Exterro vs Nuix Neo: how they compare in 2026

The brief flagged this name to check the AI bar. It clears the bar and lands low on centrality, which is the same split found on Onspring. Real and shipped: AI driven classification and filtering to reduce review volume and identify key custodians, custodian relationship visualisation surfacing communication patterns, contextual label suggestions that read content and prior labelling decisions to recommend tags, and Exterro Intelligence, an agentic layer announced 26 August 2026 with Exterro Assist for Data as its core. But the platform is a decade plus orchestration and workflow business covering legal hold, preservation, processing, production, privacy and forensics, and every one of those functions works without a model. Independent comparison material makes the same reading, describing the AI as an enhancement to a traditional GRC platform rather than the foundation it was built on, and Exterro's own framing of AI extending ediscovery says the same thing from the other direction. Graded below Everlaw and Relativity at B, where the model layer is core to what is sold. Note the recency: the agentic layer is three days old at the date of this record, so centrality here is a moving target and this grade should be revisited on the next pull rather than assumed stable.

The models are the engine of a core capability layered on a product that would still function without them. Nuix Neo's AI classifies and contextualises data, applies language models described as trained for the customer's use case to cut review volume, and drives automated redaction; remove them and the Nuix Engine, processing more than a thousand file types into searchable form, plus early case assessment, review in Nuix Neo Discover and investigation workflows remain, which is the product the company has sold for years. The EULA restricts use to internal ediscovery, investigations and information governance projects and describes the licence by data volume processed, not by AI. Home page, products page, Neo Legal and Discover pages and EULA read 6 September 2026.

Explainability is claimed as a design principle and nothing measured is published. Exterro Intelligence is positioned as turning complex data into explainable actions and insights, and the platform's defensibility architecture means outputs sit alongside chain of custody records and complete audit logs, so an action can be traced to the data it rests on. That is grounding of a kind, and for ediscovery the corpus is the collected data set rather than the law, so the failure mode is misclassification rather than invented authority. Absent: no accuracy figure for classification or filtering, no precision or recall for label suggestion or custodian identification, no false negative rate for review reduction, no hallucination statement for the agentic layer, and no published evaluation. The gap that matters most in this category is unaddressed by every vendor in it including this one: a filter that wrongly excludes a responsive document produces a defensibility failure that no audit log will surface, and nobody publishes a recall figure. Checked the ediscovery product pages, the platform and intelligence pages, the litigation use case page and the comparison material on 29 Aug 2026.

Accuracy is asserted without measurement, and the primary-authority limbs do not apply. The vendor states that its language models improve accuracy and reduce the data to review, and the telecommunications page claims elimination of up to ninety-five per cent of non-relevant data early, with no test set, method or recall figure published; EULA section 10.1 disclaims any warranty of truth or accuracy of data or information generated and makes the licensee responsible for determining whether generated information is accurate. The product classifies and culls documents rather than citing law, so the citation limbs are not held against it; what the band asks of a review tool, a measured statement of how often its classification is wrong, is not published on the surfaces read. Product pages and EULA read 6 September 2026.

Autonomy is named as a direction of travel and bounded in the same breath, which is a more honest posture than most. ARMOUR is published as an explicit strategic vision for autonomous risk management, describing a shift from AI assisted tasks to orchestration of legal, privacy and security workflows, so the vendor states plainly where it is going rather than leaving agentic capability to be discovered. Against that, Exterro Intelligence is described as keeping humans in control at critical decision points, and the platform's chain of custody and audit logging mean agent actions land in a record designed to be defensible. Held at B because the bounding is stated rather than specified: no definition of what a critical decision point is, no list of actions an agent may take unattended, no confidence or escalation behaviour, and no description of how an agent action is distinguished from a human one in the audit log. Naming a threshold concept without defining it is the gap between this and an A.

