FirmPilot vs Nexl: how they compare in 2026

The engine is the entire proposition and the vendor draws the comparison itself. What is sold is a set of inferences no agency workflow produces: a proprietary knowledge model trained on more than five million pieces of legal marketing content and a database of over three thousand legal cases, competitor crawling every ninety minutes across websites, advertisements, social activity and search performance, and generative production of website copy, blog content, social posts and ads calibrated against what that crawl finds. Always-on agents run the monitoring continuously. Asked directly whether it is a wrapper, the vendor answers that it runs on a proprietary engine built for legal marketing rather than a general-purpose model. The stated comparator throughout is not other software but marketing agencies working from gut feeling and manual adjustment, and the founding account describes discovering that structured legal content outranks generic output. Remove the models and nothing distinguishable from an agency remains. Verified 2 September 2026.

A conventional system of record carries a substantial and clearly named AI layer. The substrate is a CRM in the ordinary sense: contacts, opportunities, pipeline, campaigns, workspaces and reporting, all of which existed before machine learning and none of which requires it. The company's own origin story confirms it, describing what began as a no-manual-entry CRM that later became a growth system. Automatic capture of emails and meetings is automation rather than inference. What the models add is real and separately productised as Nexl AI: a chat interface answering natural-language questions across the relationship graph, company research reports synthesising internal relationship data with external intelligence, generative drafting of follow-up emails, and voice logging. Relationship intelligence sits between the two, since inferring the strength of a connection from interaction patterns is a learned judgement rather than a stored field. Remove the models and a working legal CRM remains, which is what places this in the middle band rather than the top. Verified 2 September 2026.

Quality is asserted, the mechanism behind it is named only in outline, and the agreement disclaims the whole subject. On the positive side the grounding sources are identified by type: a proprietary knowledge model drawing on cases, legislation and legal news, plus competitive intelligence gathered from live crawling, which is more than a bare claim of legal training. Asked whether machine-written content is penalised by search engines, the vendor answers that its output passes quality checks combining legal intelligence with originality requirements. What is missing is any content behind that phrase. No quality check is described, no accuracy or error figure is published, no evaluation or human review standard is stated, and nothing addresses what happens when the model asserts something incorrect about the law in material published under a law firm's name. The published figures are commercial rather than accuracy measures, covering lead volume and retention. Section 2 of the user terms states plainly that the services and content may contain errors, inaccuracies or omissions and that the vendor does not guarantee accuracy, completeness or currency. Verified 2 September 2026.

Grounding is described with named source types and citation, and nothing is measured. Under a heading about answers a user can trust, the vendor states that every response draws on the firm's own relationship intelligence together with cited sources including SEC filings and live web content. That is three things worth having: the retrieval base is identified, external sources are named by type rather than gestured at, and citations are returned with the answer so a user can check a claim before acting on it. The AI Company Research Reports feature is described as review-ready, which frames output as a draft for checking rather than a finished product. What is absent is measurement of any kind. No accuracy, precision or error-rate figure appears anywhere, no evaluation or benchmark is described, and nothing states how often a research report or a relationship inference is wrong. Nothing addresses hallucination by name, and nothing describes what the system does when the relationship graph is sparse, which is the condition under which a CRM assistant is most likely to assert a connection that is not there. Verified 2 September 2026.

The product is described as publishing without any approval step being mentioned anywhere. The home page states that the system will automatically create, calibrate and publish legal content tailored to the firm's practice areas, and describes deploying always-on agents to handle time-intensive work continuously. Nothing on any surface read describes a review or approval gate between generation and publication, states whether a lawyer sees content before it appears under the firm's name, or identifies who at the firm is accountable for what goes live. Checked the home page, the pricing page, the overview and the user terms in full on 2 September 2026. The user terms allocate responsibility without supplying a mechanism, making the customer solely responsible for User Content and warranting that it is accurate and not misleading, while the vendor reserves the right but disclaims any obligation to review content. The gap matters more here than on most records because what is published is lawyer advertising, which is regulated in every US jurisdiction, and because the material carries the firm's name rather than the vendor's. Verified 2 September 2026.

Review points are implied by the product design and described nowhere. Several outputs are framed as drafts a person completes: AI Email Create generates a personalised draft pre-filled into the user's own email application and ready to send, which leaves the send action with the lawyer, and company research reports are described as review-ready. The AI is positioned as recommending intelligent next steps rather than taking them. Those are meaningful design choices and they are why this is not the bottom band. What is missing is any published account of the model. Nothing states what the system does without a person, what confidence threshold governs a recommendation, whether relationship strength scores or at-risk client flags are surfaced automatically or on request, and what a user should verify before acting on a research report that blends internal data with live web content. The email marketing system sends campaigns to contacts, and nothing describes what approval sits between a drafted campaign and a send. No review obligation appears anywhere in the terms and conditions. Verified 2 September 2026.

