Exterro vs Nuix Neo: how they compare in 2026

Exterro's AI runs through the platform, but the product beneath it was built first and still works without it. Smart Labeling learns from a reviewer's labels on a sample set and applies them across a document pool, and image and video recognition have been part of the platform for more than a decade. Context Insights maps custodians and communications, and Smart Summarization, translation and transcription speed up review. Exterro Assist, launched in August 2025, added agents that answer questions over collected data, classify documents and draft reports. Subpoena Manager runs subpoena intake and routing on agents. Legal hold, preservation, collection, processing, production, privacy requests and forensics all run as workflow software, and the AI makes those workflows faster rather than defining them.

Nuix Neo's AI classifies and contextualizes data, applies language models described as trained for the customer's use case to cut review volume, and drives automated redaction. Without it, the Nuix Engine still processes more than a thousand file types into searchable form. Early case assessment, review in Nuix Neo Discover and investigation workflows also remain, which is the product Nuix has sold for years. The Solutions Terms of July 2026 say Nuix will identify in its documentation the features that materially rely on AI systems, and the license is sold by data volume processed rather than by AI use.

Source references in Exterro Intelligence results lead back to the collected documents, and the audit trail links each step to its data, so a reviewer can open what an answer rests on. A validation agent checks the accuracy and integrity of retrieved information. Exterro publishes throughput rather than accuracy: 40,000 documents an hour for classification, 100,000 an hour of preprocessing for questions, and tasks up to 400 times faster than manual work. In a global insurer's three week trial that Exterro describes, investigators compared summaries, timelines and citations with native documents. No precision, recall or error rate is published for classification, labeling, summaries or answers. In ediscovery the costly error is a responsive document culled by mistake, and no recall figure addresses it.

Nuix says its language models improve accuracy and reduce the data to review. Its telecommunications page claims that up to 95 percent of irrelevant data is eliminated early, with no test set, method or recall figure. The Solutions Terms of July 2026 call AI output probabilistic and warn that it may contain errors, omissions or bias. They disclaim any warranty on its accuracy, completeness or reliability and make the customer responsible for verifying it. The product classifies and culls documents rather than citing law, and no measured error rate for its classification is published.

Autonomy is where Exterro is heading, and it sets limits in the same breath. Subpoena Manager, launched in May 2026, uses agents to take in subpoenas from any channel, extract deadlines and matter details, route requests, follow up and drive preservation, collection and review. Legal staff give the final approval on each action. ARMOUR's autonomy ladder lets a team raise automation in steps, from manual work to conditional and then high autonomy. Exterro Intelligence agents classify content against relevance, reason and confidence thresholds, and a validation agent checks retrieved information and flags problems. Every action lands in the audit trail with chain of custody. What an agent may do without approval at each level, and where the thresholds sit, is not published.

The models work alongside reviewing people under a written commitment, with real review surfaces, but the full control structure is not published. The review product is described as responsive review with workflows enabled by AI that support faster and more precise human review. A named customer describes running its own AI within its own environment under its own compliance controls. Automated workflow templates run culling and redaction that a reviewer then works from. Nothing published sets the threshold at which a document is excluded from review, says what runs without a person, or states a route back after a misclassification beyond ordinary review.

The Hanover Insurance Group is a named Exterro customer. Its eDiscovery and information governance lead reports saving at least 75% a case on average, and more than $2 million over 12 months, by running discovery in house and tracking external against internal costs. A North American real estate company cut documents by 68% before review and those sent to outside counsel by 97% on one matter. A global insurer's three week ARMOUR trial covered 650GB, including a fraud investigation of 200,000 documents reviewed in an afternoon and a subject access request cut from about 60 hours to a few. IDC named Exterro a Leader in its 2025 eDiscovery MarketScape and a Major Player for data privacy compliance software. Exterro reports more than 2,700 organizations as customers, with its Fortune 100 share given as 40% on its review pages and 50% on its legal and security pages. The Hanover figures rest on its own cost tracking, and none of the results carries a date.

