Haast vs Hadrius: how they compare in 2026

Haast applies AI agents to marketing and communications compliance before publication and throughout the life of published content. Each agent handles a particular compliance task using regulations, internal policies and earlier review decisions. The customer sets a risk tolerance for individual rules, and reviewer feedback changes later analysis. Findings identify suspect content, explain the applied requirement and suggest a correction. Continuous monitoring extends the same work to websites, social channels and authorized partner material. Approval routing and audit history support that analysis. Removing the models would remove the automated interpretation and review service that Haast sells to enterprise compliance teams.

The models are the proposition, and the vendor argues the point itself: if AI is generating the communications, the marketing and the trades, only AI can review them at the same scale. Hadrius calls its six modules agentic, and every module's described value is a machine determination. Marketing review reads text, images, audio and video against the firm's rules and required disclosures and routes each piece for approval. Communications supervision classifies, screens and ranks messages from more than thirty channels with severity scoring. The vendor puts the cut in false positives against legacy tools at 90 percent or more on its solution pages and at 99 percent on its home page. Account surveillance tests employee and firm trading against restricted lists, blackout windows and pre clearance rules and escalates what matters. The testing program, attestations and branch examinations sit around those determinations as workflow. Strip the models out and what remains is an archive and a task tracker, which is what the platform is sold against. The agreement calls the same thing by its plainer name, describing AI generated compliance outputs, automated approvals and recommendations.

Findings trace back to configured rules and explain the text or claim that triggered a concern. Haast separates checks into dedicated agents and adjusts analysis through reviewer feedback. A September 2026 comparison claims 98.7% accuracy across more than 400,000 compliance checks, but gives no reproducible test set, error breakdown or evaluation protocol. Configured company standards can be inspected, yet legal assertions come without an openable link to primary authority. Nor is there a described mechanism for checking subsequent legal treatment. The product provides reasoning about rules, without a public evaluation that establishes reliable citation accuracy across those rules.

Outcome figures are published in quantity, and none of them measures whether the determinations are right. Hadrius claims a cut in false positives of 90 percent or more, put at 99 percent on its home page, a 96 percent cut in time spent on communications supervision, a tenfold cut in marketing review cycle time and 19 or more hours regained each week per user. It also claims a $3,900 average annual cost reduction per representative, and more than 1,000 firms holding over $10 trillion in assets. Customer stories add Republic's 60 percent cut in daily compliance time and Frec's halved review time. None of these figures carries a sample, a baseline or a method. Nothing addresses the failure that matters most in supervision, the violation the system does not flag. The agreement is more candid than the marketing. It says the services use artificial intelligence that is inherently not error free, that outputs are informational only, that Hadrius makes no warranty on their accuracy, completeness or reliability, and that the customer must verify every AI output before relying on it.

Content creators can correct flagged wording, repeat a review and submit unresolved findings to compliance. Reviewers see the analysis, leave comments and approve or reject material within the existing approval process. Risk tolerance can vary by agent, product, region or campaign, including a strict setting for claim language. In Google Docs, an unresolved submission generates an email link for the reviewer to open the same sidebar. These are concrete review and escalation surfaces. The public control description does not specify an automatic stop for unsupported legal reasoning, a mandatory reviewer threshold or a recovery procedure after an incorrect approval reaches publication.

The review point is stated, and the thresholds belong to the customer. Hadrius describes a system of record that runs compliance operations under human oversight, and its marketing module tells reviewers that they stay in control of decisions. The agreement makes that enforceable. AI outputs, automated approvals and recommendations are informational only, the customer must verify them independently before relying on them, and the vendor disclaims liability for regulatory penalties arising from reliance on automated outputs without review by qualified compliance staff. Escalation and routing are described, with severity scoring that ranks messages, trades and marketing so reviewers clear supervisory queues in priority order. Two gaps remain. The controls are the customer's to set. The firm configures surveillance rules, alert thresholds, restricted securities lists and retention periods, and the vendor does not warrant that any configuration meets the firm's regulatory obligations. And automated approvals are mentioned without any published description of what may be approved without a person, or of what happens when an item the system cleared later proves wrong.

