Exterro vs Relativity: how they compare in 2026
Exterro and Relativity are two ediscovery incumbents that publish security credentials a buyer can verify without asking. Both hold FedRAMP Moderate authorization, Relativity for aiR Government, and both hold ISO 27001 and SOC 2. Past that they separate. Exterro publishes its customer agreement, with a $1,000,000 liability cap, a $3,000,000 cap for security, confidentiality and IP claims, and cyber insurance, while Relativity publishes no agreement. Relativity publishes more about its AI: a Redgrave LLP study putting aiR Review's recall at 88 percent against 64 percent for active learning, a rationale on every aiR decision, and where AI processing runs for each of its 17 instance regions. Exterro's subprocessor list places its AI on AWS Bedrock and Google Cloud without a map by region. Exterro reaches data where it lives through more than 190 native connectors, and Relativity brings it into Azure workspaces built for large reviews.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Exterro's AI runs through the platform, but the product beneath it was built first and still works without it. Smart Labeling learns from a reviewer's labels on a sample set and applies them across a document pool, and image and video recognition have been part of the platform for more than a decade. Context Insights maps custodians and communications, and Smart Summarization, translation and transcription speed up review. Exterro Assist, launched in August 2025, added agents that answer questions over collected data, classify documents and draft reports. Subpoena Manager runs subpoena intake and routing on agents. Legal hold, preservation, collection, processing, production, privacy requests and forensics all run as workflow software, and the AI makes those workflows faster rather than defining them.
The platform began as an ediscovery system and still runs legal hold, collection, processing, review and production without generative AI. aiR Review, Privilege, Case Strategy, Data Breach Response and Assist sit on that base and drive its review and analysis work. Older model based features remain in use, among them the Prioritized Review classifier that learns from reviewers' coding, conceptual analytics on latent semantic indexing and sentiment analysis. Every AI capability is included with a committed data volume, and the platform is now sold under the aiR name.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Source references in Exterro Intelligence results lead back to the collected documents, and the audit trail links each step to its data, so a reviewer can open what an answer rests on. A validation agent checks the accuracy and integrity of retrieved information. Exterro publishes throughput rather than accuracy: 40,000 documents an hour for classification, 100,000 an hour of preprocessing for questions, and tasks up to 400 times faster than manual work. In a global insurer's three week trial that Exterro describes, investigators compared summaries, timelines and citations with native documents. No precision, recall or error rate is published for classification, labeling, summaries or answers. In ediscovery the costly error is a responsive document culled by mistake, and no recall figure addresses it.
A study by Redgrave LLP compared aiR Review with a managed first pass review using active learning on about 45,000 documents from a public data set. Responsiveness turned on federal pharmaceutical compliance rather than topic, and a subject matter expert set the ground truth through a blind review of a random sample. aiR Review reached 88 percent recall against 64 percent, with an elusion rate of 1 percent against 3 percent. It also flagged more documents, at 29 percent precision against 39 percent, a trade off the study sets out. aiR Review used about 18 hours of attorney time against about 1,123, and the full report gives the method and statistics. Each aiR Review call cites the document passages it relies on.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Autonomy is where Exterro is heading, and it sets limits in the same breath. Subpoena Manager, launched in May 2026, uses agents to take in subpoenas from any channel, extract deadlines and matter details, route requests, follow up and drive preservation, collection and review. Legal staff give the final approval on each action. ARMOUR's autonomy ladder lets a team raise automation in steps, from manual work to conditional and then high autonomy. Exterro Intelligence agents classify content against relevance, reason and confidence thresholds, and a validation agent checks retrieved information and flags problems. Every action lands in the audit trail with chain of custody. What an agent may do without approval at each level, and where the thresholds sit, is not published.
