AI Legal Index
Vendors · Regulatory & Compliance Counsel

C
Canopy

Canopy is data breach response software from Canopy Software, Inc. of Reston, Virginia, which Epiq acquired on 25 September 2026 and is bringing into its Epiq AI agentic suite through Epiq Service Cloud. It is used by review and legal service providers, digital forensics and incident response firms, breach counsel and cyber insurers after a cyber incident. Its patented Data Breach Response product uses hundreds of machine learning models to find personal and health information in compromised data of any file type without normalization, produces an impact assessment report of what was found, speeds document review, consolidates records into a deduplicated list of affected people, and exports notification lists for GDPR, HIPAA, FERPA and other notification duties.

Auto Review automates the first level of review with a proprietary ensemble of generative AI and large language models, with confidence levels that direct human quality control. It runs on AWS in the United States, Canada, the European Union, Germany, the United Kingdom and Australia. Law firms typically reach it through Canopy's partner providers, and named users include Wotton + Kearney. Pricing is not published.

Vendor siteCompare with other vendors
Compared with

Canopy, head to head

Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.

Build your own comparison

Alternatives

Alternatives to Canopy

Vendors in the same categories as Canopy whose graded profiles look most alike, with a line on what each product does.

Similar is not the same, so check that each one does the job you need. No vendor pays for placement.

Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.

Capability grades

All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.

AA on AI CentralityThe artificial intelligence is the product. Remove the models and there is nothing left to sell.

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Canopy says hundreds of machine learning models detect personal and health information in any file type, deduplicate records into unique affected people and build the notification list. Auto Review carries out first level review itself, using what Canopy calls a proprietary ensemble of generative AI and large language models. Without the models there is little left to sell.

Source: Vendor Published
CC on Citation Accuracy and Hallucination DisclosureAccuracy is asserted without measurement, or grounding is claimed while output cites sources the reader cannot open and verify.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Detection is more precise than ediscovery keyword and regex searching, Canopy's site says, and Auto Review avoids the hallucinations of generic language models. Auto Review adds Intelligent Confidence Scoring and reprocessing driven by human corrections. Case studies report hours saved and records consolidated, and the Wotton + Kearney study reports a 15 percent faster PII review. No detection rate, error rate or test set is published. The product does not cite legal authority.

Source: Vendor Published
BB on Autonomy and Oversight ModelA written commitment that the models work alongside a supervising lawyer, with real review surfaces, short of the full control structure: commonly the threshold at which the system stops or what happens after it is wrong.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Auto Review is described as replacing the first level review team, and its confidence level reporting tells review managers which documents need a second look in quality control; in Data Breach Response, people review the documents the models flag. The law firm page says classifications are validated by humans, and a hospital PHI case study limits human effort to quality control. Nothing states a limit on sending a notification list without human review.

Source: Vendor Published
BB on Operational and Outcome EvidenceReal deployment evidence with substance, short of full attribution or measurement: a named customer without figures, or figures without the named customer.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

A Wotton + Kearney case study names the firm and quotes Kieran Doyle, its Head of Cyber, Privacy and Technology: 76.77 GB of PST files, more than 829,000 documents, 15 categories of PII and a 15 percent faster PII review. An Intevac privacy audit study quotes IT Director Brenda Thrasher: a 10 GB PST, more than 110,000 emails and documents, and 3.5 hours to the first PII report. An unnamed hospital study reports 6,600 PDFs reviewed in 15 days for an incident affecting over 150,000 people.

Other case studies, gated behind download forms, report one review team saving 2,000 hours, one partner finishing review in about a third of the time and saving its client over $300,000, and 4.28 billion entities consolidated to 3 million unique people, with no customer named. Listed partners are cyberSuite, DWF, Elevate, Emergence Insurance, Epiq, Incident Response Solutions Limited, KLDiscovery and Wotton + Kearney. A partnership expansion to the UK and APAC on 5 February 2025 claimed review up to 60 percent faster.

