Merlin Search Technologies vs OpenText eDiscovery: how they compare in 2026

Alchemy's answering and analysis engines and ReviewPartner's AI reviewers sit on a full ediscovery platform with keyword and algorithmic search, review, tagging, production and multi-party workspaces that the company has sold since 2019 under the Sherlock and DiscoveryPartner names; the vendor's own framing is three engines to find and two to analyze and answer. Without the answering models, a search-and-review platform remains.

OpenText's FAQ calls Aviator a suite of LLM powered features built into OpenText eDiscovery: key document summary, summarization, concept label summaries, Review, Rapid Exploration and Agents. Aviator Review reduces or eliminates first pass responsiveness review, with sampling and token estimates before a full run, and Aviator Agents plan and run multistep search, review and summarization from a goal in natural language. The platform underneath predates the models: more than 45 connectors, deduplication, predictive search, redaction, audio and video review, and technology assisted review with continuous active learning offered for more than fifteen years. Without the generative layer, a customer still has a full eDiscovery platform with its own machine learning review engine.

The home page states that questions return comprehensive, sourced answers and reports across the document set rather than search hits, the launch coverage describes a dual-window architecture separating analysis prompts from formatting prompts to keep formatting from interfering with document analysis, and the AI services page states that every service undergoes rigorous validation for accuracy, completeness and consistency at scale. No accuracy figure, test set or evaluation is published on those pages, and the founder has published a book on generative AI for discovery. Questions about primary authority do not apply to a tool that reads the customer's own documents.

Key document summaries carry document ID citations so users can confirm them, and the AI reads the customer's own collected evidence, so a reviewer can always check the source document. OpenText publishes 90 percent or better recall with optimized workflows, alongside 88 percent faster review and 75 percent cost savings against manual review, which measure effort rather than correctness. Nothing states the matter, volume or protocol behind the recall figure, and optimized workflows is not defined. One limitation is stated: according to the FAQ, the model has multilingual capabilities, but primary testing and validation have been on English language documents and prompts, which matters for cross border investigations.

Granular role-based access control exposes every function as an assignable permission, audit logs track each person's views, tags and searches, multi-party sites give user groups private tag sets and shared searches, and the platform delivers sourced reports a lawyer works from; ReviewPartner's AI reviewers are described as applying consistent judgment across files with validation. No threshold is published at which AI review decisions stand without human sampling, nothing says what executes without approval, and no route back after a wrong classification is stated.

Clause 11.3 of the Cloud Services Use and Delivery Terms says AI Components do not replace decisions and judgment by natural individuals, that they provide added knowledge to support those decisions, and that the customer remains solely responsible for decisions based on outputs; it also prohibits unacceptable risk use under the EU AI Act. Clause 11.1 says customer chosen parameters and inputs may carry assumptions, biases and limitations. The vendor calls its approach GenAI human assisted review, summaries carry document ID citations, and Aviator Review lets a team test criteria on sample data with token estimates before committing to a full set. No threshold is published at which a feature acts alone or escalates, nothing says what an Agent will not attempt, and nothing describes what happens after an output is found to be wrong. Clause 11.3 is a general statement across all AI Components, not a limit tied to a named mode.

Dara Tarkowski, managing partner of Actuate Law, is quoted by name on the 2023 cloud utility pricing launch about adopting the pricing model, with no measured outcome. The home page states most clients save fifty to sixty percent on hosting costs, unattributed, and the TransPerfect partnership announcement states Reef ECA reduces document sets by over ninety percent on average, which is the partner's figure. US Legal Support and TransPerfect are named partners rather than customers. Nothing joins a named customer to a figure.

The UK Serious Fraud Office is named as a customer, with Richard Day quoted saying the platform transformed how the agency investigates and is embedded in its workflows. Bosch and the law firms Gleiss Lutz, Eversheds Sutherland and Pillsbury are also named. Published figures include 75 percent cost savings against manual review, 88 percent faster document review, 90 percent or better recall, up to 88 percent cost savings on the product page, and 48,756 documents reviewed in under two weeks. The named customers carry no figures, and the figures come from unnamed deployments described as a global technology leader and a major housing provider. Nothing is dated and no method accompanies any figure.