aiR Review explains why each document matters and cites the passages behind each call. aiR for Privilege predicts whether documents may be privileged, identifies the people involved and drafts a privilege log description. Prioritized Review learns from reviewers' coding decisions to rank what people see next and can run beside aiR Review. In the Redgrave LLP study, a subject matter expert reviewed a blind sample to set the ground truth before revisiting the documents where he and aiR disagreed. No threshold is published at which a document must go to a person, and no commitment covers what happens when an aiR call is wrong.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The Hanover Insurance Group is a named Exterro customer. Its eDiscovery and information governance lead reports saving at least 75% a case on average, and more than $2 million over 12 months, by running discovery in house and tracking external against internal costs. A North American real estate company cut documents by 68% before review and those sent to outside counsel by 97% on one matter. A global insurer's three week ARMOUR trial covered 650GB, including a fraud investigation of 200,000 documents reviewed in an afternoon and a subject access request cut from about 60 hours to a few. IDC named Exterro a Leader in its 2025 eDiscovery MarketScape and a Major Player for data privacy compliance software. Exterro reports more than 2,700 organizations as customers, with its Fortune 100 share given as 40% on its review pages and 50% on its legal and security pages. The Hanover figures rest on its own cost tracking, and none of the results carries a date.
JND, a Relativity partner, ran aiR Review on a corporate client's production and reports more than 750 hours and $85,000 saved, with project time cut by nearly 90%. JND checks aiR's calls on a random sample of about 400 documents and computes recall and precision. Microsoft's legal department reports average recall above 96% and precision of 71% on an antitrust matter, review costs down 45% to 60% and $1.6 million in projected annual savings. Lowenstein Sandler and Baker McKenzie are quoted on claiR. The customer stories carry no date.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Confidentiality binds both parties under the agreement, which limits Exterro's use of customer data to providing the subscription. Either party may disclose under a court order or law only with prompt notice where the law allows. Exterro states that customer data does not train its models and that Exterro Assist runs inside the platform with no external access. Review flags potentially privileged documents during processing and builds the privilege log as review proceeds. Its single instance store keeps one copy of each document, so a privilege or redaction call made in one matter follows the document into every other matter. Outside counsel get role based access to specific matters. The no training statement is not in the agreement, and nothing describes how privileged material is walled off from privacy and IT users on the same platform.
Discrete permissions control what each user reaches, and Lockbox bars administrators, Relativity staff among them, from customer data without the customer's say. Data is encrypted at rest and in transit, with customer managed keys available. Customer data processed by aiR does not train or improve third party models, and AI processing runs in the published location for each instance region. Nothing addresses training of Relativity's own models, retention periods or the handling of privileged material inside aiR.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Twice in its agreement, Exterro states that it does not practice law or give legal advice, and it disclaims any warranty that the software will assure legal compliance. Buyers are corporate legal, compliance and IT teams, law firms and government, and the AI is sold as review and workflow support with human approval on decisions. Exterro's guide for legal teams on AI in the courtroom says ethical duties and the rules of privilege and evidence still apply to AI generated material. Nothing addresses a supervising lawyer's duties over classification, culling or agent actions, or limits on use by jurisdiction.
Law firms, corporate legal departments, government agencies and legal service providers use the platform, and no consumer product is offered. aiR reviews and analyzes a matter's documents rather than advising clients on the law. No position is published on advice versus tooling, on competence and supervision duties or on jurisdiction limits.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
ARMOUR, short for Autonomous Risk Management, Orchestration and Unified Response, is Exterro's framework for agentic work. It sets out a six level autonomy ladder that moves a team from manual tasks to conditional and then high autonomy at its own pace. Exterro describes its AI capabilities as tested in real world use and keeps human approval on decisions, and it publishes analysis of the EU AI Act for customers. No AI policy, testing method, accuracy or bias result, model card or named owner for AI governance is published, and Exterro holds no AI management certification such as ISO/IEC 42001. Classification and culling decide what a reviewer sees, and nothing describes how uneven results across custodians, languages or file types are tested.
