iCONECT vs Nextpoint: how they compare in 2026

Machine learning runs core review and breach response work on a document review platform that would still function without it. iCONECT's eDiscovery product is built around processing, an Elasticsearch index, deduplication, redaction and production. The models sit in several core capabilities: continuous active learning through Sentio technology; Oversight, which the vendor says is included in standard eDiscovery licensing and finds false negatives and false positives in reviewer tagging; AI email threading; and AI assisted identification and extraction of personal information in the cyber data mining product, where users can send documents to a model of their choice. Generative AI features listed on the eDiscovery and law firm pages add document summaries, classification by content or legal relevance, entity redaction, image description, transcription and translation. The vendor describes itself as a data intelligence AI platform, and in August 2026 announced an integration with eDiscovery AI that is still under development. Without the models, a full review and production system remains.

Nextpoint's AI is real and peripheral. The main eDiscovery product page does not mention AI, machine learning or technology assisted review. Every feature it names is deterministic or classic text processing: deduplication, email threading, near duplicate detection, OCR, hit reports, coding, Bates stamping, production and privilege log templates, and pattern based auto redaction. Privilege review is done by people, and the log is generated from their coding. The AI consists of result ranking on models Nextpoint hosts and AI Transcript Summaries on Amazon's managed foundation model service. Without it, what customers pay for remains: unlimited data hosting at a flat per user rate from discovery through trial.

The Oversight post of 17 May 2024 says the tool reaches a level of precision once thought unattainable and helps teams rectify discrepancies, with no recall, precision, elusion or validation figures and no test set. The cyber data mining page says each extracted data element is linked through audit trails to its original source file, creating a defensible chain of custody, which lets a reviewer trace a notification entry back to the document. How the generative features are grounded is not described: whether a document summary cites passages, how classification by legal relevance is validated, or how automatic privilege redaction is confirmed. No error rate or statement on invented content is published.

Nextpoint is honest about accuracy and does not measure it. Its trust page says every AI feature is tested extensively before release, and that summaries and results are starting points to trust but verify. No accuracy figure, test set, recall or precision statistic, error rate or evaluation is published behind the testing claim. Nothing says whether a transcript summary links back to the passages it rests on, which a reader would need to verify it, though the transcript itself is already in the customer's hands.

The Oversight post of 17 May 2024 says a subject matter expert, attorney or experienced reviewer seeds a model with as few as fifty documents, and that Oversight reports tagging errors for the team to correct. The cyber data mining page lets a team define its criteria so that verification, whether manual or automatic, fits its needs, and says GenAI reviews are used where appropriate. The eDiscovery page says redaction, including of an entire document because of privilege, can happen automatically, and that document classification sorts documents by legal relevance automatically, with no review step described for either. Nothing states what the generative features may not be used for, when a person must check their output, or what happens when a classification or redaction is wrong. For the generative features, review is a setting the customer chooses.

Nextpoint says a person should review AI output and does not say where that happens. Its position is that the AI speeds review rather than replacing judgment, and that generated summaries are starting points to trust but verify. That is a caution, not a control. Nothing on the eDiscovery platform page, the trust and security page or the pricing page, or in the terms of use, describes what happens when a transcript does not support a summary. No confidence indicator, declining threshold, correction route or in product review step is described. The platform does have tamper resistant per document activity logs and six permission levels, but nothing published ties them to the AI.

Releases on iCONECT's site record that ProFile Discovery selected the platform for its law firm and corporate legal department environments (26 January 2021) and that Everest Discovery launched a cyber breach response service built on it (27 January 2025), with a quote from Everest's owner and president; other releases name Pictera Solutions, Right Discovery and Iota Analytics as customers. The Why iCONECT page names NASA and the FDIC among users. The law firm page presents seven large matters, among them the Vioxx, Yasmin and Pradaxa litigation, Oracle v. SAP and the Columbia investigation, without naming the firm, iCONECT's role or a result. No case study with a measured result is published on the site.

Nextpoint claims more than 600 law firms and legal teams and names many of them, including McDermott, Foley & Mansfield, Jackson Walker, Seyfarth Shaw, Simmons Hanly Conroy, Clyde & Co, Williams Kastner, Yates Construction and Augusta University. Eight testimonials carry a name, job title and firm. One gives figures: a litigation support services manager at Foley & Mansfield describes migrating 180 databases, running close to 250, and much shorter training time than on the firm's previous platform. What is missing is a measured outcome. The claims of up to 50 percent lower cost and review time cut in half are not tied to any customer, and no testimonial is dated. A case studies library is also published.

