Jhana.ai vs Lexroom: how they compare in 2026

The models are the product and the corpus was built to feed them. The vendor describes itself as a frontier legal intelligence lab and names its proprietary work as verifier models, graph models for legal ontologies, a national legal archive of more than 16 million machine enhanced documents, and research and drafting agents. Machine enhanced is the operative phrase: the corpus was not licensed and wrapped, it was processed into a model asset, and the stated use of seed capital was to build proprietary datasets and models and to hire researchers in law and AI. Every product is an agent pipeline rather than a workflow tool with a model attached, including the public sector agents running extraction, synopsis and forensic scrutiny. Remove the models and there is no product left. Same shape as Reveal, reached from the opposite direction: Reveal acquired model capability into a platform, Jhana built the corpus and the models first and the interface after.

The models are the engine of what the buyer uses, but there is a real content product underneath them. Lexroom's Libreria Lexroom is a curated collection of institutional legal sources organised into more than fifteen subject modules, each selected by legal institute and validated by partner jurists, and the commercial unit is access to those modules: the published entry plan buys one Lexroom module for one user. A curated legal database is a product that functions without any model, and it is what traditional Italian banche dati sell. The vendor also states plainly that it does not build its own large language model but uses third-party AI. That places this at B rather than A: the AI is the mechanism the buyer pays for, layered on a document collection that would still exist without it. Verified 2 September 2026.

Grounding is architectural and demonstrated, short of any published measurement. The vendor states plainly that its agents always cite their work, and names a verifier model as proprietary technology, which puts a checking mechanism in the architecture rather than in the marketing. Published product material shows source linked output where each conclusion sits one click from the underlying source page and each extracted figure is anchored to page and paragraph, which is a demonstrable behaviour a reader can inspect rather than a claim about accuracy. Held at B because nothing measured is published: no accuracy figure, no precision or recall on retrieval or extraction, no hallucination rate, no test set, no independent benchmark participation, and no statement of what the verifier catches or how often. Searched the home page, the product pages, the published blog material, the privacy policy and the terms and conditions on 29 Aug 2026. For a vendor whose named innovation is a verifier, the absence of a measured verification result is the gap.

Grounding is real, documented and central to the product. The research page states that every answer is anchored to updated sources that are verifiable and downloadable in one click, and that every statement is linked to the original source so the reader can open it, verify it and cite it. The corpus construction is described rather than asserted: thousands of legislative and case law sources, selected by legal institute, validated by partner jurists, across more than fifteen subject modules built and verified one at a time. The privacy policy adds that Lexroom always makes available the sources that justify the reasoning precisely to let the customer check it. What is entirely absent is measurement. No accuracy figure, test set, benchmark or published evaluation exists on any surface. Set against that gap, the marketing makes an absolute claim in two places, that there are zero hallucinations and zero risks, and on the research page that sources can be consulted without risk of hallucination. An unmeasured absolute claim of this kind is the strongest assertion in the pull with the least evidence behind it, and it is the reason this is not an A. Verified 2 September 2026.

The positioning implies an oversight model and no document describes one. Calling the product a paralegal rather than a lawyer is a deliberate and meaningful choice: a paralegal works under supervision, and the naming carries that. But naming is not a published model. Nothing states where a human must review agent output before it is used, whether any step can complete without review, what the agents may do unattended in the Courtroom and PUBSEC pipelines running extraction, synopsis and forensic scrutiny for courts, or what happens when an agent is wrong inside a registry workflow. No confidence threshold, escalation path or human confirmation requirement was located. Checked the home page, the product pages, the public sector material, the terms and conditions and the blog on 29 Aug 2026. The gap matters more here than for a research tool sold only to private practice, because the deployed users include judges and registrars.

The human review commitment is written down and framed against a legal test rather than as marketing. The privacy policy addresses automated decision-making under the GDPR directly, stating that outputs are always submitted to a human operator who must review them before use, and that they therefore do not constitute automated decisions in the strict sense. The product supports that with a real review surface: sources sit behind every statement so a reader can verify before relying, the research page frames the point as the user deciding rather than an algorithm, and the Word add-in proposes modifications inside the document rather than applying them. What is not published is the boundary. Nothing states what any step completes without a human, what the system does when it is uncertain, or what happens after it is wrong. Verified 2 September 2026.