Under its AI Principles, Relativity commits to building AI for defined legal data tasks, to explaining how its models are trained and what each one looks at, and to testing models for bias. Where bias appears, the principles commit it to pause, consider mitigations, document its decisions and tell customers each model's appropriate use. The principles also state plainly that AI systems, Relativity's included, can give wrong results or contribute to biased decisions. aiR systems are updated regularly to improve quality, accuracy and consistency, so their output can change over time. No AI management certification, named accountable owner or bias test result appears.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Under its agreement, Exterro commits to commercially reasonable security for customer data and to prompt notice of a data breach, with each party paying for a breach it causes. A customer can ask for its data in a standard format within 30 days of termination, and Exterro takes no responsibility for keeping it beyond 45 days. Exterro names four subprocessors in its trust center, each with function and region. AWS hosts data in the United States, the EU or Canada as the customer selects and runs AI processing for Exterro Assist through AWS Bedrock. Google Cloud hosts Exterro managed AI infrastructure in the United States and the EU, and Microsoft Azure hosts in the United States. Snowflake holds analytics and legal hold archives for customers hosted in AWS in the United States. Restricted production access and data retention and classification procedures are listed among the controls, and incident statements are posted, the latest on 5 October 2026. No retention period is stated for data or AI output during a subscription, and no notice period applies to subprocessor changes.
By default, Relativity encrypts data at rest and in transit, and customer managed keys give the customer control of its encryption key. Lockbox keeps administrators, Relativity's own included, out of customer data unless the customer grants access, and customers can audit and revoke that access in real time. Security Center, built by the Calder7 security team, maps logins, flags users without two factor authentication and sends alerts on unusual events. No retention period, deletion schedule for prompts and aiR output, or subprocessor list is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Exterro's master subscription agreement, updated June 2025, is public and sets out what Exterro stands behind. Exterro defends the customer against third party claims that the software infringes a patent, copyright or trademark, with the usual exclusions, and can secure a license, modify or replace the software, or end its use. It also defends claims arising from its own breach of confidentiality or of applicable law. Production software is warranted to run without a defect that causes a material failure against the documentation. The remedy is a fix or workaround, then termination with a refund of prepaid fees if the defect persists 30 days after notice. Liability is capped at $1,000,000, and breaches of security or confidentiality and the IP indemnity sit under a separate cap of $3,000,000. Exterro carries general liability and cyber insurance in commercially reasonable amounts. The agreement disclaims any warranty that the software is accurate or error free, and no term addresses AI output on its own.
No customer agreement, master terms or service level terms are published, so indemnity, liability caps, warranties and insurance for aiR output cannot be read before contracting. AI processing locations and aiR Unit fees are set by each customer's agreement, and Relativity may rate limit or queue AI features at its discretion. aiR for Privilege predicts privilege and drafts log descriptions, and nothing published allocates the loss if a privileged document is produced on its call.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Exterro's connector library reaches more than 190 sources across email, chat, collaboration tools, cloud storage, endpoints and business applications, and works on data in place without exports or copies. Each listed connector states what it does. Microsoft 365 covers holds and collection across Exchange, OneDrive, OneNote, SharePoint Online and Yammer, and Google Workspace covers Gmail, Drive, Calendar, Cloud Storage and Vault. Slack and Teams capture threads and shared files in context, and Box, Dropbox, Amazon S3, Salesforce and SharePoint on premises are listed the same way. Connectors use modern authentication, granular scopes and role based controls, run delta sync and throttling, report health in one console and log every action against the matter. Exterro says it can build a missing connector in about two weeks. Configuration steps and field level detail are not published.
Collection connectors reach Microsoft 365, Google Workspace, Slack, Claude Enterprise, ChatGPT Enterprise and Gemini, with new data sources added regularly. An MCP server lets assistants such as Claude, Gemini, Copilot and ChatGPT set up workspaces, organize case data and manage matters in natural language. Open APIs and the App Hub extend the platform at no extra license cost, and Gavel brings drafting into Microsoft Word. What each connector moves, in which direction, and what an administrator configures are not described.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Hosted software that Exterro runs and on premises software that the customer deploys are both sold, and its comparison material adds private cloud, hybrid and managed options. Its trust center places hosting in AWS regions in the United States, the EU and Canada, as the customer chooses. Google Cloud adds the United States and the EU, and Microsoft Azure the United States. AI processing for Exterro Assist runs through AWS Bedrock and on Exterro managed infrastructure in Google Cloud. A FedRAMP Moderate authorized cloud serves United States government customers. Which region runs AI processing for a given hosting region, and what differs between hosted, private cloud and on premises editions, is not published.