Zurich uses Haast in Australia and New Zealand to check product disclosure statements, target market determinations, social content, customer communications and third party contracts from draft to publication. Its November 2025 case study says drafting those disclosure documents now takes half the time. Haast also scans Zurich's websites, social channels and internal document repositories, and a call center transcript review is in pilot there. Equity Trustees uses Haast to precheck regulated materials, newsletters and fact sheets and to monitor fund manager and superannuation marketing online. Its November 2024 account describes more than 80 custom compliance requirements and monitoring across thousands of resources. Mate, a telco, is credited with an 80% cut in review time, and Future Super and Aviva are also named. None of these figures comes with a baseline, a sample or a measurement method. The accounts establish named use and stated results without a controlled outcome study.

Five customers are quoted on the home page through the person accountable for the program: Tealee Hinger, Chief Compliance Officer at M1 Finance; Robert Spake, Chief Compliance Officer at Republic Capital; Michael Schmidtke, Chief Compliance Officer at Csenge Advisory Group; Laurie Williams, Deputy Chief Compliance Officer at SmartAsset; and Raymond Gettins, Director at United Advisor Group. Nine dated customer stories follow, and several carry figures. Republic reported a 60 percent cut in daily compliance time and Frec halved its review time, both in November 2023, and Arrived cut weekly marketing review time tenfold. In July 2026, Csenge described one compliance officer overseeing about 70 advisers across 28 firms, and SEC examiners asking no questions about marketing approved through Hadrius. Twenty Five Capital, an RIA its two advisers launched with NextReg, spends about an hour a month on compliance. The Series A announcement names BBVA, Altruist, Allworth Financial and World Investment Advisors as customers, and the home page claims more than 1,000 firms with over $10 trillion in assets. No figure carries a baseline, a period or a way of measuring it.

Customer content is limited to running compliance reviews and improving accuracy within that customer's account. Haast expressly excludes training shared or third party models in its product policy. Google integration data has a further purpose restriction and passes to infrastructure providers only as necessary for enabled functionality. Encryption and authenticated access protect stored and transmitted information. The public usage agreement does not reproduce an express training prohibition, and attorney client privilege and work product treatment are not specifically addressed. Granular administrative controls are available, but matter level segregation and the retention terms of individual model providers remain outside the public confidentiality description.

Substantive written commitments, readable before signing, with privilege the part left unaddressed. The Master Services Agreement carries mutual confidentiality limited to people who need access, deletion of the other party's information after the agreement ends, subject to record keeping law, and a compelled disclosure clause requiring reasonable prior notice so the other party can contest the order. The customer keeps ownership of its inputs and is assigned the outputs. Inputs and outputs are used solely to provide the services, comply with law, enforce the agreement and prevent abuse. The agreement also bars Hadrius from using, aggregating or anonymizing any inputs or outputs derived from the customer's communications data for AI model training. The privacy policy says Hadrius processes customer data solely at the direction of its business customers as controllers, and that its AI providers' agreements prohibit them from training on customer data. A data processing agreement is incorporated by reference and available on request. Two things are left open. The training bar is worded for communications data, so other inputs rest on the purpose limit alone, and nothing addresses privilege or work product.

The intended users include enterprise lawyers, compliance staff and marketers. Marketing teams receive an initial review, while compliance reviewers resolve findings and make publication decisions. Haast's implementation staff translate customer policies into automated checks, and the platform is described as an AI legal reviewer. A separate statement defining the boundary between software output and legal advice is not supplied in the current usage policy or product materials. Nor are lawyer competence duties, consumer disclosures or jurisdictional limits on legal services set out. The authorized content restriction governs what customers may monitor; it does not explain professional responsibility for an erroneous legal interpretation.

The advice line is drawn in the agreement, in terms, and it names the professional who has to do the checking. The Master Services Agreement states that AI generated compliance outputs, automated approvals and recommendations are provided for informational purposes only and do not constitute legal, regulatory or professional compliance advice. The customer must independently verify all AI generated outputs before relying on them and assumes sole responsibility for decisions based on them. Hadrius disclaims liability for regulatory penalties arising from reliance on automated outputs without independent review by qualified compliance personnel. A separate clause states that the service is designed to assist with SEC and FINRA compliance but does not guarantee compliance, and that the customer remains solely responsible for all compliance obligations, regulatory filings and supervisory decisions. Configuration is handled the same way. Hadrius gives implementation assistance and does not warrant that any configuration satisfies the firm's regulatory obligations. Who the product is for, what it is not, and whose judgment governs are each stated.