Adoption is quantified and unusually institutional. Stated: more than 10,000 users, over 150 judges and registrars across five or more courts, more than 100,000 paralegal sessions and over 200,000 searches. Judicial adoption is the strongest element and the second instance on this index of a public authority using the product rather than merely appearing as a logo, after FinregE and the FCA Handbook. Also dated and attributable: a $1.6m seed led by Together Fund with named participants, a January 2026 partnership with CADRE ODR for online arbitration, and support from Jio GenNext, the AWS Public Sector Startup Hub, Microsoft Founders Hub and the Google Cloud Startups Program. Held at B on three gaps. Every usage figure is self reported with no methodology, period or definition, so a paralegal session is whatever the vendor counts. No court, institution or firm is named. No outcome measure of any kind is published: nothing on time saved, error reduction or research quality, only volume.

Named customers are numerous and span sectors: Satispay, Fastweb, Italgas, Mediolanum, CRIF, WST, MDV and Generali on the corporate side, and the law firms Withers, LCA and Gatti Pavesi. Four individuals speak on the record with name, role and employer, including Maddalena Malzanni, Legal Counsel Lead at Qonto, and Ferdinando de Martinis, Associate at Gitti and Partners, with dedicated customer story pages for Qonto, Jet HR and Credem Banca. Figures are published but they sit apart from the customers: 40 per cent time saved on repetitive tasks, 2.5 times more documents drafted, and more than 15,000 legal professionals using the platform. Those are aggregate claims with no method, no basis and no attribution to any named firm, and nothing is dated, so the record has named customers and separately has figures rather than figures for named customers. The individual customer stories were not opened this pass. Verified 2 September 2026.

Real documentation exists and none of it is about privilege, and one disclosed practice cuts against the posture. The privacy policy is a genuine product document framed against the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000, with erasure on request by email, retention carve outs for fraud prevention and for tax, legal reporting and audit obligations, and a security section. That is more than several better funded vendors on this index publish. What is absent: any treatment of legal professional privilege or work product, any statement about the confidentiality of case files uploaded to AI Paralegal or Document Intelligence, and any segregation model. Named as a concern rather than buried: the privacy policy states that personal information may be disclosed to data processors including marketing and advertising agencies and web analytics companies. For a platform holding client matter documents, disclosure to advertising and analytics categories is a real posture question, and the policy does not distinguish account level personal data from uploaded matter content.

This record meets the limb almost every other vendor in this pull fails. Professional secrecy is addressed directly and repeatedly, not merely implied: the security page commits to confidentiality in compliance with privacy law and with segreto professionale, the privacy policy states that beyond privacy Lexroom protects professional secrecy and confidential information generally, and there is an operational control attached to it, since efficiency monitoring data is visible to Lexroom staff only in anonymised form specifically so that confidentiality and professional secrecy are not compromised. Segregation is documented at tenant level: each customer has a dedicated and exclusive virtual space, private library contents are not shared with other customers, and the privacy policy states it is physically impossible for one customer to reach another's. Retention and deletion are stated precisely, and the position on third-party providers is explicit, with Google and OpenAI named and contractually excluded from training on customer prompts. What holds this at B is the vendor's own reservation, examined on the training signal: Lexroom may use prompts for its own benchmarking and fine tuning after stripping personal and confidential data. Matter-level walls inside a single firm are also not addressed, which matters because law firms are a named buyer. Verified 2 September 2026.

Not addressed in any located material. The product generates propositions, advisories and memos from natural language input, which is output shaped like advice, and the user base explicitly extends beyond advocates to founders, tax professionals and compliance teams. That combination is precisely where the question bites: a non lawyer receiving an advisory generated from case law is the unauthorised practice scenario, and nothing published addresses it. No statement that output is not legal advice, no positioning on the supervising advocate's role, and no engagement with Bar Council of India rules on advocate conduct or advertising. Checked the home page, the product pages, the terms and conditions, the privacy policy and the blog on 29 Aug 2026. The paralegal naming is the closest thing to a position and it is a brand choice rather than a disclosure.

The supervision dimension is published and unusually concrete. The privacy policy states that outputs are always submitted to a human operator who must review them before use, and the research page frames the product as amplifying professional judgement rather than replacing it, with the user rather than an algorithm deciding. Coverage is bounded, since the platform is stated throughout as available in Italy, Spain and Germany only, which tells a professional where it does and does not reach. Two things are missing. No statement that output is not legal advice was located on any surface, which is a notable gap for a research product, and there is no published terms of service anywhere on the site in which such a statement would normally sit. And no bar or professional guidance is engaged: neither Italian Consiglio Nazionale Forense material nor any equivalent in Spain or Germany is named. Verified 2 September 2026.