Each client has its own AWS account with no shared database or infrastructure. Each matter has its own servers, database, storage, URL and login. Sites shared by several parties give each group private fields, tag sets and searches, which the security page describes as protecting each group's work product, so work product is addressed in writing. Confidentiality controls include document lockdown with time limited authorization tokens, encryption in transit and at rest, and audit logging. The security pages make no statement on training and no retention or deletion commitment, and do not identify the models the platform runs. No customer agreement is published, and Merlin also publishes a privacy policy.

Customer data, prompts and outputs are never used for training, and OpenText states it does not train models. Each LLM interaction is a separate session scoped to one project, and results are not shared across projects. The eDiscovery terms require OpenText's conflicts check to be completed before the service is provided for a matter. The provider is named, and session data is deleted from Amazon Bedrock at close, with Bedrock not storing or logging customer data. Clause 5.2 says the customer owns its Content, and clause 9 binds both parties to confidence for the term and three years after. Privilege and work product are not addressed by name in the published material. Retention and deletion are left to Supplemental Terms under clause 6.5, which says OpenText need not retain or delete Content except as agreed. Clause 11.4 says OpenText does not guarantee privacy protection, rights to use or output accuracy for large language model components.

The product is sold to law firms, corporate legal departments and investigators, and its AI reviewers are described as applying senior attorney-level judgment, which is a capability claim rather than a position on where the lawyer's responsibility sits. The home, security and AI services pages do not state that outputs are not legal advice or how the product supports a supervising lawyer's duties, and no customer agreement exists on the site to carry such a statement.

Clause 11.3 says AI Components do not replace decisions and judgment by natural individuals, that they provide added knowledge to support them, and that the customer remains solely responsible for decisions and judgments based on outputs. It prohibits unacceptable risk use under the EU AI Act or industry standards. Clause 11.6 makes the customer responsible for laws on AI use in its own processes, and clause 3.2 adds compliance with laws on AI systems. The subscription may be used only for the customer's legal or regulatory matters, and access may not be given to a managed service, eDiscovery or document review company without written consent. The vendor describes its approach as human assisted review and says agentic AI strengthens rather than replaces legal judgment. Nothing addresses supervision or competence, no professional conduct rule or bar authority is named, and no jurisdiction limit is stated.

The security page names a chief information security officer reporting to the chief executive and a Technology Governance Committee chaired jointly by the CISO and COO providing executive oversight, and the AI services page states rigorous validation of every service. That is security governance. No responsible AI framework, ISO 42001 or equivalent, testing results or statement about uneven output across document types or languages is published.

Clause 11.1 of the agreement says a customer's parameters and inputs may carry assumptions, biases and limitations that affect output quality, and clause 11.2 makes input quality the customer's sole responsibility. Clause 11.3 prohibits unacceptable risk use under the EU AI Act, clause 11.6 puts compliance with AI law on the customer, and clause 11.4 says OpenText does not guarantee the accuracy of outputs from large language model components. No responsible AI page for this product is published, no owner for model behavior is named, no testing regime is described, and no evaluation results are published. The agreement treats bias as a property of the customer's inputs, and nothing addresses bias in outputs across custodians, languages and document types.

Access control covers granular role-based access control, document lockdown by time-limited token, audit logs of every view, tag and search, private subnets with no public IP addresses, and TLS and AES-256 encryption. Amazon Web Services is named as the infrastructure provider, with per-client accounts and regions chosen by the client; AI model providers are not named. The SOC 2 Type II scope covers monitoring and incident response, and the single-tenant design is described as limiting the blast radius of any incident to one environment; no customer notification commitment is published. The security pages state no retention period or deletion commitment, no customer agreement is published, and Merlin also publishes a privacy policy.