The emphasis falls on explainable decisions, customer control of rule settings and ongoing feedback from legal reviewers. Each task has its own agent, and a finding exposes the rule applied and the reason for the flag. Those features support a customer's compliance governance, while legal engineers help encode the customer's standards during implementation. A separate vendor governance framework does not name an accountable AI officer, describe release approval testing or report uneven performance across industries, languages or protected groups. The aggregate accuracy claim also lacks a published evaluation protocol. The available commitments concern transparent operation and customization rather than a defined vendor assurance program.

A governance posture is stated, and no mechanism sits behind it. The vendor says the platform runs compliance operations under human oversight, that the AI follows each firm's compliance manual, and that the models behind it never store or retain client data. The agreement adds that artificial intelligence is inherently not error free. Hadrius also runs webinars for compliance officers on what AI can and cannot do in compliance work, which educate buyers rather than describe its own models. Nobody inside the company is named as accountable for the models, nothing is published about what is tested before a change ships, and nothing says whether output differs across channels, languages, firm types or the people an adviser communicates with. The trust center offers an information security policy, a continuity plan and an incident response plan on request, and none is described as covering model testing or bias. On a product whose headline claim is its false positive rate, no testing regime behind that number is published.

The March 2026 privacy policy covers use of the compliance platform as well as the website. It specifies encryption, multifactor authentication for sensitive systems, intrusion detection, vulnerability assessments and an incident response plan with legally required breach notice. Information is retained while a legitimate purpose continues, then deleted or anonymized; backups may remain securely stored when deletion is not possible. Individuals can request access, correction or deletion by email. Google data has a separate restriction to enabled functionality and equivalent protections for infrastructure providers. No current list of subprocessors, prompt specific retention schedule or fixed backup deletion deadline accompanies these controls.

Retention, deletion, access, subprocessors and incident handling are each published, and each is specific enough to hold the vendor to. Retention is the customer's to set. The agreement makes the firm configure retention periods to its regulatory requirements, the privacy policy says customer data is kept on the customer's instructions, and records are archived write once to the 17a-4 standard. At the AI layer, Hadrius says its models never store or retain client data and that data is permanently deleted once processed. When the agreement ends, each party deletes the other's information, subject to record keeping law. Access is controlled by role, with single sign on through WorkOS, multi factor authentication and information barriers at user, branch and organization level, and data is encrypted in transit and at rest with AES-256. Hadrius publishes a list of fifteen subprocessors with their purposes, all located in the United States, from Amazon Web Services for hosting to OpenAI and Anthropic for model inference. The agreement commits to notifying the customer within seventy two hours of confirming a security incident involving data subject to Regulation S-P, with written detail of its scope, preserved forensic evidence and reports fit for a regulatory examination. Third party penetration testing runs at least once a year, and the incident response plan is offered through the trust center on request.

The public terms page contains a usage policy covering authorized users, lawful activity, prohibited content and restrictions on competitor monitoring. Haast may throttle or suspend access for violations and can modify that policy without advance notice. The policy does not allocate financial loss from an incorrect compliance finding or an approval that misses a regulatory issue. No output warranty, vendor indemnity, liability cap or contractual correction remedy is stated there. Customer support and reviewer feedback provide operational assistance, not compensation rights. Any additional commercial allocation of those risks remains outside the publicly available agreement.

A real published position, and the exposure the product creates sits outside it. The Master Services Agreement, effective January 1, 2026, carries a mutual indemnity with stated scope and a defined procedure. Hadrius defends claims that the software behind its services infringes third party intellectual property, subject to six exclusions such as customer inputs, modifications and combinations with other products. The customer defends claims arising from its own use of the services and its inputs. Liability is capped at the fees paid or payable in the twelve months before the claim, lost profits and consequential, indirect, punitive and special damages are excluded both ways, and indemnities sit outside the cap. Hadrius warrants professional and workmanlike service by qualified personnel and commercially reasonable efforts to keep out malicious code, and otherwise provides the service as is. What is expressly excluded is the loss a compliance officer would fear most. Hadrius is not liable for regulatory enforcement actions, fines or sanctions imposed on the customer or its staff, and disclaims liability for penalties arising from reliance on automated outputs without independent review. No insurance is referenced. Disputes go to arbitration in New York under Delaware law.