Two customers speak on the record and the aggregate claims travel without support. Jonathan Steele, Managing Partner at Steele Law, is quoted with a figure, saying FirmPilot quickly tripled to quadrupled monthly lead volume, and Jessica Arena, Managing Attorney at Jessica Arena Law, is quoted on the pricing page. A partner at Romano Law Group appears in a funding announcement. A case studies library is published and was not opened on this pass, which is recorded as a limit on this reading rather than as an absence. Against that, the headline claims are unattributed and undated: 180 per cent or more increases in cases, a 96 per cent client retention rate, tens of thousands of qualified leads since 2023, and a stated average time to return on investment of three to six months. None carries a sample size, a measurement basis or a date, the retention figure appears in a marketing FAQ rather than anywhere it could be checked, and the home page's own headline counter rendered as zero because it is an animated element that did not execute. Verified 2 September 2026.

The named-customer evidence is broad and international; the outcome evidence is thinner than it first appears. Nine individuals speak with name, title and firm, spanning Sheenika Gandhi, Chief Marketing Officer at Greenberg Glusker, Nicole L. Kershaw, Chief Client Relations Officer at Harter Secrest & Emery, Dianne Skurray, Chief Marketing and Strategy Officer at Marriott Harrison, Christine Liaeker Lindberg at Wiersholm, Lee Peretz at Farrell Fritz, and partners at IndusLaw, Gufa Law and Ironbridge Legal, covering the United States, United Kingdom, Norway, India, Honduras and Australia. Bernstein Shur and Fasken appear separately. That is real breadth across firm size and jurisdiction. One caution belongs on the record and is the reason this is not higher. The headline figure the site carries, that firms grow 42 per cent faster, is not a Nexl customer outcome: it comes from the company's own Rethinking Rainmakers benchmark study and describes firms whose business development is spread beyond a few rainmakers, whether or not they use this product. No outcome figure is attached to any named customer, and nothing is dated. Verified 2 September 2026.

None of the five limbs is addressed and one published term runs against the customer. Checked the home page, the pricing page, the overview and the user terms in full, together with the site footer, on 2 September 2026: there is no security page, no data processing addendum, no confidentiality clause and no trust surface of any kind, and the footer carries only a privacy policy, the terms and a cookie settings link that resolves to a coming-soon page. Nothing states whether customer content is used to train models, nothing describes segregation between customers, neither privilege nor work product is mentioned, no retention or deletion position exists, and no model provider is identified. Section 3 of the user terms goes further than silence: submitting content grants the vendor a worldwide, perpetual, royalty-free, irrevocable licence to use, reproduce, modify, adapt, publish, translate, create derivative works from and distribute that material, and to incorporate it into any form, medium or technology now known or later developed. Section 4 adds that the services are not a system of record and disclaims any obligation to store or back up customer content. Verified 2 September 2026.

Three limbs are answered in the agreement and the question a law firm would ask first is unanswered. What is published is substantive: the AI page states plainly that the firm's data is never used to train AI models, and the terms are consistent with it rather than contradicting it, since clause 10.7 limits Nexl's licence over Customer Data to supplying the service, diagnosing problems and developing other products expressly without using Customer Data within them, while clause 10.5 confines analytics to statistical and performance information, excluding information about the customer's own clients. Clause 10.1 confirms the customer owns its data, confidential information and user inputs. Clause 14 is a mutual confidentiality regime with prior written notice before any compelled disclosure. Clause 12.6 gives a month to export everything in SQL format followed by permanent deletion. What is not addressed is the scope of mailbox monitoring. The terms define a Mailbox as an email address monitored by the Services and never state whether the system reads message content or only metadata such as addresses and timestamps. For a firm connecting partner mailboxes that is the central confidentiality question, and neither privilege nor work product is mentioned anywhere. No separation between customers is described. Verified 2 September 2026.

The advice line is drawn clearly and repeatedly; the professional obligations that actually bite are unaddressed and one clause cuts against them. On the good side, every page of the site carries a footer statement that FirmPilot AI, Inc. and FirmPilot are not a law firm and do not provide legal advice, and section 3 of the user terms repeats it in capitals, stating that the vendor is not an attorney or legal advisor and provides no legal or other professional advice. That is unambiguous and consistently placed. What is absent is anything about the buyer's own obligations. The product generates and publishes lawyer advertising, which is governed by professional conduct rules on communications about legal services, solicitation and claims of expertise in every jurisdiction it operates in, and no rule, ethics opinion or advertising standard is named anywhere. Section 5 of the user terms then disclaims, expressly, any warranty that the services will comply with applicable law, which for a product whose output is regulated speech is the opposite of the assurance a firm would want. Verified 2 September 2026.

Nothing published addresses professional conduct, and one limb of this axis genuinely does not apply while another does and is unmet. The product gives no legal advice and produces no legal work product, so the unauthorised practice question is largely inapplicable and its absence is not counted against the record. The professional responsibility question is live for a specific reason: Nexl ships an email marketing system to law firms, and communications a firm sends to prospective clients are governed by legal advertising and solicitation rules in every jurisdiction it operates in. Clause 5.4 of the terms imposes detailed obligations on the customer covering consent, consent records, unsubscribe links and a compliant privacy policy, together with prohibitions on bought or scraped lists. Every one of those is marketing and data protection law. Not one references a bar rule, a solicitation restriction or any professional conduct standard on lawyer advertising. Checked the home page, the AI, CRM, about and clients pages, the terms and conditions in full and the full footer on 2 September 2026. Verified 2 September 2026.