Nothing published about how the models are governed, evaluated or monitored. No AI policy, no evaluation methodology, no bias or fairness assessment, no accuracy monitoring, no drift statement, no model card, no named governance body and no external standard such as ISO 42001. The absence is conspicuous against the vendor's own subject matter expertise, since its published blog material analyses the DPDP Act and DPDP Rules compliance obligations in structured detail for its customers, and none of that analytic rigour is turned on its own system. Also unaddressed: whether a corpus described as machine enhanced introduces systematic error into the archive itself, which for a research product built on a proprietary dataset is the governance question that matters most. Checked the home page, the company and funding material, the product pages, the blog and the terms and conditions on 29 Aug 2026.

What exists is compliance positioning rather than governance. The security FAQ states that Lexroom is fully compliant with the GDPR and the new European AI Act, and the privacy policy contains a reasoned analysis of automated processing under Article 22, concluding that outputs are not decisions in the strict sense because a human must review them. A Data Protection Officer is named in full, with chambers, tax code and certified email address, which is more accountability disclosure than any other record in this pull, though the role covers data protection rather than model behaviour. Absent is everything the higher bands ask for: no governance framework, no owner of model behaviour, no account of what is tested before release, no certification such as ISO 42001, and nothing whatsoever published about uneven output across matter types, parties or populations. Checked the home page, research, security and privacy pages on 2 September 2026. Verified 2 September 2026.

The vendor speaks to stewardship directly, which most of this roster does not, and what it says does not hold together. The home page states that customer data is not used for training, and in the next sentence that free users have the choice to opt out of sharing data for model training. Those two statements cannot both be complete. The privacy policy supports erasure on request, discloses processor categories, and states that appropriate security measures and generally accepted industry standards are applied. Held at C because the operative rule is unclear from public material: no retention period is stated for prompts or generated output, no distinction is drawn between account data and uploaded matter content, and the training position depends on which sentence a reader stops at. The signal row records the contradiction with the quote. Credited above D because a vendor that addresses training at all, and gives free users a control, is materially ahead of one that is silent.

All five elements are published and specific to the day. Retention: private library files are deleted within 30 days of the end of the relationship, with backup copies on Google Cloud disposed of within a maximum of 180 days; prompts are kept for the duration of the relationship; customer registry and billing data for ten years under Italian accounting law. Deletion follows the same clock and data subject requests are answered within 30 days. Access control: data access is limited to a small number of technical staff holding special authorisations, with all access and downloads monitored, alongside an enforced password policy, encrypted stored passwords and single sign-on over SAML and OAuth 2.0. Subprocessors: Google and OpenAI are named as the AI providers, with categories of other recipients listed and a software bill of materials available on request. Incident practice: a formalised emergency procedure, notification to the customer as soon as possible, and communication by certified email or another secure channel agreed with the customer. Encryption is AES-256 at rest with a bring your own key option, daily vulnerability scanning is in place, and external penetration tests are run with summaries available on request. Verified 2 September 2026.

Terms exist, were read, and run one way. The terms and conditions contain an indemnity under which the user holds the company and its officers, agents and employees harmless against third party claims, demands, damages, penalties, losses and actions including reasonable attorneys' fees, together with an entire agreement clause incorporating the privacy policy. No corresponding vendor commitment was located: no warranty as to output, no accuracy undertaking, no service level, no liability position, and no remedy where a generated citation, advisory or memo is wrong. This is graded on published material rather than on absence, which is why the basis is Vendor Published: the document exists and allocates risk in one direction. Checked the terms and conditions and the privacy policy on 29 Aug 2026.

Nothing published states who bears the loss when the output is wrong. No terms of service, master agreement or customer contract appears anywhere on the site: the footer offers only a privacy policy and a cookie policy, and the data processing agreement is described in the privacy policy as signed at the point of contract activation rather than published. No indemnity, no liability cap, no warranty and no carve-out is stated on any surface. Two liability-adjacent facts are published and are recorded because they are real. Lexroom states that it holds cyber risk insurance with a carrier rated double A by Standard and Poor's, with a copy of the certificate available on request, and that a service level agreement is attached to the corporate plan contract. Neither tells a buyer what recourse it has against Lexroom for a bad answer; the insurance protects the vendor's own balance sheet. Checked the home page, research page, security page, privacy policy and site footer on 2 September 2026. Verified 2 September 2026.