A written commitment that the models work alongside reviewing people, with real review surfaces, short of the full control structure. The review product is described as responsive review with AI-enabled workflows that support faster and more precise human review, the bring-your-own-AI option is described by a named customer as running within its own environment under its own compliance controls, and automated workflow templates run culling and redaction that a reviewer then works from. What is not published is the threshold at which a document is excluded from review, what executes without a person, or a stated route back after a misclassification beyond ordinary review. Discover, Neo Legal and Neo pages read 6 September 2026.

Independent analyst placement is the strongest element and it is dated and checkable. Named a Market Leader in the IDC MarketScape for eDiscovery 2025 and a Major Player in the IDC MarketScape for Data Privacy Compliance Software 2025, which are third party evaluations rather than vendor claims. Further recognition: LegalTech Breakthrough Award for overall eDiscovery, KM World Best eDiscovery Solution, British Legal Technology Award for Innovation in Legal Services, Golden Stevie American Business Award, and an Oregon Tech Award. Verified customer commentary appears on an independent review platform, including a detailed account crediting a fully integrated end to end lifecycle that let the customer bring matters in house rather than sending data to outside vendors. Held at B because no customer is named in vendor material: the most substantial published case describes a major global insurance company with more than 35,000 employees without identifying it, and outcome claims of measurable ROI and significant reduction in outside counsel costs carry no figure, baseline or period.

A named customer without figures, and figures without a named customer. Donn Hoffman, Chief Privacy Officer and Deputy District Attorney at the Los Angeles County District Attorney's office, is quoted on the on-premises Discover page about implementing bring-your-own-AI within the office's own environment, with no measured outcome; IAV GmbH is named on the same page as an ediscovery services customer. The up-to-ninety-five-per-cent data reduction figure on the telecommunications page is unattributed and undated. Nothing joins a named customer to a figure. Discover on-premises page and telecommunications page read 6 September 2026; customer stories were not opened.

Platform confidentiality is the best evidenced on this index and privilege specifically is not addressed. The certification set is unusually broad and is graded on the Security axis rather than double counted here, but its practical effect on confidentiality is real: FedRAMP Moderate and HITRUST both carry confidentiality control requirements that an independent assessor has tested. Chain of custody and complete audit logs support defensible handling at every stage. What was not located: any treatment of legal professional privilege or attorney work product, any statement about privilege review workflows within the platform despite privilege log production being a standard ediscovery task, and any description of how privileged material identified during review is protected from the wider platform where privacy and IT teams also operate. That last point matters because the unified Legal GRC architecture is the selling proposition: legal, compliance, security and IT work in one system, and the boundary around privileged material inside that system is not described. Checked the ediscovery pages, the platform pages, the security and privacy material and the about page on 29 Aug 2026.

Substantive published commitments, structural and contractual, short of the full picture. The deployment is on-premises under the EULA: one copy installed in the licensee's own production environment, so matter data stays with the licensee, and EULA section 3.4 has the licensee own Licensee Data and license it to Nuix solely to provide support. Section 9 treats licensee data as confidential information and sections 9.3 and 9.4 commit, on any legally compelled disclosure, to prompt notice where permitted, assistance in seeking a protective order, and disclosure of no more than counsel advises is required. The bring-your-own-AI option keeps third-party models inside the customer environment. Not located: any statement on training use, since the agreement is silent on machine learning, any description of matter-level segregation inside the review product, and any treatment of privilege or work product. EULA read in full; product pages read 6 September 2026.

Not located. The platform makes responsiveness and privilege adjacent determinations at scale through AI driven classification and filtering, and an agentic layer now acts across workflows, so the question of what a supervising lawyer must review is squarely engaged by the product. Nothing published addresses it: no statement on the reviewing attorney's role over AI classification decisions, no positioning on the professional responsibility of a legal team relying on automated culling, and no engagement with any bar guidance or judicial expectation on the use of AI in discovery. Checked the ediscovery product pages, the platform and intelligence pages, the litigation use case page and the resource material on 29 Aug 2026. Note for consistency: no vendor in this category on the index engages the Federal Rules or technology assisted review case law, and this record does not break that pattern.