No governance material was located on any surface. Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026. There is no responsible AI page, no framework or set of principles, no individual or function named as accountable for model behaviour, no account of what is evaluated before a model or content change ships, and no certification. The nearest published statement is a marketing FAQ asserting that output meets search engine quality standards through legal intelligence and quality checks, which names no control and describes no testing. Nothing anywhere addresses uneven output, which has a specific form here: a system that learns what already ranks and reproduces it will reproduce whatever the incumbent legal marketing corpus contains, including its claims style and its framing of clients and case value, and the vendor's own description of reverse-engineering high performers makes that mechanism explicit rather than incidental. Verified 2 September 2026.

No governance material was located on any surface. Checked the home page, the Nexl AI product page in full, the CRM, about and clients pages, the terms and conditions in full and the full footer on 2 September 2026. There is no responsible AI page, no framework or set of principles, no individual or function named as accountable for model behaviour, no account of what is evaluated before a model change ships, and no certification such as ISO 42001. The one AI-specific commitment published, that customer data is never used to train models, is a data handling promise rather than a governance programme, and it is treated on the confidentiality axis. Nothing anywhere addresses uneven output, which has a concrete form on this product: a system that scores relationship strength and surfaces which lawyers should be introduced to which clients is making judgements about people inside the firm, and those judgements plausibly favour whoever generates the most captured interaction volume. Nothing states whether that is evaluated. Verified 2 September 2026.

None of the five elements is published and no security surface exists. Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026. There is no security page, no trust centre or portal, no certification claim of any kind, and no data processing addendum. Nothing states any retention period or deletion practice, no subprocessor or vendor is named, no incident or breach notification practice is described, and no encryption or access control detail appears anywhere. Access credentials are addressed only as the customer's responsibility to keep confidential, with the vendor disclaiming liability for unauthorised access caused by the customer's acts or omissions. Section 4 of the user terms disclaims storage obligations outright, telling customers that the services are not a system of record, that they must extract and back up their own content, and that the vendor will not be responsible for backup or recovery in the event of data loss. Verified 2 September 2026.

Retention and supply chain control are unusually strong in the agreement, and two elements were not reachable. Clause 12.6 is the standout: for one month after termination the customer may copy all Customer Data, Confidential Information and Personal Information, with access provided in SQL format specifically for that purpose, after which Nexl permanently deletes all of it, and clause 12.7 adds a transition period of up to six months with continued service and export assistance. Exit is answered better here than almost anywhere in this corpus. Clause 15.8 requires the customer's prior written consent before Nexl engages any subcontractor, which is a stronger control than a notification right. Clause 13.1(c) warrants appropriate administrative, physical and technical safeguards, and clause 10.9 indemnifies the customer against unauthorised access to or disclosure of Customer Data. What could not be established: no encryption specifics, access control detail or breach notification timeline appears in the terms, and the two documents that would carry them were not read on this pass, since the data processing agreement was not opened and the Vanta-hosted trust centre returned page metadata with no body, which is recorded as a retrieval limit rather than an absence. Verified 2 September 2026.

The published position is among the most adverse in this corpus. Section 6 of the current user terms caps the total aggregate liability of FirmPilot, its affiliates and its suppliers at one hundred US dollars for anything arising from the services, the platform, the terms or the privacy policy, and separately excludes liability for unauthorised access to or loss of customer information, lost profits, business interruption and cost of substitute services. Section 5 disclaims all warranties of any kind, including expressly any warranty that the services will comply with applicable law or generate enforceable obligations. No indemnity runs from the vendor to the customer in any direction on any subject. Claims must be brought within two years and a jury trial is waived. One further defect belongs on the record: the terms page serves two stacked documents, the current FirmPilot AI, Inc. user terms updated 4 February 2026 and an earlier FirmPilot, LLC website terms of use dated 1 November 2022 carrying a fifty dollar cap, Florida governing law and a mandatory arbitration clause, against Delaware law in the current set. A reader cannot tell from the page which governs. Verified 2 September 2026.

The allocation is published, readable without a sales conversation, and better structured than the great majority of records here. Clause 11.1 caps aggregate liability at twelve months of fees but opens with express carve-outs placing each party's obligations on intellectual property, confidentiality and data protection outside the cap entirely, so the exposures a law firm actually fears are uncapped rather than merely enhanced. Clause 10.9 gives a four-limb indemnity running from Nexl covering third-party intellectual property claims, claims that its analytics violate third-party rights, any unauthorised access to, acquisition, disclosure or use of Customer Data, and its own gross negligence or wilful misconduct; a indemnity of that kind is rare in this corpus. Clause 10.10 sets an ordered remedy ladder ending in termination with a pro-rata refund of prepaid fees. Clause 13.1 warrants seven things including that the services will perform in accordance with the specifications provided, and consequential loss is excluded mutually with a carve-back where the loss was caused or exacerbated by the services. Two gaps: no insurance position is stated, and no warranty attaches specifically to the accuracy of AI output. Verified 2 September 2026.