Donn Hoffman, Chief Privacy Officer and Deputy District Attorney at the Los Angeles County District Attorney's office, is quoted on the Discover page for installation on premises. He speaks about running the office's own AI within its own environment, with no measured outcome. IAV GmbH is named on the same page as an ediscovery services customer. The data reduction figure of up to 95 percent on the telecommunications page carries no customer name or date. No named customer is joined to a figure.

Confidentiality binds both parties under the agreement, which limits Exterro's use of customer data to providing the subscription. Either party may disclose under a court order or law only with prompt notice where the law allows. Exterro states that customer data does not train its models and that Exterro Assist runs inside the platform with no external access. Review flags potentially privileged documents during processing and builds the privilege log as review proceeds. Its single instance store keeps one copy of each document, so a privilege or redaction call made in one matter follows the document into every other matter. Outside counsel get role based access to specific matters. The no training statement is not in the agreement, and nothing describes how privileged material is walled off from privacy and IT users on the same platform.

Customer data stays the customer's under Nuix's Solutions Terms of July 2026, which license Nuix to process it only to provide the solutions. They state that Nuix will not use customer data to train any AI systems, treat customer data as confidential information, and require prompt written notice of any compelled disclosure where the law permits. Installed on premises, the software keeps matter data in the customer's own environment, and the bring your own AI option keeps third party models there too. For SaaS, each customer's databases and file shares are logically separated and encrypted with AES 256. Privilege and work product are not addressed as such, and no separation by matter inside the review product is described.

Twice in its agreement, Exterro states that it does not practice law or give legal advice, and it disclaims any warranty that the software will assure legal compliance. Buyers are corporate legal, compliance and IT teams, law firms and government, and the AI is sold as review and workflow support with human approval on decisions. Exterro's guide for legal teams on AI in the courtroom says ethical duties and the rules of privilege and evidence still apply to AI generated material. Nothing addresses a supervising lawyer's duties over classification, culling or agent actions, or limits on use by jurisdiction.

AI output is probabilistic and may contain errors, omissions or bias, according to Nuix's Solutions Terms of July 2026. The terms say AI systems are no substitute for legal or other professional advice or for review by a trained professional, and the customer must verify output before relying on it. Buyers span law firms, corporate legal teams, law enforcement, financial regulators and telecommunications companies. Nothing describes how the product supports a supervising lawyer's duties, and no jurisdiction limit is named beyond export control and the territory clause.

ARMOUR, short for Autonomous Risk Management, Orchestration and Unified Response, is Exterro's framework for agentic work. It sets out a six level autonomy ladder that moves a team from manual tasks to conditional and then high autonomy at its own pace. Exterro describes its AI capabilities as tested in real world use and keeps human approval on decisions, and it publishes analysis of the EU AI Act for customers. No AI policy, testing method, accuracy or bias result, model card or named owner for AI governance is published, and Exterro holds no AI management certification such as ISO/IEC 42001. Classification and culling decide what a reviewer sees, and nothing describes how uneven results across custodians, languages or file types are tested.

Nuix markets its review product as powered by ethical AI and describes language models trained to the customer's use case. Its Solutions Terms of July 2026 commit Nuix to governance processes designed to identify, assess and mitigate material bias in its proprietary AI output. Customers get a written route to report systemic bias, and Nuix commits to comply with AI laws that apply to it as a provider. No governance framework, ISO 42001 or equivalent, named owner, testing before release or finding about uneven classification across document types or languages is published.

Under its agreement, Exterro commits to commercially reasonable security for customer data and to prompt notice of a data breach, with each party paying for a breach it causes. A customer can ask for its data in a standard format within 30 days of termination, and Exterro takes no responsibility for keeping it beyond 45 days. Exterro names four subprocessors in its trust center, each with function and region. AWS hosts data in the United States, the EU or Canada as the customer selects and runs AI processing for Exterro Assist through AWS Bedrock. Google Cloud hosts Exterro managed AI infrastructure in the United States and the EU, and Microsoft Azure hosts in the United States. Snowflake holds analytics and legal hold archives for customers hosted in AWS in the United States. Restricted production access and data retention and classification procedures are listed among the controls, and incident statements are posted, the latest on 5 October 2026. No retention period is stated for data or AI output during a subscription, and no notice period applies to subprocessor changes.