The advice line is not drawn and the audience is broad. The EULA confines use to the licensee's internal ediscovery, investigations and information governance projects and makes the licensee responsible for the accuracy of generated information, but no surface read states that the product does not provide legal advice or how it supports a supervising lawyer's duties; the buyers named span law firms, corporate legal, law enforcement, financial regulators and telecommunications companies. No jurisdiction limit is named beyond export control and the territory clause. EULA and product pages read 6 September 2026.

Governance vocabulary is present and consistent, and nothing behind it is published. The AI is described as governed and trusted, ARMOUR is a named framework, humans are stated to remain in control at critical decision points, and the vendor publishes analysis for customers on EU AI Act enforcement including transparency obligations and general purpose AI rules, so the subject is engaged rather than avoided. That places it ahead of the several records in this pull with no governance language at all. What is missing is every artifact a reader could inspect: no AI policy, no model card, no bias or fairness testing methodology or result, no accuracy monitoring, no drift statement, no named internal governance body, and no ISO 42001 despite holding ISO 27001. The specific untested question: classification and filtering decide what a reviewer ever sees, and any systematic tendency in that filtering shapes the evidentiary record of a matter without appearing anywhere in the audit log. Checked the platform and intelligence pages, the ediscovery pages, the about page and the published EU AI Act material on 29 Aug 2026.

Responsible-use language without a published mechanism, testing regime or accountable owner. The review product is marketed as powered by ethical AI, the Neo page describes language models trained to the customer's use case, and the vendor writes about capturing AI productivity responsibly; no governance framework, ISO 42001 or equivalent, pre-release testing description or statement about uneven classification across document types or languages is published on the surfaces read. Product pages read 6 September 2026.

One of very few records on this index to state an AI data handling position rather than leave it to inference. The published in platform processing rules for Exterro Intelligence are no training, no access and no storage, which answers three separate questions most vendors leave open: customer data is not used to train models, the model layer does not retain it, and access is bounded. For a platform holding entire collected data sets under legal hold, including custodian communications and forensic images from live endpoints, that is the disclosure a buyer most needs and it is made plainly. Held at B rather than A because the statement is short and unelaborated: it appears as a product architecture note rather than in a contract or a policy document, no scope is given for whether it covers every AI feature or only the agentic layer, nothing states whether the same rules apply to the pre existing classification and labelling models, no retention figure is attached to the surrounding platform as distinct from the AI layer, and no third party attestation covers the claim. A short true sentence still needs somewhere durable to live.

Some of the ground is covered, much of it by the deployment model rather than by published policy. Under the EULA the licensee installs the software in its own environment and is solely responsible for backing up and securing Licensee Data, Nuix processes personal information only with prior written consent and then under a DPA that prevails over the licence, and Usage Data sent to the licensing server excludes Licensee Data. No retention period, deletion commitment, sub-processor list or incident-notification practice for hosted deployments was located; the DPA at the URL the EULA names and the 2020 Discover SaaS terms of use were not opened and are the rebuttal route for the hosted product. EULA read in full 6 September 2026.

No published position located. Nothing was found on liability for AI output, warranty, indemnity, service levels or remedy where classification, filtering or an agent action is wrong. The exposure is concrete in this category rather than theoretical: an AI driven cull that wrongly excludes responsive material creates a discovery failure attributable to the customer in front of a court, and the customer carries that consequence with no published vendor position on it. Checked the ediscovery pages, the platform and intelligence pages, the about page and the site navigation on 29 Aug 2026. Research limitation: enterprise agreements govern this and are not public, and no public terms page was located in this pass.

