Hadrius vs Red Oak Compliance: how they compare in 2026

The models are the proposition, and the vendor argues the point itself: if AI is generating the communications, the marketing and the trades, only AI can review them at the same scale. Hadrius calls its six modules agentic, and every module's described value is a machine determination. Marketing review reads text, images, audio and video against the firm's rules and required disclosures and routes each piece for approval. Communications supervision classifies, screens and ranks messages from more than thirty channels with severity scoring. The vendor puts the cut in false positives against legacy tools at 90 percent or more on its solution pages and at 99 percent on its home page. Account surveillance tests employee and firm trading against restricted lists, blackout windows and pre clearance rules and escalates what matters. The testing program, attestations and branch examinations sit around those determinations as workflow. Strip the models out and what remains is an archive and a task tracker, which is what the platform is sold against. The agreement calls the same thing by its plainer name, describing AI generated compliance outputs, automated approvals and recommendations.

Models now drive a core capability, and the platform beneath them still runs without them. Red Oak calls itself an agentic compliance platform, and two products rest on models. Mira, the supervision agent from MirrorWeb, reads each captured message in context against the firm's own handbook rather than matching keywords, scores each flag for severity and traces it to the clause that triggered it, and Red Oak credits it with 98 percent fewer false positive alerts. AI Review reads marketing against the firm's policies and lexicon before a reviewer opens it. The rest of the platform is workflow and record keeping, from routing and approval, the disclosure library and distribution through 4U to capture from more than thirty channels, WORM archiving and registration and complaint management. Those served the market for years before the models arrived, and they would still work as a review and archiving system with the models removed.

Outcome figures are published in quantity, and none of them measures whether the determinations are right. Hadrius claims a cut in false positives of 90 percent or more, put at 99 percent on its home page, a 96 percent cut in time spent on communications supervision, a tenfold cut in marketing review cycle time and 19 or more hours regained each week per user. It also claims a $3,900 average annual cost reduction per representative, and more than 1,000 firms holding over $10 trillion in assets. Customer stories add Republic's 60 percent cut in daily compliance time and Frec's halved review time. None of these figures carries a sample, a baseline or a method. Nothing addresses the failure that matters most in supervision, the violation the system does not flag. The agreement is more candid than the marketing. It says the services use artificial intelligence that is inherently not error free, that outputs are informational only, that Hadrius makes no warranty on their accuracy, completeness or reliability, and that the customer must verify every AI output before relying on it.

Accuracy is asserted without measurement, and the grounding points to the firm's own handbook. Mira traces each flag to the policy and handbook clause that triggered it and shows its reasoning, so a reviewer sees which rule applies. AI Review flags language against the firm's policies and lexicon. The published figures measure speed and noise rather than correctness. Red Oak cites 98 percent fewer false positives and 80 percent less review time with Mira, and 3.3 times faster content approvals and 70 percent fewer compliance touches with AI Review, the approval figure reported by clients. None carries a sample, a period or a method, and nothing measures the missed violation. The agreement states the limit plainly. AI outputs may be inaccurate, incomplete or unreliable, may resemble third party content, are not guaranteed free of errors, and must be reviewed and validated by the client before use.

The review point is stated, and the thresholds belong to the customer. Hadrius describes a system of record that runs compliance operations under human oversight, and its marketing module tells reviewers that they stay in control of decisions. The agreement makes that enforceable. AI outputs, automated approvals and recommendations are informational only, the customer must verify them independently before relying on them, and the vendor disclaims liability for regulatory penalties arising from reliance on automated outputs without review by qualified compliance staff. Escalation and routing are described, with severity scoring that ranks messages, trades and marketing so reviewers clear supervisory queues in priority order. Two gaps remain. The controls are the customer's to set. The firm configures surveillance rules, alert thresholds, restricted securities lists and retention periods, and the vendor does not warrant that any configuration meets the firm's regulatory obligations. And automated approvals are mentioned without any published description of what may be approved without a person, or of what happens when an item the system cleared later proves wrong.

