Hanzo vs Smarsh: how they compare in 2026
Hanzo and Smarsh both preserve and collect collaboration data that ordinary ediscovery tools handle badly, such as Slack, Teams and chat, and both apply AI to narrow it. Hanzo sits in the top two bands on eleven of fifteen axes and Smarsh on ten of fifteen, level on seven, with Hanzo ahead on five and Smarsh on three. Hanzo's lead is about where its AI runs and what it stands behind. It states that Spotlight AI runs on local language models inside the customer's own tenant, explains why each item was flagged, and published a 95 percent recall figure at its 2023 launch. Its IBM Marketplace agreement adds an intellectual property indemnity and $5 million each of general and professional liability insurance. Smarsh leads where AI is central and evidenced in use: its agents drive surveillance and investigation, a commissioned Forrester study reports a 124 percent three year return with its method described, and its terms state plainly that the service does not guarantee legal compliance. Neither vendor's terms say whether client data trains its models.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Artificial intelligence is present and peripheral by the vendor's own construction. The Illuminate page describes Spotlight AI as an optional switch-on element within the platform, and the FAQ describes two core products, Chronicle for website and social preservation and Illuminate for collaboration-data hold, collection and review, that function without it; the vendor's own 2023 account of Spotlight AI's origin describes it as a feature added to a culling and preservation platform whose strength was big-data culling. This is the legacy-platform case the axis is asked to discriminate. Illuminate page, FAQ and 2023 origin post read 6 September 2026.
The models drive the capabilities the vendor now leads with, on a capture and archive platform that works without them, which is the B band. The Intelligent Agent and Noise Reduction Agent filter and detect risk in surveillance, the AI Assistant summarises and translates, and the Discovery Agent produces summaries, timelines and custodian mapping for investigations. Underneath is a capture, retention, legal hold, search and export platform, sold for decades as a recordkeeping system of record under SEC Rule 17a-4, that functions fully without models. Verified 18 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
A measured figure is published and the outputs are explained, short of a described test set and a current republication. The November 2023 launch release states ninety-five per cent recall in identifying documents pertinent to a case, with no test set, method or date of measurement and no republication against the current product located; the FAQ and Spotlight AI page state that results are ranked and tagged so reviewers know why something was flagged, and the vendor's engineering post describes facets written by generative AI that users can adjust and supply examples for, which is documented grounding to the case description. The figure is three years old and the primary-authority limbs do not apply to a review tool. Launch release, FAQ, Spotlight AI page and engineering post read 6 September 2026.
Performance is asserted with figures that carry no method, and grounding is claimed rather than described, which is the C band. The vendor's releases and pages say the Noise Reduction Agent cuts false positives by 60 per cent, review volumes fall by up to 50 per cent, the Intelligent Agent surfaces three to five times more real risk, and the Discovery Agent cuts investigation costs by up to 75 per cent, with no sample, baseline or test described. The innovations FAQ says AI summaries and risk signals rest on traceable source data and are reproducible, but does not describe how a summary links back to the messages it relies on or what happens when the AI misreads a conversation. Verified 18 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The modes, the constraints and the review surface are published, short of the full control structure. Spotlight AI is optional and switched on per matter, it flags anomalies and relevant content for human review with an explanation per flag, and the facets that drive relevancy assessment are generated by the model but can be supplemented, tweaked and clarified with examples by the user, which the vendor describes as giving the user control over first-pass review while computers take the laborious steps; explanations are stated to make every decision defensible. What is not published is the threshold at which content is excluded from review without a person or a stated route back after a wrong relevancy call beyond adjusting the facets. FAQ, Spotlight AI page and engineering post read 6 September 2026.
Automated suppression of surveillance alerts is described without a published human control, which places this at C. The Noise Reduction Agent and Intelligent Agent suppress low-relevance alerts so supervisory teams see fewer, and the vendor describes these as autonomous systems that augment rather than replace human expertise, with audit trails and chain of custody. Nothing published says whether suppressed alerts can be reviewed or are sampled, what threshold governs suppression, or who approves the agent's configuration, which matters because supervisory review of communications is a regulatory duty for the vendor's financial services customers. Discovery Agent output is presented as input to investigators. Verified 18 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Figures without a named customer on the surfaces read. The FAQ states that for some teams first-pass review moved from weeks to hours and that teams using Illuminate with Google Workspace data work up to fifty per cent faster, both unattributed; the vendor states it serves large corporations worldwide and is audited by several enterprise clients, none named. A case studies page exists in the navigation and was not opened, and is the rebuttal route. FAQ and navigation read 6 September 2026.
