Hadrius vs Red Marker: how they compare in 2026
These two meet a piece of marketing at different moments. Hadrius holds the approval and its record for firms answering to the SEC and FINRA. Red Marker reaches further out, into the author's draft and onto live websites, with a sequential approval route in between. Hadrius checks text, images, audio and video for missing disclosures, routes each piece to an approver and keeps every version write once for an examination. Its marketing module sits beside communications supervision and trade surveillance in one system. Red Marker, owned by IntelligenceBank since 2024, scans drafts inside Word, PowerPoint, Figma and Google Docs, and RiskGPT offers new wording for a flagged sentence. Its rule libraries reach MiFID II, SFDR and ESMA as well as FINRA and SEC rules, and it hosts in the United States, Australia or Europe. Hadrius keeps every subprocessor in the United States. The terms differ on training. Hadrius's agreement bars it on communications data, while Red Marker's lets deidentified customer data improve accuracy. A US adviser or broker dealer that wants approvals and records in one place should start with Hadrius. A firm whose risk sits in drafts, partner websites and markets abroad should start with Red Marker.
Which one fits
Choose Hadrius if
- You are registered with the SEC or FINRA and want each approved piece, with every earlier version, kept write once and ready to export for an examination.
- Video, audio and image ads need checking for missing disclosures alongside written copy, in the same queue that routes each piece to an approver.
- Advisers' social posts and messages, captured from Microsoft 365, LinkedIn and more than thirty other channels, should sit in the same system as your marketing review.
- You want the agreement to bar AI training on your communications data and to give you notice before a court or agency order forces disclosure of your information.
- You want proof from firms like yours, such as Arrived's tenfold cut in weekly marketing review time, or Csenge Advisory Group's report that SEC examiners asked nothing about marketing approved through Hadrius.
Choose Red Marker if
- Your writers draft in Word, PowerPoint, Figma or Google Docs and should see risk flags there before anything reaches compliance.
- Marketers want replacement wording for a flagged sentence that they can insert or regenerate, with RiskGPT sending only that sentence to OpenAI's API.
- Dealer, partner or affiliate websites carry your products, and you need them scanned on a schedule, as Golden Charter does across more than 800 partner domains.
- You market in the UK or Europe as well as the United States, and need rule libraries for MiFID II, SFDR and ESMA beside FINRA Rule 2210 and SEC Rule 206(4)-1, with hosting in London, Sydney or Northern Virginia.
- Brand checks for logos, imagery, colors and tone belong in the same review, and you prefer implementation folded into an annual license.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the proposition, and the vendor argues the point itself: if AI is generating the communications, the marketing and the trades, only AI can review them at the same scale. Hadrius calls its six modules agentic, and every module's described value is a machine determination. Marketing review reads text, images, audio and video against the firm's rules and required disclosures and routes each piece for approval. Communications supervision classifies, screens and ranks messages from more than thirty channels with severity scoring. The vendor puts the cut in false positives against legacy tools at 90 percent or more on its solution pages and at 99 percent on its home page. Account surveillance tests employee and firm trading against restricted lists, blackout windows and pre clearance rules and escalates what matters. The testing program, attestations and branch examinations sit around those determinations as workflow. Strip the models out and what remains is an archive and a task tracker, which is what the platform is sold against. The agreement calls the same thing by its plainer name, describing AI generated compliance outputs, automated approvals and recommendations.
Machine learning identifies risky language and images within marketing assets, while RiskGPT generates alternative wording for selected passages. Natural language processing, optical character recognition and sentence embeddings work alongside customer specific logic and rule libraries. Brand checks added in May 2026 apply image classification and logo detection to logos, imagery, colors and tone of voice. The service also scans websites and produces reports about regulatory and brand concerns. Users can route content through sequential approvals and follow its review status. Those workflow and rule management functions have value independent of generated wording. AI drives the interpretation and revision of content within a broader compliance platform that also provides conventional controls, reporting and structured coordination between marketing and legal teams.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Outcome figures are published in quantity, and none of them measures whether the determinations are right. Hadrius claims a cut in false positives of 90 percent or more, put at 99 percent on its home page, a 96 percent cut in time spent on communications supervision, a tenfold cut in marketing review cycle time and 19 or more hours regained each week per user. It also claims a $3,900 average annual cost reduction per representative, and more than 1,000 firms holding over $10 trillion in assets. Customer stories add Republic's 60 percent cut in daily compliance time and Frec's halved review time. None of these figures carries a sample, a baseline or a method. Nothing addresses the failure that matters most in supervision, the violation the system does not flag. The agreement is more candid than the marketing. It says the services use artificial intelligence that is inherently not error free, that outputs are informational only, that Hadrius makes no warranty on their accuracy, completeness or reliability, and that the customer must verify every AI output before relying on it.