Source: Vendor Published
CC on Privilege and Confidentiality PostureConfidentiality is asserted in general terms, or the commitment lives only in a sales conversation and cannot be read in advance.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The Privacy Notice, last updated 14 November 2023, says Canopy processes client data only as a litigation support service provider on its clients' instructions and that employees sign confidentiality agreements, and the security pages describe encryption and a virtual private cloud in the customer's jurisdiction. No customer agreement is published. Nothing says whether customer data trains Canopy's models: Canopy's home page says the platform gets smarter with every project, the law firm page says human validated classifications help the algorithms continuously improve, and Auto Review learns from human corrections. Privilege is not addressed.

Source: Vendor Published
DD on UPL and Professional Responsibility PostureNothing published on the advice line for a product that produces legal work, including where it is sold to people who are not lawyers.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.

The software produces the lists breach counsel rely on to advise clients on notification duties, but nothing states that it gives no legal advice or addresses counsel's review of its output.

Source: Operator Verified
DD on AI Governance and Bias DisclosureNo governance position published for a system whose output affects legal outcomes.

AI Governance and Bias Disclosure

Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

No AI governance position, accountable owner, testing before release, or finding on how detection performs across document types, languages or regions is published.

Source: Operator Verified
CC on AI Safety and Data StewardshipA generic privacy policy covers the product without addressing what happens to documents and prompts after processing.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Safeguards on Canopy's site run to encryption at rest and in transit, a virtual private cloud within the customer's jurisdiction, tenant administrator permissions, penetration testing and staff security training. The Privacy Notice, last updated 14 November 2023, does not say how long case data is kept or how it is deleted. No subprocessor list or incident notification commitment is published; the trust center requires a login.

Source: Vendor Published
DD on AI Liability and RecourseNothing published on who bears the loss when the system is wrong.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No customer agreement is published, so nothing states Canopy's liability, warranties or indemnities.

Source: Operator Verified
DD on Practice Systems Integration DepthNo integration into practice systems located, or the product stands alone and requires work to move to it.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Entity and notification lists export in formats suited to different jurisdictions, and Canopy's DFIR page offers processing templates built in advance by region, regulation and sector. No connection to a review platform, case management or other practice system is published.

Source: Operator Verified
BB on Deployment Model and Data ResidencyDeployment model is stated clearly with partial residency detail, or residency is offered without the processing location being addressed, or the tenancy model is stated on its own with no residency detail published.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The software runs on AWS with separate instances and logins for the United States, Canada, the European Union, Germany, the United Kingdom and Australia, more regions on request, and data resides in a virtual private cloud within the customer's jurisdiction. Canopy says it is available in 26 countries and can be up in any supported region within 48 hours. Since 8 July 2026, Auto Review computation for Australian data runs in Australia, and the data does not leave the country. Elsewhere, where model processing runs is not stated separately, and no other deployment option is offered.

Source: Vendor Published
BB on Security Certifications and Trust CenterCertification is real and stated, short of accessible evidence: a named standard without scope, date, or a way to obtain the report.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Canopy says it maintains ISO 27001 certification and regularly runs third party penetration tests. The trust center linked from the footer requires a member login, and no certificate, scope or date is published on the public pages.

Source: Vendor Published
CC on Model Supply Chain DisclosureThe vendor refers to advanced or proprietary models without identifying what sits underneath.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Canopy describes hundreds of patented machine learning models, continuously trained, using clustering algorithms, neural networks and natural language processing, and announced U.S. Patent No. 12,596,938 on 7 April 2026. Auto Review is "Enhanced with a proprietary ensemble of GenAI and large language models (LLMs)", and Canopy says its agentic approach outperforms generic language models. No model, provider or architecture is named, and no notice of changes is committed.

Source: Vendor Published
DD on Commercial TransparencyNo pricing information published at any level, including the unit of charge.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No price, unit or tier is published; every route to a price is a demo request.

