Smarsh vs Theta Lake: how they compare in 2026
Smarsh and Theta Lake capture, archive and supervise the communications of regulated firms, from email and chat to voice, video and mobile messaging, and both run AI over that record to flag risk. The difference is how each describes its AI. Theta Lake holds ISO 42001 certification for AI management, links every detection to the captured interaction behind it, and states in its agreement that output is machine generated, may be wrong and must be reviewed by the customer. Its data processing addendum commits to deletion on request and gives a right to object to new subprocessors. Smarsh's Noise Reduction Agent suppresses low relevance surveillance alerts, with audit trails and chain of custody. Its terms let it use client data to provide support and improve the services on the client's behalf. Smarsh answers with audit paperwork, committing by contract to hand clients its ISO 27001 and SSAE 18 reports and a penetration test summary.
Which one fits
Choose Smarsh if
- Your auditors want the reports as part of the contract, not after a request. Smarsh's Services Agreement commits to annual independent audits under ISO 27001 or SSAE 18 and to give clients its most recent ISO 27001 and SSAE 18 reports and a penetration test summary as standard audit documentation.
- Your firm sits outside core financial services, or spans several regulated sectors. Smarsh serves wealth management, broker dealers, RIAs and banks, public bodies handling FOIA, energy and utilities under FERC, NERC and CFTC oversight, and life sciences, with capture from mobile carriers such as Verizon and AT&T and apps such as WhatsApp and Signal.
- Your legal team needs to narrow what goes to outside counsel. Smarsh's Discovery Agent produces summaries, timelines and custodian mapping over archived communications to cut what is exported, and the archive supports legal holds, with retention periods you set, up to seven years by default.
Choose Theta Lake if
- Your governance review wants the AI itself audited. Theta Lake holds ISO/IEC 42001:2023 certification for AI management alongside SOC 2 and PCI DSS, and its agreement states plainly that machine generated output may be inaccurate or differ between runs and must be evaluated by the customer, including by human review.
- You need to supervise how employees use AI assistants. Theta Lake captures interactions with Microsoft Copilot, Zoom AI Companion, Anthropic's Claude and OpenAI's tools as records, with classifiers for prompt injection, jailbreak behavior, shadow AI and sensitive information sharing, and applies legal hold to that content for custodians in a matter.
- You want control over what is kept, for how long and where. Theta Lake lets you set retention rules, choose not to retain some records at all, and store in the region you choose, with customer specific encryption keys you can manage in AWS or Azure and a documented Relativity integration for legal hold and export.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The capabilities the vendor now leads with are driven by models, on a capture and archive platform that works without them. Two agents filter surveillance alerts and detect risk, the AI Assistant summarizes and translates, and the Discovery Agent builds summaries, timelines and custodian maps for investigations. Underneath sits a capture, retention, legal hold, search and export platform, sold for decades as a recordkeeping system of record, that functions fully without models.
Without the models, a capture, archive, search and legal hold platform remains. Capture and archiving run across more than 100 certified API integrations, and the SEC 17a-4 archive, eDiscovery export and legal hold workflow all work without a model. Proactive Compliance is where models drive a core feature: patented machine learning and language processing detect risk in what is shared, shown, spoken and typed, using more than 80 built in and custom policies, plus classifiers for prompt injection, jailbreaks, shadow AI and steered summaries. Theta Lake's AI governance page (modified 14 July 2026) presents this as a detection layer over the capture platform.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Performance figures are published without a method, and grounding is claimed rather than described. Releases and pages say the Noise Reduction Agent cuts false positives by 60 percent, the Intelligent Agent surfaces three to five times more real risk, and the Discovery Agent cuts investigation costs by up to 75 percent. No sample, baseline or test is described for any of them. The same FAQ grounds AI summaries and risk signals in traceable source data, but does not describe how a summary links back to the messages it relies on, or what happens when the AI misreads a conversation.
Legal authority is not cited. Every detection links to the captured interaction it came from, with investigation, timeline, replay and add to case views, so a reviewer opens the source rather than a summary. Proactive Compliance includes audit and explainability reporting for its ML and AI. Clause 10(d) of the MSA, updated 12 March 2026, states that output is machine generated, carries no warranty of accuracy or reliability, may differ between runs, and must be evaluated by the customer, including by human review. No detection accuracy, recall or precision figure and no test set is published.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Alert suppression is automated, and no human control over it is published. The Noise Reduction Agent and Intelligent Agent suppress alerts of low relevance so supervisory teams see fewer, and the vendor calls these autonomous systems that augment rather than replace human expertise. Nothing published says whether suppressed alerts can be reviewed or are sampled, what threshold governs suppression, or who approves the agents' configuration. That matters because supervisory review of communications is a regulatory duty for the vendor's financial services customers. Discovery Agent output is presented as input to investigators.