RiskGPT generates proposed replacements for content that Red Marker's detection models have flagged. The vendor acknowledges that natural language generation is probabilistic and allows users to request a different suggestion. That warning does not quantify error rates or identify a test set for legal accuracy. Rule libraries name relevant regulatory provisions, but the output description does not promise an openable primary source for every suggested correction or test subsequent legal treatment. Reviewers receive contextual risk feedback and retain responsibility for approval. No independently reproducible evaluation establishes the frequency of unsupported regulatory assertions, missed issues or incorrect replacement language in this workflow.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The review point is stated, and the thresholds belong to the customer. Hadrius describes a system of record that runs compliance operations under human oversight, and its marketing module tells reviewers that they stay in control of decisions. The agreement makes that enforceable. AI outputs, automated approvals and recommendations are informational only, the customer must verify them independently before relying on them, and the vendor disclaims liability for regulatory penalties arising from reliance on automated outputs without review by qualified compliance staff. Escalation and routing are described, with severity scoring that ranks messages, trades and marketing so reviewers clear supervisory queues in priority order. Two gaps remain. The controls are the customer's to set. The firm configures surveillance rules, alert thresholds, restricted securities lists and retention periods, and the vendor does not warrant that any configuration meets the firm's regulatory obligations. And automated approvals are mentioned without any published description of what may be approved without a person, or of what happens when an item the system cleared later proves wrong.
RiskGPT is enabled by customer choice and leaves each proposed change under user control. A marketer can insert the suggestion, reject it or request another version before sending content for compliance review. The separate Approvals function routes an asset to named individuals or teams in sequence and displays its current stage. Contract terms require trained legal or compliance professionals to check and approve content before publication. These controls establish review responsibility and visible intervention points. The service does not publish a confidence threshold that stops processing, a mandatory automated escalation rule or a defined recovery process after a mistaken compliance conclusion.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Named firms, named officers and dated figures, short of a method. Five customers are quoted on the home page through the person accountable for the program: Tealee Hinger, Chief Compliance Officer at M1 Finance; Robert Spake, Chief Compliance Officer at Republic Capital; Michael Schmidtke, Chief Compliance Officer at Csenge Advisory Group; Laurie Williams, Deputy Chief Compliance Officer at SmartAsset; and Raymond Gettins, Director at United Advisor Group. Nine dated customer stories follow, and several carry figures. Republic reported a 60 percent cut in daily compliance time and Frec halved its review time, both in November 2023, and Arrived cut weekly marketing review time tenfold. In July 2026, Csenge described one compliance officer overseeing about 70 advisers across 28 firms, and SEC examiners asking no questions about marketing approved through Hadrius. Twenty Five Capital, an RIA its two advisers launched with NextReg, spends about an hour a month on compliance. The Series A announcement names BBVA, Altruist, Allworth Financial and World Investment Advisors as customers, and the home page claims more than 1,000 firms with over $10 trillion in assets. What is missing is the method. No figure carries a baseline, a period or a way of measuring it.
Angle Auto Finance describes combining Red Marker with IntelligenceBank's repository and workflow platform for a network of more than 800 dealerships and other partners. Its November 2024 account reports a 30 day deployment, two minute asset reviews and 45 internal and external users. Dealers submit advertising for diagnostic feedback before final approval, while websites receive monthly light scans and quarterly deep scans. Named customer staff describe the process and its benefits. Golden Charter, a UK financial services firm that works through independent funeral directors, described in September 2024 how it checks every page of more than 800 partner domains against FCA financial promotion rules. It reports more than 12,000 web pages scanned and the equivalent of 52 working weeks saved each year. Red Marker's own pages also claim reviews up to 30 times faster than manual review. None of these figures carries a comparable baseline or a reproducible calculation. The Angle account also does not isolate the contribution of Red Marker from the combined platform.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive written commitments, readable before signing, with privilege the part left unaddressed. The Master Services Agreement carries mutual confidentiality limited to people who need access, deletion of the other party's information after the agreement ends, subject to record keeping law, and a compelled disclosure clause requiring reasonable prior notice so the other party can contest the order. The customer keeps ownership of its inputs and is assigned the outputs. Inputs and outputs are used solely to provide the services, comply with law, enforce the agreement and prevent abuse. The agreement also bars Hadrius from using, aggregating or anonymizing any inputs or outputs derived from the customer's communications data for AI model training. The privacy policy says Hadrius processes customer data solely at the direction of its business customers as controllers, and that its AI providers' agreements prohibit them from training on customer data. A data processing agreement is incorporated by reference and available on request. Two things are left open. The training bar is worded for communications data, so other inputs rest on the purpose limit alone, and nothing addresses privilege or work product.
The customer retains ownership of uploaded data, and both parties undertake confidentiality obligations covering employees, agents and subcontractors. Third party model training is prohibited, while a separate clause permits deidentified customer data to improve service accuracy. Purchased custom models require consent and must benefit the particular customer's use. The service also prohibits storage of personally sensitive information, including financial identifiers and health records. It is therefore not presented as a repository for unrestricted client confidences. Attorney client privilege, legal work product and matter level retrieval barriers are not directly treated, and conditional provider retention language does not promise universal zero retention.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The advice line is drawn in the agreement, in terms, and it names the professional who has to do the checking. The Master Services Agreement states that AI generated compliance outputs, automated approvals and recommendations are provided for informational purposes only and do not constitute legal, regulatory or professional compliance advice. The customer must independently verify all AI generated outputs before relying on them and assumes sole responsibility for decisions based on them. Hadrius disclaims liability for regulatory penalties arising from reliance on automated outputs without independent review by qualified compliance personnel. A separate clause states that the service is designed to assist with SEC and FINRA compliance but does not guarantee compliance, and that the customer remains solely responsible for all compliance obligations, regulatory filings and supervisory decisions. Configuration is handled the same way. Hadrius gives implementation assistance and does not warrant that any configuration satisfies the firm's regulatory obligations. Who the product is for, what it is not, and whose judgment governs are each stated.