The Google Docs add on has a published installation and review sequence. A customer installs it from the Workspace Marketplace, grants permissions and signs in with Haast credentials or single sign on. Content is analyzed from a sidebar, with findings linked to the relevant passage. Authors edit in the original file and run another review; unresolved issues are submitted to compliance, whose reviewer receives an email link to that file and sees the same findings and comments. Haast retains the audit history. That sequence describes configuration and how content and review work move between author and reviewer. Haast also lists connections to Microsoft Word, Office 365, Figma, Notion, Adobe Workfront and Monday.com, a Chrome extension and an API, with less detail on what each one moves.

The systems this work lives in are named, and the setup is written down in a help center an administrator can follow. Microsoft 365 email is captured by a journal rule in Microsoft Purview that sends a copy of every message sent or received by everyone in the organization to the firm's Hadrius journaling address. Where a relay such as Proofpoint, Mimecast or Barracuda sits in the mail path, the guide adds a mail flow connector in Exchange and gives its settings. Employees connect LinkedIn direct messages by signing in to LinkedIn from inside Hadrius. Claude Enterprise feeds every employee prompt and response, with the sender, time and conversation, through Claude's read only Compliance API, and ChatGPT is archived as well. Each of these flows runs into Hadrius, into the archive and the review queues. The agreement names the customer systems it expects to connect, Gmail and Microsoft Exchange, Slack, WhatsApp, LinkedIn and Telegram, and Plaid for brokerage feeds, and it binds Hadrius to Google's user data policy for data from Google Workspace. The subprocessor list adds SnapTrade, MX, Vezgo and BridgeFT for account surveillance and capture services for iMessage, SMS, RCS, Discord and Zoom, and filing support connects to FINRA Gateway. The agreement is frank that third party integrations are a convenience, that continued availability is not guaranteed and that Hadrius is not liable for data gaps arising from them, and it puts permissions and access settings on the customer.

Haast is delivered as software as a service, with account login, browser access and connections inside content creation tools. Its Google Docs integration authorizes access to the specific content needed for the requested functionality. Customer rules can vary across brands, teams and geographic markets within a deployment. The published delivery description does not identify hosting regions, distinguish storage location from AI processing location or explain whether customers share underlying infrastructure. International regulatory coverage concerns the rules being applied, rather than where information is processed. Private cloud, installation on customer infrastructure and region selection do not appear among the purchasing options.

Hadrius runs as a cloud service on Amazon Web Services, and its subprocessor list places AWS and every other subprocessor in the United States. That country is the residency detail published. Nothing states the AWS region, offers a residency choice for a firm with obligations outside the United States, or separates where data is stored from where models process it, beyond the same list naming OpenAI and Anthropic, also in the United States, for inference. Nothing published states how customers are separated from one another, with no tenancy model and no single tenant or private option. The separation that is published sits inside an account rather than between accounts, in the workspaces offered to compliance consultants so they can run several client firms from one login, and in information barriers set at user, branch and organization level. The agreement's export control clause bars access from embargoed countries.

The current privacy policy identifies ISO 27001 and SOC 2 Type II certifications and describes independent audits. Platform materials repeat ISO 27001 certification and SOC 2 compliance. The accompanying controls include encryption, authentication, vulnerability review and incident handling, while procurement teams can request security documentation through the RFP process. No audit period, certification scope, issuing assessor or immediately accessible report accompanies those claims. A reader can identify the standards Haast claims, but cannot establish their coverage of individual AI services from those statements alone. No specific model provider assurance is incorporated into that certification description.

Standards are named, a trust center exists, and the evidence sits behind a request. Hadrius says it is SOC 2 Type II compliant, with its security, availability and confidentiality controls independently audited, and every page carries ISO 27001, AICPA SOC and GDPR marks. The trust center at trust.hadrius.com lists SOC 2, ISO 27001, GDPR and CCPA. It offers the SOC 2 Type II report, the information security policy, the continuity and disaster recovery plan, the incident response plan and a penetration test, each through an access request. No audit period, auditor or ISO certificate scope is published, and nothing says whether the documents are released before a contract. Third party penetration testing runs at least once a year alongside continuous vulnerability assessment, and systems are monitored around the clock.