A commissioned study with a described method and a named customer with figures, neither both at once, which is the B band. Smarsh publishes a Forrester Consulting Total Economic Impact study (September 2024) that interviewed six representatives of financial services firms, built a composite organisation, and risk-adjusted each benefit: 124 per cent ROI over three years, archive costs down 25 per cent, e-discovery time down 65 per cent, and false-positive surveillance alerts down 25 to 45 per cent by interviewee estimate; the interviewees are anonymous and Smarsh chose them. Its customer story for Securities America, a named broker-dealer, reports messages flagged for review falling from 19 to 10 per cent (8,000 a day) in three months, but that 2020 result came from professional services tuning of policy rules, not the current AI agents, and no method is given. The 2026 release figures for the AI agents still carry no method. Verified 18 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive published commitments on segregation, provider exposure and deletion, short of a training statement and of privilege named as such. Third-party model providers: the FAQ and About page state that Spotlight AI runs on local language models with tenant-level deployment so data never leaves the customer's environment, which is the strongest possible answer on provider exposure if accurate. Segregation: the Illuminate page describes controlled access for users, teams and third parties. Retention and deletion: the IBM Marketplace MSA transfers client content on request within thirty days of termination and then deletes it. Confidentiality and legal process: MSA section 4 with prior notice of compelled disclosure. Not located: any statement on training use, since the MSA licenses client content solely to provide the service without naming training and the direct-purchase agreement is unpublished; and any treatment of privilege or work product. FAQ, About page, Illuminate page and IBM Marketplace MSA read 6 September 2026.
Contractual confidentiality is in place while the AI data position is not addressed, which places this at C. The Smarsh Services Agreement treats the client's data as the client's property and confidential information, with notice before compelled disclosure, and licenses Smarsh to use client data to provide support and improve the services on the client's behalf. No published term addresses whether client communications are used to train or adapt the domain-adapted models behind the AI agents, which model providers if any see client data, or privilege and work product in data held for discovery. The innovations FAQ describes AI running inside governed environments with role-based access and chain of custody. Verified 18 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
No advice line or supervision statement was located. The product is sold to corporate legal and compliance teams for preservation, collection and review, the IBM Marketplace MSA places responsibility for determining whether the services are accurate or sufficient on the client, and no surface read states how the AI sits with a supervising lawyer's duties or names a jurisdiction limit. The site's own terms page states it is non-binding and informational. FAQ, MSA and terms page read 6 September 2026.
A clear position that the product is a compliance tool and not legal advice, short of the supervision dimension, which is the B band. The Services Agreement states that Smarsh does not guarantee that use of the services, or its advice or consulting, will ensure the client's legal compliance, and the legal documents page says Smarsh materials are not legal advice and customers must consult an attorney. The audience is compliance, legal and records professionals in regulated firms. Nothing addresses how supervisors or counsel should treat AI-suppressed alerts or AI summaries in meeting their own obligations. Verified 18 September 2026.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Transparency principles are published without a governance framework, testing regime or accountable owner. The vendor states three core philosophies for Spotlight AI, client data security, decision transparency and practicality, and describes prompt-engineering practice and facet design in an engineering post; the FAQ states the company follows NIST standards and the ISO 27001 framework, which is security rather than AI governance. No responsible AI framework, ISO 42001 or equivalent, pre-release testing results or statement about uneven output is published on the surfaces read. Origin post, engineering post and FAQ read 6 September 2026.