The contract expressly treats the service as a business tool for competent personnel and denies that it supplies legal or regulatory advice, opinions or signoff. Trained compliance or legal professionals must still check and approve material before it is published. Product guidance allows marketers and content creators to use the tool without a legal qualification, with expert reviewers responsible for final decisions. The intended professional boundary and a supervision requirement are therefore set. It does not map lawyer competence or client consent duties to named jurisdictions, or describe separate disclosures for consumers receiving generated guidance. The principal use remains internal marketing compliance review.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
A governance posture is stated, and no mechanism sits behind it. The vendor says the platform runs compliance operations under human oversight, that the AI follows each firm's compliance manual, and that the models behind it never store or retain client data. The agreement adds that artificial intelligence is inherently not error free. Hadrius also runs webinars for compliance officers on what AI can and cannot do in compliance work, which educate buyers rather than describe its own models. Nobody inside the company is named as accountable for the models, nothing is published about what is tested before a change ships, and nothing says whether output differs across channels, languages, firm types or the people an adviser communicates with. The trust center offers an information security policy, a continuity plan and an incident response plan on request, and none is described as covering model testing or bias. On a product whose headline claim is its false positive rate, no testing regime behind that number is published.
Red Marker acknowledges variability in generated suggestions and keeps acceptance of AI output with the customer. Rule configuration is tailored with implementation staff and optimized through continuing support. Its security engineering principles concern software and infrastructure protection, while claims of more objective review concern the consistency of compliance feedback. A separate AI governance framework does not identify release approval criteria, an accountable model risk owner or test results for uneven performance across languages and industries. The May 2026 expansion into Spanish, French, Italian and German is not accompanied by comparative reliability measurements. Customer supervision and customization are visible, but a vendor model assurance process remains unspecified.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention, deletion, access, subprocessors and incident handling are each published, and each is specific enough to hold the vendor to. Retention is the customer's to set. The agreement makes the firm configure retention periods to its regulatory requirements, the privacy policy says customer data is kept on the customer's instructions, and records are archived write once to the 17a-4 standard. At the AI layer, Hadrius says its models never store or retain client data and that data is permanently deleted once processed. When the agreement ends, each party deletes the other's information, subject to record keeping law. Access is controlled by role, with single sign on through WorkOS, multi factor authentication and information barriers at user, branch and organization level, and data is encrypted in transit and at rest with AES-256. Hadrius publishes a list of fifteen subprocessors with their purposes, all located in the United States, from Amazon Web Services for hosting to OpenAI and Anthropic for model inference. The agreement commits to notifying the customer within seventy two hours of confirming a security incident involving data subject to Regulation S-P, with written detail of its scope, preserved forensic evidence and reports fit for a regulatory examination. Third party penetration testing runs at least once a year, and the incident response plan is offered through the trust center on request.
Encryption, customer controlled accounts, backups and restoration commitments govern service data. The privacy policy promises notice of a confirmed personal data breach within 24 hours and distinguishes account records, aggregated usage and uploaded service content. Paid service data remains for at least 30 days after the last transaction, subject to audit or legal needs; active prompt and output lifetimes are not fixed. Terms name several model providers, but the wider service provider inventory largely identifies functions instead of companies. Some optional tools process information in other regions. These policies describe operational safeguards without a complete subprocessor inventory or a universal deletion schedule.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
A real published position, and the exposure the product creates sits outside it. The Master Services Agreement, effective January 1, 2026, carries a mutual indemnity with stated scope and a defined procedure. Hadrius defends claims that the software behind its services infringes third party intellectual property, subject to six exclusions such as customer inputs, modifications and combinations with other products. The customer defends claims arising from its own use of the services and its inputs. Liability is capped at the fees paid or payable in the twelve months before the claim, lost profits and consequential, indirect, punitive and special damages are excluded both ways, and indemnities sit outside the cap. Hadrius warrants professional and workmanlike service by qualified personnel and commercially reasonable efforts to keep out malicious code, and otherwise provides the service as is. What is expressly excluded is the loss a compliance officer would fear most. Hadrius is not liable for regulatory enforcement actions, fines or sanctions imposed on the customer or its staff, and disclaims liability for penalties arising from reliance on automated outputs without independent review. No insurance is referenced. Disputes go to arbitration in New York under Delaware law.
IntelligenceBank promises material conformity to agreed service specifications, supplies response and restoration targets and indemnifies customers for specified intellectual property infringement and unlawful acts. Aggregate liability is generally capped at payments made during the relevant 12 month period, with consequential losses excluded. Technology professional indemnity, cyber and other insurance categories are identified without policy limits. A customer terminating for an unremedied qualifying breach can receive unused prepaid fees under the stated procedure. These are contractual remedies, but the terms expressly disclaim responsibility for detecting every legal breach and do not warrant the accuracy of individual compliance suggestions or generated replacements.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The systems this work lives in are named, and the setup is written down in a help center an administrator can follow. Microsoft 365 email is captured by a journal rule in Microsoft Purview that sends a copy of every message sent or received by everyone in the organization to the firm's Hadrius journaling address. Where a relay such as Proofpoint, Mimecast or Barracuda sits in the mail path, the guide adds a mail flow connector in Exchange and gives its settings. Employees connect LinkedIn direct messages by signing in to LinkedIn from inside Hadrius. Claude Enterprise feeds every employee prompt and response, with the sender, time and conversation, through Claude's read only Compliance API, and ChatGPT is archived as well. Each of these flows runs into Hadrius, into the archive and the review queues. The agreement names the customer systems it expects to connect, Gmail and Microsoft Exchange, Slack, WhatsApp, LinkedIn and Telegram, and Plaid for brokerage feeds, and it binds Hadrius to Google's user data policy for data from Google Workspace. The subprocessor list adds SnapTrade, MX, Vezgo and BridgeFT for account surveillance and capture services for iMessage, SMS, RCS, Discord and Zoom, and filing support connects to FINRA Gateway. The agreement is frank that third party integrations are a convenience, that continued availability is not guaranteed and that Hadrius is not liable for data gaps arising from them, and it puts permissions and access settings on the customer.