The Aviator FAQ describes the data flow step by step: a session is opened with the model through the Amazon Bedrock API from the customer's own AWS environment, the prompt and document text go out, the response comes back, and the session closes with all data deleted from Bedrock, which does not store or log customer data. Each feature interaction is a separate session scoped to one project, and the model is a deep copy hosted by Bedrock with no internet access. Training is excluded. Clause 7.4 provides audit report summaries on written request under a confidentiality agreement. No subprocessor list is published: the Data Processing Addendum takes general authorization with a thirty day objection and termination route, and AWS is named only in the agreement. No incident or breach notification practice is published. Platform retention is left to Supplemental Terms under clause 6.5, and clause 10 allows deletion after termination to be delayed up to 180 days by the cloud provider.

The site's navigation and footer carry a privacy policy, a GDPR disclosure and a contact page and no terms of service or customer agreement. The security page describes controls and invites contact for security requirements without any warranty, indemnity, cap or insurance statement.

The agreement has a dedicated Artificial Intelligence Technologies section. Clause 11.3 says OpenText has no liability for the creation or use of outputs or for decisions based on them, which are the customer's sole responsibility. Clause 11.4 says that for large language model components the technology may limit privacy protection, rights to use and output accuracy, and OpenText guarantees none of the three. Clause 11.5 says third party AI components may carry extra terms. Clause 7.4 entitles the customer to summaries of SOC 1 Type II, SOC 2 Type II and ISO 27001 assurance on request under confidentiality, and clause 2.3 requires OpenText to explain and discuss any change with a material adverse effect on functionality. No liability cap appears in these terms, which leave caps to order documents and supplemental terms. No vendor indemnity, AI service level or insurance position is published.

The April 2026 partnership release states that TransPerfect's Reef ECA is deployed as the processing engine across all Alchemy cloud instances, giving a unified workflow from ingestion through review, and the security page offers hosting in a client's own AWS environment. No document management, review-platform or load-file integration is described with what moves and in which direction, and no integration documentation is published.

More than 45 data source connectors feed the platform; on a discovery product the source systems are custodians' mail, chat and file stores. OpenText Connectors for Private Cloud is a paid extra in the purchase table. The platform sits in a Legal Tech family with OpenText Investigation, Core Insight, Core Legal Hold and Legal Knowledge Management, and the agreement names AWS as the infrastructure. Audio and video are ingested and made searchable in native and transcribed form. No individual source system is named on the product pages, no direction of flow is described, and nothing says what a customer must configure for a connector.

The security page states a single-tenant architecture with a separate AWS account, network, servers, databases and storage per client and dedicated resources per matter, deployment into any AWS region to meet local residency rules within forty-eight hours, hosting stated across the United States, European Union, United Kingdom, United Arab Emirates, Australia and Singapore, and the options of hosting in a client's own AWS environment or a government-approved FedRAMP environment. All processing and communication with cloud services occurs inside the client's private VPC over private links. The vendor contrasts this explicitly with shared multi-tenant platforms.

The purchase table names public cloud, private cloud and managed service, the product page adds on premises and hybrid, and a deployment checklist is published. The company also offers a sovereign cloud and publishes a private cloud availability map by region. The Aviator FAQ says the features are available to cloud customers whether single tenant or multitenant. The agreement names AWS as the infrastructure for the eDiscovery Services and says the AWS Customer Agreement governs its use. Availability is described as all AWS regions: no region is committed for a given customer, no residency guarantee is published, and where inference runs relative to the evidence is not stated, though the Bedrock session starts from the customer's own AWS environment. Clause 10 allows deletion after termination to be delayed up to 180 days by the infrastructure provider.

The security page says a SOC 2 Type II audit was completed in November 2025 by an independent service auditor. It covered the control environment and governance, risk assessment, logical access, system operations and change management, and monitoring and incident response. A penetration test was completed in September 2025 by AppSecure, a CREST accredited firm, with all findings fixed and verified. The vendor plans to pursue ISO 27001 in 2026, which is a plan, not a certification. The auditor is not named, and the SOC 2 report and penetration test summary are available to qualified prospects under NDA by contacting the team.