Source: Operator Verified
BB on Firm and Practice CoverageSegment and practice coverage is described with substance, short of the boundaries: what is supported is clear, what is not is left open.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Digital forensics and incident response firms, review and legal service providers, law firms and cyber insurers are the audiences on Canopy's site, which covers ransomware and business email compromise and names GDPR, HIPAA and FERPA notification duties across its hosting regions. Epiq acquired Canopy on 25 September 2026: Canopy joins the Epiq AI agentic suite through Epiq Service Cloud, former COO Adi Elliott becomes VP Product Management, Cyber, and its engineers join Epiq AI for Cyber.

The site footer still names Canopy Software, Inc. What data types, languages or jurisdictions it does not handle is not stated.

Source: Vendor Published
Sources on file

5 public documents

The public pages on file for Canopy, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.

Change log

Product updates

Sep 25, 2026Acquisition / corporateVerified

Epiq acquired Canopy, maker of the patented Data Breach Response platform and the agentic Auto Review feature that automates first level data mining review. Epiq states the Canopy platform will be integrated into its Epiq AI suite and made accessible through Epiq Service Cloud, with Canopy engineers joining to build Epiq AI for Cyber. Former Canopy COO Adi Elliott becomes Epiq VP, Product Management, Cyber.

Bears on: Deployment Model and Data ResidencySource
All Canopy updates →

Legal Signals

What each signal means

A signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.

Confidentiality and Privilege

Client Data in Training

Can material a lawyer puts into this product be used to train a model?

No agreement published

No customer agreement, terms of service or equivalent contract is published on any surface located, and no policy page states a position on training. Nothing is granted and nothing is withheld, so a client has no term to hold the firm to. Where a policy page does state a position, the row takes the matching policy value instead and the summary records that no agreement exists.

No customer agreement is published on the home, product, About or security pages, in the site map or at the /terms and /terms-of-service addresses, and the Privacy Notice takes no position on training. The product pages say Canopy's models are continuously trained without saying on what data, and Auto Review learns from human corrections.

Source: Operator VerifiedAs of Sep 22, 2026

Prompt and Output Retention

How long does the product keep what a lawyer typed, and can that be set to zero?

Not addressed

No located public material states how long prompts and outputs are retained.

The Privacy Notice says client data is processed on clients' instructions but states no retention period for breach data, review decisions or generated lists, and the product and security pages state none either.

Source: Operator VerifiedAs of Sep 22, 2026

Ethical Walls and Matter Segregation

Does retrieval respect the firm’s ethical walls, or can the model read across them?

Own model, documented

The product maintains its own permission model, documented, requiring the firm to keep it aligned.

Access is set in Canopy's own permission model, maintained by the customer's tenant administrators, covering who can see data and who can export entity lists; each customer's data sits in a virtual private cloud in its jurisdiction. Nothing describes separating individual matters within a tenant or inheriting permissions from another system.

Source: Vendor PublishedTenant admins can set user permissions for everything from accessing data to exporting entity lists.As of Sep 22, 2026Evidence

Third Party Request and Subpoena Notice

If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?

Disclosure addressed, notice absent

Published terms or policy address disclosure to authorities or in response to legal process, and no commitment or reservation regarding customer notice is located anywhere. The vendor has told the customer that data can leave and has said nothing about whether the customer hears of it.

The Privacy Notice says Canopy does not disclose personal information to third parties except as required by law in response to lawful requests by public authorities, including for national security or law enforcement. Nothing addresses notifying the customer, and no customer agreement is published.

Source: Vendor Publishedin response to lawful requests by public authoritiesAs of Sep 22, 2026Evidence
Accuracy and Authority

Primary Law Corpus Provenance

Where does the law in this product come from, and does the vendor have the right to use it?

Not addressed

No located public material identifies the corpus behind the product’s answers.