No integration into the systems a law firm runs was located, and none is claimed. Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026. No practice management, intake, customer relationship or case management system is named, no telephony or lead-routing tool, no connector list, and no API or developer documentation. There is no integrations page in the navigation. What the platform does connect to is the firm's public marketing estate rather than its internal systems, covering the website, Google Business Profile, paid search and social channels, and the user terms acknowledge only in general terms that the services may include links or connections to third-party websites and services with the customer responsible for those third parties' terms. The gap is consequential rather than formal, because a marketing engine that generates leads and cannot deliver them into the firm's intake or case management system leaves the most valuable handoff undescribed. Verified 2 September 2026.

Integration into email and calendar is the foundation the product stands on, and almost nothing is named. Automatic capture requires a live connection to firm mailboxes and calendars, and the terms formalise it, defining a Mailbox as an email address monitored by the Services and making the number of Mailboxes a licensed metric. Contact intelligence is described as visible from within the inbox, which places the product inside the tool lawyers already use. Clause 7.2 acknowledges optional functionality interoperating with third-party software and puts the licensing of that software on the customer. Beyond that the record is thin. No mail platform is named on any first-party page read, no document or practice management system, no finance or billing system for the revenue insights the platform reports on, and no experience or matter database. There is no integrations page in the navigation, no connector list and no API or developer documentation was located. For a system whose value is a complete relationship picture, what it can and cannot see is left undocumented. Verified 2 September 2026.

Nothing published addresses where the platform runs or how customers are separated within it. Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026. No cloud provider is named, no hosting region or country is stated, no residency option is offered, nothing distinguishes processing from storage, and no tenancy or isolation model is described. Cloud delivery is evident only by inference from a customer login on a separate application domain, and even that is not presented as a deployment statement. The only geography published anywhere is the company's own Miami address, and the user terms note that the platform may be subject to United States export control law without stating where anything is hosted. No security page or data processing addendum exists in which any of this could appear. Verified 2 September 2026.

Residency is answered better than tenancy, and it is answered in the contract rather than on a page. Three separate regional instances are published and separately addressable for the United States, Australia and Europe, each reachable from the site's own login menu, so a buyer sees the choice before speaking to anyone. Clause 11.2(b) then makes it durable: Nexl reserves the right to move to an alternative hosting provider without liability, but expressly conditions that on the data hosting location remaining in the same region, spelling out that an Australian server remains in Australia, a United States server remains in the United States and a European server remains in the European Union. A residency commitment that survives a change of infrastructure provider is a stronger promise than most vendors make anywhere. What is absent is the rest of the picture. No cloud provider is named, no tenancy or isolation model is described, nothing states what differs between the three instances in features, certification scope or subprocessors, and no on-premises or customer-cloud option exists. Verified 2 September 2026.

No certification is claimed and no trust surface exists. Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026, and ran a targeted search for company security documentation which returned nothing. Neither SOC 2 nor ISO 27001 nor any other standard is named anywhere on the site, no auditor or attestation is referenced, there is no trust centre or portal, no badge or seal appears on any page, and no penetration testing or vulnerability disclosure programme is described. This is an absence rather than a retrieval limit: every page requested rendered cleanly and the footer, which lists only a privacy policy, the terms and a cookie settings link that resolves to a coming-soon placeholder, establishes that no gated security surface exists behind which such material might sit. Verified 2 September 2026.

Two standards are named on the vendor's own page and the evidence behind them is not published. The Nexl AI page states that the platform is SOC 2 and ISO 27001 certified, which names both frameworks rather than gesturing at enterprise-grade security, and a trust centre is linked from the main navigation under Security at the company's own trust subdomain. A public status page is separately maintained. What is not established is anything a reviewer could test. No auditor or certification body is named, no report period, issue date or expiry is published, no scope statement identifies which services or regions are covered, and the SOC 2 claim does not distinguish Type 1 from Type 2, which is the difference between controls existing on a date and operating over a period. No penetration testing programme is described. The trust centre is Vanta-hosted and returned page metadata with no readable body on 2 September 2026, which is recorded as a retrieval limit on this reading rather than as an absence, and no document request was submitted. Verified 2 September 2026.

The engine is branded and trademarked and nothing underneath it is identified. FirmPilot describes a proprietary AI Legal Marketing Engine, states that it is protected by pending patents, and quantifies its training inputs as more than five million pieces of legal marketing content and a proprietary database of over three thousand legal cases. Asked directly how it differs from general-purpose tools, the vendor answers that it is not built on them and runs a proprietary engine trained on legal texts, search practice and competitive data. That is a clear denial of one provider without identification of any other. No model is named, no version, no provider entity, and nothing states whether any component is built in-house or reached through a third party, where inference runs, what a provider may retain, or whether customers would be told if the model set changed. No subprocessor list exists in the terms or anywhere else, and the terms refer to third-party providers, licensors and suppliers as a category without naming one. Verified 2 September 2026.

