C

Casepoint

CaseAssist Active Learning learns from reviewers' decisions to put likely relevant documents first, and the vendor ties its claim of 95 percent faster identification to it. Generative features add chat over customer data, summaries and automatic classification. Without the AI, a full eDiscovery platform remains: legal hold, collection from Microsoft 365, Teams, Slack and Google Vault, processing of more than 600 file types, review, production, FOIA work and hosting at government authorization levels.

The AI is bundled at no extra cost rather than sold on its own, and the vendor leads with security and unified workflow, with AI third.

Generative answers use retrieval augmented generation over the customer's own data, with source citations, so a reviewer can open the document behind an answer. The agreement names five limits of its AI: training data quality, errors from vague prompts, nuance and sarcasm in language, factual inaccuracy, and lack of common sense. No accuracy figure, recall or precision statistic, or validation protocol is published, and courts examine validation statistics for technology assisted review. The terms also bar customers from sharing benchmark results without written consent.

Casepoint states that its technology should amplify human judgment, not replace it, and the agreement commits to human in the loop AI features. Every generative feature is optional, and the customer controls adoption. Reviewers get source citations on generated answers, and transparency logs are said to record every AI decision. Active learning is supervised by design, since reviewers' own calls train it. The agreement also tells customers not to rely solely on output for anything with material consequences.

No threshold at which a feature declines to answer, no behavior when the data does not support a result, and no route for reporting a wrong output is described.

Marriott International, Mayo Clinic, the West Virginia Office of Technology, Kramer Levin, Beveridge & Diamond, Larkin Hoffman and Lewis Roca are named as customers, with named people and titles. Lewis Roca, an Am Law 200 firm, is tied to a measured result: more than 90 percent less document review time from the analytics and AI. Other case studies report a 57 percent cut in discovery related costs at a Fortune 500 construction company, faster FOIA responses at a major defense agency, and a migration of up to a petabyte at a federal regulator.

Casepoint states more than 250 government agencies and about 80 percent of federal agencies as customers. Most measured results name a category rather than a customer.

Confidential information, as the agreement defines it, includes attorney work product, attorney client privilege, personal data and health data. A separate AI clause makes AI inputs and outputs customer data and confidential information, limits their use to running the service, and commits AI features to enforce the customer's access and matter permissions. It also prevents retrieval across tenants or matters and logs administrative access.

Casepoint staff may review AI inputs or outputs only for customer requested support or a security incident, with time limited, audited access. Remote support needs the customer's own enablement and multi factor authentication. Another clause gives Casepoint a transferable license over customer data and usage data to improve its products, and the AI clause carves out only AI inputs and outputs.

Customers are told not to rely solely on any output, including AI output, for anything with material consequences or that affects anyone's rights, under Casepoint's agreement. It makes the customer responsible for the completeness, accuracy and content of the results it relies on. Human in the loop is a stated commitment, and the vendor says technology should amplify human judgment. No bar or ethics authority is named, including ABA Formal Opinion 512, no jurisdiction limits are stated, and nothing addresses the duties of the reviewers who act on the output. The product has no consumer facing surface.

TRUST, the AI framework, has five principles, and Casepoint's terms turn several of them into commitments. The terms limit how AI inputs and outputs may be used, restrict staff review of them, require AI features to respect the customer's access and matter permissions, and require logging of administrative access. Transparency logs are said to record every AI decision. Customers above a stated spend get an annual audit right over privacy and security controls.

No fairness testing, testing regime or accountable owner is published, and nothing addresses whether review ranking can be uneven across custodians, languages or document types.

Casepoint commits to written notice within seventy two hours of a validated security incident, with updates on cause, mitigation, impact and remediation. On termination it exports all customer data in a common format within a seven day window, and states that copies may persist on backup media. Access controls include role based access, zero trust networking, encryption in transit and at rest, and no standing remote support access.

Staff face ten year criminal background checks and OFAC screening. Disaster recovery plans are tested every year. The agreement promises a subprocessor list, and none is published.