The agreement says the AI is designed to assist human reviewers. It makes the client solely responsible for reviewing and validating every AI output, by human review included, before any use or reliance, and bars using AI outputs in regulated decision making without appropriate human review and oversight. It also bars connecting AI agents or autonomous processes to the AI features without Red Oak's written permission. The product follows the same line. AI Review gives submitters feedback before a reviewer opens the piece and suggests fixes that reviewers accept or reject. Mira routes each flag to the right reviewer with the clause behind it, supports escalation to a senior reviewer, and drafts policy refinements from reviewer decisions that change nothing until the firm's chosen approver signs off. Nothing published sets a threshold at which the AI stops, or says what happens to material the AI passed that a regulator later faults.

Five customers are quoted on the home page through the person accountable for the program: Tealee Hinger, Chief Compliance Officer at M1 Finance; Robert Spake, Chief Compliance Officer at Republic Capital; Michael Schmidtke, Chief Compliance Officer at Csenge Advisory Group; Laurie Williams, Deputy Chief Compliance Officer at SmartAsset; and Raymond Gettins, Director at United Advisor Group. Nine dated customer stories follow, and several carry figures. Republic reported a 60 percent cut in daily compliance time and Frec halved its review time, both in November 2023, and Arrived cut weekly marketing review time tenfold. In July 2026, Csenge described one compliance officer overseeing about 70 advisers across 28 firms, and SEC examiners asking no questions about marketing approved through Hadrius. Twenty Five Capital, an RIA its two advisers launched with NextReg, spends about an hour a month on compliance. The Series A announcement names BBVA, Altruist, Allworth Financial and World Investment Advisors as customers, and the home page claims more than 1,000 firms with over $10 trillion in assets. No figure carries a baseline, a period or a way of measuring it.

Scale is claimed, and none of it is attributed. Red Oak says more than 1,550 regulated firms use it, including 37 of the top 40 global asset managers, with about $101 trillion in client assets, an 84 Net Promoter Score and sixteen years serving regulated firms. Logos for Blackstone, Dimensional Fund Advisors, Fidelity Investments, J.P. Morgan, State Street, BNY, Raymond James, Lazard and USAA appear beside that claim, with no account of what any of them uses. The outcome figures carry no named firm, period or method. They are 98 percent fewer false positives and 80 percent less review time with Mira, and 3.3 times faster approvals and 70 percent fewer compliance touches with AI Review. The July 2026 combination announcement gives other numbers for the same claims, 17 of the top 20 asset managers and more than $62 trillion in assets. No client story naming a person and a result is published.

Substantive written commitments, readable before signing, with privilege the part left unaddressed. The Master Services Agreement carries mutual confidentiality limited to people who need access, deletion of the other party's information after the agreement ends, subject to record keeping law, and a compelled disclosure clause requiring reasonable prior notice so the other party can contest the order. The customer keeps ownership of its inputs and is assigned the outputs. Inputs and outputs are used solely to provide the services, comply with law, enforce the agreement and prevent abuse. The agreement also bars Hadrius from using, aggregating or anonymizing any inputs or outputs derived from the customer's communications data for AI model training. The privacy policy says Hadrius processes customer data solely at the direction of its business customers as controllers, and that its AI providers' agreements prohibit them from training on customer data. A data processing agreement is incorporated by reference and available on request. Two things are left open. The training bar is worded for communications data, so other inputs rest on the purpose limit alone, and nothing addresses privilege or work product.

Confidentiality is committed in a published agreement, and the training position rests on product pages. The master services agreement carries mutual confidentiality for information marked confidential or that a reasonable person would see as confidential. It limits access to people who need to know and are bound by equal duties, and lasts three years after termination and longer for trade secrets. A legal process clause commits Red Oak to prompt written notice of a subpoena or similar demand, unless the law forbids it, so the client can seek a protective order, and to disclose only what is specifically requested. The client owns its data, and Red Oak's license is to provide the services. Against that, Red Oak may create deidentified client data and use it for any and all purposes during and after the term, and may keep client data after termination under its own retention policies. The statement that customer content is never used to train AI models sits on product pages rather than in the agreement. Nothing addresses segregation between clients, privilege, work product or what a model provider may keep.