The capability is branded and nothing underneath it is identified. Nexl AI is presented as a product line with four named features, and the terms refer in the definition of Nexl Intellectual Property to machine learning algorithms output from the Software, so machine learning is acknowledged as present. No model is named, no version, no provider entity, and nothing states whether any component is built in-house or reached through a third party. Nothing describes where inference runs, what any provider may retain, or whether customers would be told if the model set changed. What is disclosed is the data side rather than the model side: external sources are identified as including SEC filings and live web content, and prospecting runs against a database of 25 million companies and 100 million contacts, but the supplier of that database is not named either. No subprocessor list is published, though clause 15.8 gives the customer a prior written consent right over any subcontractor, which is a control over the supply chain rather than disclosure of it. Verified 2 September 2026.

Three named tiers carry published monthly figures, which is rarer in this corpus than it should be. The pricing page lists Lite at 4,250 US dollars per month, Firm at 6,900 and Premium at 9,250, and frames the model deliberately: the vendor notes that traditional agencies bill monthly and charge a percentage of advertising budget, producing fluctuating and surprise costs, and states that it charges flat monthly subscription fees instead. A buyer therefore learns the price, the unit, the billing period and the charging philosophy without contacting anyone, and can compare against an agency retainer directly. What is missing keeps it out of the top band. Each tier carries only the words contact us to learn more in place of any feature list, so nothing states what distinguishes Lite from Firm from Premium, whether advertising spend is included or billed separately on top, or what volume of content or channels each covers. No contract term, minimum commitment or notice period is published, and the user terms are silent on fees, renewal and termination. Verified 2 September 2026.

The charging structure is set out in the agreement in more detail than most vendors publish anywhere, and no figure appears. The licensed metrics are named and defined: Authorized Users, Mailboxes, Contacts and Emails, with two licence shapes distinguished, a Limited License covering part of the firm and an Enterprise License where user and mailbox licences approximate total firm headcount. True-up is contractual rather than discretionary, with Nexl verifying active metrics at least sixty days before each twelve-month period and, on an Enterprise License, asking the customer to verify total firm headcount, so a buyer knows in advance what triggers an increase. Clause 3.5 adds that a twenty per cent rise in firm headcount may trigger a mid-term increase. Clause 9.5 sets a default annual uplift of eight per cent where the Order Form is silent, and clause 9.4 allows one fee change a year on sixty days notice with a right to terminate if the customer does not accept it. Renewal is annual with thirty days notice. What is absent is any number, band or per-seat rate; the pricing page is a request form. Verified 2 September 2026.

Segmentation is documented more thoroughly than by most vendors in this lane, along two axes. Nine practice areas each have a dedicated page covering personal injury, family law and divorce, criminal defence, employment, estate and probate, immigration, business, bankruptcy and general practice, and the pages are differentiated in substance rather than templated, with the personal injury page addressing the cost and competitiveness of that market specifically. Three further pages segment by firm size, addressing solo practitioners, small firms and mid-to-large firms. Six service pages set out what is covered, spanning search optimisation and answer-engine visibility, paid search, local search, link building and digital public relations, social media and on-page optimisation. What is absent is the boundary. No jurisdiction is stated anywhere, which matters because lawyer advertising rules differ by state and the product publishes regulated communications, and nothing identifies which states or bar jurisdictions the content is calibrated for. No firm size band is given in numbers and nothing states what the product does not cover. Verified 2 September 2026.

Coverage is documented along two axes at once, which is unusual and useful. By role, three pages address partners and lawyers, business development and marketing teams, and managing partners and leadership, each describing what that group gets rather than restating the product. By maturity, three further pages segment firms as Start, Grow and Scale, describing firms building a business development foundation, firms with structured proactive practice already in place, and high-maturity firms optimising at scale, which tells a buyer where they sit before a sales conversation. Firm size is addressed indirectly but contractually through the Limited and Enterprise licence definitions, the second pegged to total firm headcount. Geographic reach is evidenced rather than asserted, with named customers across six countries and three regional platform instances. What is missing is the boundary. No practice area is named anywhere, nothing states which jurisdictions the marketing module's compliance features are built for, no firm size band is given in numbers, and nothing states what the product does not cover. Verified 2 September 2026.

No clause names training in either direction, and the licence the customer grants is nonetheless the broadest in this pull. Section 3 of the user terms provides that content submitted in connection with the services is licensed to FirmPilot on a worldwide, perpetual, royalty-free, fully paid-up, irrevocable and non-exclusive basis to use, reproduce, modify, adapt, publish, translate, create derivative works from and distribute, and to do the quoted thing with it. A second sentence covering content posted to the website adds transferable and fully sublicensable through multiple tiers of distribution. Separately, the vendor owns all Usage Data and all Feedback outright, together with all improvements to its property based on them. None of that language names training, model training, machine learning or model improvement over customer content, so under the naming test it does not move the value in either direction. What a reader should take from it is that the licence is perpetual and irrevocable rather than term-limited, is not confined to providing the service, and would not need to be widened for training to fall inside it.