A real published position on liability, short of the full picture because the vendor gives no indemnity. EULA section 11.2 caps Nuix's aggregate liability at the licence fee paid under the applicable order form in the preceding twelve months, section 11.1 excludes indirect, consequential, and lost-profit claims and bars claims not brought within a year, both carving out intentional misconduct, gross negligence and bodily injury; section 10.3 gives repair, replacement or a prorated refund as the sole remedy for a warranty that cannot be excluded, section 10.1 disclaims accuracy of generated information, and section 11.5 states that Nuix is not an insurer and the licensee looks to its own insurance. Only the licensee indemnifies, under 11.6. A signed direct agreement supersedes the EULA. EULA read in full 6 September 2026.

The largest published connector footprint on this index and the only record to state a count. More than 190 native connectors supporting in place operations across email, cloud storage, collaboration platforms and endpoints, with more than 120 data sources reachable for in place preservation, and Microsoft 365, email systems and archiving tools named specifically. In place is the operative distinction and it is a substantive capability claim rather than a list: preserving and collecting where data lives, without copying it out first, is what prevents accidental deletion during a hold and is the hard part of the problem. A dedicated connectors page is published. Held at B rather than A on a stated limitation: the connector list itself was not read in this pass, so the count is credited from vendor summary material and the composition of the 190 is unverified, and no API or export documentation was reviewed. Correction candidate in the upward direction if the list is read and holds up.

Integrations are referred to without documentation an implementer could use on the surfaces read. The Engine's ingestion of more than a thousand file types and connection to data sources is the product's core, the EULA contemplates APIs as ancillary software licensed for use with the software, and the Neo Legal page describes orchestrating business applications across the enterprise, but no integrations page or documentation was opened and no document, matter or review system connection is described with what moves and in which direction. Product pages and EULA read 6 September 2026; the documentation is the rebuttal route.

Deployment posture is partly established by a certification rather than by a deployment statement. FedRAMP Moderate authorization is meaningful here beyond security: it establishes that the SaaS platform runs an authorised boundary meeting United States federal cloud requirements, which carries residency and control implications a reader can verify independently through the FedRAMP marketplace. TISAX similarly implies assessed European handling for automotive supply chain customers. What is absent as a direct statement: no hosting provider is named, no region list or data residency commitment is published, no single tenant or dedicated instance option is described, and nothing states where non federal customer data is processed and stored. Credited at C because the certifications carry real deployment information that a buyer can check, and held there because the vendor never states the position itself. Checked the security and privacy material, the about page, the platform pages and the ediscovery pages on 29 Aug 2026.

The deployment model is stated clearly and residency for hosted deployments is not. Nuix Neo Discover is offered as a native on-premises deployment for organisations with data sovereignty and chain-of-custody requirements, the EULA licenses one copy installed in the licensee's production environment, and the vendor's own description is that the customer keeps complete control over its sensitive information; a hosted route exists through service provider partners and third-party hosting providers under separate terms. For on-premises use residency is wherever the licensee puts it, which answers the question fully; for the hosted route no region, tenancy model or processing location is stated on the surfaces read. Discover on-premises page and EULA read 6 September 2026.

The strongest security record on this index. Five distinct frameworks, named, with a published Trust Center bringing together security controls, privacy practices, certifications and audits. ISO/IEC 27001 certification announced 29 January 2026, so both current and dated, with the Chief Information Security Officer named as Anthony Diaz and quoted on what the certification covers, which is a risk based information security management system under continuous surveillance audit. SOC 2. HITRUST e1 certification of the SaaS platform. TISAX, derived from ISO 27001 and governing automotive sector handling. And FedRAMP Moderate authorization, which is the element that lifts this above every other record: FedRAMP requires third party assessment organisation review and authorisation by a government authority, and the resulting status is listed publicly, so an outsider can verify it without contacting the vendor or entering a portal. That is the definition of the top of this axis. The vendor also publishes its own reasoning on why third party audits are useful internally, quoting the CISO on audits identifying gaps the company would not otherwise have found, which is a notably unmarketing thing to say. Calibration ladder for later records: Regology and Onspring B, Lexis+ AI A on scope, currency and a self serve portal, Exterro A on five frameworks including one independently verifiable in a public government registry with a named CISO and a dated certification.