Instance regions for Relativity aiR span the United States, Canada, Brazil, the UK, Ireland, France, Germany, the Netherlands, Switzerland, the UAE, South Africa, India, Australia, Japan, Hong Kong, Singapore and South Korea. All of them run on Microsoft Azure. Generative AI processing can run outside an instance's own region, and Relativity publishes where it runs for each one. French, German, Irish, Dutch, Brazilian and South African instances process within the EU Data Boundary, UK and UAE instances in the UK, and Hong Kong, Japanese, Singaporean and Korean instances in Japan. The United States, Canada, Switzerland, Australia and India process in country. aiR Government runs on Azure Government, and all of its customer data is processed in the continental United States. The processing map may shift as model availability changes.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
ISO/IEC 27001:2022, SOC 2, FedRAMP Moderate authorization, TISAX, HITRUST e1 and UK Cyber Essentials are all held by Exterro. The ISO certificate, the 2025 SOC 2 Type II report and bridge letter, the 2026 HITRUST e1 certificate and a SIG questionnaire are released through an access request. Controls are listed by area, and incident statements are posted, such as the 5 October 2026 note on the Canny.io incident. FedRAMP Moderate status appears in the public FedRAMP marketplace. ISO 27001 certification was announced in January 2026, with CISO Anthony Diaz describing a risk based security management system under continuous audit. Reports come through the access request rather than as open downloads.
ISO/IEC 27001:2022 and ISO/IEC 27018:2019 certifications, a SOC 2 Type II report, a SOC 3 report and the Cloud Security Alliance CAIQ are listed, with a request route for compliance certificates. aiR Government holds a FedRAMP Moderate authorization, the platform is assessed under IRAP at Protected, and Relativity states HIPAA compliance. Calder7, Relativity's in house security team, builds the Security Center monitoring application that customers use. Report dates and auditing firms are not published.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Where the AI runs is named on the subprocessor list. AWS Bedrock processes Exterro Assist requests, and Exterro managed AI infrastructure is hosted on Google Cloud in the United States and the EU. Exterro says it owns every layer of its stack, that data is not transferred to, stored or processed by third party language model vendors, and that it does not wrap models such as OpenAI's. Smart Labeling and image and video recognition are older models built into the platform. The models used through Bedrock or on Exterro's own infrastructure are not named, and no notice is promised before the list changes.
aiR runs on GPT-4o, GPT-4.1 mini, GPT-5 mini, GPT-5.1 and GPT-5.2, all through Microsoft Azure services. Which model or combination serves a task depends on the aiR system's purpose and on model capability and availability. Inference locations are published for every instance region, and customer data processed by aiR does not train or improve third party models. Relativity notes that those locations may change, and it promises no notice to customers before the models or locations change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Pricing structure is public at Exterro, without the figures. Its agreement bills subscriptions annually in advance in USD, on licensed rights rather than usage, and lets Exterro raise the annual fee at renewal by the greater of CPI or 6%. Exterro Review is sold with unlimited annual user licensing and single instance storage instead of per GB hosting fees. Subpoena Manager is priced on the volume of subpoenas processed, on demand or in bulk. At its August 2025 launch, Exterro Assist came with unlimited questions and topic classification for a customer's first matter up to 250GB. Modules are sold one at a time or as a suite, and no rate, tier price or implementation fee is published.