The advice line is drawn in the agreement, in terms, and it names the professional who has to do the checking. The Master Services Agreement states that AI generated compliance outputs, automated approvals and recommendations are provided for informational purposes only and do not constitute legal, regulatory or professional compliance advice. The customer must independently verify all AI generated outputs before relying on them and assumes sole responsibility for decisions based on them. Hadrius disclaims liability for regulatory penalties arising from reliance on automated outputs without independent review by qualified compliance personnel. A separate clause states that the service is designed to assist with SEC and FINRA compliance but does not guarantee compliance, and that the customer remains solely responsible for all compliance obligations, regulatory filings and supervisory decisions. Configuration is handled the same way. Hadrius gives implementation assistance and does not warrant that any configuration satisfies the firm's regulatory obligations. Who the product is for, what it is not, and whose judgment governs are each stated.

A real position on advice and tooling sits in the agreement, short of naming the regimes it covers. The master services agreement says the AI functionality is designed to assist human reviewers and should not be used for legal, financial, tax or other professional advice, decisions or recommendations without review by qualified professionals. The client is solely responsible for reviewing and validating every AI output before use and for decisions made in reliance on it, and may not use AI outputs in regulated decision making without appropriate human review and oversight. Red Oak is not responsible for the client's compliance with state and federal laws, which stays with the client alone, and it makes no investment recommendations. What is not stated is which regulatory regimes the product is built for and where it stops, and no clause ties the review duty to a named rule.

A governance posture is stated, and no mechanism sits behind it. The vendor says the platform runs compliance operations under human oversight, that the AI follows each firm's compliance manual, and that the models behind it never store or retain client data. The agreement adds that artificial intelligence is inherently not error free. Hadrius also runs webinars for compliance officers on what AI can and cannot do in compliance work, which educate buyers rather than describe its own models. Nobody inside the company is named as accountable for the models, nothing is published about what is tested before a change ships, and nothing says whether output differs across channels, languages, firm types or the people an adviser communicates with. The trust center offers an information security policy, a continuity plan and an incident response plan on request, and none is described as covering model testing or bias. On a product whose headline claim is its false positive rate, no testing regime behind that number is published.

Principles for the AI are published, and no mechanism for governing the models sits behind them. Red Oak's AI approach page sets out that a person makes every review decision, that every policy update the AI drafts waits for an administrator's approval, that improvements stay inside the firm, and that every classification, routing step, escalation and resolution is logged with the reviewer's name. It says plainly that its compliance grade AI label is not a certification or a regulatory approval. What is not published is how Red Oak governs the models themselves. No owner of the AI is named, nothing describes testing or evaluation before a model or prompt change reaches customers, and nothing addresses whether flags differ across content types, channels, languages or the people an adviser serves. The agreement adds that outputs may be inaccurate, incomplete or unreliable, and that other users may receive similar output.

Retention, deletion, access, subprocessors and incident handling are each published, and each is specific enough to hold the vendor to. Retention is the customer's to set. The agreement makes the firm configure retention periods to its regulatory requirements, the privacy policy says customer data is kept on the customer's instructions, and records are archived write once to the 17a-4 standard. At the AI layer, Hadrius says its models never store or retain client data and that data is permanently deleted once processed. When the agreement ends, each party deletes the other's information, subject to record keeping law. Access is controlled by role, with single sign on through WorkOS, multi factor authentication and information barriers at user, branch and organization level, and data is encrypted in transit and at rest with AES-256. Hadrius publishes a list of fifteen subprocessors with their purposes, all located in the United States, from Amazon Web Services for hosting to OpenAI and Anthropic for model inference. The agreement commits to notifying the customer within seventy two hours of confirming a security incident involving data subject to Regulation S-P, with written detail of its scope, preserved forensic evidence and reports fit for a regulatory examination. Third party penetration testing runs at least once a year, and the incident response plan is offered through the trust center on request.