Interoperability is claimed at the right level for the public sector product and documented nowhere. The vendor states that Courtroom and PUBSEC are interoperable with existing and new systems and are transacted with over API, which is the correct shape for selling into court registries, and the January 2026 CADRE ODR partnership is a named integration into an online arbitration workflow. What does not exist: any API documentation, any authentication or scope detail, any statement of what moves in which direction, and any named integration for private practice. No document management system, no practice management platform, and nothing addressing how a firm gets its own matter files in and its work product out. Checked the home page, the public sector material, the product pages and the blog on 29 Aug 2026.

The surface is narrow and what exists is described with real precision. The Microsoft Word add-in is documented as to data flow rather than merely named: the privacy policy states that the add-in involves no additional data processing and that prompts formulated through it are directed straight to Lexroom without retention by or access from Microsoft or any other intermediary. That is a clearer statement of what moves and where it goes than most vendors in this pull manage for any integration. Single sign-on is specified by protocol, compatible with Google and Microsoft accounts and with SAML and OAuth 2.0. Beyond those two there is nothing. No document management, practice management, email or e-filing integration is named, no API or developer documentation was located, and no integrations page exists. Real integrations documented, but too few of them and no implementer material, which is the B band. Verified 2 September 2026.

One genuinely strong deployment disclosure sits beside a complete absence for everyone else. For the public sector products the vendor states that the agents are owned and hosted by the courts themselves, which is customer hosted deployment stated plainly and is the strongest such position located in this pull. It is also the correct answer for a judiciary that cannot put case data on a startup's infrastructure. For the commercial product nothing equivalent exists: no hosting provider is named, no region or data residency commitment is published, and no private or single tenant option is described for firms. Cloud vendor programme memberships with AWS, Microsoft and Google are startup support programmes and are not a hosting disclosure, and are not credited as one. Data residency is a live question in India under the DPDP framework the vendor itself writes about. Checked the home page, the public sector material, the privacy policy and the terms and conditions on 29 Aug 2026.

Residency is published with a named country and processing is separated from storage. The security page states that all data are processed on servers located exclusively in the European Union and that the principal server is in the Netherlands, with backup redundancy across several EU data centres as protection against extreme weather events. The privacy policy adds the storage half, that Lexroom keeps data long term on servers within the European Union, and discloses the one exception precisely rather than burying it: limited transits to the United States for website hosting only, covered by both EU standard contractual clauses and the Data Privacy Framework. The tenancy model is stated, with each customer given a dedicated and exclusive virtual space, and a bring your own key option is offered for encryption. Lexroom also states it operates no physical data centre of its own and relies on cloud services listed in the Italian national cybersecurity agency's digital infrastructure catalogue. The limitation a buyer outside Europe should weigh is that there is one region and no non-EU option, which is a disclosed restriction rather than a gap in disclosure. Verified 2 September 2026.

No certification of any kind was located, and the security language is the unfalsifiable shape this index does not credit. The privacy policy states that appropriate security measures are taken against unauthorised access, alteration, modification, disclosure or destruction, and that generally accepted industry standards are followed. Neither statement names a standard, an auditor, a scope or a date, and generally accepted industry standards is a phrase that cannot be checked or falsified by any reader. Located nothing on SOC 2 of either type, ISO 27001, ISO 42001, CERT-In empanelment or any Indian assurance framework, and no trust centre, security page or documentation request route exists. Checked the privacy policy, the terms and conditions, the home page, the product pages and the site footer on 29 Aug 2026. Under the three tier test the artifact is absent rather than gated. Weighed against the deployment position: a vendor whose court customers host the software themselves has offloaded the hardest part of this question for those customers, and published nothing for the rest.

Certification is real, stated, and named to the version, which is more precise than most: Lexroom is certified to ISO 27001:2022. External penetration testing is stated with auditors described as external and a summary report available on request, daily vulnerability scanning is described with findings classified and prioritised, and a software bill of materials and a cyber insurance certificate are each offered on request. What the top band asks for is missing from the pages read: no auditor is named, no certificate number, issue date or coverage period is published, and no report is downloadable. A trust centre exists at trust.lexroom.ai and is linked from both the footer and the security page, but it was not opened this pass, so its contents and access tier are unestablished and nothing in it is either credited or held against the vendor. That single surface is the one most likely to move this grade. Verified 2 September 2026.