Transparency features are described without a governance framework, which places this at C. The innovations FAQ says AI runs within preserved, governed environments with full audit trails, traceable source data, chain of custody and role-based access so outputs are transparent and reproducible, and press coverage quotes the vendor on auditability aligned with regulator expectations. No accountable owner, pre-release testing regime or disclosure of uneven performance across languages or communication styles is published, although the misconduct detection agent is pitched on reading slang, jargon and multilingual exchanges. Smarsh also sells AI governance products to financial firms; under R126 that purpose earns nothing on this row. Verified 18 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy covering most of the ground, with the agreement's scope named. Retention and deletion: IBM Marketplace MSA section 7.3 gives thirty days after termination for transfer of client content in the format set by the offer, then deletion unless legally prohibited. Access control: MSA section 5.4 commits to commercially reasonable security measures against unauthorised access, the Illuminate page describes controlled access, and the FAQ states annual SOC 2 Type 2 audits with a twelve-month evidence period. Incident practice: section 5.4 commits to prompt notification of any breach that may expose unencrypted client confidential information, stating the information at risk, with immediate steps to stop continued access. Sub-processors: no list was located; the vendor states the AI runs inside the customer's tenant. The MSA governs IBM Marketplace purchases and the direct-purchase agreement is unpublished. MSA, FAQ and Illuminate page read 6 September 2026.
The agreement covers retention, deletion, access and part of the subprocessor picture, short of a published incident commitment, which is the B band. The Services Agreement lets the client set retention periods (up to seven years by default in Professional Archive), sets temporary retention of up to 30 days for capture services with deletion after, provides for deletion of client data after termination, and lists subprocessors for mobile capture by name and location; the trust page states encryption in transit and at rest, SSO and MFA, and regular penetration testing. The Information Security Addendum and DPA are available on request and were not read, no incident notification timeline is published, and the agreement's post-termination terms conflict between deletion as soon as practicable and retention for up to six months. Verified 18 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
What the vendor stands behind is published and specific, and it includes insurance, which no other record in this pull states. The IBM Marketplace MSA of June 2023, section 9.1, gives a defence and indemnity for third-party intellectual property claims with listed exclusions and procure, replace or terminate-and-refund remedies; section 6.1 caps each party's liability at fees received in the preceding twelve months and excludes consequential loss, carving out gross negligence, wilful misconduct, breach of confidentiality and the IP indemnity; section 5.2 warrants material conformity with documentation with remedial services, section 5.5 places responsibility for accuracy and sufficiency on the client; and section 10.2 commits Hanzo to maintain five million dollars of commercial general liability and five million dollars of professional liability insurance for the term and two years after, with a certificate on request. The agreement governs purchases through the IBM Marketplace; the agreement for direct purchases is not published and the site's terms page states it is non-binding. IBM Marketplace MSA read in full 6 September 2026.
A detailed published liability position with an indemnity and cap, with nothing on AI output, which is the B band. The Services Agreement gives a vendor indemnity against claims that use of the services infringes a U.S. patent, trademark or copyright, caps Smarsh's liability at fees received in the prior twelve months, provides service-level credits as the remedy for availability failures, and disclaims any guarantee that use of the services ensures legal compliance. No term addresses AI-generated summaries or suppressed alerts, and no insurance position is published. Verified 18 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations with depth described, because the connectors are the product. The vendor describes preserve-in-place for Slack with holds by custodian, channel and timeframe and dynamic synchronisation of new messages, capture of Teams and Google Workspace data with threading, reactions, edits and deletions intact, and a Data Connectors page in the navigation; the 2023 launch states Spotlight AI leverages IBM's watsonx.ai studio. What a customer must configure and any connection to a review platform or document management system are not described on the surfaces read, and the Data Connectors page was not opened. FAQ, Slack guide and 2021 preservation announcement read 6 September 2026.
Broad named connections with some depth described, short of documentation read, which is the B band. The Services Agreement and pages describe capture from email, collaboration, mobile carriers such as Verizon and AT&T, apps such as WhatsApp and Signal, voice, social media, websites and Microsoft 365 Copilot, and the platform offers Audit, Identity and Review Alert APIs and exports to outside counsel tools. Product documentation sits in the Smarsh Central support portal and was not read. Verified 18 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The deployment model for the AI layer is stated clearly and the platform's residency detail is partial. The FAQ and About page state that Spotlight AI runs on local language models with tenant-level deployment inside the customer's environment so data does not leave the perimeter; the platform itself is cloud-hosted with no region, hosting provider or residency election stated on the surfaces read, and the security page was not opened. FAQ, About page and MSA read 6 September 2026.