Theta Lake documents review tools: multi party review workflows routed by detection, investigation and timeline views, role based access on private links, two way alert links to SIEM and SOC tools, and customer set compound detection rules. It also states that the system acts on its own in places: risk remediation and prevention, automatic legal hold on AI summaries for custodians in matters, real time notices and disclaimers inserted into Teams chats, and retention rules deciding what is not kept. No threshold is published at which any of that runs without a reviewer. MSA clause 10(d) leaves evaluating output to the customer.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Two kinds of evidence are published, a commissioned study with a described method and a named customer with figures, and neither joins both. Smarsh publishes a Forrester Consulting Total Economic Impact study (September 2024) that interviewed six representatives of financial services firms, built a composite organization and adjusted each benefit for risk. It reports a 124 percent ROI over three years, archive costs down 25 percent and electronic discovery time down 65 percent. The interviewees are anonymous and Smarsh chose them. A customer story for Securities America, a named broker dealer, reports messages flagged for review falling from 19 to 10 percent (8,000 a day) in three months. That 2020 result came from professional services tuning of policy rules, not the current AI agents, and no method is given.
A customer is named with a role and a use, the Head of Technology at Longview Partners, on MiFID II compliance for Microsoft Teams, quoted on the Theta Lake site. No figures come with it. Analyst recognition includes Furthest in Vision in the 2025 Gartner Magic Quadrant for Digital Communications Governance and Archiving and first in five of six use cases in the companion Critical Capabilities report, which rate the product rather than a customer deployment. Theta Lake also publishes a case studies library.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Confidentiality is contractual, and the AI data position is not addressed. The Services Agreement treats the client's data as the client's property and confidential information, with notice before compelled disclosure, and its use license is limited to support and improvement. No published term covers the AI side: which model providers, if any, see client data, or how privilege and work product are handled in data held for discovery.
MSA section 1(d) makes Customer Data, Reports and Output the customer's confidential information. Section 5(a) limits Theta Lake's use of Customer Data to providing the service, producing output and reports, and creating usage and anonymized data, for the subscription only. The DPA's US schedule bars retaining, using, selling or sharing personal data except to provide the services on instructions, or combining it with other data. DPA section 8 commits to deletion or return on request, retention is customer set, and MSA section 8(c) requires notice before compelled disclosure. Both documents are published and readable before signing; the MSA was updated 12 March 2026 and the DPA 2 July 2025. Privilege and work product are not addressed, and nothing says what any third party model provider may keep.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The product is positioned clearly as a compliance tool, not legal advice, and supervision is left out. The Services Agreement states that Smarsh does not guarantee that use of the services, or its advice or consulting, will ensure the client's legal compliance. The legal documents page says Smarsh materials are not legal advice and customers must consult an attorney. The audience is compliance, legal and records professionals in regulated firms. Nothing addresses how supervisors or counsel should treat alerts the AI suppressed, or AI summaries, in meeting their own obligations.
MSA clause 10(d) says output is machine generated, may contain errors or be incomplete, does not represent Theta Lake's views, and is the customer's responsibility to evaluate, including by human review. Users are Authorized Users named in an order form, for internal business use. Real Time Advisor shows the customer's own policies, training links and disclaimers rather than legal conclusions. Nothing addresses a supervising lawyer's competence and supervision duties, and no jurisdiction limits are stated for a product sold in the US, UK and EU. The product has no public facing advice surface.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Transparency features are described, and no governance framework is. The innovations FAQ says AI runs within preserved, governed environments with full audit trails, traceable source data, chain of custody and access by role, so outputs are transparent and reproducible. Press coverage quotes the vendor on auditability aligned with regulator expectations. No accountable owner, testing regime before release or disclosure of uneven performance across languages or communication styles is published, although the misconduct detection agent is pitched on reading slang, jargon and multilingual exchanges. Smarsh also sells AI governance products to financial firms; those are products, not a policy for its own AI.