Canopy works on each customer's breached data. Notification rules are said to vary by jurisdiction and industry, but the product and law firm pages identify no source of those rules.

Source: Operator VerifiedAs of Sep 22, 2026

Good Law Verification

Does the product tell you when the authority it just cited has been overruled?

Not addressed

No located public material addresses whether authority is checked for subsequent history.

The product does not cite legal authority, and nothing on the product or law firm pages addresses checking authority for later treatment.

Source: Operator VerifiedAs of Sep 22, 2026

Refusal and Uncertainty Behavior

What does the product do when the answer is not in the corpus?

Confidence signal only

The product exposes a confidence or grounding score without an explicit abstention path.

Auto Review reports a confidence level for its first level review decisions, through what Canopy calls Intelligent Confidence Scoring, and Canopy says this tells review managers which documents need a second look in quality control. No path in which the system declines to classify a document is described.

Source: Vendor PublishedAs of Sep 22, 2026Evidence

Fabricated Citation Record

Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?

None located

No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.

The AI Hallucination Cases database maintained by Damien Charlotin records no case naming Canopy, and no court order, opinion or disciplinary record naming the product is on the public record. This is a statement about the public record rather than a finding about the product.

Source: Bar Guidance or Court RecordAs of Sep 22, 2026Evidence
Professional Responsibility

Bar Guidance Alignment

Has the vendor engaged in public with the ethics opinions its buyers are bound by?

Not addressed

No located public material engages with bar or ethics guidance.

Nothing on the home, law firm, review and LSP or About pages or in the Privacy Notice engages with lawyers' professional or ethical obligations or names any ethics opinion.

Source: Operator VerifiedAs of Sep 22, 2026

Billing and Fee Posture

Does the vendor address what happens to the bill when the work takes an hour instead of six?

Outside the fee relationship

The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.

Canopy is licensed by incident response and review providers who bill the breached organization for the work; law firms reach it through those partners and advise the client on the results. It does not sit in a lawyer's own time billing, and nothing addresses how its use is reflected in legal fees.

Source: Vendor PublishedAs of Sep 22, 2026Evidence

Outside Counsel Guideline Readiness

Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?

Not addressed

No located public material supports a client side disclosure obligation.

The security, product and review and LSP pages and the Privacy Notice publish no subprocessor or model provider list and no client facing disclosure material; the trust center requires a member login.

Source: Operator VerifiedAs of Sep 22, 2026

Court Disclosure Support

If a judge’s standing order requires an AI disclosure, can the product produce one?

Not addressed

No located public material addresses court disclosure or verification certification.

The regulator, not a court, usually receives this work. The product and law firm pages describe an impact assessment report and defensible detection, but nothing records which decisions the models made and which a person verified, or addresses disclosing AI use.

Source: Operator VerifiedAs of Sep 22, 2026
Contact

Correct a record, or ask how something was graded

Every grade and every signal on this index is drawn from public sources and dated. If a record is wrong, out of date, or missing an artifact the index did not locate, send the source and it will be reviewed and the record redated. Vendors are welcome to submit documentation. Nothing on this index is for sale, including a listing, a placement, or a grade.

AI Legal Index

The AI Legal Index is an independent index that tracks changes to AI vendors in legal. It holds 462 vendors across 9 categories, each graded on the same 15 capability axes and recorded against 12 legal signals, from public sources. No vendor pays for inclusion, placement, or rating.

Index Status
Last index update
November 8, 2026
The AI Legal Index is an editorial reference. It is not a regulatory body, not a law firm, and nothing published here is legal advice or a recommendation to retain or avoid a vendor. Records are verified against published sources, bar guidance and public court records. Where a record reads not addressed, the material was not located in public sources on the date shown. See the Methodology page for evaluation standards and limitations.
© 2026 AI Legal Index
3801 N Capital of Texas Hwy, Ste E240 · Austin, TX 78746