Hosting model and region are stated per service in the agreement, without the AI processing location, which is the B band. The Services Agreement states that Professional Archive and Web Archive run in a Smarsh-managed environment in the United States, Cloud Capture runs in a multi-tenant AWS environment in the United States, and mobile capture stores data in the United States unless agreed otherwise. Where the AI agents process data, and whether other regions are offered for them, is not stated in the documents read. Verified 18 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real, dated and audited by a named class of auditor, short of a report reachable without asking. The FAQ states SOC 2 Type 2 certification achieved in October 2019 and renewed annually with a twelve-month evidence period, audited by a CPA firm to AICPA standards, alongside adherence to NIST standards and the ISO 27001 framework and audits by enterprise clients; the IBM Marketplace MSA section 5.4 commits to provide the most recent audit report on written request as confidential information. The auditor is not named and no trust centre was located; the security page in the navigation was not opened. FAQ and MSA read 6 September 2026.
Named certifications with a contractual route to the reports, short of evidence read, which is the B band. The trust page shows ISO 27001 certification under ANAB accreditation and third-party SOC audits, and the Services Agreement commits Smarsh to annual independent audits under ISO 27001 or SSAE 18 and to give clients its most recent ISO 27001 and SSAE 18 reports and a penetration test summary as standard audit documentation. The certification scope, auditor and report periods are not stated on any page read. The trust.smarsh.com portal, hosted on Vanta, was opened and returned only its page description, so its contents could not be read. Verified 18 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The supply chain is partly disclosed. The FAQ states Spotlight AI runs on local language models deployed at tenant level inside the customer's environment, which states where inference runs and that no external model provider sees content; the 2023 launch states the solution leverages IBM's data science and machine learning studio, now part of watsonx.ai, which names the platform provider; the engineering post describes generative models writing case facets. No specific model is named and no change-notification commitment is stated. FAQ, launch release and engineering post read 6 September 2026.
Models are referred to without being identified, which is the C band. The vendor describes production-ready AI models for global institutions, press coverage quotes it on domain-adapted large language models built with an in-house team, and its APIs support customers' own models; no model, provider or version is named in the agreement or on the pages read, and nothing commits to notice when the models behind surveillance decisions change. Verified 18 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure are stated in the agreement without the figure. The IBM Marketplace MSA prices by data ingestion, storage or other metrics set in the offer with overage charges above volume limits, on annual subscription periods that auto-renew for the shorter of the prior term or one year with thirty days' notice, with fees increasable annually by the greater of three per cent or CPI, and billing through IBM; no figure, tier or pricing page was located on the vendor's site. MSA read in full 6 September 2026.
The unit and structure are published without the figure, which is the B band. The Services Agreement explains that Professional Archive is licensed per connection (a mailbox, account, phone number or social profile) and Web Archive per domain and per page, with minimum commitments equal to the recurring fees, usage-based overage fees, a renewal uplift capped at ten per cent, and additional fees for retention beyond seven years; the Intelligent Agent was announced as a priced add-on. No price or rate is published and buying runs through sales. Regraded from C on 18 September 2026 under R45: the band text for B names unit and structure without the figure. Verified 18 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment and coverage are described with substance; the boundaries are partly stated. The buyer is corporate legal and compliance, with industry pages for government, healthcare and corporations and use cases for legal hold, investigations, website preservation, ediscovery, early case assessment, DSAR and PCAOB evidence; data coverage is stated as Slack, Teams, Google Workspace, email, websites and social media. The product's scope, dynamic and collaborative data rather than the whole ediscovery estate, is a stated boundary; no jurisdiction or matter type is named as unsupported. Navigation, FAQ and use-case pages read 6 September 2026.
Segments and the regulatory regimes served are described with substance, short of limits on the AI, which is the B band. The vendor serves wealth management, broker-dealers, RIAs and banks, public sector bodies handling FOIA, energy and utilities under FERC, NERC and CFTC oversight, and life sciences, with separate small and mid-sized and enterprise offerings, and names SEC Rule 17a-4 and FINRA supervision among the rules it supports. The agreement sets use limits, such as capturing only employees' communications. Nothing states which languages, channels or misconduct types the AI agents handle less well. Verified 18 September 2026.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The published agreement does not name training either way. The IBM Marketplace MSA licenses client content to Hanzo solely as necessary to provide the subscription service under section 8.2, and section 8.1 permits collection and use of aggregated, anonymized analytics that could not identify the client; a license confined to providing the service does not permit training, but no clause names model training, and the direct-purchase agreement is unpublished.