Theta Lake holds ISO/IEC 42001:2023 certification, an independently audited AI management standard, and lists the CSA AI Trustworthy Pledge 2025 on its trust center. It describes its classifiers as certified, safe and transparent. No accountable owner or testing before release is published, and nothing covers uneven output across content types, languages or groups, though missed detections are themselves compliance failures. The AI governance page claims CSA STAR for AI Level 2, while Theta Lake's trust center lists CSA STAR Level 1. A How We Use AI document sits behind an access request on the trust center.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The client sets retention, capture data is held only briefly before deletion, client data is deleted after termination, and subprocessors for mobile capture are listed by name and location. The trust page states encryption in transit and at rest, SSO and MFA, and regular penetration testing. The agreement and the trust page give no incident notification timeline. An Information Security Addendum is available on request.
Retention is set by the customer, including no retention, per the DPA and privacy policy. DPA section 8 covers deletion, with certification on request, and customers can export to their own S3, Azure Blob or O365 storage under MSA section 4(b). Access control includes encryption in transit and at rest, customer specific keys that can be held in the customer's AWS or Azure key service, SAML single sign on, role based access and two factor authentication. DPA section 4(b) commits to breach notice without undue delay, with details, mitigation and recommended steps. The DPA requires a Subprocessor Site giving each subprocessor's name, location and activities, with notice of changes, an objection right and termination if unresolved.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
A detailed liability position is published with an indemnity and a cap, and AI output is not covered. The Services Agreement gives a vendor indemnity against claims that use of the services infringes a U.S. patent, trademark or copyright, and caps Smarsh's liability at fees received in the prior twelve months. Service level credits are the remedy for availability failures. No term addresses AI summaries or suppressed alerts, and no insurance position is published.
MSA section 11(a) defends and indemnifies against third party patent, trademark and copyright claims, with named carve outs and a repair, replace or refund choice as the sole remedy for IP claims. Section 12 caps liability at twelve months of fees, with gross negligence, recklessness, intentional misconduct and IP violation uncapped. Exhibit A warrants 99.999% availability with service credits at three thresholds and a claim procedure. Clause 10(d) disclaims any warranty on the accuracy, completeness or reliability of machine generated output, no output indemnity is offered, and no insurance is named.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The Services Agreement and pages describe capture from email, mobile carriers such as Verizon and AT&T, apps such as WhatsApp and Signal, and Microsoft 365 Copilot, among other channels. The platform offers Audit, Identity and Review Alert APIs and exports to outside counsel tools. Product documentation sits in the Smarsh Central support portal.
More than 100 API capture integrations, built in house and certified by the platforms, each have a page: Microsoft Teams, Zoom, Webex, RingCentral, Slack, Symphony, Verizon, Asana, Mural, CrowdStrike Falcon SIEM and more, across communications, contact center, whiteboards, content, mobile, email, voice, storage, social and financial messaging. Depth is described: what is captured per channel, two way SIEM and SOC alerts, an open developer platform for workflows and data extraction, export to the customer's S3, Azure Blob or O365, and a Relativity integration for eDiscovery and legal hold. Relativity is the only legal system integrated, and no document or practice management connection is published.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Hosting model and region are stated per service in the agreement; the AI processing location is not. Professional Archive and Web Archive run in an environment Smarsh manages in the United States, Cloud Capture runs in a multitenant AWS environment in the United States, and mobile capture stores data in the United States unless agreed otherwise. Where the AI agents process data, and whether other regions are offered for them, is not stated in the documents read.
Dedicated server environments on AWS and Azure are described on Theta Lake's security page. The AI governance page says customers can set retention rules deciding which records to keep, for how long and in which region, and can store in any and multiple locations to meet data sovereignty rules. Its trust center lists AWS and Azure separately. The list of available regions, what changes by tier, and where processing happens as distinct from storage are not published.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The trust page shows ISO 27001 certification under ANAB accreditation and SOC audits by third parties. The Services Agreement commits Smarsh to annual independent audits under ISO 27001 or SSAE 18 and to give clients its latest ISO 27001 and SSAE 18 reports and a penetration test summary as standard audit documentation. The trust page and the agreement do not state the certification scope, auditor or report periods. Smarsh also runs a trust portal at trust.smarsh.com, hosted on Vanta.