The only legal documents on the site are a terms of use (31 July 2024) and a privacy policy (June 2024), both written for the website. No customer agreement, data processing addendum or statement on training with customer documents is published. The eDiscovery and law firm pages cite SOC 2 certification, rigorous data protection and handling protocols and controlled access, and the SOC 2 Type 2 report on the SaaS platform covers the confidentiality criterion. The cyber data mining page lets users send documents to a model of their choice, including models from OpenAI, Microsoft and Google, and nothing published states what those providers may keep or use. The platform can be deployed on premises, which keeps documents in a firm's own environment, but nothing addresses privilege handling, segregation between matters, or what happens to documents sent to a model.

Nextpoint's commitments on confidentiality and training sit outside its contract. Its trust page says AI runs entirely inside its Amazon environment, case data never trains any model, and inputs and outputs are never shared with or kept by an outside model provider. The terms of use describe the service as a platform for privileged data and work product, confirm the customer owns its content, and limit Nextpoint's use to providing the service, with no license to improve products. Separation is documented: six permission levels down to the document, mandatory multi factor authentication, single sign on, limited staff access with approvals, and confidentiality agreements. What is missing: the training commitment is a website FAQ, not a contract term, the terms have no AI clause, no retention period is stated for prompts or output, and the master services agreement is not published.

The terms of use say information on iCONECT's pages is distributed on the understanding that the authors are not rendering legal, accounting or other professional advice. That sentence governs website content, not the review platform. The product classifies documents by legal relevance, redacts for privilege and summarizes documents for law firms, corporations, public sector organizations and service providers, and nothing published states that its output is not legal judgment, that a supervising lawyer must review it, or how it fits a lawyer's competence and supervision duties. No ethics opinion or court decision on technology assisted review is named.

Nothing published addresses the advice line. The eDiscovery platform page, the pricing page, the trust and security page and the terms of use (updated June 2026) do not say that output is not legal advice, whether an attorney client relationship arises, or who is responsible for a summary a lawyer relies on. No bar authority, including ABA Formal Opinion 512, and no jurisdiction limit is named. The terms deny that information from the service is accurate or reliable, which allocates risk rather than drawing the line. Nextpoint does say its AI speeds review rather than replacing judgment and that output should be verified, a supervision statement without a disclaimer. The platform advises on nothing, though transcript summaries are work a lawyer acts on.

The platform page and a post of 10 May 2024 describe iCONECT's path as a responsible adoption of generative AI that enhances the platform without compromising data integrity or security. No person is named as accountable for model behavior, and no testing before release, evaluation results or principles are published. The SOC 2 Type 2 report covers information security controls and not the conduct of the models. Nothing addresses uneven output across languages and document types in classification by legal relevance or personal information identification. Users choosing between models from OpenAI, Microsoft and Google for personal information identification are not told how iCONECT evaluated them.

Nextpoint publishes an AI governance position with a real mechanism, and says nothing about bias. Its trust page answers five AI questions: whether case data trains models, where documents are processed, how this differs from a consumer chatbot, whether output can be trusted, and which compliance framework covers the AI. The answer to the last is that AI features sit inside Nextpoint's SOC 2 Type II scope and its annual IT risk assessment, so model behavior is inside an audited scope. An ungated document, Security, Compliance, Privacy and AI at Nextpoint, sets out its AI principles and safeguards. What is missing: no accountable owner is named, the stated testing before release has no published result, and nothing addresses bias or uneven output across custodians, document types or languages.

The eDiscovery and law firm pages cite SOC 2 certification, regular security training and penetration testing, workstation and server security, data protection and handling protocols and controlled access, and the platform page cites encryption, access controls, regular security audits and adherence to GDPR and HIPAA standards. The SOC 2 Type 2 audit of the SaaS platform, completed on 22 September 2025 by A-LIGN, covers security, availability, processing integrity, confidentiality and privacy. The cyber data mining page says ingestion, extraction, review and modification actions are logged with audit trails. The privacy policy (June 2024) covers the website and not data processed in the platform. No retention period, deletion commitment, breach notice timing, subprocessor list or statement on what model providers keep when documents are sent to them is published.