The FAQ and About page state that Spotlight AI runs on local models inside the customer's tenant, which addresses where data goes rather than whether it trains. Surfaces checked 6 September 2026.
The published Services Agreement grants a use right over client data bounded to support and improvement of the services, and never names training. Section 4.2 licenses Smarsh to access and use client data as necessary to provide support and improve the services on the client's behalf. No published term addresses whether client communications train or adapt the models behind Smarsh's AI agents.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
A specific period is published for the agreement's channel. IBM Marketplace MSA section 7.3 provides that on request within thirty days of termination Hanzo transfers client content in the format and process set by the offer, and after that period deletes all client data in its possession unless legally prohibited; section 7.3 also requires return or destruction of confidential information. Nothing states a configurable window for AI facets, tags or outputs during the term, and the direct-purchase agreement is unpublished. Surfaces checked 6 September 2026.
The client sets retention. The Services Agreement retains archived data for client-set periods (up to seven years by default, longer for a fee), keeps capture data for a client-configured temporary period of up to 30 days before deletion, and provides for deletion after termination, though one section says as soon as practicable and another allows up to six months. Retention of AI summaries and prompts is not addressed separately.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Segregation is claimed without documentation of a permission model. The Illuminate page states controlled access for users, teams and third parties such as outside counsel, and the FAQ states that Spotlight AI is deployed at tenant level inside the customer's environment, which separates one customer from another; nothing describes matter-level walls within a tenant or how the relevancy engine respects them. Surfaces checked 6 September 2026.
Role-based access is described without published detail on separating matters or investigations. The agreement lets clients set user roles with different access levels, and the innovations FAQ refers to role-based access and chain of custody around AI outputs. How access is walled between investigations or legal holds is not documented in the materials read.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The published agreement commits to notice, for its channel. IBM Marketplace MSA section 4.2 permits disclosure of confidential information required by law, legal process or regulation provided the receiving party gives the disclosing party reasonable prior written notice to permit it to contest the disclosure and limits disclosure to what is required; client content is confidential information under section 4.1. The MSA governs IBM Marketplace purchases; the direct-purchase agreement is unpublished and the site's terms page is non-binding. No transparency report is published. Surfaces checked 6 September 2026.
The Services Agreement commits to reasonable notice before compelled disclosure of confidential information, including client data, where feasible and legally permitted, so the client can contest the order, and to cooperate at the client's expense.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies a legal corpus behind the product's output, and the product is not built on one: Spotlight AI assesses relevancy across the customer's own collected collaboration data against facets generated from the case description, citing no law. FAQ and engineering post checked 6 September 2026.
Searched the innovations and trust pages and the Services Agreement on 18 September 2026. The AI works over the client's own captured communications; no external legal corpus is described.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history, and the product does not retrieve or cite primary law; its output is preserved collaboration data and relevancy assessments. Recorded as the honest value for a product without a citator function. Surfaces checked 6 September 2026.
Searched the same surfaces on 18 September 2026. The product does not cite legal authority, so no subsequent-history check arises and none is described.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The product documents how a reviewer can see why an item was flagged rather than what the model does when it cannot decide. The FAQ states results are ranked and tagged with reasons, the Spotlight AI page describes transparent explanations for every decision, and the engineering post describes facets a user can clarify with examples for edge cases; no abstention path or confidence threshold for uncertain relevancy calls is described.
Recorded as documented on the strength of the explanation design, with the abstention gap noted. FAQ, Spotlight AI page and engineering post checked 6 September 2026.
Searched the innovations page and FAQ, the trust page, the Services Agreement and the 2026 press releases on 18 September 2026. No abstention path, confidence score or grounding indicator is described for AI summaries or risk signals; the agents suppress low-relevance alerts rather than flagging uncertain ones.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record naming Hanzo, Illuminate, Chronicle or Spotlight AI was located as of 6 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on the company and product names together with a general search for court findings; results returned the vendor's own launch material and commentary, none of which is a court record naming this product. This is a statement about the public record, not a finding about the product; a preservation and review tool that cites no authority carries a remote exposure on this signal.