The processing architecture assigns an individual agent to each compliance task instead of using one general agent for every rule. Customer policies, past decisions and risk settings shape those agents, and feedback from reviewers adjusts later work. This explains how analysis is organized and customized. It does not identify the underlying model families, their providers, versions or inference locations. Google APIs supply an integration channel, not an identification of the models performing compliance analysis. Shared model training is excluded by policy, but provider retention terms and a commitment to notify customers about model substitutions are not included in the public architecture description.

The providers are named, and the commitments stop there. Hadrius's published subprocessor list names OpenAI and Anthropic for model inference, both located in the United States, alongside Reducto for processing marketing documents, and the privacy policy names OpenAI among the AI providers behind certain features. The privacy policy also says those providers' agreements prohibit them from using customer data for their own training, and Hadrius says the models never store or retain client data. What is not published is which model or version runs which module, the region where inference happens, or any commitment to tell customers when a provider or model changes, and the agreement carries no clause on notice of subprocessor changes. Claude also appears in a second role. A July 2026 integration with Claude's Compliance API pulls employee prompts and responses out of Claude Enterprise into the archive, alongside existing ChatGPT archiving, which makes those platforms sources of records to supervise rather than the engine doing the supervising.

Haast charges according to usage rather than the number of individual users. Its enterprise pricing description permits the broader team to use the service without a separate subscription for every person. Rates and the exact metered unit are not published, and no named package table sets out included volumes, overage prices or minimum commitments. Implementation is tailored to users, rules, content and integrations with legal and technical staff involved, and Haast puts it at 8 to 12 weeks. The associated implementation charge is not stated. The commercial structure is therefore a negotiated usage subscription with an identified basis, while the amount and the boundary of included deployment services remain private.

The shape is visible and the number is not. Six modules are sold as separate solutions, the testing program, marketing, people oversight, communications, account surveillance and branches, and Hadrius says two thirds of its customers use three or more of them. The agreement names the billing structure. Fees are set in an order form, invoices fall due within thirty days, and past due balances carry the lesser of 1.5 percent a month or the legal maximum. Order terms renew automatically for successive twelve month periods unless either side gives thirty days' notice, and fees can be raised for a renewal term on thirty days' notice. The inspection clause names the unit in passing. The customer keeps records of user counts and module usage, Hadrius may audit them once a year, and the customer pays the audit costs if fees were underpaid by more than 5 percent. No rate, band, minimum or implementation figure is published, there is no pricing page, and the route to a price is a demo request that asks for firm size in four bands.

The product serves enterprise legal, compliance and marketing departments reviewing regulated communications. Financial services coverage includes FINRA, SEC, FCA, ASIC and consumer protection requirements, and insurers, fintechs and superannuation funds are named buyer types. Separate industry workflows address retail, telecommunications, pharmaceuticals, gaming and other regulated businesses. Teams can apply different rule sets across products, regions, campaigns and brands. Supported material includes text, images, presentations, audio and video, with monitoring of websites and authorized partner channels after publication. The published scope explains these supported compliance tasks but does not offer a definitive jurisdiction exclusion list or limits for unusual content. It is an enterprise review platform rather than a general case management service for law firms.

Four buyer segments, each tied to the rules it answers to, and no statement of where the product stops. Broker dealers get supervision under FINRA Rules 3110, 3120 and 3130 with write once retention and evidence for the chief executive's annual certification. RIAs get SEC Rule 206(4)-7 put into practice, with program testing, annual reviews and Marketing Rule workflows. Private funds get personal trading surveillance against restricted lists and blackout windows with Code of Ethics attestations and conflict tracking. Compliance consultants get workspaces that hold several client firms under one login, with standard evidence packs across them. The customer stories show the range in practice, from Twenty Five Capital, a two adviser RIA, to Csenge Advisory Group, an RIA aggregator overseeing 28 firms across nearly 40 custodians, and on to BBVA and M1 Finance. Firm size bands on the demo form run from 1 to 50 up to more than 5,000. What is absent is the boundary. Nothing says which regimes are out of scope, and a firm with banking, insurance or obligations outside the United States is left to infer.