The commitment is stated on a product page rather than in the agreement, and the agreement was checked and found consistent with it rather than contradicting it. The Nexl AI page carries the quoted statement under a heading reading no training on your data, adding that client relationships, CRM data and activity remain strictly confidential. The terms and conditions contain no training clause in either direction, and the two provisions that come closest both cut the same way as the policy. Clause 10.7 grants Nexl a licence over Customer Data limited to three purposes, supplying the service, diagnosing problems, and developing other related products or services expressly provided that no Customer Data or Confidential Information is used within those products. Clause 10.5 confines analytics to statistical and performance information, records that no personally identifiable information beyond a user's name and email is included, and states that analytics do not include information about the customer's own clients. What keeps this from the contractual tier is that no clause names training or model improvement over customer content and prohibits it; the prohibition lives on a marketing surface while the agreement achieves a similar result through purpose limitation.

Retention is addressed only as a disclaimer of responsibility. Section 4 of the user terms states that the services are a tool for retrieving, analysing and managing content and are not a storage system or other system of record, that the customer is responsible for extracting and backing up its own content onto its own systems on a regular basis, and that the vendor will not be responsible for backup, recovery or any other step to ensure content is recoverable in the event of data loss. Section 3 adds that content may be deleted at any time without prior notice, that there is no duty to store or back it up, that the vendor may delete all of it at the conclusion of the services, and that it reserves the right to remove content at any time for any reason without notice. Section 3 of the older terms stacked on the same page repeats the point. No retention period is stated for anything, no deletion route or export facility is described, and nothing addresses how long generated content, competitor intelligence or campaign records are held.

The post-termination position is fixed, contractual and precise, and the during-term position is unstated. Clause 12.6 gives the customer one month from termination or expiry to copy all Customer Data, Confidential Information and Personal Information, with Nexl obliged to provide access during that window including access in SQL format specifically so the copy can be taken, followed by the quoted deletion commitment. Clause 12.7 layers a transition period of up to six months on top, during which service continues at the existing rate and Nexl must provide export assistance and a copy of Customer Data in a format the customer reasonably requests. This reaches AI outputs because Customer Data is defined to include data generated by the Services as a result of the customer's use of them, which captures generated reports, drafted emails and enriched contact records. What is absent is any retention period during the term: nothing states how long AI chat prompts, generated research reports or drafted emails are held while the agreement is running, and no retention setting is described.

Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026. Nothing describes segregation between customers and no tenancy model is stated. The question takes an unusual and pointed form on this product. FirmPilot's method is to crawl competing law firms and use what it learns to build a client's marketing, so two firms competing in the same market and practice area could each be customers while each is also a subject of the other's competitive analysis. Nothing published states whether a customer's own performance data, keyword set or campaign results can inform recommendations made to a competitor who is also a customer, and no wall of any kind is described. For a buyer this is the confidentiality question the product actually raises, and it is unaddressed.

Checked the home page, the Nexl AI and CRM product pages, the about and clients pages, the terms and conditions in full and the full footer on 2 September 2026. Nothing describes segregation between customers, and nothing describes segregation inside a customer either. The second gap is the more consequential one on this product. The platform's signature capability is a firmwide relationship graph showing who knows whom across offices and practice groups, and the terms make Mailboxes a licensed metric, so partner mailboxes across a firm feed one shared picture. Nothing published states whether an ethical wall can be represented in the system, whether a lawyer screened from a matter is prevented from seeing the relationship data attached to it, or whether contact and interaction records inherit any access restriction from the firm's own conflicts arrangements. Three separate regional instances exist for the United States, Australia and Europe, which is a geographic boundary rather than a tenancy or matter one.

Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026. Nothing addresses disclosure to authorities or in response to legal process, and nothing addresses notice to the customer if a demand arrives. There is no confidentiality article in the user terms at all, in either direction, which is unusual for a business agreement and means the question is not reached rather than answered adversely. The nearest provision runs the other way: the suspension clause permits the vendor to suspend access or remove content where it believes in good faith that continuing would expose either party to legal, regulatory or compliance risk, and the older terms stacked on the same page reserve a right to report users to law enforcement. Neither is a notice commitment. A privacy policy is published and was not opened on this pass.

The commitment is in the operative agreement and it is stronger than the usual formulation. Clause 14.1 sets out the exceptions to the mutual confidentiality obligation, the last of which permits disclosure where the recipient is compelled by law, subject to the quoted condition. Notice **prior to** disclosure rather than prompt notice afterwards is the difference between an opportunity to intervene and a notification once the material has gone, and most agreements in this corpus offer the weaker version. The obligation is mutual, and the definition of Confidential Information expressly states that the customer's Confidential Information includes Customer Data and Personal Information, so the notice right attaches to the material a firm would actually care about rather than only to commercial terms. Two limits: the clause carries no undertaking to seek a protective order or otherwise narrow the disclosure, and no exception is carved out for cases where a court order forbids notification, which leaves the interaction between the two unaddressed.

The training corpus is described by volume and category with no rights basis stated for any of it, and one category raises a question the vendor does not address. FirmPilot states that its knowledge model has processed more than five million pieces of legal marketing content and draws on a proprietary database of over three thousand legal cases, adding elsewhere that it mines cases, legislation, legal news and videos. Cases and legislation are public records. The five million pieces of legal marketing content are not: they are the website copy, advertisements and social output of other law firms, gathered by crawling competitors every ninety minutes, and that material is ordinarily the copyrighted work of those firms or their agencies. Nothing states on what basis it was collected or may be used, whether robots directives are honoured, or what separates learning from a competitor's approach from reproducing their expression. No database, publisher or supplier is named for the case collection either, and no jurisdictions or update cadence are stated.