Word and PowerPoint integrations let authors invoke a scan and receive contextual compliance findings while creating material. The privacy notices explain that authorized document content is extracted, analyzed and returned as annotations. RiskGPT then displays suggested changes in the application or office add in, where a user can insert a revision or request another. This specifies the input, returned result and user's control over writing back to the original asset. Plug ins for Figma and Google Docs bring the same checks to designs and shared drafts. Asana tasks receive an annotated PDF of the review, Aprimo and bethebrand are listed as connections, and Adobe Workfront and Monday.com come through technology partners. A browser extension for Chrome and Edge checks open pages, dropped files and highlighted text, and an open API, email in and single sign on complete the list. The public integration list separately marks Jira, Red Oak, Seismic and Veeva connections as forthcoming or proposed. Those planned links do not carry the same operational status as the described authoring integrations.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Hadrius runs as a cloud service on Amazon Web Services, and its subprocessor list places AWS and every other subprocessor in the United States. That country is the residency detail published. Nothing states the AWS region, offers a residency choice for a firm with obligations outside the United States, or separates where data is stored from where models process it, beyond the same list naming OpenAI and Anthropic, also in the United States, for inference. Nothing published states how customers are separated from one another, with no tenancy model and no single tenant or private option. The separation that is published sits inside an account rather than between accounts, in the workspaces offered to compliance consultants so they can run several client firms from one login, and in information barriers set at user, branch and organization level. The agreement's export control clause bars access from embargoed countries.
The service uses regional cloud hosting, with Red Marker customers assigned to United States, Australian or European infrastructure. Its FAQ identifies AWS regions in Northern Virginia, Sydney and London, with disaster recovery locations in Oregon, Tokyo and Ireland respectively. Advanced AI rules use private models in named regional markets, and a model outside the customer's data geography requires prior consent. Some separately purchased IntelligenceBank services have their own processing locations. No complete processing route is mapped for every RiskGPT operation, model version and subscription option. Storage regions and conditional model geography are clearer than the full feature level residency matrix.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Standards are named, a trust center exists, and the evidence sits behind a request. Hadrius says it is SOC 2 Type II compliant, with its security, availability and confidentiality controls independently audited, and every page carries ISO 27001, AICPA SOC and GDPR marks. The trust center at trust.hadrius.com lists SOC 2, ISO 27001, GDPR and CCPA. It offers the SOC 2 Type II report, the information security policy, the continuity and disaster recovery plan, the incident response plan and a penetration test, each through an access request. No audit period, auditor or ISO certificate scope is published, and nothing says whether the documents are released before a contract. Third party penetration testing runs at least once a year alongside continuous vulnerability assessment, and systems are monitored around the clock.
Red Marker states that it is ISO 27001:2013 certified and describes secure engineering, authentication and infrastructure protections. Its security portal shows ISO 27001 and statement of applicability marks alongside a FIPS 140-2 logo. The portal lists a penetration test report, a security prospectus, a network diagram, the product architecture, cyber insurance and core security policies, offered through a request for sensitive information. The common service agreement also specifies annual external penetration testing and an ISAE 3402 or SOC 2 compliance audit, with topline results available to customers on request. Hosting provider compliance is identified separately, and the portal names AWS as the host. No certificate scope, audit period or assessor is published. The assurance standards are therefore named, but how far they reach across Red Marker's AI components is unclear.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The providers are named, and the commitments stop there. Hadrius's published subprocessor list names OpenAI and Anthropic for model inference, both located in the United States, alongside Reducto for processing marketing documents, and the privacy policy names OpenAI among the AI providers behind certain features. The privacy policy also says those providers' agreements prohibit them from using customer data for their own training, and Hadrius says the models never store or retain client data. What is not published is which model or version runs which module, the region where inference happens, or any commitment to tell customers when a provider or model changes, and the agreement carries no clause on notice of subprocessor changes. Claude also appears in a second role. A July 2026 integration with Claude's Compliance API pulls employee prompts and responses out of Claude Enterprise into the archive, alongside existing ChatGPT archiving, which makes those platforms sources of records to supervise rather than the engine doing the supervising.