A personal data breach gets notice without undue delay under the data processing addendum of June 2026, with information and help in mitigating it. Nuix deletes or returns personal data at the end of the agreement, or at any time on written request, unless the law requires it to keep some. A SaaS customer has 10 days after its subscription ends to download its data under the Solutions Terms of July 2026. Nuix then deletes it, and data is unrecoverable from backups 90 days after the end. The Security Requirements of June 2026 set encryption, logical separation of each customer's data and an incident response program. On premises, the customer holds and backs up its own data. No subprocessor list is published.

Exterro's master subscription agreement, updated June 2025, is public and sets out what Exterro stands behind. Exterro defends the customer against third party claims that the software infringes a patent, copyright or trademark, with the usual exclusions, and can secure a license, modify or replace the software, or end its use. It also defends claims arising from its own breach of confidentiality or of applicable law. Production software is warranted to run without a defect that causes a material failure against the documentation. The remedy is a fix or workaround, then termination with a refund of prepaid fees if the defect persists 30 days after notice. Liability is capped at $1,000,000, and breaches of security or confidentiality and the IP indemnity sit under a separate cap of $3,000,000. Exterro carries general liability and cyber insurance in commercially reasonable amounts. The agreement disclaims any warranty that the software is accurate or error free, and no term addresses AI output on its own.

Third party claims that the customer's use of a solution infringes intellectual property are defended and any losses awarded or settled are paid under the Solutions Terms of July 2026. Exclusions cover unsupported versions, combinations and unauthorized use. Nuix warrants that software is free from defects for 90 days from the license key and that a SaaS offering is free from defects through the subscription, with repair as the remedy. Each party's liability is capped at the fees for the agreement year. A super cap of twice that applies to breaches of the security requirements or the data processing addendum that compromise customer data. Fraud, wilful default, death or injury from negligence and indemnified claims sit outside the caps. Nuix maintains professional liability and general liability insurance. AI output carries no warranty of accuracy, completeness or reliability.

Exterro's connector library reaches more than 190 sources across email, chat, collaboration tools, cloud storage, endpoints and business applications, and works on data in place without exports or copies. Each listed connector states what it does. Microsoft 365 covers holds and collection across Exchange, OneDrive, OneNote, SharePoint Online and Yammer, and Google Workspace covers Gmail, Drive, Calendar, Cloud Storage and Vault. Slack and Teams capture threads and shared files in context, and Box, Dropbox, Amazon S3, Salesforce and SharePoint on premises are listed the same way. Connectors use modern authentication, granular scopes and role based controls, run delta sync and throttling, report health in one console and log every action against the matter. Exterro says it can build a missing connector in about two weeks. Configuration steps and field level detail are not published.

The Engine ingests more than a thousand file types and connects to data sources, which is the core of the product. Nuix's Solutions Terms cover customer integrations and the use of Nuix's APIs, and the Neo Legal page describes orchestrating business applications across the enterprise. No document, matter or review system connection is described with what moves, in which direction or what a customer must configure.

Hosted software that Exterro runs and on premises software that the customer deploys are both sold, and its comparison material adds private cloud, hybrid and managed options. Its trust center places hosting in AWS regions in the United States, the EU and Canada, as the customer chooses. Google Cloud adds the United States and the EU, and Microsoft Azure the United States. AI processing for Exterro Assist runs through AWS Bedrock and on Exterro managed infrastructure in Google Cloud. A FedRAMP Moderate authorized cloud serves United States government customers. Which region runs AI processing for a given hosting region, and what differs between hosted, private cloud and on premises editions, is not published.

On the customer's premises or as a SaaS offering, Nuix Neo Discover serves organizations with data sovereignty and chain of custody requirements. On premises, the customer installs one production copy in its own environment and keeps complete control over its data, so residency is wherever the customer puts it. For SaaS, Nuix's Security Requirements commit to logically separated databases and file shares dedicated to each customer, with encryption at rest and in transit. No hosting provider, region or processing location for the SaaS offering is stated.

