D

DecoverAI

Classification for responsiveness, privilege and confidentiality is what compresses the review, and every downstream artifact depends on it: the privilege log is generated from the AI's privilege calls, redaction is driven by automated detection with attorney override, and the headline claim is 80 percent less review because the model triages every document. The company markets a webinar on how it post trains an LLM to run document review at under five cents a document. Without the models, document storage with Bates numbering remains.

The published subprocessor list names Parallel Web Systems for web search grounding of AI answers and citations, Cohere for reranking search results, and UniCourt for case law and litigation data feeding AI research features, so a reader can see what answers rest on and who supplies each part. The agreement names failure modes: clause 13.5 refers to incorrect, inaccurate or hallucinated AI output, including case citations and regulatory references. No accuracy figure, test set or evaluation is published. A white paper on defending AI review is published.

The product position is that every classification is reviewable and every redaction overridable, with redactions burned without touching originals so the underlying document survives an override. The commitment is contractual as well as marketing: clause 2.5 makes the customer solely responsible for supervising and verifying all AI generated outputs before professional reliance, and clause 13.5 requires independent review and verification by a licensed attorney.

Clause 4.3 keeps access and activity logs for at least twelve months and makes them available on written request. No threshold is published at which the system stops or escalates, no confidence signal is described as visible to the reviewer, and nothing states what happens after a misclassification is found beyond the customer's own override.

Six case studies are published, three naming the firm: Clayton Trial Lawyers, with a 15.4 million dollar jury verdict after a five week trial; Schaff Law Group, with more than 100 hours saved on case preparation; and Gregor Wynne Arney PLLC, processing more than a million documents in a 35 million dollar healthcare fraud and anti kickback investigation. Three more give figures without a firm name, including 30,000 documents produced in three days saving 147,000 dollars and 25 days, a remediation of more than 360,000 documents fixing six of six defects under federal scrutiny, and a construction defect matter covering a terabyte across three buildings. The figures are tied to the named firms. No case study is dated, and no method appears on the summary cards.

Clause 7.3 treats all Customer Data as Confidential Information and says nothing in the agreement waives any legal privilege or protection over it. Clause 10.4 gives privileged Customer Data the highest level of protection, instructs staff not to review Customer Data except as strictly needed for technical support and only with the customer's prior authorization, and binds everyone with possible access to written confidentiality.

Clause 7.9 prohibits training without prior written consent. Separation is documented: single tenant deployment, private VPC, deployment in the customer's own VPC, least privilege role based access, and processing in isolated environments destroyed after each job. Clause 7.10 sets retention and deletion, with irreversible deletion and written certification available. Nine AI and machine learning subprocessors are named with their role and country.

Clause 2.5 says the Services are productivity tools and not legal advice, and names the duties engaged: competence under ABA Model Rule 1.1, confidentiality under ABA Model Rule 1.6, and supervision. Clause 11.4 says the Services do not replace professional legal judgment and no generated content is legal advice. Clause 13.5 requires a licensed attorney to review and verify output before relying on it and puts the risk of unverified reliance on the customer.

Clause 4.4 requires the customer to warrant it has any client consent needed under bar rules or ethics opinions on cloud legal technology, and clause 2.3 bars use that breaks professional responsibility rules. No jurisdiction limit on substantive coverage is stated, and the product works on the customer's own documents; the authorities named are American and California law governs.

No AI governance framework is published: no one is named as accountable for model behavior, no evaluation before release is described, no test results are published, and nothing addresses bias or uneven output, although the product's core job is classifying documents as responsive or privileged. SOC 2 Type II covers security, availability and confidentiality, controls are said to be monitored continuously and shown live in a trust center, and a white paper on what courts expect from AI assisted review is published. Security certification is a different subject from AI governance.

Retention is a stated period: clause 7.10 retains Customer Data for the subscription term plus thirty days for export, then irreversibly deletes or destroys it, with written certification of deletion on request, and clause 7.7 lets the customer request removal at any time with a commitment to process it within thirty days. Access control under clause 7.4 covers TLS 1.2 or higher in transit, AES-256 or equivalent at rest, role based access and least privilege for DecoverAI personnel, and regular penetration testing and vulnerability scanning by independent third parties.

Incident practice is contractual: clause 3.5 commits to notifying the customer of any confirmed security breach affecting Customer Data within seventy two hours of confirmation. The subprocessor list is public, dated and versioned, naming every provider, its function and its country, with thirty days' prior written notice before any addition and a subscribable list for change notices. Clause 4.3 retains access logs for at least twelve months and releases them on request, and clause 7.11 gives an annual customer audit right.