All client data is stored in the United States, though a limited number of Red Oak and vendor personnel may reach it from abroad to provide the service. Either party must report a security breach involving client data or confidential information within seventy two hours of confirming it. Records sit in WORM storage, administrators set retention by communication type, and access runs through single sign on and role based permissions. After the agreement ends, Red Oak may keep client data under its internal retention and compliance policies or as the law requires. The client may export its data free for thirty days, and a charge applies after that, and no express duty to delete client data is stated. The legal center lists a subprocessor list by contracting company and a data processing addendum; outside those two documents, no subprocessor is named and no encryption standard is published. Security and data handling detail is pointed to a trust center hosted on MirrorWeb's domain.

A real published position, and the exposure the product creates sits outside it. The Master Services Agreement, effective January 1, 2026, carries a mutual indemnity with stated scope and a defined procedure. Hadrius defends claims that the software behind its services infringes third party intellectual property, subject to six exclusions such as customer inputs, modifications and combinations with other products. The customer defends claims arising from its own use of the services and its inputs. Liability is capped at the fees paid or payable in the twelve months before the claim, lost profits and consequential, indirect, punitive and special damages are excluded both ways, and indemnities sit outside the cap. Hadrius warrants professional and workmanlike service by qualified personnel and commercially reasonable efforts to keep out malicious code, and otherwise provides the service as is. What is expressly excluded is the loss a compliance officer would fear most. Hadrius is not liable for regulatory enforcement actions, fines or sanctions imposed on the customer or its staff, and disclaims liability for penalties arising from reliance on automated outputs without independent review. No insurance is referenced. Disputes go to arbitration in New York under Delaware law.

A real published position, and it leaves the AI's errors with the customer. The master services agreement has Red Oak defend third party claims that the services as it provides them infringe a copyright, trademark, trade secret or patent. Exclusions cover client data, use outside the agreement and combinations with other products, and Red Oak may modify the service or end the subscription and refund prepaid fees. That indemnity is the client's exclusive remedy for infringement. Red Oak warrants that the services contain the functionality described in its documentation, and the remedy is repair, reperformance or a pro rata refund. Liability is capped at the fees paid or payable in the twelve months before the first event, with indirect, consequential, punitive, special, lost data and lost profit damages excluded, and the cap applies to every claim, the indemnity included. For the AI, Red Oak disclaims all liability arising from the client's use of or reliance on AI outputs, and the client is solely responsible for reviewing and validating them. No insurance is referenced. Disputes go to arbitration in Delaware under Delaware law.

The systems this work lives in are named, and the setup is written down in a help center an administrator can follow. Microsoft 365 email is captured by a journal rule in Microsoft Purview that sends a copy of every message sent or received by everyone in the organization to the firm's Hadrius journaling address. Where a relay such as Proofpoint, Mimecast or Barracuda sits in the mail path, the guide adds a mail flow connector in Exchange and gives its settings. Employees connect LinkedIn direct messages by signing in to LinkedIn from inside Hadrius. Claude Enterprise feeds every employee prompt and response, with the sender, time and conversation, through Claude's read only Compliance API, and ChatGPT is archived as well. Each of these flows runs into Hadrius, into the archive and the review queues. The agreement names the customer systems it expects to connect, Gmail and Microsoft Exchange, Slack, WhatsApp, LinkedIn and Telegram, and Plaid for brokerage feeds, and it binds Hadrius to Google's user data policy for data from Google Workspace. The subprocessor list adds SnapTrade, MX, Vezgo and BridgeFT for account surveillance and capture services for iMessage, SMS, RCS, Discord and Zoom, and filing support connects to FINRA Gateway. The agreement is frank that third party integrations are a convenience, that continued availability is not guaranteed and that Hadrius is not liable for data gaps arising from them, and it puts permissions and access settings on the customer.