Processor categories are disclosed, a list is promised, and no entity is named. The privacy policy states that personal information may be disclosed to entities that may qualify as data processors under the DPDP Act, listing categories including hosting service providers, cloud computing entities, IT service firms, marketing and advertising agencies and web analytics companies, and states that the vendor will make efforts to disclose an updated list of key processors. A promise to publish is not a publication, and no such list was located. On the model layer specifically: the vendor claims proprietary verifier and graph models, which is a supply chain statement of a kind, and never says whether any third party foundation model sits underneath the agents, which is the question a buyer needs answered. Compare Onspring at B, the only record on this index that names its model provider outright.

The providers are named and the vendor is candid about the architecture. The privacy policy states plainly that Lexroom does not develop its own large language model but relies on third-party artificial intelligence, and that the service therefore transfers data to sub-suppliers, in particular Google and OpenAI. It adds a real contractual commitment about what those providers may do, namely that customer prompts are expressly excluded from the AI suppliers' training under the terms agreed with them as sub-processors. Where inference runs is addressed at the level of the estate rather than the route, with all processing on EU servers. Two of the four things the top band asks for are absent: no model is named, only the houses they come from, and nothing commits to notifying customers when the supply chain or the models change. Verified 2 September 2026.

A free tier is quantified and the paid ladder is behind a login. Published free tier limits are specific: ten paralegal sessions, fifteen searches and thirty file document intelligence per month, which tells a buyer both the unit of consumption and the shape of the meter, and is more structural disclosure than most of this roster offers. Beyond that, plan details require signing in, and no price, currency or range for any paid tier was located. Held at C rather than higher because the headline is visible and the actual cost is not, and a buyer cannot compare against an incumbent subscription without creating an account. Source basis recorded as Third Party Estimated: the free tier limits come from an independent review platform's product assessment dated July 2026 rather than from a vendor pricing page read directly, and that assessment itself notes pricing is not fully public and may be out of date.

Real pricing is published for the entry point and withheld above it, which is the B band exactly. The site states a starting price of 99 euros per month, excluding VAT and on an annual contract, and sets out precisely what that buys: one Lexroom module, one user, up to 200 documents, the Microsoft Word add-in, and the possibility of tailored training. That is a rate, a unit and a term, and it is the only published figure located in this pull so far. Above the entry plan the page says prices are tailored to requirements, so the enterprise range is a sales conversation. What keeps it off the top band is that nothing states what implementation or the tailored training adds, no module is priced individually even though modules are the unit of purchase, and there is no pricing page as such, the figure appearing in a demo-booking block repeated across the site. Verified 2 September 2026.

Corpus scale and jurisdiction are stated precisely and the vendor is candid that the scope is one country. More than 16 million judgments and statutes in a corpus described as India's National Legal Archive, with the explicit positioning that this is purpose built for the Indian legal context rather than a general model with a legal skin. Named user populations span private practice lawyers, law firms, in house teams, judges and registrars across five or more courts, founders, tax professionals and compliance teams, and published subject matter reaches SEBI regulations, AML and CFT, the DPDP Act and Rules, the IT Act and Supreme Court authority on Section 65B evidence certification. Single jurisdiction scope is a limitation for a buyer outside India and is not a disclosure failure. Held at B rather than A because the corpus is not broken down: no list of which courts, tribunals and forums are included, no statement of historical depth, and no update lag or refresh frequency, so a practitioner cannot confirm their own forum is covered or how current it is.

The buyer taxonomy is the most complete in this pull. Seven segments each have their own page: law firms, companies and public administration on the organisation side, and advocates, notaries, accountants and labour consultants on the professional side, which covers private practice, in-house and government use explicitly. Jurisdiction is bounded and repeated on every page, with the platform stated as available in Italy, Spain and Germany, so a buyer knows where it does not reach. Subject coverage is counted rather than listed: more than fifteen subject modules are said to exist, each built and verified individually, and modules are the unit a customer buys, but the pages read do not name them. That is what holds this below A, together with the absence of any statement of firm size or of what the product does not support. Verified 2 September 2026.

Recorded at opt-out, which is the weakest position the vendor's own text establishes, because the two statements it makes cannot both be complete. The quoted sentence appears on the home page, and the sentence immediately following it states that free users have the choice to opt out of sharing data for model training. A choice to opt out only exists where the default is participation, so free tier data is used for training unless the user acts, which contradicts the blanket claim. Reading the stronger sentence alone would credit a never commitment the vendor has qualified in the next breath. Both statements sit on a marketing page rather than in the terms and conditions or the privacy policy, neither of which was found to address model training at all, so even the stronger reading is policy rather than contract. Checked the home page, the terms and conditions and the privacy policy on 29 Aug 2026. This is the clearest instance in the pull of why the value set separates contract from policy.