Two external data bodies are described by scale or type and neither has a stated rights basis. The CRM page states that users can search 25 million companies and 100 million contacts to identify targets, map decision-makers and build outreach lists, which is a purchased or licensed business contact database of substantial size, and nothing names its supplier, its update cadence or the basis on which the contact records were obtained. That matters more than usual because the records are personal data about individuals who have not dealt with the law firm, and the customer will use them for marketing. Separately, the AI page states that responses draw on cited sources including SEC filings and live web content: SEC filings are public records and naming them is useful, while live web content describes a retrieval method rather than a source. A customer testimonial refers to data enrichment combining email traffic with social media including LinkedIn, and no licence or permitted-use basis is stated for that either.

Checked the home page, the pricing page, the overview and the user terms on 2 September 2026. The product does not retrieve primary law for a reader and cites none, so a citator has nothing to operate on in the usual sense. The analogous question is live and unaddressed, and it is not a technicality here. The vendor states that its knowledge model draws on cases, legislation and legal news to produce authoritative content, and that content is published on law firm websites as material prospective clients will read and rely on. Nothing describes whether the legislation behind a published article is checked for amendment or repeal, whether a case relied on remains good law, or whether previously published content is revisited when the law changes. Section 2 of the user terms states in terms that the vendor does not guarantee its content is accurate, complete or current.

Checked the home page, the Nexl AI and CRM product pages, the terms and conditions and the full footer on 2 September 2026. The product retrieves no legal authority and cites none, so this signal has nothing to operate on and its absence is not a criticism of the record. The closest analogue concerns whether the data behind a recommendation is current, since a relationship graph built on historical email traffic can show a strong connection to someone who left the client organisation years ago, and a contact database of 100 million records will contain stale entries. Nothing published describes any currency check, decay model or last-verified indicator shown to a user before they act on a relationship or a prospect record.

Checked the home page, the pricing page, the overview and the user terms in full on 2 September 2026. Nothing describes what the system does when it cannot produce reliable output, and no confidence indicator is described as surfaced to the user. The published material describes generation and publication as continuous and automatic, with no account of a case in which the system declines, holds an item, or flags material for a person. The vendor's own framing of quality is a claim rather than a behaviour: content is said to pass quality checks combining legal intelligence with originality requirements, and nothing states what a failed check produces. Nothing addresses what happens when the model has thin grounding for a practice area or jurisdiction, which is where over-confident output would be most likely and most consequential given that the result is published under a law firm's name.

Checked the home page, the Nexl AI product page in full, the CRM page, the terms and conditions and the full footer on 2 September 2026. Nothing describes what the system does when it cannot answer, and no confidence indicator is described as shown to the user for any output. The published framing runs the other way: a section headed answers you can trust states that responses always let the team act with confidence, which asserts reliability rather than describing behaviour at the limits. Citations are provided with responses, which lets a user check a claim, but that is grounding rather than an uncertainty signal and it does not tell the user which parts of an answer the system was least sure of. Nothing states what happens when a research report finds little external information about a prospect, or what a relationship strength score means when the underlying interaction history is thin.

Searched the AI Hallucination Cases database maintained by Damien Charlotin, and reporting drawing on it, on 2 September 2026 on the product and corporate names FirmPilot, FirmPilot AI, Inc. and FirmPilot, LLC, together with a separate search for bar advertising complaints or disciplinary action connected to the product. No court order, opinion, disciplinary record or regulatory action naming it was located. This is a statement about the public record rather than a finding about the product. The signal fits this product class poorly: the platform generates marketing content rather than filings, so its characteristic failure is a misstatement of law in published website copy or a claim that breaches a jurisdiction's advertising rules. That surfaces as a bar complaint or a state disciplinary matter against the firm rather than the vendor, and those are not indexed anywhere comparable to a court sanctions tracker.

Searched the AI Hallucination Cases database maintained by Damien Charlotin, and reporting drawing on it, on 2 September 2026 on the product and corporate name Nexl and Nexl Pty Ltd, together with a separate search for regulatory or data protection action involving the company. No court order, opinion, disciplinary record or enforcement action naming the product was located. This is a statement about the public record rather than a finding about the product. The signal fits this product class poorly and the reason is worth stating: the platform produces business development intelligence and marketing communications rather than legal citations, so its characteristic failure is a wrong relationship inference, a stale contact record or a research report asserting something inaccurate about a prospect. Those surface as a wasted pitch or an embarrassed partner rather than as a sanctions order, and no tracker indexes them.

Checked the home page, the pricing page, the overview, the nine practice area pages listed in the navigation and the user terms in full on 2 September 2026. No public material engages guidance from any professional body, and on this product that absence is the sharpest in the pull. What FirmPilot generates and publishes is lawyer advertising: website copy, blog articles, social posts and paid search adverts appearing under a law firm's name and read by prospective clients. Communications about legal services are regulated in every United States jurisdiction, covering false or misleading statements, claims of specialisation, comparisons with other lawyers, testimonials, results claims and required disclaimers, and the rules differ by state. Not one rule, ethics opinion or advertising standard is named anywhere. The user terms compound it rather than filling the gap, disclaiming in section 5 any warranty that the services comply with applicable law and placing sole responsibility for the accuracy and legality of published content on the customer.