Nextpoint publishes detailed, current practice across most of the ground. Access control is strongest: six permission levels down to the document, mandatory multi factor authentication, single sign on through Okta or Azure AD, IP restricted AWS access with lockout, and staff access limited to a subset of employees with approvals and prompt revocation. Customers can export at any time, deletion follows a Data Archive Form, and retired media are wiped to DoD 5220.22-M or NIST 800-88 or destroyed. The incident process covers daily log review, notice to affected users as soon as possible without harming the investigation, cooperation duties, and the customer's sole right to decide onward breach notice. A public status page reports incidents. Staff get background checks and annual training, and storage is redundant with eleven nines of stated durability. What is missing: no subprocessor list beyond Amazon, no retention period during the term, and no breach notice deadline.

No customer agreement, license terms or SaaS terms are published. The terms of use (31 July 2024, California law) disclaim liability for direct, indirect, special, incidental or consequential damages arising from the website and its content; they do not govern the software. No indemnity, warranty, cap or allocation of risk is published for missed documents, wrong classifications, failed redactions or errors in personal data extraction, on a product used to decide what is produced to an opposing party and who is notified after a breach.

Liability is handled by a standard limitation package, and nothing runs toward the customer. The terms of use (updated June 2026) cap liability at fees paid in the twelve months before the event, exclude indirect and consequential damages including lost data, and set a one year limit to bring claims, under Illinois law with venue in Chicago. The service is provided as is, with no promise that information from it, a generated summary included, is accurate or reliable. The customer releases Nextpoint, with a California Civil Code 1542 waiver, and indemnifies it; there is no vendor indemnity. What is missing: no carve outs from the cap, no warranty on output, no insurance position and no AI term. The Subscription Agreement and Master Services Agreement the terms refer to are not published.

iCONECT's release of 10 June 2021 says its Ligl integration, available then, lets organizations identify, hold, preserve and collect enterprise documents in Ligl, process and cull them, and push relevant documents to iCONECT for review. The cyber data mining page lets users send selected documents to a model of their choice, including models from OpenAI, Microsoft and Google. The partners page shows Microsoft, Nuix, LexisNexis, Sentio, Opus 2 and Heureka Software as technology partners, as logos without descriptions, alongside more than 25 hosting partners. An integration with eDiscovery AI was announced on 24 August 2026 as under development, with availability to follow. The platform page says iCONECT integrates with the most common applications in its three markets, without naming them. Nothing describes connections to a firm's document management, matter management or litigation support systems, and no integration documentation is public.

Nextpoint names working connections and what they do. Evidence can be pulled from OneDrive, Dropbox and Google Drive without manual export. Single sign on runs through Okta or Azure Active Directory, with custom SSO through Client Success, and multi factor authentication is mandatory. No connector to iManage or NetDocuments, matter management, electronic billing, court filing, Word or Outlook is listed. An API exists, mentioned only as an invitation to discuss custom integrations, with no public documentation.

The eDiscovery page offers on premises, hybrid, cloud and SaaS deployment. The post of 19 July 2024 on system architecture describes in house deployment, cloud deployment on Microsoft Azure, Google Cloud, AWS or other providers, and hosting through iCONECT's network of legal service providers. The release of 23 August 2023 launching iCONECT SaaS says it runs on Microsoft Azure. A firm can therefore keep the platform and its documents on its own infrastructure. Not stated are where iCONECT's SaaS stores or processes data, which regions are available, and whether SaaS customers are separated at the tenant level. Nor is it stated where documents go when they are sent to a model from OpenAI, Microsoft or Google for personal information identification, or whether the generative features work in an on premises deployment.