The quoted line, from the Training section of the privacy policy, states that Lexroom itself may use customer Prompts for its own benchmarking and fine tuning, with the de-identification qualifier that personal data and confidential information are removed first and the work carried out only on principles not traceable to identified or identifiable persons. It names fine tuning expressly, which is what makes this a permission rather than an aggregate-data carve-out. No published agreement exists to test it against: the site publishes only a privacy policy and a cookie policy, and the data processing agreement is signed at contract activation. The marketing says the opposite in three places and a buyer should see both halves. The home page and security page state that documents and data sent to Lexroom are not used for training, a Zero Training Policy badge appears in the footer, and the security FAQ narrows it, saying uploaded documents and user queries are never used to train global language models. The genuinely strong commitment sits one layer out: customer prompts are expressly excluded from the AI suppliers' own training under the terms agreed with Google and OpenAI as sub-processors.

Disclosed vaguely. The privacy policy gives users a route to request erasure of personal information and account closure by email, which is a real control, and then states that some information may be retained for legitimate business interests such as fraud detection and prevention and safety, and to meet tax, legal reporting and audit obligations. That describes the exceptions without ever stating the rule. No retention period is given for anything, no distinction is drawn between account data and uploaded matter documents or paralegal session content, and nothing indicates whether retention is configurable or can be set to zero. A user knows they can ask for deletion and not what is kept, for how long, or which of their case files fall inside the carve outs. Checked the privacy policy, the terms and conditions and the home page on 29 Aug 2026.

Specific published periods that the customer cannot change. Prompts are kept for the entire duration of the relationship and afterwards only for the time needed to run Lexroom's updates. Private library files, where that optional service is activated, are deleted within 30 days of the end of the relationship, with traces remaining only in Google Cloud backup copies which are disposed of within a maximum of 180 days. Customer registry and billing data are held for ten years as required by Italian accounting law, and navigation data for one year. Two published statements sit against this and a buyer should weigh them: a Zero Data Retention Policy badge appears in the site footer, and the security FAQ says documents are not stored permanently. Neither is false on its own terms, since library files are deleted and backups expire, but prompts persisting for the life of the contract is not zero retention, and no retention setting is offered to the customer.

Not addressed. No permission model, access control statement or segregation description was located for either the private practice product or the public sector agents. Nothing indicates whether one user's uploaded case files are reachable by another user in the same firm, whether matter level restriction is possible, or how retrieval behaves across a shared workspace. The vendor describes a collaborative interface, which raises the question rather than answering it. There is no document management system integration to inherit permissions from. Checked the home page, the product pages, the privacy policy and the terms and conditions on 29 Aug 2026.

Lexroom operates and documents its own separation model at the level of the customer account. The security page states that each customer has a dedicated and exclusive virtual space, that Lexroom does not share customer data to feed public libraries, and that it does not share it with other customers. The privacy policy goes further on the private library, saying each customer can use only its own and that it is physically impossible to reach a third party's, and adds that prompt data remain segregated inside the user's account. Access is administered by Lexroom rather than inherited from a source system, with authorisation limited to a small number of technical staff and all access and downloads monitored. What is not addressed is separation inside a single customer. Law firms are a named buyer segment with their own page, and nothing published describes walls between matters, teams or individual users within one firm's account.

Not addressed. The privacy policy states that personal data may be processed for certain legitimate uses where required in compliance with the Digital Personal Data Protection Act 2023, the Information Technology Act 2000 and other laws. That discloses that lawful processing may occur; it is not a commitment to notify the customer before producing their data to an authority. No notice commitment, no stated process, no window and no transparency report were located. Checked the privacy policy, the terms and conditions and the site footer on 29 Aug 2026. Worth flagging for a later reader that this vendor's public sector agents are deployed inside courts and registries, which makes the relationship between vendor, customer and state less arm's length than usual.

The privacy policy addresses disclosure to authorities directly, listing public administrations, supervisory and control authorities and judicial authorities among the categories to which personal data may be communicated, where required by law or by an order of those bodies. It also records that personal data may be used in judicial proceedings to defend Lexroom's own position. Nothing anywhere commits to telling the customer when such a request arrives, and nothing reserves discretion over notice either: the question is simply never reached. Checked the privacy policy, the security page including its governance and continuity section, the research page and the home page on 2 September 2026. The breach notification commitment on the security page, that the customer will be warned as soon as possible and by certified email, addresses security incidents rather than legal process.

