits Exterro's use of customer data to providing the subscription and its improvements to that customer, and gives Exterro anonymized aggregate data on system operation for performance tuning only. Whether the older Smart Labeling and recognition models follow the same rule is not stated.
No customer agreement, license terms or data processing addendum is published, and no page states a position on training with customer documents. The terms of use (31 July 2024) and the privacy policy (June 2024) cover the website only. Oversight's matter model is seeded by the customer's own reviewers with its own documents, which is not vendor training, and the cyber data mining page lets users send documents to models from OpenAI, Microsoft or Google with nothing published on whether those providers may train on them.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Exterro Assist keeps prompts and outputs inside Exterro's platform, with no external storage of either. No period is stated for how long prompts, answers or agent output stay in the platform during a subscription. Under the agreement, a customer can ask for its data back within 30 days of termination, and Exterro is not bound to keep it beyond 45 days. Audit logs and chain of custody records are kept by design.
Nothing published states how long documents, extracted data, summaries or other AI outputs are kept, or when they are deleted, in the SaaS platform or by a model provider. The privacy policy covers website data only.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Exterro Review lets a legal team give outside counsel role based access to specific matters, connectors use granular scopes and role based controls, and audit logs are tied to matters. Nothing published sets out how permissions are scoped per matter or per custodian. Nor does it say whether a privacy or IT user on the same platform can reach material held for litigation.
Nothing describes walls between matters or teams, or how the generative features and continuous active learning are kept within a matter. The eDiscovery and law firm pages cite controlled access and the SaaS launch release mentions user setup and matter management, without describing how access is segregated.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Exterro's customer agreement lets either party disclose confidential information when a law, rule or court order requires it, provided it gives the other party prompt notice where the law permits. The disclosing party must also cooperate with any attempt to obtain a protective order, at the other party's cost. No transparency report is published.
No published agreement addresses legal demands for customer data held in the platform. The privacy policy (June 2024), which covers the website, says iCONECT may disclose a website user's name, city, state, telephone number and email address to law enforcement on a verified request without a subpoena; it does not reach documents processed in the platform.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Exterro answers from the customer's own collected data rather than a body of primary law, so there is no case law or statute source to name or license. Smart Labeling learns from a reviewer's labels on a sample set within a matter. What trained the classification, labeling and image recognition models is not stated.
iCONECT works on a customer's own documents and data and does not describe retrieval of case law or other legal sources; no outside body of legal sources applies.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Exterro works on a matter's collected evidence, such as email, chat, files and forensic images, rather than on case law, so its answers cite documents from the collection, not legal authority. No citator or check for subsequent history is part of the product.
The product does not cite legal authority, so no check of subsequent history applies, and none is described.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Exterro's metadata and classification agents sort content against relevance, reason and confidence thresholds, and a validation agent checks retrieved information and flags problems for attention. Exterro does not describe what Exterro Assist does when it cannot ground an answer, or whether reviewers see where a document falls against a threshold.
Nothing published describes what the summaries, classification or personal information identification do when a document gives them no basis for an answer, or how low confidence is shown.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database kept by Damien Charlotin lists court decisions on hallucinated AI content worldwide, and none names Exterro, FTK or Exterro Assist. Exterro produces no citations to legal authority, and a court finding on a flawed collection, cull or production run through it would fall outside that database.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming iCONECT. iCONECT reviews, classifies and redacts a customer's own documents for eDiscovery and breach response rather than drafting filings.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Exterro's guide for legal teams on AI in the courtroom, drawn from an eDiscovery Today webinar it sponsored, holds that legal principles, civil procedure and ethical duties still govern AI work. It discusses rulings such as Morgan v. V2X on loading confidential discovery material into AI tools, and a 2026 review of court rulings covers orders to disclose the AI platform used. No named ethics opinion, such as ABA Formal Opinion 512, is discussed, and the guidance is not tied to Exterro's own features.
The terms of use (31 July 2024) state that information on iCONECT's pages is distributed on the understanding that the authors are not rendering legal, accounting or other professional advice. The clause governs website content, not the review platform. No ethics opinion, bar guidance or court decision on technology assisted review is named on the product pages or in iCONECT's posts.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Exterro quotes savings in hours and dollars. Subpoena Manager cuts manual subpoena work by up to 95% and up to 7,500 hours a year, and Review cuts the documents sent to outside counsel. Hanover reports saving more than $2 million in a year by keeping discovery in house. Most of those savings land on a corporate legal budget, but Review is also sold to law firms and service providers. No guidance on billing for AI assisted review is published, and no record of AI work is described for fee purposes.
iCONECT's pages claim savings without addressing billing. The eDiscovery page says AI email threading and deduplication reduce the dataset and that AI automations eliminate repetitive steps, the Why iCONECT page displays a counter for ROI savings delivered, and a customer release quotes Everest Discovery on reducing costs. The platform is sold to law firms and to service providers whose review charges reach clients, and nothing published addresses how AI assisted review is billed or disclosed.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Exterro's trust center publishes its subprocessors with function and region, including AWS Bedrock for Exterro Assist AI processing and Google Cloud for Exterro managed AI infrastructure. Security reports, certificates and a completed SIG questionnaire are released through an access request on the same site, and the customer agreement is public. No client facing note about the AI or list of models by feature is published.