Nextpoint describes its infrastructure in detail and does not address residency. It runs on Amazon Web Services, with redundant storage across facilities, eleven nines of stated durability, checksums, survival of two facility losses, Virtual Private Cloud isolation, CloudWatch monitoring and IP restricted staff access. Its own office holds client data in a keyed office in a keyed building, with server access by password over a VPN. What is missing: no region, residency option or tenancy model is stated, and nothing separates where data is stored from where AI runs, beyond AI running in the same Amazon environment. GovCloud appears once, about Amazon's physical controls, not as an option. The Advanced plan's custom account headquarters feature is not defined.

iCONECT's release of 29 September 2025 says A-LIGN completed a SOC 2 Type 2 audit of its SaaS platform on 22 September 2025 covering security, availability, processing integrity, confidentiality and privacy, and the home page carries an A-LIGN badge. No audit period is stated, no trust center is published, and the report is offered neither for download nor on request. The eDiscovery and law firm pages add regular penetration testing and security training, and the platform page claims adherence to GDPR and HIPAA standards without any certification behind them.

Nextpoint holds SOC 2 Type II, described as an annual third party audit covering security, availability, confidentiality and privacy. SOC 3 reports are available on request, and SOC 2 reports after a signed nondisclosure agreement. It separates its own certification from Amazon's SOC 1, SOC 2, SOC 3, ISO 27001 and FedRAMP for the underlying cloud, without claiming those as its own. A public status page, an annual IT risk assessment and an ungated overview document support it. What is missing: no auditor, report date or coverage period is given, and the SOC 2 report needs a signed agreement.

The cyber data mining page lets users send selected documents for personal information identification to a model of their choice, including models from OpenAI, Microsoft and Google. The platform page says iCONECT integrated Sentio technology, which carries its continuous active learning, and acquired AI source code from Ayfie in 2021. Nothing published names the model behind document summaries, classification, image description, transcription or translation, states whether iCONECT or the customer holds the model provider relationship, says where those models run, or commits to notice when a model changes.

Nextpoint names the service its generative AI runs on: Amazon Bedrock, Amazon's managed foundation model service. Ranking runs on models Nextpoint hosts in its own private cloud, and transcript summaries run on Bedrock in the same environment. Naming the service means its terms can be read. Bedrock does not train on customer data, does not store or log prompts or completions, and does not share inputs or outputs with model providers. What is missing: which Bedrock model writes a summary, any model version, and a promise to notify customers when the model changes, which Bedrock makes easy.

The law firm page offers flexible pricing with monthly or annual terms, the Why iCONECT page describes predictable pricing through monthly and yearly plans, and the release of 23 August 2023 launching iCONECT SaaS describes Price Protect, which applies discounts automatically as data volume grows without renegotiating the contract. That points to data volume as a driver and term length as a choice, without stating the unit, the rate or what the generative features add. No price, rate per gigabyte, user fee or tier is published, and every route to a number runs through a demo request.

Nextpoint publishes the full shape of its pricing and no number. Three plans are named with their features. Essential covers smaller review, production and deposition work, Advanced adds analytics, auto redaction for each document, production templates, advanced permissions and activity reporting, and Apex is a custom enterprise plan. Each user costs a flat monthly rate. The page lists what is never charged: storage, processing, hosting, OCR, deduplication, productions, exports and sharing, compared with per gigabyte fees elsewhere. Annual prepayment discounts and volume pricing are mentioned. No figure appears at any tier, and every plan routes to a call. One discrepancy: the marketing says unlimited data, while the terms of use say plans may be user based or data based, with hosting and processing limits set in an unpublished master services agreement.

The site addresses law firms, corporations, public sector organizations and service providers, each with its own page, across three products: eDiscovery, cyber data mining for breach response, and data governance. The law firm page covers litigation, investigations and responsive actions, the cyber data mining page covers breach notification work for incident response professionals, and the release of 24 August 2026 names law firms, corporations, legal service providers and public sector organizations as customers. Named users include NASA and the FDIC. What is not stated is which languages the generative features and personal information identification support, which privacy regimes the breach tools are built around beyond references to GDPR and HIPAA, and which deployment options carry the generative features.

Nextpoint documents coverage three ways, with no stated limits. By buyer: law firms, corporations, government agencies and education, each with a page. By specialty: construction litigation, insurance defense, mass tort and IP litigation. By use: data collection, internal investigations, FOIA requests and transcript management. File types are listed, including PST, MSG, EML and MBOX email, Office files, images, audio, video, archives, source code, CAD files and building information models, with text extraction and OCR. It states it handles millions of documents and multi party MDL matters, reusing processed data across hundreds of related cases. What is missing: no excluded practice, size limit or unsupported jurisdiction is named; the only limit stated is that specialized formats may need specific workflows.