RiskGPT's FAQ identifies OpenAI's GPT 3.5 family and explains that selected risky sentences and instructions are sent through the API, rather than the entire asset. The RiskGPT product page describes the feature as GPT 3 together with proprietary models, so the two pages do not agree on the version. The wider agreement names Microsoft Azure, OpenAI, AWS Bedrock and Google for third party AI capabilities, with private regional processing and consent for exceptional geographic changes. It also permits purchased custom models under customer consent. These disclosures identify providers and part of the architecture, while the model version behind each current feature is left open. The general right to substitute service components does not provide a specific commitment to notify customers of every model or provider replacement.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The shape is visible and the number is not. Six modules are sold as separate solutions, the testing program, marketing, people oversight, communications, account surveillance and branches, and Hadrius says two thirds of its customers use three or more of them. The agreement names the billing structure. Fees are set in an order form, invoices fall due within thirty days, and past due balances carry the lesser of 1.5 percent a month or the legal maximum. Order terms renew automatically for successive twelve month periods unless either side gives thirty days' notice, and fees can be raised for a renewal term on thirty days' notice. The inspection clause names the unit in passing. The customer keeps records of user counts and module usage, Hadrius may audit them once a year, and the customer pays the audit costs if fees were underpaid by more than 5 percent. No rate, band, minimum or implementation figure is published, there is no pricing page, and the route to a price is a demo request that asks for firm size in four bands.
Document Scanning and Web Reports are separately described commercial offerings with private quotes. Document Scanning includes configurable risk detection, API integration, ongoing training and support, a dedicated client success manager and rule library modules that can be bought separately or packaged together. Web Reports supplies monthly reports for selected sites, delivered as CSV or PDF files. The agreement invoices access fees annually in advance and permits upgrades for additional users, data allowances, modules and features. It does not publish a rate, a definite charge per scan or rule, or a standard allowance attached to a named price. Implementation is included in the annual license, and custom configuration is scoped with the customer. A request for pricing now goes to IntelligenceBank's site, where a named specialist replies within one business day. The product split is visible, while actual pricing and the selected charging units depend on the order.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Four buyer segments, each tied to the rules it answers to, and no statement of where the product stops. Broker dealers get supervision under FINRA Rules 3110, 3120 and 3130 with write once retention and evidence for the chief executive's annual certification. RIAs get SEC Rule 206(4)-7 put into practice, with program testing, annual reviews and Marketing Rule workflows. Private funds get personal trading surveillance against restricted lists and blackout windows with Code of Ethics attestations and conflict tracking. Compliance consultants get workspaces that hold several client firms under one login, with standard evidence packs across them. The customer stories show the range in practice, from Twenty Five Capital, a two adviser RIA, to Csenge Advisory Group, an RIA aggregator overseeing 28 firms across nearly 40 custodians, and on to BBVA and M1 Finance. Firm size bands on the demo form run from 1 to 50 up to more than 5,000. What is absent is the boundary. Nothing says which regimes are out of scope, and a firm with banking, insurance or obligations outside the United States is left to infer.
Red Marker serves legal, compliance and marketing teams in regulated enterprises. Named sectors include financial services, insurance, healthcare, pharmaceuticals, telecommunications, automotive and food businesses. Rule library modules cover FINRA Rule 2210, SEC Rules 206(4)-1 and 482, Regulation Z, MiFID II, SFDR and ESMA requirements, with FCA and CFPB guidance built into the foundational modules. Organizations can add their own brand standards and risk logic. The product checks drafts before publication and reviews owned or partner websites afterward, with authoring tools and structured approvals supporting both legal and marketing users. Since May 2026, reviews also run in Spanish, French, Italian and German, applying the same custom rules used for English content. A complete jurisdiction and language exclusion list is not supplied, and the service is not described as general legal research or client matter management.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The agreement names AI model training and bars it on communications data. Its purpose limit comes first. Hadrius uses a customer's inputs and outputs solely to provide the services, comply with law, enforce the agreement and prevent abuse. It then states that Hadrius shall not use, aggregate, anonymize or otherwise process any inputs or outputs derived from the customer's communications data for AI model training, so aggregation or anonymization opens no route to training on that material.
Usage data about how the service is used may support product improvement and is disclosed only in aggregated or anonymized form, and that right never names training. The prohibition is worded for communications data, so other inputs, such as trade and account data, rest on the purpose limit. The privacy policy adds that Hadrius's AI providers, OpenAI among them, are contractually barred from training on customer data.
Its separate line on improving AI models with aggregated or anonymized personal data covers data Hadrius collects itself, and it states that customer data is governed by the customer agreements.
The agreement's accuracy improvement license permits use of deidentified customer data without restricting that permission to a named technical method. Separate provisions prohibit training third party models and require customer consent for purchased models tailored to that customer's use. Those narrower protections do not expressly remove the broader service improvement license for the vendor's own systems. RiskGPT's policy also excludes OpenAI API training.
The permission recorded here concerns the residual contractual improvement right; it does not mean that third party training is allowed or that customer specific model training occurs automatically.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Two retention regimes run side by side, and the customer controls the one that holds the record. At the AI layer the commitment is zero. Hadrius says its models never store or retain client data and that data is permanently deleted once processed. At the record layer the product exists to keep things, because the firm is required to. The agreement makes the customer configure retention periods to its regulatory requirements, and the communications module offers customizable retention on a write once archive.
The privacy policy says customer data is kept in line with customer instructions, with periods governed by the data processing agreement and the customer agreement. No setting to keep nothing is offered for the archived record, and no period is stated for review outputs held inside the platform.
Paid service content is kept for at least 30 days after the last customer transaction, with auditing and legal exceptions. Account data and anonymized aggregated usage may remain indefinitely, while other contact records have separate periods. The contract also describes nightly database backups retained for 30 days and customer download options before expiry. These are backup and exit arrangements, not a fixed active lifetime for every prompt and output. Advanced models use zero day retention only where available, so that phrase is not a universal no storage policy.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Separation is documented at the level this product needs it, between client firms inside one account and between parts of a firm. Compliance consultants are sold workspaces that hold several client firms under one login, to deliver reviews, testing and evidence packs across them. The branches module carries the same structure inside a single firm, managing branch examinations, the personnel org chart, questionnaires and remediations as separate units.