No subprocessor list or disclosure material for a client's AI terms is published. The cyber data mining page names OpenAI, Microsoft and Google as model choices for one feature, which is not a list of the providers that process customer data, and the SOC 2 report is not offered for download or on request.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Exterro records chain of custody and an immutable audit log tied to each matter, covering holds issued, data preserved and collected, and every action taken on it. Exterro Intelligence results carry source references, each step links to its sources and logs, and privilege logs build during review. No export is described that shows, document by document, which decisions an agent or model made, which model made them and whether a person confirmed them.
The cyber data mining page says ingestion, extraction, review and modification actions are logged with audit trails that link each extracted data element to its source file, creating a defensible chain of custody for regulatory inquiries and legal review. Oversight produces reports of tagging errors, and the law firm page lists reviewer productivity reporting. Nothing records which model produced a summary or classification, and no export for disclosing AI use or validating continuous active learning to a court is described.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
Which one fits
Choose Exterro if
- Legal hold, forensics and review should live in one system. Exterro runs holds, collection, FTK forensics, early case assessment, review and production from one platform.
- Your company reuses the same documents across many matters. Single instance storage keeps each file once, with privilege and redaction labels that carry into the next matter.
- Seat counts keep growing. Exterro Review is licensed annually with unlimited users and charges no hosting fee for data held in review.
Choose iCONECT if
- You run review for outside clients. Service providers host iCONECT for their own customers, and law firms can install it inside their own networks.
- Notification lists are a regular deliverable. iCONECT's cyber data mining tool builds the list of people to notify from breached files and keeps a chain of custody for each extracted item.
- You want a say in which model reads the data. For breach extraction, iCONECT sends documents you select to a model you choose from OpenAI, Microsoft or Google.
In summary
Exterro
Exterro, based in Portland, Oregon, sells a data risk management platform that joins eDiscovery, digital forensics, data privacy and information governance. The eDiscovery suite runs legal hold, collection, early case assessment, review and production on single instance storage. Exterro Intelligence and Exterro Assist add agentic AI with human approval, AI summaries, translation and audio and video transcription. According to the AI Legal Index, Exterro holds ISO 27001, SOC 2, FedRAMP, TISAX and HITRUST certifications and publishes no price.
iCONECT
iCONECT, from iCONECT Development, LLC, is a review and analysis platform used since 1999 for eDiscovery, incident response and data governance. Law firms, corporations, public sector organizations and service providers run it on their own servers, in their own cloud accounts, through partners or as SaaS on Azure. According to the AI Legal Index, continuous active learning and the Oversight quality check come in standard eDiscovery licensing, beside generative summaries, classification and redaction.
Questions buyers ask
Is Exterro built for law firms or corporate legal teams?
Exterro is aimed mainly at corporate legal, compliance and IT teams, with separate offerings for law firms and government. iCONECT names law firms, corporations, public sector bodies and service providers as its buyers. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
How do Exterro and iCONECT keep a person in charge of AI review?
Exterro Intelligence lets agents carry out and record workflow steps, with human approval at decision points and citations on outputs. iCONECT's learning tools rank and recheck documents while reviewers make the coding decisions. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Which one handles digital forensics?
Exterro owns FTK, a forensic toolkit for imaging and examining devices, alongside its eDiscovery suite. iCONECT starts at processing and covers review, production and breach data mining. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
How are Exterro and iCONECT licensed?
Exterro Review uses annual licensing with unlimited users and no hosting fees under single instance storage. iCONECT sells monthly or annual terms with deployment options from on premises to SaaS. Neither shows a price. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
What security standards do Exterro and iCONECT meet?
Exterro holds ISO 27001, SOC 2, FedRAMP, TISAX and HITRUST certifications and runs a trust center. iCONECT's SaaS platform holds a SOC 2 Type 2 report, and an installation on a customer's servers falls under that customer's own controls. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Exterro is headquartered in Portland, Oregon, with engineering offices in Coimbatore and Chennai, India. iCONECT is made by iCONECT Development, LLC. Neither vendor reviewed this page.