A SafeBase trust center at trust.thetalake.com is reachable without a sales call, though not linked from the main Theta Lake site. It names SOC 2, PCI DSS, SEC Rule 17a-4, ISO/IEC 42001:2023, ISO/IEC 27001, TruSight, CSA STAR Level 1, the CSA AI Trustworthy Pledge 2025, GDPR, CCPA, CPRA and PIPEDA, and lists the documents behind them, including the SOC 2 report, ISO 42001 certificate, PCI DSS attestation, penetration test report and subprocessor list. The privacy policy says SOC 2 Type II and PCI DSS audits are annual, and the MSA makes the latest audit report available to customers. The reports sit behind an access request of unstated type, and no scope, date or auditor is shown openly. Two claims conflict: CSA STAR Level 1 against STAR for AI Level 2, and ISO 27001 listed against controls described as aligned with it.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The vendor describes AI models ready for production at global institutions, press coverage quotes it on large language models adapted to the domain and built by its own team, and its APIs support customers' own models. No model, provider or version is named in the agreement or on the product pages, and nothing commits to notice when the models behind surveillance decisions change.
The detection stack is described as patented, in house machine learning and language processing with built in classifiers and compound rules, with no model or provider named. The AI vendors on its integrations page, such as Anthropic, OpenAI, Microsoft Copilot and Zoom AI Companion, are what it governs, not its suppliers. Customers can bring their own classification tools and models. A How We Use AI document is on the trust center behind an access request.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure of pricing are published, and the figures are not. The Services Agreement licenses its archives by connection and by site, with a minimum commitment, overage fees, a capped renewal uplift and extra fees for long retention, all recorded in the pricing structure. The Intelligent Agent was announced as a separately priced addition. No price or rate is published, and buying runs through sales.
Part of the price appears on an AWS Marketplace listing, where Theta Lake is the seller and writes the content. Two annual platform tiers are listed: SMB, up to 999 users, at $15,000 for twelve months, and Enterprise, 1,000 users or more, at $50,000. The platform is charged per app integration, and both tiers also need a per user per year content charge by type (video, voice, chat). That per user rate, the part that grows with the organization, is not published, and nothing covers implementation. Fees are non cancellable and non refundable except as law requires. The thetalake.com site has no pricing page; every route is a demo request. RingCentral MVP customers get archiving and eDiscovery features through that reseller.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
The vendor serves financial services firms from broker dealers and RIAs to banks, along with public sector bodies handling FOIA requests, energy and utilities companies under FERC and NERC oversight, and life sciences. Small and midsized firms and enterprises have separate offerings, and SEC Rule 17a-4 and FINRA supervision are named among the rules supported. The agreement sets use limits, such as capturing only employees' communications. Nothing states which languages, channels or misconduct types the AI agents handle less well.
Theta Lake's industry pages cover financial services, state and local government, healthcare and telemedicine, education, and manufacturing and technology. Buyers are named as security and governance, compliance, retention and technology, and legal and eDiscovery teams, with specific promises on preservation, evidence sets and productions. Regulation pages cover SEC 17a-4, CFTC 1.31, MiFID II, GDPR, HIPAA and CCPA. It is bought by an enterprise compliance and legal function, not a law firm practice group. No jurisdiction or platform limits are stated, and nothing says what it does not support.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The published Services Agreement grants a use right over client data bounded to support and improvement of the services, and never names training. Section 4.2 licenses Smarsh to access and use client data as necessary to provide support and improve the services on the client's behalf. No published term addresses whether client communications train or adapt the models behind Smarsh's AI agents.
The MSA (updated 12 March 2026) limits Theta Lake's use of Customer Data to providing the service, producing output and reports, and creating usage and anonymized data, under a license for the subscription only. The DPA's US schedule bars use of personal data except to provide the services on instructions. Nothing names training either way: not the MSA, the DPA (2 July 2025), the privacy policy (updated 8 January 2026) or any product page.
Two qualifiers: anonymized data, stripped of identifiers and aggregated, may be used to improve the service, and customers can opt out by emailing the legal address; and usage telemetry is also used to improve the service. Neither names models or training.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The client sets retention. Archived data is kept for periods the client sets, up to seven years by default and longer for a fee, and capture data is held for a temporary period the client configures, up to 30 days, before deletion. Deletion after termination is provided for, though one section says as soon as practicable and another allows up to six months. Retention of AI summaries and prompts is not addressed separately.