Pricing runs on a committed data volume, paid as you go or locked in on a one or three year commitment. aiR Review, Privilege, Case Strategy, Assist and claiR come with that volume, with no separate AI licenses and no per user fees. APIs, the App Hub and the MCP server carry no extra license cost, and specialized solutions are added as needed. Some aiR products consume aiR Units or carry fees set in the customer's contract. No rate per gigabyte or per unit is published.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Corporate legal, compliance, privacy, security and IT teams are Exterro's core buyers, with editions for law firms, government and law enforcement. In discovery it covers legal hold, custodian interviews, preservation in place, collection, processing, early case assessment, review, production, subpoena response and public records requests. FTK covers forensic acquisition from endpoints, cloud sources and mobile devices. Governance and privacy modules handle data mapping, retention and defensible deletion, records of processing, assessments, data subject requests and consent. Industry editions name financial services and insurance, healthcare and life sciences, energy, technology, government and manufacturing. No jurisdiction list is given for the privacy modules, and nothing says which modules run on premises, in which region or under FedRAMP.
Law firms, corporations, government agencies and legal service providers are the stated buyers, with 193 of the Am Law 200 among them and customers in more than 30 countries. Solution pages cover ediscovery, investigations, second requests, FOIA, data subject access requests, data breach response, early case intelligence and contracts, and plaintiff firms have a page of their own. aiR Government serves agencies under a FedRAMP Moderate authorization. What the platform is not built for, and which languages aiR handles, are not stated.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
According to Exterro's AI pages, Exterro Assist runs inside the platform with no external access to or training on customer data, and no customer data trains the models. The customer agreement does not mention training. It limits Exterro's use of customer data to providing the subscription and its improvements to that customer, and gives Exterro anonymized aggregate data on system operation for performance tuning only. Whether the older Smart Labeling and recognition models follow the same rule is not stated.
Customer data processed by aiR systems is not used to train or improve third party models or services, which covers the GPT models aiR reaches through Microsoft Azure. Training of Relativity's own models is not addressed, and Prioritized Review learns from reviewers' coding decisions. No published agreement carries a training term.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Prompts and outputs from Exterro Assist stay inside the platform, with no external storage of either. No period is stated for how long prompts, answers or agent output stay in the platform during a subscription. Under the agreement, a customer can ask for its data back within 30 days of termination, and Exterro is not bound to keep it beyond 45 days. Audit logs and chain of custody records are kept by design.
aiR Review writes a rationale and citations for every document, and aiR for Privilege drafts log descriptions, so each matter builds up AI generated commentary on its documents. No retention period, customer setting or deletion control is published for that output or for prompts.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Outside counsel can get role based access to specific matters in Exterro Review, connectors use granular scopes and role based controls, and audit logs are tied to matters. Nothing published sets out how permissions are scoped per matter or per custodian. Nor does it say whether a privacy or IT user on the same platform can reach material held for litigation.
Discrete permissions inside the platform govern what each user reaches, so a firm keeps matter access aligned in Relativity aiR rather than inheriting a document management system's rules. Lockbox blocks administrators, including Relativity staff, from customer data unless the customer grants access, and that access can be audited and revoked in real time. Ethical walls are not named as such.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Either party may disclose confidential information when a law, rule or court order requires it, under Exterro's customer agreement, provided it gives the other party prompt notice where the law permits. The disclosing party must also cooperate with any attempt to obtain a protective order, at the other party's cost. No transparency report is published.
No customer agreement, data processing agreement or transparency report is published, so no commitment to notify a customer of a government or law enforcement request for its data can be read.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Answers come from the customer's own collected data rather than a body of primary law, so there is no case law or statute source to name or license. Smart Labeling learns from a reviewer's labels on a sample set within a matter. What trained the classification, labeling and image recognition models is not stated.
aiR draws on the customer's own collected documents rather than a vendor supplied library of law, so no legal content source, license or update cycle applies.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
A matter's collected evidence, such as email, chat, files and forensic images, is the working material rather than case law, so answers cite documents from the collection, not legal authority. No citator or check for subsequent history is part of the product.
aiR works on a matter's collected documents rather than published case law, and claiR answers from that same data with direct citations to it. No treatment signal or later history check applies to legal authority.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Metadata and classification agents sort content against relevance, reason and confidence thresholds, and a validation agent checks retrieved information and flags problems for attention. Exterro does not describe what Exterro Assist does when it cannot ground an answer, or whether reviewers see where a document falls against a threshold.