Named connections, described by what they move, short of setup detail. Review records file directly to FINRA's AREF system from the workflow, and comment letters are retrieved and stored with them. A FINRA API carries registrations, licenses and CRD records, and FINRA charges separately for that access. A disclosure API sends approved disclosure language out, and Seismic, Adobe Workfront and Adobe Experience Manager exchange approved content, disclosures, submissions and review markups with the platform. Capture covers more than thirty channels, each provisioned in about a minute. Email from Microsoft 365, Exchange and Google Workspace arrives by journal copy with full body and attachments, Bloomberg chats and mail by a daily file through the firm's SFTP, ICE Chat and Symphony every twelve hours, WhatsApp by phone enrollment, and social accounts by enrollment. Teams, Slack Enterprise Grid, Zoom, iMessage, LinkedIn, X, Facebook, Instagram, TikTok, YouTube and generative AI tools are captured too. What is missing is depth for an implementer. No setup guide or developer documentation is published, and nothing states what a firm configures for each connection.

Hadrius runs as a cloud service on Amazon Web Services, and its subprocessor list places AWS and every other subprocessor in the United States. That country is the residency detail published. Nothing states the AWS region, offers a residency choice for a firm with obligations outside the United States, or separates where data is stored from where models process it, beyond the same list naming OpenAI and Anthropic, also in the United States, for inference. Nothing published states how customers are separated from one another, with no tenancy model and no single tenant or private option. The separation that is published sits inside an account rather than between accounts, in the workspaces offered to compliance consultants so they can run several client firms from one login, and in information barriers set at user, branch and organization level. The agreement's export control clause bars access from embargoed countries.

The storage country is stated, and the rest of the deployment picture is not. The master services agreement says all client data will be stored in the United States, and that a limited number of Red Oak and vendor personnel may access it from outside the United States to provide the services. The service is delivered as a cloud subscription. Nothing names the cloud provider or region, describes the tenancy model, or offers single tenant, private or on premises options. Nothing separates where the AI processes content from where records are stored. No residency choice is offered for firms outside the United States, although the combined company now has an office in Manchester and its privacy policy covers transfers between its affiliates.

Standards are named, a trust center exists, and the evidence sits behind a request. Hadrius says it is SOC 2 Type II compliant, with its security, availability and confidentiality controls independently audited, and every page carries ISO 27001, AICPA SOC and GDPR marks. The trust center at trust.hadrius.com lists SOC 2, ISO 27001, GDPR and CCPA. It offers the SOC 2 Type II report, the information security policy, the continuity and disaster recovery plan, the incident response plan and a penetration test, each through an access request. No audit period, auditor or ISO certificate scope is published, and nothing says whether the documents are released before a contract. Third party penetration testing runs at least once a year alongside continuous vulnerability assessment, and systems are monitored around the clock.

No independent security attestation is named on Red Oak's own pages. Red Oak points buyers to a trust center hosted on MirrorWeb's domain for access, security and data handling, and its product pages describe single sign on, role based access and WORM storage for every record. The agreement commits to breach notice within seventy two hours and to storing client data in the United States, and the privacy policy describes physical, electronic and procedural safeguards meeting federal and state standards. None of that is a third party's examination. No SOC 2 report, ISO 27001 certificate, audit period, auditor or penetration test is named on any Red Oak page or in its product terms. A chief information security officer, Phil Clegg, is named among the leadership.

The providers are named, and the commitments stop there. Hadrius's published subprocessor list names OpenAI and Anthropic for model inference, both located in the United States, alongside Reducto for processing marketing documents, and the privacy policy names OpenAI among the AI providers behind certain features. The privacy policy also says those providers' agreements prohibit them from using customer data for their own training, and Hadrius says the models never store or retain client data. What is not published is which model or version runs which module, the region where inference happens, or any commitment to tell customers when a provider or model changes, and the agreement carries no clause on notice of subprocessor changes. Claude also appears in a second role. A July 2026 integration with Claude's Compliance API pulls employee prompts and responses out of Claude Enterprise into the archive, alongside existing ChatGPT archiving, which makes those platforms sources of records to supervise rather than the engine doing the supervising.