OpenText describes an information security management system based on ISO/IEC 27001 with the ISO 27002 control set, aligned to the NIST Cybersecurity Framework, says it runs regular Service Organization Controls audits, and publishes a security paper naming SOC 2, HITRUST, PCI DSS, HIPAA, SWIFT, TISAX, CyberEssentials+ and FedRAMP across its estate. Clause 7.4 of the agreement commits OpenText, on written request, to provide summaries of SOC 1 Type II, SOC 2 Type II and the ISO 27001 certificate, and lets a customer check other controls through a Shared Assessments Security Information Gathering form. Reports come only on written request under a confidentiality agreement, and no report, date or certificate can be reached without that step. Nothing published says whether OpenText eDiscovery itself sits inside the ISO or SOC scope.

The Alchemy AI page is headed three search engines and multiple AI models, and the home page describes five AI engines, without naming the models. A 2024 third party directory entry mentions GPT-4, but that is not vendor material. The vendor says all processing happens inside the client's locked down AWS VPC, which places inference in the client's environment without naming the provider or model. No commitment to notify customers of model changes is stated.

OpenText's FAQ names Anthropic, reached through the Amazon Bedrock API from the customer's own OpenText eDiscovery AWS environment, with availability in all AWS regions. Bedrock makes a deep copy of the model and hosts it, the provider has no read or write access, the model has no internet access, each interaction is a separate session scoped to one project, session data is deleted from Bedrock at close, and Bedrock does not store or log customer data. The agreement names AWS as an OpenText Licensor for the eDiscovery Services. No model name, version or family is given, and nothing says what happens if the model changes. No commitment to notify customers of a model change is published; the Data Processing Addendum gives a thirty day objection and termination right on notice of a new subprocessor, which is a contract route rather than a notice commitment.

Cloud Utility Pricing charges by the hour while a site is in use and a much lower rate, stated as seventy percent less, when it is switched off. Customers can schedule operating hours and use an energy saver power down, and the vendor says most clients save fifty to sixty percent on hosting. The 2023 launch describes a low hourly rate without naming it. A pricing page appears in the navigation.

The capability set and delivery options are published and the price is not. A How to buy table lists what a subscription includes: OpenText eDiscovery Aviator, technology assisted review, self service data processing, predictive search and an integrated viewer with redaction, with OpenText Connectors for Private Cloud as a paid extra. A second table names public cloud, private cloud and managed service, alongside a deployment checklist. The Aviator page describes on demand, multiple matter subscription and private cloud options for the AI features. No rate, unit, per gigabyte or per custodian price, minimum or implementation charge appears, and every route leads to Contact us or Speak with an expert. Aviator Review gives token estimates on sample data before a full run, which the vendor markets as cost certainty; that helps existing customers and is not published pricing.

The platform is sold to law firms, corporate legal departments and investigators for investigations, discovery and litigation, with the Alchemy page naming complex criminal matters, multi-defendant civil cases and joint defense groups as design targets, AI services extending to medical records, transcripts and scanned documents, review stated in any language, and hosting across six named jurisdictions. No matter type, data type or jurisdiction is named as unsupported.

Matters named are litigation, internal investigations, regulatory compliance, and personal data protection through automated detection and redaction using a preconfigured pattern library and custom regular expressions. Three use cases are published: case strategy and early case assessment, collection through production, and personal data protection. Named customers span an investigating authority, the UK Serious Fraud Office; a corporate legal department, Bosch; and the law firms Gleiss Lutz, Eversheds Sutherland and Pillsbury. Training is a four day instructor led case manager certification. No matter type is named as unsupported, no data volume ceiling is published, and no jurisdictional limit is stated. According to the AI FAQ, Aviator validation has been mainly on English language documents and prompts.