aiR Review explains and cites each call, and aiR for Privilege ranks likely privileged documents by its prediction. No path is described for declining a call when a document does not support one, and no confidence threshold is shown to the user.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database kept by Damien Charlotin lists court decisions on hallucinated AI content worldwide, and none names Exterro, FTK or Exterro Assist. Exterro produces no citations to legal authority, and a court finding on a flawed collection, cull or production run through it would fall outside that database.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Relativity or aiR. aiR works on a matter's own documents and cites the passages behind each call rather than citing case law.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Exterro's guide for legal teams on AI in the courtroom, drawn from an eDiscovery Today webinar it sponsored, holds that legal principles, civil procedure and ethical duties still govern AI work. It discusses rulings such as Morgan v. V2X on loading confidential discovery material into AI tools, and a 2026 review of court rulings covers orders to disclose the AI platform used. No named ethics opinion, such as ABA Formal Opinion 512, is discussed, and the guidance is not tied to Exterro's own features.
No named ethics opinion, such as ABA Formal Opinion 512, or state bar guidance is engaged. The AI Principles commit Relativity to openness about its AI so that customers can defend their own processes.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Exterro quotes savings in hours and dollars. Subpoena Manager cuts manual subpoena work by up to 95% and up to 7,500 hours a year, and Review cuts the documents sent to outside counsel. Hanover reports saving more than $2 million in a year by keeping discovery in house. Most of those savings land on a corporate legal budget, but Review is also sold to law firms and service providers. No guidance on billing for AI assisted review is published, and no record of AI work is described for fee purposes.
In customer stories, JND reports cutting a corporate client's costs by nearly 60%, and Microsoft projects $1.6 million a year. The Redgrave LLP study recorded about 18 attorney hours against 1,123 for the same review. No per matter record of AI assisted work exists for billing, and nothing addresses how a firm bills or discloses that work to clients.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Subprocessors are listed with function and region in Exterro's trust center, including AWS Bedrock for Exterro Assist AI processing and Google Cloud for Exterro managed AI infrastructure. Security reports, certificates and a completed SIG questionnaire are released through an access request on the same site, and the customer agreement is public. No client facing note about the AI or list of models by feature is published.
ISO 27001 and 27018 certifications, SOC 2 Type II and SOC 3 reports and the CAIQ are available through a request route, and the models and processing locations behind aiR are published. No subprocessor list, data processing agreement or client notice pack is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Exterro records chain of custody and an immutable audit log tied to each matter, covering holds issued, data preserved and collected, and every action taken on it. Exterro Intelligence results carry source references, each step links to its sources and logs, and privilege logs build during review. No export is described that shows, document by document, which decisions an agent or model made, which model made them and whether a person confirmed them.
Every aiR Review call explains why the document matters and cites the passages behind it, and aiR for Privilege drafts privilege log descriptions. Relativity names the models aiR uses and the processing location for each region. No single export per document brings together the model used, the passages relied on and the human review.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
Which one fits
Choose Exterro if
- The data is spread across a hundred systems and must not be moved to be held. Exterro preserves and collects through more than 190 native connectors across email, chat, cloud storage, collaboration platforms and endpoints, acting on data where it lives rather than copying it out first, which avoids accidental deletion during a hold.
- Your assurance list is long and includes sectors outside legal. Exterro publishes ISO/IEC 27001 certification announced in January 2026 with its Chief Information Security Officer named, SOC 2, HITRUST e1 for the SaaS platform, TISAX for automotive sector handling, and FedRAMP Moderate authorization, which is assessed by a third party organization and listed publicly so an outsider can confirm it without contacting the vendor.
- You want the vendor's terms in writing before you sign. Exterro's published agreement caps liability at $1,000,000, raises the cap to $3,000,000 for security, confidentiality and IP claims, warrants the software against material defects with a refund remedy, and commits Exterro to cyber insurance.
Choose Relativity if
- You want to know who can see the prompts. Relativity's Lockbox keeps administrators, its own staff included, out of a customer workspace unless the customer grants access, which can be audited and revoked in real time, while customer managed encryption keys and discrete permissions control the rest.