Access is controlled by role, with single sign on and multi factor authentication, and Hadrius lists information barriers with controls at user, branch and organization level. The agreement puts the configuration of those permissions on the customer, and the audit trail records who reviewed, escalated, approved and remediated what. How an information barrier is enforced when the AI reads across a workspace is not described, which matters most in the consultant setup, where one reviewer may serve competing advisers.
Customers administer authorized user access and can provide a customer success manager with a support license. Approvals can be directed to specified teams or individuals, and the agreement defines a dedicated customer platform with its own settings and data allowance. These arrangements describe account administration and workflow participation. They do not explain whether model retrieval checks permissions on each query, inherits a source system's access rules or separates individual client matters inside an organization. A reviewer assignment is not itself a restriction on what information an AI component can retrieve.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The commitment is in the agreement, and it is aimed at letting the customer fight. The confidentiality section allows a party to disclose the other's information under a judicial or governmental order only with reasonable prior notice, so the other party can contest the order. The clause is mutual, puts notice before disclosure rather than after, and states the contest as its purpose. The privacy policy says the same in plainer words.
Hadrius does not voluntarily give customer data to government agencies outside valid legal process, and where legally permitted it notifies affected business customers before disclosing their data. A related clause has Hadrius cooperate with the customer's own regulatory examinations by providing documentation and staff, with the customer reimbursing costs beyond eight hours a year. No transparency report is published.
The privacy policy allows disclosure without consent when legal process requires it, including court orders, subpoenas and tax investigations. Its promise to notify applies only where notice is possible and appropriate. That qualification leaves a discretionary judgment beyond a simple prohibition imposed by law. The confidentiality clause separately permits disclosure required by law or securities exchange rules, without adding an unconditional customer notice obligation.
No published transparency report explains how often requests occur or how disputed demands have been handled for customers.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The rules are named, and where the rule content comes from is not. Published coverage runs to the SEC Marketing Rule and Rule 206(4)-7, ADV Part 2B, FINRA Rules 3110, 3120 and 3130, Rule 17a-4 and write once retention, Regulation S-P, and the Code of Ethics and personal trading rules for an adviser's employees. The other source is the customer's own policy, described as policy as code and configured to each firm's compliance manual, with the firm responsible for setting its own surveillance rules, thresholds and restricted lists.
Nothing states who writes or maintains the regulatory rule content, how quickly a rule change reaches the platform, or on what basis any source is used. No third party regulatory content provider is named, so the analysis is the vendor's own.
Rule library modules name FINRA Rule 2210, SEC Rule 206(4)-1, SEC Rule 482, Regulation Z under the Truth in Lending Act, MiFID II, SFDR and ESMA requirements. FCA and CFPB guidance is built into the foundational modules. Customers add internal requirements and custom risk rules for their content. The checks therefore name the legal standards they apply, though not a complete set of source publications, a licensing or public domain basis for each text, or a stated update delay across the collection.
Customer configured logic and generated replacement language also remain distinct from an open library of authoritative legal materials with documented provenance.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Hadrius cites no authority a reader could open, so there is nothing for a treatment signal to rest on. Its output is a determination about a piece of marketing, a communication or a trade, together with an audit trail, rather than a proposition of law with a citation behind it. The rules it applies are named in the marketing, from FINRA Rules 3110, 3120 and 3130 to SEC Rule 206(4)-7, but nothing published describes how the platform keeps current with them.
Nothing says who monitors SEC or FINRA rule changes, how long a change takes to reach the review logic, or whether a firm is told when a rule it relies on has moved. For a product sold on being ready for an examination, that currency question is the nearest analog to a treatment signal, and it is unanswered.
The service detects problematic claims, missing disclaimers and other advertising risks against configured requirements. No commercial citator or proprietary method for reviewing the later treatment of judicial authority is described. Website rescanning and rule maintenance can address changing content, but neither establishes that an opinion cited in a legal explanation remains valid. The RiskGPT process rewrites selected risky sentences rather than presenting a described legal history analysis.
Human legal review is required before publication, without a separate product function that verifies subsequent case treatment.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Uncertainty is expressed as risk ranking, and what the system does when it cannot tell is not described. The published behavior is triage. The AI classifies, screens and prioritizes trades, communications and marketing with severity scoring, so reviewers clear supervisory queues in order, and Hadrius claims a cut in false positives of 90 percent or more. That is a confidence signal applied to workload rather than to knowledge.
Nothing published describes an abstention, a threshold below which the system declines to decide, or what a reviewer sees when the model has no basis for a judgment as distinct from a low risk one. The agreement approaches the same ground from the other side. It requires the customer to verify every AI output independently before relying on it and disclaims liability where automated outputs are relied on without review by qualified compliance personnel.
RiskGPT warns that probabilistic generation can return varying suggestions and offers another attempt when a user dislikes the result. It does not describe an explicit refusal when a compliant rewrite lacks support, a confidence cutoff or a no answer response for an unresolved legal question. The user can decline a suggestion and send material to compliance, but that is human intervention rather than model abstention.