Jurisdiction stated, sources not. India is named unambiguously and the corpus is quantified at more than 16 million judgments and statutes described as India's National Legal Archive, machine enhanced and proprietary. That is a clear jurisdictional boundary and a real scale claim. What is absent is everything a researcher would check: no list of which courts, tribunals or forums are included, no historical coverage range, no statement of the licence or public domain basis on which Indian judgments and statutes were obtained, and no update lag or refresh frequency. The machine enhanced description also leaves open what was altered in processing, which is a provenance question about the archive itself rather than about its sources. Checked the home page, the product pages and the blog material on 29 Aug 2026.

Coverage is described by jurisdiction and the corpus itself is not identified. The three markets are stated on every page, Italy, Spain and Germany. The research page describes thousands of legislative and case law sources selected by legal institute and validated by partner jurists across more than fifteen subject modules, and the privacy policy adds that the Lexroom Library is a collection of documents drawn from institutional legal sources, divided by subject, with customers accessing only the modules bought. That identifies the character and the curation method but not a single named source, publisher or database, and no licence or rights basis is stated for any of it. An update cadence is claimed only as sources being current. One inconsistency belongs on the record: the first-party pages say thousands of sources, while Italian trade press in May 2026 reported a company statement of more than six million verified legal sources, a figure that could not be confirmed on any first-party surface.

Not addressed, and this one was nearly recorded higher on material that does not qualify. A third party company profile states that the platform automatically detects contradictions and flags outdated citations, which if it appeared in vendor material would support an own treatment signal value. It does not appear in vendor material. Under the standing rule that a credential must appear in the vendor's own material, because directories and review sites routinely attribute capabilities a vendor never claimed, it is not credited and is recorded here so the next reader knows it was seen and rejected rather than missed. What the vendor itself publishes is that its agents always cite their work and that verifier models are proprietary technology. Citing an authority is not checking whether that authority is still good law, and no citator, treatment signal or overruled and superseded flag is described anywhere in vendor material. Checked the home page, the product pages, the blog and the public sector material on 29 Aug 2026.

Checked the home page, the legal research feature page, the security page and the privacy policy on 2 September 2026. No public material addresses whether an authority returned by the product is still good law. The nearest claims concern the freshness of the collection rather than the standing of an individual authority: sources are described as updated, official and certified, and the stated purpose of retaining the library is to ensure outputs stay current. Neither speaks to subsequent history, to legislation that has been repealed or amended, or to decisions overtaken by later Cassazione rulings. The question bites on this product because it retrieves legislation and case law directly and presents linked authority as the basis for its answers.

Not addressed. No explicit no answer path, abstention behaviour or confidence signal is documented. The named verifier model implies a checking step and nothing states what happens when the check fails: whether the agent declines, flags the output, retries, or returns it anyway with a citation. For a research product whose central claim is that its agents always cite their work, the behaviour when nothing supportable is found is the load bearing case, and it is undocumented. Checked the home page, the product pages, the blog and the terms and conditions on 29 Aug 2026.

Checked the home page, the legal research feature page, the security page and the privacy policy on 2 September 2026. Nothing describes what the product does when it cannot ground an answer. No abstention path is documented and no confidence or grounding indicator is described. The marketing runs the other way, asserting zero hallucinations and zero risks, which is a claim that the situation does not arise rather than an account of what happens when it does. The architectural answer offered instead is verification by the reader: every statement is linked to its source so the user can check it, which places the burden of detecting an unsupported assertion on the lawyer rather than on the system.

None located, with the instrument named so the finding is worth what the search is worth. General web searches combining the vendor and product names with court, judgment, order, hallucination, fabricated citation and disciplinary terms returned nothing on 29 Aug 2026. No Indian court record database was searched, and none of the Indian judgment reporting services was queried directly, so the instrument here is weaker than the subject deserves: this is a research product deployed with judges and registrars in Indian courts, and an Indian docket search would be the correct instrument. Recorded as a statement about what this search found and not as a clearance, and flagged as worth revisiting with a proper Indian court record search.

Searched the AI Hallucination Cases database maintained by Damien Charlotin, and Italian and international reporting drawing on it, on 2 September 2026 on the product and corporate name Lexroom and Lexroom S.r.l. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product. One structural caveat: the database is heavily weighted to United States filings and its Italian coverage is thin, so an Italian product is less likely to surface even where an incident occurred. Lexroom itself cites the phenomenon in its own marketing, with company material reported in May 2026 referring to more than 1,300 documented filings containing AI-generated hallucinations.