Certification is stated on the product's own surface, short of a report reachable without asking. The Nuix Discover page states that the product holds globally recognised certifications including ISO 27001 and SOC 2. No auditor, coverage period, report type or route to the report is published, and no trust centre was located on the surfaces read; the EULA adds no security warranty beyond the licensee's own obligations. Discover page and EULA read 6 September 2026.

The handling rules are disclosed and the parties are not. The no training, no access, no storage statement establishes how the model layer treats customer data, which is a supply chain adjacent disclosure of real value, and it implies bounded relationships with whatever models sit underneath. But no foundation model provider, model family or version is named anywhere located, no subprocessor list was found, and nothing distinguishes proprietary classification models built over years from whatever powers the agentic layer announced three days ago. A buyer knows the rules governing the models and not their identity, which is the inverse of Onspring, the only record on this index naming its provider outright while saying less about handling. Checked the platform and intelligence pages, the ediscovery pages, the security and privacy material and the about page on 29 Aug 2026.

The supply chain is partly disclosed. The vendor describes proprietary AI in the Engine and bespoke language models trained for the customer's use case, and a bring-your-own-AI option that lets the customer run its chosen models inside its own environment, which places the third-party model, where it runs and who controls it with the customer; a named customer describes using the latest AI advancements within its own environment on that basis. What is not published is the name of any model Nuix supplies, any provider behind its own models, or a change-notification commitment. Neo page, Discover on-premises page and EULA read 6 September 2026.

No pricing at any level. No price, no range, no unit of charge, and no indication of how the modular structure prices, which is the specific question this product raises: the platform is explicitly sold as individual products or as a complete orchestrated suite, so a buyer starting with Legal Hold Pro and expanding cannot determine what expansion costs. Independent software directories list pricing as available on request and carry no figure. Every route is a demo request. Checked the product pages, the about page, the site navigation and independent directory listings on 29 Aug 2026.

The unit and structure are stated in the agreement without the figure. EULA section 5.2 defines a consumption-based licence with a unit of one terabyte of uncompressed data processed per annum, aggregated across instances, expiring unused at the end of each twelve-month term, with quarterly usage reporting and true-up at order-form overage rates; section 7.2 sets automatic twelve-month renewals with ninety days' notice and section 4.1 folds standard support into fixed-term licence fees while premium tiers cost extra. No figure, tier name or price page was located. EULA read in full 6 September 2026.

Coverage is enumerated where it counts for this category, which is data reach rather than jurisdiction. More than 190 native connectors and more than 120 in place preservation sources across email, cloud storage, collaboration platforms and endpoints, spanning the full EDRM from legal hold and preservation through collection, processing, early case assessment, review, production and defensible deletion. Adjacent coverage extends to digital forensics through FTK, data privacy including subject access request fulfilment, data inventory and mapping, retention, vendor risk profiling and consent management. The buyer set is enterprise legal, compliance and IT, described consistently. Held at B rather than A because coverage is stated as counts and categories rather than as an inspectable list in the material read, no jurisdictional scope is given for the privacy modules despite privacy regimes being jurisdiction specific, and nothing indicates which capabilities are available in which deployment or region.

Segment and coverage are described with substance; the boundaries are partly stated. Primary users are listed on the Neo Legal page as law firms managing large-scale ediscovery, corporate legal teams handling regulatory matters and disputes, financial services firms, compliance officers, investigation teams and security leaders, with separate solution lines for investigations, data privacy and industry pages for telecommunications, integrity agencies and financial regulators; the Engine's coverage of more than a thousand file types is stated. The EULA's territory clause and the on-premises option are stated boundaries; no matter type or practice area is named as unsupported. Product pages and EULA read 6 September 2026.