Retention is set by the customer, and no retention is an option. The AI governance page says customers choose which records to keep, for how long and in what region, and what not to keep, with WORM storage and 17a-4 attestation options. The privacy policy says customers control retention and can apply several periods, and the DPA records retention defined by the customer. DPA section 8 commits to deletion. What is retained is captured communications, AI interaction records and reports. Theta Lake also keeps backups for business continuity and disaster recovery.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Access by role is described, and separation of matters or investigations is not documented. The agreement lets clients set user roles with different access levels, and the innovations FAQ applies role controls around AI outputs. How access is walled between investigations or legal holds is not documented in the materials read.
Theta Lake runs its own permission model rather than applying a document system's access rules at query time. It documents role based access, including on private investigation links, group and role based notices, SAML single sign on to the customer's identity provider, two factor authentication, and DPA measures for user identification and authorization. Its trust center lists access control and logging entries behind a request.
No ethical wall, conflicts check or matter level boundary is published; legal hold cases are a workflow, not an access boundary, so walls depend on how a firm sets roles.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The Services Agreement commits to reasonable notice before compelled disclosure of confidential information, including client data, where feasible and legally permitted, so the client can contest the order, and to cooperate at the client's expense.
Both documents commit to notice, and no transparency report is published. MSA section 8(c) allows disclosure of confidential information when law or a court subpoena requires it, only after written notice so the other party can contest, limit or seek a protective order, and only the required portion, treated confidentially. Customer Data, Reports and Output are the customer's confidential information. DPA section 6(b) commits to notify the customer of a binding public authority order for personal data unless prohibited, and the SCC schedule directs notice to the customer rather than data subjects. No request figures are published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The AI works over the client's own captured communications, and no external legal source is described. The innovations and trust pages and the Services Agreement were searched on 18 September 2026.
Answers come from the customer's own captured communications, not from case law or statute, so no legal corpus is used or licensed. In its place is a library of more than 80 built in and custom detection policies mapped to named rules, including SEC 17a-4, CFTC 1.31, MiFID II, GDPR and HIPAA, each with its own page.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product does not cite legal authority, so no check of later history arises, and none is described.
The product does not cite legal authority, so no published material addresses checking later history, and none would be expected of it. Detections reference the customer's own captured content and the vendor's policy library rather than decided cases.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No abstention path, confidence score or grounding indicator is described for AI summaries or risk signals. The agents suppress alerts judged of low relevance rather than flagging uncertain ones. Searches on 18 September 2026 covered the 2026 press releases, the innovations pages, the trust page and the agreement.
Nothing published describes what the system does when it cannot ground an answer. MSA clause 10(d) says output may contain errors, be incomplete or differ between uses, and must be evaluated by the customer, which assigns responsibility rather than describing behavior. Detections appear as prioritized alerts in a review workflow, and no confidence or grounding score is published.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin and trade press reporting were searched on 18 September 2026. Neither held a court record addressing fabricated or hallucinated content in output from Smarsh products. Litigation history of other kinds is not covered here.
The AI Hallucination Cases database maintained by Damien Charlotin records no case naming Theta Lake or Theta Lake, Inc., and no court order, opinion or disciplinary record naming the product or the company appears in other published trackers of AI hallucination decisions. This is a statement about the public record rather than a finding about the product. The product does not generate legal citations, which is the conduct those records address.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
The vendor cites securities recordkeeping and supervision rules, which are regulatory requirements, not bar guidance. No bar ethics opinion or court rule on AI is named, as of 18 September 2026.
No public material engages with bar or ethics guidance. Theta Lake publishes widely on regulatory obligation, with a page each for SEC, CFTC, MiFID II, GDPR, HIPAA and state privacy law, and an Ethics Policy is named on its trust center behind an access request. A corporate ethics policy is not engagement with the professional responsibility guidance a lawyer is bound by, and nothing published addresses ABA Formal Opinion 512 or any state bar opinion on generative AI.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product is bought by regulated firms for their own compliance and investigations, where no client is billed for the work. Savings are claimed for the buyer's own costs, including lower outside counsel spend and investigation costs.