Checked the home page, the Nexl AI and CRM product pages, the about and clients pages, the terms and conditions in full and the full footer on 2 September 2026. No public material engages guidance from any professional body. The gap is specific rather than general on this product, because Nexl sells an email marketing system to law firms and communications sent to prospective clients are governed by lawyer advertising and solicitation rules everywhere it operates. Clause 5.4 of the terms does impose detailed obligations on the customer, requiring explicit consent where legally required, records of consent, unsubscribe links in all communications and a compliant privacy policy, and prohibiting bought, rented or scraped contact lists. Every one of those addresses marketing and data protection law rather than professional conduct. No bar rule on advertising or solicitation is named, no jurisdiction-specific guidance is cited, and nothing addresses conflicts, which a firmwide relationship graph also touches.

Checked the home page, the pricing page, the overview and the user terms in full on 2 September 2026. Nothing addresses what happens to a client's bill, and the product does not touch billing. FirmPilot operates entirely before the client relationship exists, on visibility, lead generation and case acquisition, so the compression of billable time this signal tracks does not arise and the absence is not a criticism. Nor does the vendor make claims that would engage the lower values: the figures published concern lead and case volume, retention and time to return on marketing investment rather than time saved on legal work. Its cost claims are about replacing agency retainers and reducing marketing overhead, which is a comparison between vendors rather than anything the firm would disclose to a client.

Checked the home page, the Nexl AI and CRM product pages, the terms and conditions in full and the full footer on 2 September 2026. Nothing addresses what happens to a client's bill, and the product does not touch billing. Nexl operates before the engagement rather than during it, on relationship management, pitching and marketing, so the compression of billable time this signal exists to track does not arise in its usual form and the absence is not a criticism. Nor does the vendor make savings claims that would engage the lower values: the headline figure on the site concerns growth rather than efficiency, and it is drawn from the company's own benchmark research about firms that spread business development beyond a few rainmakers rather than from any claim about time saved. Nothing published describes recording or disclosing AI-assisted work of any kind.

Checked the home page, the pricing page, the overview and the user terms in full, together with the full site footer, on 2 September 2026, and ran a targeted search for company security or vendor documentation which returned nothing. No subprocessor list exists in any form, no processor or vendor is named anywhere, and no model or AI provider is identified. There is no data processing addendum, no security page and no trust centre, so no forwardable client-facing artifact exists beyond the published privacy policy and the user terms themselves. The user terms refer to third-party providers, licensors and suppliers as a category, and treat them as third-party beneficiaries of the liability limitations, without naming one. A firm asked by a client which entities process data connected to its marketing, or which model writes content published in its name, could answer nothing from anything the vendor publishes.

Not one AI provider is named anywhere, which is what decides this. The signal asks whether a firm can answer a client's AI clause without a bespoke negotiation, and the answer here is no: no model, model provider or AI subprocessor appears on any surface, no subprocessor list is published in any form, and infrastructure is not named either, so even the weaker naming that would not by itself suffice is absent. What the vendor does publish is worth recording and is genuinely useful for the broader vendor-diligence question. A data processing agreement is published openly in the site footer rather than gated behind an executed contract, SOC 2 and ISO 27001 certification is stated on the product page, and clause 15.8 of the terms gives the customer a prior written consent right over any subcontractor Nexl wishes to engage, which is a stronger control than a notification right even though it is a control rather than a disclosure. The Vanta-hosted trust centre returned no readable body on this pass, recorded as a retrieval limit.

Checked the home page, the pricing page, the overview and the user terms in full on 2 September 2026. Nothing addresses disclosure of AI involvement to any tribunal or regulator, and no record identifying which content the system generated is described as available or exportable. The forum here is a state bar rather than a court, and the scenario is concrete: where a regulator or a complainant questions a marketing claim published on a firm's website, the firm would need to show what was published, when, on whose instruction, and whether a person reviewed it before it went live. The platform holds that history, since it generates, calibrates and publishes the content and reports campaign performance through a dashboard. Nothing states that any of it is retained as an auditable record or exportable, and section 4 of the user terms cuts the other way by disclaiming that the service is a system of record at all.

Checked the home page, the Nexl AI and CRM product pages, the terms and conditions in full and the full footer on 2 September 2026. Nothing addresses disclosure of AI use to any tribunal or regulator, and no record identifying which outputs a model produced is described as available or exportable. The forum question barely arises for a business development platform, since its outputs are pitches, campaigns and internal intelligence rather than anything filed. One adjacent scenario is real and unaddressed: where a regulator or a client queries a marketing communication a firm sent, the firm would need to show what was sent, to whom, on what consent basis, and whether the text was machine-drafted. The terms require the customer to keep consent records, and the marketing module reports campaign analytics, but nothing describes a record of which communications were AI-generated. Clause 12.6's SQL-format export on termination is a data portability right rather than an audit record.