Not addressed. No engagement with Bar Council of India rules, no reference to advocate conduct or advertising restrictions, and no named professional guidance of any jurisdiction was located. The vendor publishes substantial regulatory analysis for its customers, covering SEBI regulations, AML and CFT, the DPDP Act and Rules and Section 65B evidence certification, so the capacity to engage with a professional rules framework plainly exists and has not been turned toward the duties of the advocates using the tool. Checked the home page, the product pages, the blog index and the terms and conditions on 29 Aug 2026.

Checked the home page, the legal research feature page, the security page, the privacy policy and the professional segment pages for advocates and notaries on 2 September 2026. No public material engages with professional or ethics guidance from any of the three markets served, and nothing names the Italian Consiglio Nazionale Forense, the Consiglio Nazionale del Notariato, or any Spanish or German equivalent. Lexroom does engage named instruments, claiming compliance with the GDPR and the European AI Act, and it addresses professional secrecy directly, but both bind the supplier rather than setting out the professional obligations of the lawyers and notaries using the product, which is what this signal records.

Not addressed. Nothing published addresses billing for AI assisted time, and no record is described that an advocate could produce to a client showing what was machine generated. Published metering describes what the customer is charged by the vendor, in paralegal sessions, searches and files per month, which is the vendor's own pricing unit rather than a fee posture toward the end client. Checked the home page, the pricing material and the terms and conditions on 29 Aug 2026.

Savings are claimed with figures and nothing addresses the bill. The home page publishes a 40 per cent reduction in time spent on repetitive tasks and 2.5 times more documents drafted, and a named customer is quoted saying the platform is not only a saving of time but a saving of money for the company because she has needed outside counsel less often. No published material addresses how AI-assisted work is recorded, billed or disclosed to a client, and no per matter record of AI-assisted work was located. The buyer mix is relevant to how this signal reads here: Lexroom sells to private practice advocates and law firms who do bill clients, so unlike the in-house products in this pull the assumed direction holds, which makes the silence more pointed rather than less.

Not addressed, with a promise on the record that has not been kept. The privacy policy states that the vendor will make efforts to disclose an updated list of key entities engaged as data processors, and no such list was located. Categories are given, including hosting providers, cloud computing entities, IT service firms, marketing and advertising agencies and web analytics companies, but no entity is named. No model provider disclosure, no trust centre, no security documentation and no request route exist, so a firm has nothing it could forward to its own client. The undertaking to publish is noted here because it is checkable later and gives a reader a specific thing to look for on the next verification pass. Checked the privacy policy, the terms and conditions, the home page and the site footer on 29 Aug 2026.

The model providers are named on a public page, which clears the test that infrastructure alone never satisfies this signal: the privacy policy states that Lexroom does not develop its own large language model and transfers data to sub-suppliers, in particular Google and OpenAI, and records that customer prompts are excluded from those suppliers' training under the terms agreed with them. Categories of other recipients are listed, and a software bill of materials is offered on request. It stops short of the top value because the third limb is not published: there is no forwardable client-facing disclosure pack, the data processing agreement is signed at contract activation rather than published, and no consolidated subprocessor register with entities, roles and regions exists. Cloud storage providers are given by category rather than by name, although Google Cloud is identified elsewhere as holding backups.

Partial record, and the source linking is the strongest element of it. Published product material shows output where each conclusion sits one click from the underlying source page and extracted figures are anchored to page and paragraph, and the vendor states its agents always cite their work, so a user can produce what the system relied on and where it came from. That is the sources retrieved limb, evidenced rather than asserted. The other two limbs are missing: nothing indicates that output records which model produced it, and nothing describes a human verification record or an export a court could be handed. The gap is sharpest in the public sector products, where Courtroom runs extraction, synopsis and forensic scrutiny inside judicial and registry workflows and no disclosure artifact is described for work a court itself would need to stand behind.

Checked the home page, the legal research feature page, the security page and the privacy policy on 2 September 2026. Nothing addresses court disclosure of AI use or any certification that citations were checked by a person. The product does leave a usable trail for the lawyer's own verification, since every statement is linked to the source that justifies it and search history is retained and retrievable, but nothing is described as an exportable per document record covering which model produced which passage, what was retrieved and who reviewed it. Italian and Spanish courts have not developed the standing-order practice that drives this signal in the United States, so the obligation it tracks is less established in the markets Lexroom serves, but the record here is simply that the question is not addressed.