Theta Lake does not touch a lawyer's fee to a client. It is bought by a company's compliance, security or in house legal function to supervise and archive its own communications, and no client is billed for its detection work. Its savings claims, such as fewer alerts, lower investigation and review cost, and less over retention, concern the buyer's own costs.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Only mobile capture subprocessors are listed in the agreement, among them TeleMessage, Microsoft Azure and AWS. No AI or model provider is named, and the DPA is available on request rather than published. The Services Agreement, trust page and legal documents index were searched on 18 September 2026.
A subprocessor list is published and maintained by contract; model providers are not named. DPA section 7 and Annex III put the list at a named URL on the support portal, with each subprocessor's name, location and activities, notice of changes, and an objection right with termination as remedy. The trust center has a subprocessor entry behind a request, and the published DPA can be forwarded to clients. No statement of which model providers see customer content is published; a How We Use AI document sits behind the same request.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Parts of a defensible record exist, short of an AI disclosure record. The archive supports legal holds and exports, and the vendor describes chain of custody and reproducible AI outputs. Nothing records which model produced a summary or risk signal, or who reviewed it.
Theta Lake captures AI interactions, identifying the assistant used with prompts and responses, puts them on a timeline, applies legal hold automatically for custodians in a matter, keeps review actions and policy notices in an audit history, produces conversation audit reports, and exports to the customer's storage. It does not produce a certification for each document tying a model, sources and a human reviewer to a filing, because it records communications rather than brief drafting, so a firm would assemble any certification itself from that material.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
- Refusal and Uncertainty Behavior
- Bar Guidance Alignment
In summary
Smarsh
Smarsh, of Portland, Oregon, captures, archives, supervises and searches the communications of regulated firms, mainly in financial services. It covers email, messaging, collaboration tools, mobile including WhatsApp, voice and social media, to meet rules such as SEC Rule 17a-4 and FINRA supervision. Its AI agents suppress low relevance surveillance alerts, detect misconduct across languages, summarize and translate messages, and support investigations. According to the AI Legal Index, its published Services Agreement lets clients set retention, commits to notice before compelled disclosure and provides ISO 27001 and SSAE 18 reports to clients. It licenses per connection.
Theta Lake
Theta Lake, based in Santa Barbara, California, is a communications governance and archiving platform for regulated organizations. It captures voice, video, chat, mobile messaging, email and whiteboard content through more than a hundred API integrations and applies machine learning to detect compliance, conduct and data protection risk. It also governs employees' interactions with AI assistants. According to the AI Legal Index, it holds ISO 42001 certification for AI management, and its published agreement and data processing addendum cover confidentiality, deletion, subprocessors and notice before compelled disclosure. It sells through AWS Marketplace, with platform tiers from $15,000 a year.
Questions buyers ask
Smarsh vs Theta Lake: which is better for communications compliance?
On published evidence Theta Lake documents more, and its lead comes from how it describes its AI: ISO 42001 certification, detections linked to source content, and contract terms on deletion and subprocessors. Smarsh serves a broader range of regulated sectors and commits contractually to hand clients its audit reports. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Does Smarsh's AI suppress surveillance alerts without review?
Smarsh's Noise Reduction Agent and Intelligent Agent suppress low relevance alerts so supervisory teams see fewer, and Smarsh reports false positives down 60 percent. The vendor describes the agents as augmenting rather than replacing human expertise, with audit trails and chain of custody. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
How much does Theta Lake cost?
Theta Lake's AWS Marketplace listing, where it is the seller of record, shows an SMB platform tier for up to 999 users at $15,000 a year and an Enterprise tier for 1,000 or more users at $50,000 a year, charged per app integration. Both tiers also carry a per user per year content charge for video, voice or chat. Fees are non cancellable and non refundable. Smarsh licenses per connection. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Do Smarsh and Theta Lake train AI on client communications?
Smarsh's Services Agreement lets it use client data to provide support and improve the services on the client's behalf. Theta Lake's agreement confines use of customer data to providing the service, generating reports, and creating anonymized aggregated data that may improve the service, with an opt out by email. Both tie data use to the service. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Two points to weigh. Theta Lake's own pages disagree in places: its trust center lists CSA STAR Level 1 while its AI governance page claims Level 2 for AI, and it lists ISO 27001 as a compliance item while its security architecture page says only that controls are aligned with it. Smarsh publishes performance figures for its AI agents, such as 60 percent fewer false positives, without a sample or method, and its own terms conflict on whether client data is deleted as soon as practicable after termination or kept for up to six months. Neither vendor reviewed this page.