- Every AI call has to be defensible to a court. Relativity's aiR suite spans review, privilege, case strategy, data breach response and an assistant, with each decision accompanied by a rationale a reviewer can inspect against the document, privilege log descriptions generated automatically, and predictions positioned to guide counsel's second pass rather than to replace it.
- You want the AI included in the price. Relativity states that 193 of the Am Law 200 use it and folds aiR Review, Privilege, Case Strategy and Assist into a committed data volume instead of charging for them one by one.
In summary
Exterro
Exterro is a data risk management platform combining ediscovery, digital forensics, data privacy and information governance for corporate legal, compliance and IT teams. It covers legal hold, preservation in place, collection, processing, early case assessment, review, production and subpoena response, with more than 190 native connectors. Exterro Intelligence agents classify, validate and report, and Exterro Assist, launched in August 2025, runs inside the platform without training on customer data. According to the AI Legal Index, Exterro holds ISO 27001, SOC 2, FedRAMP Moderate authorization, HITRUST e1 and TISAX, and publishes its customer agreement and subprocessors. No price or accuracy figure is published.
Relativity
Relativity is an ediscovery and legal data intelligence platform now sold as Relativity aiR, formerly RelativityOne, on Microsoft Azure, covering hold, collection, processing, review, production and analytics. Its aiR suite of five generative products spans review, privilege, case strategy, data breach response and an assistant, with each decision accompanied by a rationale. The AI Legal Index records a control that keeps its own administrators out of customer workspaces, alongside FedRAMP Moderate authorization and ISO 27001 certification. Data processed by aiR does not train third party models, and no customer agreement, liability position or price is published.
Questions buyers ask
Exterro vs Relativity: which is better for ediscovery?
Relativity publishes more about its AI review: a recall study with its method, a rationale on every aiR decision and a processing location for each region. Exterro publishes more of its contract, including liability caps and insurance, and reaches data in place across more than 190 connectors. Both hold verifiable security credentials, and the choice turns on whether review volume or upstream reach drives the work. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
What can be verified independently?
Both hold FedRAMP Moderate authorization, which is assessed by an accredited third party and listed publicly, so a buyer can verify it independently. Relativity adds ISO/IEC 27001:2022, ISO/IEC 27018:2019, IRAP assessed at Protected, SOC 2 Type II, a public SOC 3 summary report and a Cloud Security Alliance questionnaire. Exterro adds ISO/IEC 27001 certified in January 2026, SOC 2, HITRUST e1 and TISAX, with its Chief Information Security Officer named. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
What happens to the data the AI sees?
Exterro says Exterro Assist runs inside its platform with no external access to or training on customer data and no external storage of prompts or outputs, and its trust center places that processing on AWS Bedrock and Google Cloud. Relativity states that data processed by aiR does not train or improve third party models, runs AI processing in a published location for each region, and adds Lockbox and customer managed keys. Neither states a retention period for prompts or generated output. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
Do either publish an accuracy figure?
Relativity does. In a Redgrave LLP study, aiR Review reached 88 percent recall against 64 percent for active learning, with lower precision, and the full report sets out the method. Every aiR decision also carries a rationale. Exterro attaches source references to its AI results and runs a validation agent over retrieved information, but publishes no precision or recall number, test set or evaluation. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
What do Exterro and Relativity both leave unpublished?
Neither publishes a rate. Relativity sells on a committed data volume, paid as you go or on a one or three year term, and Exterro sells annual subscriptions, with Review licensed for unlimited users. Neither publishes a retention period for AI output, an AI governance certification, a named owner of model behavior or any evaluation of uneven output. From the AI Legal Index, based on each vendor's own published materials as of September 3, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Two points to weigh. Relativity publishes no customer agreement, so its indemnity, warranties and liability cap cannot be read before signing, including for aiR for Privilege, a product built to reduce inadvertent production of privileged material. Exterro publishes no recall or precision figure for the classification and culling it performs, and a filter that wrongly drops a responsive document leaves no trace in an audit log. Neither vendor reviewed this page.