The published workflow therefore explains revision and review controls without establishing what the AI returns when it cannot justify a proposed correction.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database kept by Damien Charlotin holds no entry naming Hadrius or Quantbase. Hadrius asserts no law and cites no authority, so an invented citation is not the exposure here. The failure that would matter is a communication or an advertisement that cleared automated review and later drew an SEC or FINRA finding, or a trade pattern the surveillance did not escalate. This covers fabricated citations only and is not a litigation history.
The current AI Hallucination Cases database has no matching entry for Red Marker, RiskGPT or IntelligenceBank concerning fabricated legal citations as of October 16, 2026. Red Marker is used primarily for marketing compliance analysis and suggested changes to advertising content. Its own terms still require trained professionals to approve material and disclaim detection of every legal breach. Absence of a matching court record does not validate each compliance finding or generated sentence. It concerns fabricated citations specifically and carries no conclusion about the product's overall reliability.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Professional obligation is referred to as such, and no rule, opinion or bar is named. The Master Services Agreement states that AI generated compliance outputs, automated approvals and recommendations are informational only and do not constitute legal, regulatory or professional compliance advice, and that reliance without independent review by qualified compliance personnel is the customer's own risk. A second clause puts supervisory decisions and all compliance obligations squarely on the customer.
That engages the duty in general terms. What Hadrius names in abundance is regulation binding the firm rather than guidance binding a practitioner, from the SEC Marketing Rule and Rule 206(4)-7 to FINRA Rules 3110, 3120 and 3130, Rule 17a-4 and Regulation S-P. None of that is bar or ethics guidance. No rule of professional conduct, ethics opinion or bar publication appears, and nothing engages the guidance on lawyers' use of generative AI.
The service contract requires trained legal or compliance professionals to check material before publication and treats the software as a tool used with competent business judgment. These statements engage with supervision and responsibility in general terms. The vendor does not map the product to a named lawyer ethics opinion or specify how client consent and competence obligations differ among jurisdictions. A general FAQ quotation defining law technology does not supply that mapping.
Regulatory advertising rules in the rule libraries address content standards, rather than the professional conduct duties of a lawyer using AI.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
No lawyer's fee sits in this product's path. The buyer is the regulated firm itself, or a compliance consultant serving several such firms, and the subscription is an operating cost the firm carries rather than anything billed to an advisory client. The vendor's economic case is internal efficiency. It claims 19 or more hours regained each week per user and an average annual compliance cost reduction of $3,900 per registered representative, and pitches consultants on scaling oversight rather than headcount.
Those are savings claims about the firm's own costs. Nothing here bears on what a client is told about work done with AI or how it is billed, because no client bill is involved. The disclosure duties the product does engage run to regulators rather than clients.
Marketing and compliance departments buy Red Marker to reduce their own content review effort and coordinate approval inside an enterprise. Advertised time savings concern that internal process, including work by marketing teams and reviewers. The service is not described as producing legal invoices, measuring outside counsel fees or turning reduced hours into a client charge. Its software subscription is paid by the organization using the workflow.
The Angle Auto Finance example concerns dealer advertising and operational capacity, with no outside lawyer to client billing relationship specified in the deployment.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor list names the model providers that see customer content. Hadrius publishes fifteen subprocessors on its trust center with their purposes, all in the United States. OpenAI and Anthropic run model inference, Amazon Web Services hosts the platform, Reducto processes marketing documents, and the rest capture messages or feed account data. The privacy policy links to the same list and says the AI providers are contractually barred from training on customer data.
The agreement adds terms a reviewer can cite. It commits to notice within seventy two hours of a security incident involving Regulation S-P data, with written scope, forensic preservation and reports ready for an examination, and to cooperation with the customer's own regulatory examinations. The SOC 2 Type II report, the penetration test and the security policies sit behind an access request, and the data processing agreement is available on request. No client facing disclosure or consent pack is published.
The service agreement names Microsoft Azure, OpenAI, AWS Bedrock and Google for AI capabilities, and describes other optional services involving Zapier or processing in particular AWS regions. The RiskGPT FAQ adds a named model family and the limited sentence content sent to its API. That supplies a public model provider list, although it does not map all providers to each subscription or offer a complete inventory of support vendors. No standard client consent letter or outside counsel disclosure package comes with them.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The record is built for an examiner rather than a court, and read that way it is substantial but incomplete. Every review, escalation, approval and remediation is timestamped into an immutable audit trail, and communications and marketing are archived write once. Hadrius offers one click exam exports that compile an examination package in seconds, and account surveillance exports audit trails ready for an examiner. The agreement commits Hadrius to cooperate with the customer's regulatory examinations by providing documentation and making staff available.
Csenge Advisory Group says SEC examiners asked no questions about marketing it approved through Hadrius. What is missing is the disclosure question itself. Nothing distinguishes a determination the AI made from one a reviewer made once both sit in the trail, and nothing describes an export that discloses machine involvement.
Approval status identifies where an asset sits in a sequence of reviewers, and the common service agreement provides for returning workflow history and database records as CSV files when applicable. Web Reports can also deliver findings in CSV or PDF form. These artifacts can help explain compliance review to a regulator or examiner. They do not form a described export combining the exact model, retrieved legal sources and human verification for every generated passage. The available operational history therefore covers part of the review account without a complete AI disclosure record.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
In summary
Hadrius
Hadrius is an AI compliance platform for SEC and FINRA registrants, built by a New York company founded in 2023 that has raised $27 million. Its marketing module checks text, images, audio and video for missing disclosures and potential issues, routes each piece to approval and keeps an immutable version history under write once retention. The same system supervises messages from more than thirty channels, surveils personal trading and runs testing and branch examinations, so advertising shares one audit trail with the rest of the program. Customers include Republic Capital, Altruist, Allworth Financial and Arrived, which cut weekly marketing review time tenfold. The AI Legal Index walks through an agreement that calls every AI output informational, requires qualified compliance staff to verify it and names SEC and FINRA compliance as the purpose of the service. The main caveat for a firm marketing outside the United States is that Hadrius names no other regime and hosts only in the United States, and no price is published.