ISO/IEC 27001:2022, SOC 2, FedRAMP Moderate authorization, TISAX, HITRUST e1 and UK Cyber Essentials are all held by Exterro. The ISO certificate, the 2025 SOC 2 Type II report and bridge letter, the 2026 HITRUST e1 certificate and a SIG questionnaire are released through an access request. Controls are listed by area, and incident statements are posted, such as the 5 October 2026 note on the Canny.io incident. FedRAMP Moderate status appears in the public FedRAMP marketplace. ISO 27001 certification was announced in January 2026, with CISO Anthony Diaz describing a risk based security management system under continuous audit. Reports come through the access request rather than as open downloads.

The Nuix Discover page states that the product holds ISO 27001 and SOC 2 certifications. Nuix's Security Requirements of June 2026 bind it, for SaaS offerings, to obtain an annual third party audit report on ISO/IEC 27001 compliance covering the cloud infrastructure, client and web applications, APIs and software development. They also require AES 256 encryption at rest and in transit and logical separation of each customer's databases and file shares. No auditor, coverage period or route to a report is published, and Nuix runs no public trust center.

Where the AI runs is named on the subprocessor list. AWS Bedrock processes Exterro Assist requests, and Exterro managed AI infrastructure is hosted on Google Cloud in the United States and the EU. Exterro says it owns every layer of its stack, that data is not transferred to, stored or processed by third party language model vendors, and that it does not wrap models such as OpenAI's. Smart Labeling and image and video recognition are older models built into the platform. The models used through Bedrock or on Exterro's own infrastructure are not named, and no notice is promised before the list changes.

The supply chain is partly disclosed. The vendor describes proprietary AI in the Engine and custom language models trained for the customer's use case. A bring your own AI option lets the customer run its chosen models inside its own environment, which places the third party model, where it runs and who controls it with the customer. A named customer describes using the latest AI advances within its own environment on that basis. Nuix does not publish the name of any model it supplies, any provider behind its own models, or a commitment to notify customers of changes.

Pricing structure is public at Exterro, without the figures. Its agreement bills subscriptions annually in advance in USD, on licensed rights rather than usage, and lets Exterro raise the annual fee at renewal by the greater of CPI or 6%. Exterro Review is sold with unlimited annual user licensing and single instance storage instead of per GB hosting fees. Subpoena Manager is priced on the volume of subpoenas processed, on demand or in bulk. At its August 2025 launch, Exterro Assist came with unlimited questions and topic classification for a customer's first matter up to 250GB. Modules are sold one at a time or as a suite, and no rate, tier price or implementation fee is published.

A unit and structure are published without a figure. The EULA effective 30 September 2025 remains published for agreements made under it. It sells a consumption license at one terabyte of uncompressed data processed per year, aggregated across instances and expiring unused at the end of each term. Usage is reported quarterly and reconciled at the overage rates in the order form, renewals run for twelve months with ninety days' notice, and premium support costs extra. The Solutions Terms of July 2026 leave the usage entitlement to the order. No figure, plan name or price page is published.

Corporate legal, compliance, privacy, security and IT teams are Exterro's core buyers, with editions for law firms, government and law enforcement. In discovery it covers legal hold, custodian interviews, preservation in place, collection, processing, early case assessment, review, production, subpoena response and public records requests. FTK covers forensic acquisition from endpoints, cloud sources and mobile devices. Governance and privacy modules handle data mapping, retention and defensible deletion, records of processing, assessments, data subject requests and consent. Industry editions name financial services and insurance, healthcare and life sciences, energy, technology, government and manufacturing. No jurisdiction list is given for the privacy modules, and nothing says which modules run on premises, in which region or under FedRAMP.

The Neo Legal page lists law firms managing ediscovery at large scale, corporate legal teams handling regulatory matters and disputes, financial services firms, compliance officers, investigation teams and security leaders. Separate solution lines cover investigations and data privacy, with industry pages for telecommunications, integrity agencies and financial regulators. The Engine handles more than a thousand file types. The territory clause and the choice of installation on premises or SaaS set the boundaries, and no matter type or practice area is named as unsupported.