Searched the AI Hallucination Cases database maintained by Damien Charlotin and trade press reporting on 18 September 2026 for court records addressing fabricated or hallucinated content in output from Smarsh products. None located. This signal does not record litigation history of any other kind.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material names an ethics opinion, bar rule or professional responsibility framework. The vendor's material addresses defensibility of preservation and review and PCAOB audit evidence, which are procedural standards rather than bar guidance on lawyers' use of AI. FAQ, use-case navigation and MSA checked 6 September 2026.
Searched the same surfaces on 18 September 2026. The vendor names securities regulations such as SEC Rule 17a-4 and FINRA supervision rules, which are regulatory recordkeeping and supervision requirements, but no bar ethics opinion or court rule on AI.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The buyer is an in-house corporate legal or compliance team that bills no client, so the product sits outside a lawyer-to-client fee relationship. The published savings framing is operational, weeks of first-pass review reduced to hours and collection scope reduced; nothing addresses how AI-assisted review is recorded or disclosed on any bill, and no law firm is a named buyer segment. FAQ and Spotlight AI page checked 6 September 2026.
The product is bought by regulated firms for their own compliance and investigations, where no client is billed for the work. Savings are claimed for the buyer's own costs, including reduced outside counsel spend and investigation costs cut by up to 75 percent.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
No sub-processor list or model provider list was located, and the vendor's answer to the model-provider question is that there is none: the FAQ states Spotlight AI runs on local language models deployed inside the customer's tenant so data never leaves the customer's environment, which a firm could forward to a client, and the 2023 launch names IBM's watsonx.ai as the studio the solution leverages. No published register of processors, no DPA on the site, and the direct-purchase agreement is unpublished; the security page was not opened and is the rebuttal route. Surfaces checked 6 September 2026.
Searched the Services Agreement, trust page and legal documents index on 18 September 2026. The agreement lists subprocessors for mobile capture only (TeleMessage, Microsoft Azure, AWS and CallCabinet entities); no AI or model provider is named, and the DPA and Information Security Addendum are available on request rather than published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of a disclosure record are available and no export of an AI-use record is described. The Spotlight AI page states that every relevancy decision carries a transparent explanation so it is defensible, and the platform captures collaboration data in a format the vendor states holds up to legal scrutiny with edits and deletions intact; nothing states that a record of the model used, the facets applied and the human verification can be exported for a court. Spotlight AI page and FAQ checked 6 September 2026.
Some elements of a defensible record exist, short of an AI disclosure record. The vendor describes chain of custody, full audit trails, traceable source data and reproducible AI outputs, and the archive supports legal holds and exports. Nothing records which model produced a summary or risk signal, or who reviewed it.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
- Bar Guidance Alignment
- Outside Counsel Guideline Readiness
Which one fits
Choose Hanzo if
- Your collaboration data cannot be sent to an outside AI provider. Hanzo states that Spotlight AI runs on local language models deployed at tenant level inside your environment, and it is switched on per matter, so review AI is optional and stays inside your perimeter.
- You need Slack, Teams and Google Workspace preserved as conversations, not flattened exports. Hanzo's Illuminate preserves Slack in place with holds by custodian, channel and timeframe, keeps threading, reactions, edits and deletions intact, and captures messages posted after a hold is set.
- You want the vendor insured against getting it wrong. Hanzo's IBM Marketplace agreement commits it to carry $5 million of commercial general liability and $5 million of professional liability insurance for the term and two years after, alongside an intellectual property indemnity and a twelve month liability cap with carve outs.
Choose Smarsh if
- You need one archive for every channel your regulated staff use. Smarsh captures email, instant messaging, collaboration tools, voice, social media and mobile messaging from carriers and apps including WhatsApp and Signal into a retained archive built for SEC Rule 17a-4 and FINRA supervision.
- You want an outcome study with a method, not only a claim. Smarsh publishes a Forrester Total Economic Impact study from September 2024, built from interviews with six financial services firms and risk adjusted, reporting a 124 percent return over three years and discovery time down 65 percent.