The general cap is the fees paid under the relevant order in the six months before a claim. A higher cap of five times annual fees, plus direct damages, applies to confidentiality breaches, data breaches, gross negligence and willful misconduct. Personal injury, fraud and anything that cannot be excluded by law are carved out. Casepoint defends and indemnifies against claims that the software infringes a copyright in the United States or misappropriates a trade secret, with named remedies.

The software is warranted to perform substantially as documented for sixty days, services are warranted as workmanlike, and uptime is committed at 99.5 percent with service credits. No warranty attaches to AI output, the agreement puts accuracy on the customer, and no insurance position is published.

Microsoft 365, Microsoft Teams, Slack and Google Vault are collected in place without manual export, through connections into the systems where data lives, with more than 600 file types in processing. An API automates collection from those platforms. The MCP Server connects a customer's own approved AI systems to the platform. No iManage or NetDocuments integration is named, nothing covers matter management, ebilling or court filing, and no public API documentation is published. The terms restrict use of APIs Casepoint does not support.

Deployment comes three ways, hosted by Casepoint with 99.5 percent uptime, installed by the customer or a third party under named conditions, and in separately certified government environments. SOC 1, SOC 2, SOC 3, ISO 9001, ISO 27001 and NIST apply to the commercial offering, and GovRAMP, FedRAMP Moderate and High and Department of Defense Impact Levels 4 to 6 to certain environments. Residency is committed for export controlled data, which stays in environments Casepoint controls in the United States, with no replication abroad and access only by American persons.

No region list for the commercial offering, tenancy model, or split between where data is stored and where it is processed is published. A Canada government offering appears in the navigation with no residency statement.

Casepoint holds fourteen certifications and authorizations, each explained on its security page. They are FedRAMP High and Moderate, Department of Defense Impact Levels 4, 5 and 6 with DISA authorities to operate, GovRAMP, SOC 1 Type II, SOC 2 Type II, SOC 3, the SIG questionnaire, ISO 9001:2015, ISO 27001:2022, NIST 800-53, NIST 800-171 and the Data Privacy Framework between the EU and the United States. FedRAMP and DISA authorizations are assessed by third parties and listed by the authorizing bodies, so they can be confirmed without a sales call.

The SOC 2 Type II is described as annual, covering all five Trust Services Criteria over twelve months. The agreement restates the set and says which apply to the commercial offering and which to certain environments. No auditor is named for the SOC or ISO work, and no report date is shown. Reports are available to customers on request.

Generative answers use retrieval augmented generation over the customer's own data. The agreement names machine learning, technology assisted review and large language models as the technologies in use. It commits Casepoint to license third party software properly, patch it, and keep a list of material third party components and subprocessors; that list is not published. No model, provider, version or inference location is named, and no notice is promised when a model changes. The separate MCP Server lets a customer connect its own approved AI systems.

The pricing page is titled Transparent Pricing and gives no price. It does publish the shape of the deal: a modular platform priced to the applications a customer takes, with no charge for products it does not use. The purchasable modules are named across the site, from eDiscovery and Legal Hold to FOIA, Casepoint AI and the MCP Server. The agreement adds billing mechanics. Fees are the greater of actual usage or the agreed cap, metered on data storage, processing and users.

Terms run one year and renew automatically unless either side gives sixty days' notice. No rate, per gigabyte or per user figure, or starting price is published. The only route is a demo request.

By market Casepoint serves federal civilian, federal defense, state, local and education, Canada, and corporate enterprise. By team it serves corporate legal, government legal, FOIA and public records, audit and investigations, and IT and security, with a separate law firm page. Use cases include legal hold, investigations, litigation, eDiscovery, data subject access requests, third party subpoena responses, FOIA requests and congressional inquiries.

It processes more than 600 file types from named sources. No excluded practice area, unsupported data source or volume limit is named on the platform, pricing or security pages or in the site navigation, and the Canada offering is not described.