Clause 12.1 indemnifies against patent, copyright, trademark and trade secret claims, with five exclusions at 12.3 and remedies at 12.2. Clause 13.2 caps each party at twelve months of fees, and clause 13.3 lifts the cap for breach of confidentiality, gross negligence or willful misconduct and for DecoverAI's indemnity, leaving confidentiality breach uncapped. Clause 11.2 gives six warranties, including that the Services will perform materially as documented and that DecoverAI maintains SOC 2 Type II certification, turning a marketing claim into a contract promise.

Clause 14.1 commits to 99.9 percent uptime with service credits. No insurance position is published. Clause 13.5 disclaims liability under any theory for incorrect, inaccurate or hallucinated AI output, naming case citations and regulatory references, and puts all reliance risk on the customer.

The subprocessor page lists customer authorized connections: Microsoft SharePoint, OneDrive and Microsoft 365 through the Graph API, Google Drive and Gmail, Dropbox, Box, customer owned Amazon S3 buckets, and two legal systems, iManage and Clio. It says DecoverAI reaches these sources only at the customer's direction and under the customer's own agreement with each provider, and that the customer configures the connections.

Appendix A of the agreement lists connectors to document management systems, email platforms and cloud storage as a contracted service element set in the Order Form.

Three options are published: default multitenant, single tenant with dedicated infrastructure, and deployment in the customer's own VPC for full isolation, all with AES-256 at rest and TLS 1.2 or higher in transit, and processing in isolated environments destroyed when each job finishes. The subprocessor list gives a country for every provider, placing AWS hosting and storage in the United States, optical character recognition by Mistral AI in France, and reranking by Cohere in Canada, which separates where processing happens from where data is stored.

No residency offering is published: no region can be chosen, and nothing lets a customer require data to stay in a given jurisdiction.

SOC 2 Type II is claimed for the security, availability and confidentiality criteria, verified over an observation period rather than at one point. HIPAA compliance is claimed, with a Business Associate Agreement on request. Clause 11.2(f) warrants that DecoverAI keeps SOC 2 Type II certification, and clause 7.11 gives an annual audit right that DecoverAI may meet with its latest SOC 2 Type II report and a third party penetration test summary.

A trust center at trust.decover.ai is said to show control monitoring live. No auditor, report date or observation period is published, and the full report is available only under NDA. GDPR is described as certification in progress.

The subprocessor list, dated August 2026 and versioned, names nine AI and machine learning providers with their role and country: OpenAI, Anthropic and Google through its Gemini API for inference in document analysis, classification and question answering, all in the United States; OpenRouter as a routing layer to more models; Mistral AI in France for optical character recognition; Cohere in Canada for reranking; E2B for isolated code execution in agent workflows; Parallel Web Systems for web search grounding; and UniCourt for case law and litigation data.

AWS is named for hosting, storage, databases, search, authentication and content delivery. Additions require thirty days' prior written notice, with a notification list, repeated in clause 7.5 of the agreement. Gemini is named as a model family and the rest only by provider, and the OpenRouter layer means the model behind a given request is not disclosed by design.

The rate is 60 US dollars per gigabyte per month, described as all in, with no seat fees, enterprise tier or contract, and the page lists what it covers: AI classification for responsiveness, privilege and confidentiality, redaction detection with attorney override, an automatic privilege log spreadsheet, Bates numbering to firm conventions, a full audit trail for regulatory productions, and SOC 2 compliant encrypted hosting.

A second unit is two cents per document, with an example that most teams process five to twenty gigabytes per matter for 300 to 1,200 dollars all in, and a cost estimator and self serve signup are offered. The marketing says no contracts and no seat fees, while the agreement provides for Order Forms with user seats, capacity limits, overage rates, annual invoicing in advance, sixty days' notice to stop renewal, and fees due to the end of the term. Both are published.

Four stages of litigation have their own pages: ediscovery, early case assessment, internal investigations covering cyber breaches, whistleblower actions, subpoenas and regulatory inquiries, and trial preparation. Case studies show the matter types: commercial litigation, personal injury, white collar crime, a tax credit investigation, a federal production remediation and a multiparty construction defect matter. Buyers are law firms and in house legal teams, and HIPAA is positioned as the baseline for personal injury, medical malpractice and healthcare investigations.

Clause 2.4 addresses US Government use rights under FAR and DFAR. No firm size, matter volume range, or excluded matter or data type is stated.