- Your investigators work across languages. Smarsh's AI Assistant summarizes and translates communications, and its Discovery Agent builds summaries, timelines and custodian maps for legal investigations so less material has to be exported to outside counsel.
In summary
Hanzo
Hanzo is an ediscovery and preservation platform for dynamic and collaborative data, sold to corporate legal and compliance teams by Hanzo Archives, Inc., with its North American headquarters in Portland, Oregon. Chronicle preserves websites and social media, and Illuminate handles legal hold, collection and review across Slack, Microsoft Teams, Google Workspace and email. Spotlight AI, an optional layer, ranks and tags content by relevance with an explanation for each flag and runs on local language models inside the customer's tenant. The AI Legal Index grades it in the top two bands on eleven of fifteen capability axes, with an A on liability and recourse. As of 6 September 2026 the index located no training statement, no subprocessor list and no published agreement for direct purchases.
Smarsh
Smarsh Inc. of Portland, Oregon sells communications capture, archiving, surveillance and discovery to regulated organizations, mainly financial services firms, and also to public sector bodies, energy and utilities and life sciences companies. It retains email, messaging, collaboration, mobile, voice and social content for recordkeeping rules such as SEC Rule 17a-4. Its AI agents filter surveillance alerts, detect misconduct in context across languages, and summarize and map evidence for investigations. The AI Legal Index grades it in the top two bands on ten of fifteen capability axes. Its Services Agreement licenses per connection, lets clients set retention and states that the service does not guarantee legal compliance. As of 18 September 2026 the index located no training position for client data, no named model and no incident notification timeline.
Questions buyers ask
Hanzo vs Smarsh: which is better for Slack and Teams discovery?
The grid puts them one axis apart: Hanzo sits in the top two bands on eleven of fifteen AI Legal Index capability axes and Smarsh on ten of fifteen. Hanzo is built for preserving and reviewing collaboration data in place for legal holds, with AI that runs inside the customer's tenant. Smarsh is a broader archive for regulated firms, capturing every channel for recordkeeping and supervision, with AI centered on surveillance. The choice turns on whether the need is litigation holds or regulatory supervision.
Where does Hanzo's Spotlight AI run?
Hanzo states that Spotlight AI runs on local language models deployed at tenant level inside the customer's environment, so data never leaves it, and its 2023 launch said the solution leverages IBM's data science studio, now part of watsonx.ai. No specific model is named and no commitment to notify customers of model changes is published. Smarsh names no model or provider behind its AI agents. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
What does Smarsh publish about its contract terms?
Smarsh publishes its Services Agreement. It licenses Professional Archive per connection, lets clients set retention periods up to seven years by default, commits to notice before compelled disclosure, gives an intellectual property indemnity, caps liability at the prior twelve months of fees, and states that the services do not guarantee legal compliance. It lists subprocessors only for mobile capture, and its data processing addendum is available on request. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
Does Hanzo publish accuracy figures for its AI?
One figure. Hanzo's November 2023 launch release states 95 percent recall in identifying documents pertinent to a case, with no test set, method or later measurement published. Its product pages state that results are ranked and tagged with the reason each item was flagged, and users can refine the case facets that drive relevancy with examples. Smarsh publishes figures such as 60 percent fewer false positives from its agents, also without a method. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
What do Hanzo and Smarsh both leave unpublished?
Whether client data trains their models: neither publishes a term naming training either way. Neither describes a governance framework or testing for its AI, or says what its AI does when it cannot judge relevance or risk with confidence. Neither documents walls between matters inside one customer account, engages with bar guidance for lawyers relying on its output, or offers a record showing which items a model flagged and who reviewed them. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
Two readings to weigh. Hanzo's published master services agreement governs purchases through the IBM Marketplace; the agreement for direct purchases is not published, so its liability, notice and deletion terms are confirmed for that channel only. Its 95 percent recall figure dates from the 2023 launch and has no published test set or later measurement. Smarsh's Forrester study was commissioned by Smarsh, its interviewees were chosen by Smarsh and are anonymous, and its figures describe the platform rather than the newer AI agents. Hanzo was verified on 6 September 2026 and Smarsh on 18 September 2026. Neither vendor reviewed this page.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything above comes from public material on the dates shown. How the index grades.