Red Marker
Red Marker is a marketing compliance checker founded in Australia in 2013 and owned by IntelligenceBank since 2024, which also sells it as IntelligenceBank Marketing Compliance. Legal, compliance and marketing teams in financial services, insurance, healthcare and other regulated industries use it to scan drafts against configured rules in Word, PowerPoint, Figma, Google Docs or a Chrome and Edge extension. RiskGPT, switched on by choice, proposes replacement wording for a flagged sentence, and Web Reports checks owned and partner websites each month. Golden Charter uses it across more than 800 partner domains and reports the equivalent of 52 working weeks saved a year. As set out in the AI Legal Index, Red Marker's terms forbid storing personally sensitive data such as financial identifiers and health records, so it is not a place for client account details. The main caveat is in those terms, which let Red Marker use deidentified customer data to improve accuracy and promise notice of a legal demand only where that is possible and appropriate.
Questions buyers ask
How does Red Marker compare to Hadrius for reviewing financial marketing before it goes out?
Red Marker checks a draft where it is written, in Word, PowerPoint, Figma or Google Docs, against rule libraries such as FINRA Rule 2210, the SEC Marketing Rule, MiFID II and SFDR, and RiskGPT suggests compliant wording for a flagged sentence. Hadrius takes a submitted piece into a review queue, flags missing disclosures in text, images, audio and video, routes it to an approver and keeps each version write once for an SEC or FINRA examination. Red Marker also scans live owned and partner websites, while Hadrius adds communications supervision and trade surveillance in the same system. In both, a qualified person makes the final call before anything is published. From the AI Legal Index, based on each vendor's own published materials as of November 5, 2026. No vendor pays for placement.
How much do Hadrius and Red Marker cost?
Neither Hadrius nor Red Marker publishes a price, and both quote after a demo or consultation. Hadrius sells six modules separately under an order form, tracks user counts and module usage for billing, and renews for twelve months unless either side gives 30 days' notice. Red Marker quotes Document Scanning and Web Reports separately, bills access fees annually in advance with implementation included, and lets customers add users, data allowances and rule library modules during the term. Red Marker's pricing requests now go to IntelligenceBank, where a named specialist replies within one business day. From the AI Legal Index, based on each vendor's own published materials as of November 5, 2026. No vendor pays for placement.
Can marketing uploaded to Hadrius or Red Marker be used to train AI models?
Hadrius's master services agreement bars it from using, aggregating or anonymizing inputs and outputs derived from a customer's communications data for AI model training, and limits other inputs to providing the service. Its privacy policy adds that its AI providers are contractually barred from training on customer data. Red Marker's agreement bars training third party models on customer data and needs consent for a custom model built for one customer. It also lets Red Marker use deidentified customer data to improve the accuracy of its own service. For RiskGPT, Red Marker says OpenAI does not use content sent through its API. From the AI Legal Index, based on each vendor's own published materials as of November 5, 2026. No vendor pays for placement.
Where do Hadrius and Red Marker host data, and what reaches the model provider?
Hadrius runs on Amazon Web Services, and its fifteen subprocessors, including OpenAI and Anthropic for model inference, are all in the United States. Red Marker assigns each customer to AWS in Northern Virginia, Sydney or London, with disaster recovery in Oregon, Tokyo or Ireland, and needs consent before a model runs outside the customer's data region. In the AI Legal Index's write up of RiskGPT, only the flagged sentence and its instructions go to OpenAI's API, never the rest of the document. Hadrius says its models never store client data, and the firm sets how long its archive keeps records, while Red Marker keeps paid service content for at least 30 days after the last transaction. Hadrius states SOC 2 Type II and Red Marker ISO 27001, and both release their security reports on request.
What do Hadrius and Red Marker do with marketing once it is published?
Hadrius keeps the approved piece and every earlier version in a write once archive to the Rule 17a-4 standard, timestamps each review and approval into an audit trail, and builds an examination package through a one click export. Red Marker turns to the live web. Its Web Reports scan owned and partner websites on a regular cadence and send a monthly summary, and its browser extension checks an open page, including staged pages behind a login. Angle Auto Finance runs light scans monthly and deep scans quarterly across its dealer network. Red Marker's approvals show where each asset stands, and its agreement returns workflow history as CSV files. From the AI Legal Index, based on each vendor's own published materials as of November 5, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Neither vendor publishes a price, a tested accuracy rate for its flags, or terms that make it answer for an advertisement a regulator later faults. Hadrius excludes regulatory fines from its liability, and Red Marker disclaims catching every legal breach. On a Hadrius order, the points to settle are the modules and users being priced, whether the training bar covers marketing under review as well as communications, and whether marketing aimed at the UK or Europe can be reviewed against those rules. On a Red Marker order, they are the scanning and reporting allowances, whether the accuracy improvement right can be removed, how long RiskGPT text and approval history are kept, and whether approved pieces can be archived to the SEC's books and records rule.