The AI is described, and the models underneath are not identified. Red Oak's pages describe AI Review and Mira by what they do, and the agreement defines its AI functionality to include large language models, but no provider, model family or version is named. Nothing says where inference runs, and no commitment is made to tell customers when a model changes. ChatGPT and Claude appear only as tools whose employee use Red Oak captures for supervision, not as the engines behind its own features. The agreement forbids clients from trying to reconstruct the architecture, weights, parameters or training data of any model used in the services, which confirms the models are there without saying whose they are.

The shape is visible and the number is not. Six modules are sold as separate solutions, the testing program, marketing, people oversight, communications, account surveillance and branches, and Hadrius says two thirds of its customers use three or more of them. The agreement names the billing structure. Fees are set in an order form, invoices fall due within thirty days, and past due balances carry the lesser of 1.5 percent a month or the legal maximum. Order terms renew automatically for successive twelve month periods unless either side gives thirty days' notice, and fees can be raised for a renewal term on thirty days' notice. The inspection clause names the unit in passing. The customer keeps records of user counts and module usage, Hadrius may audit them once a year, and the customer pays the audit costs if fees were underpaid by more than 5 percent. No rate, band, minimum or implementation figure is published, there is no pricing page, and the route to a price is a demo request that asks for firm size in four bands.

The structure and units are published in the terms, and no figure is. Red Oak's product terms set the compliance platform fee by the assets under management of the client's own customers, and count usage in books and records units, one consumed per submission, with attachments able to add more. A client that exceeds its tier moves up automatically and is billed the full difference without proration, for up to two tiers, before usage is billed at current prices. The distribution platform is priced by total firm assets and content record tier and invoiced annually in advance. FINRA charges separately for its own API. The master services agreement treats the order form quantities as a minimum annual commitment billed in advance, measures usage monthly and invoices overages quarterly. Unit rates rise by 5 percent on each anniversary, and terms renew for a year at a time unless either side gives sixty days' notice. No rate, tier boundary or implementation fee is published, and there is no pricing page, so the route to a number is a demo request.

Four buyer segments, each tied to the rules it answers to, and no statement of where the product stops. Broker dealers get supervision under FINRA Rules 3110, 3120 and 3130 with write once retention and evidence for the chief executive's annual certification. RIAs get SEC Rule 206(4)-7 put into practice, with program testing, annual reviews and Marketing Rule workflows. Private funds get personal trading surveillance against restricted lists and blackout windows with Code of Ethics attestations and conflict tracking. Compliance consultants get workspaces that hold several client firms under one login, with standard evidence packs across them. The customer stories show the range in practice, from Twenty Five Capital, a two adviser RIA, to Csenge Advisory Group, an RIA aggregator overseeing 28 firms across nearly 40 custodians, and on to BBVA and M1 Finance. Firm size bands on the demo form run from 1 to 50 up to more than 5,000. What is absent is the boundary. Nothing says which regimes are out of scope, and a firm with banking, insurance or obligations outside the United States is left to infer.

Segments and the rules behind them are named, and the boundary is not. Red Oak sells to small and mid sized firms and to enterprises across broker dealers, registered investment advisers, asset managers, wealth platforms and the distributors that share approved content with them. It says 37 of the top 40 global asset managers use it among more than 1,550 regulated firms. The rules named run from SEC Rule 17a-4 for broker dealers and Advisers Act Rule 204-2 for advisers to FINRA filing through AREF and registrations through the FINRA API. Use cases cover books and records, off channel communications, exam readiness, and investigations and regulatory requests. Partners include consultants, implementation partners and more than 300 wealth and investment firms connected through 4U. What is absent is the boundary. Nothing states which regimes or firm types the platform does not serve, and coverage of rules outside the United States is not described, despite the Manchester office.