D

DISCO

The models drive a core layer on a platform that works without them. DISCO Ediscovery covers upload, filtering, review and production, and Cecilia AI arrived in 2023, about a decade after the company was founded. Cecilia Q&A, single document Q&A, summaries, definitions and Auto Review's first pass classification run on language models. DISCO now sells unlimited Cecilia AI inside its per GB rate, so the generative features come with every matter on the platform.

Cecilia Q&A answers only from the customer's evidence, with citations, and Auto Review gives an explanation for every tagging decision so a reviewer sees why each classification was made. Auto Review tracks recall and precision inside the product, and DISCO's AI consulting team advises on sampling and validation. DISCO says Auto Review delivers precision and recall 10 to 20 percent above human reviewers. No test set, date, evaluator or method accompanies that figure, so an outsider cannot check or reproduce it.

Auto Review suggests tags with an explanation for each, and the team moves to quality control on those suggestions. Customers choose whether to run Auto Review themselves, refining tags with Tag Tuner, or to have DISCO's Managed Review team run the project, including privilege review. Recall and precision are tracked in the product so a team can validate the review before relying on it. Cecilia answers cite the evidence they draw on. No threshold at which a document must go to a person, and no limit on what Auto Review decides unaided, is published.

CS Disco's annual filing, a regulated document, reports 1,549 customers including 330 large customers and a 98 percent dollar based net retention rate at 31 December 2025. Named customer material is published too. A Perkins Coie associate is quoted on Auto Review, and a story on Rhoades McKee describes DISCO's professional services on an inherited multi jurisdiction case. Auto Review is said to deliver precision and recall 10 to 20 percent above human reviewers, with no test set, date or method given. No named customer is paired with dated figures and a method a reader can assess.

The language models used in Cecilia never train on or learn from customer data and usage, DISCO says, and do not retain customer data after a query. The models behind Auto Review are prohibited from training on or retaining customer data after processing, and model vendors must hold SOC 2 Type 2 or ISO 27001 certification. Data is encrypted in transit and at rest. The data processing addendum binds DISCO to confidentiality, breach notice and deletion or return of personal data on termination, and notice of subpoenas or other orders seeking personal data.

No position on privilege or work product as such, and no separation between users or matters inside a customer, is published.

The buyers are law firms, corporate legal teams and government legal teams, with no consumer product, and DISCO analyzes collected evidence rather than giving advice. Auto Review instructions can be written with DISCO's AI consulting team, and its Managed Review team can run a first pass review and handle privilege review, which places vendor staff inside the customer's review method. Nothing published addresses advice versus tooling, the supervising lawyer's responsibility for a review DISCO's team runs, competence duties or jurisdiction limits.

Every Auto Review tag suggestion carries an explanation, and Auto Review tracks recall and precision inside the product so a team can validate a review. DISCO's AI consulting team advises on sampling, validation and defensibility. The annual filing discusses AI related operational and regulatory risk beside cybersecurity, privacy compliance and reliance on third party model and cloud providers. No AI governance framework, AI principles, ISO 42001 certification, named owner of model governance or prerelease testing regime is published.

Nothing addresses uneven output across matter types, parties or populations, for a product that classifies up to 32,000 documents an hour.

DISCO's data processing addendum commits to notice of a personal data breach without undue delay, with assistance afterward, and on termination DISCO deletes or returns customer personal data or provides a way to do so. Its subprocessor list names each provider with function and country, and customers have 14 days to object after the list is updated. The language models behind Cecilia and Auto Review do not train on or retain customer data after processing, and every model vendor must hold SOC 2 Type 2 or ISO 27001 certification.

Data is encrypted in transit and at rest on AWS. No period is stated for keeping case documents, Cecilia prompts or generated output, and retention under DISCO's own document retention policies is reserved.

DISCO's terms and conditions indemnify the customer against third party claims that the technology offerings or documentation infringe United States intellectual property rights, with the usual exclusions. DISCO warrants that each technology offering conforms in all material respects to its documentation, and that professional services are performed in a professional and workmanlike manner, with correction or termination as the remedy.

Each party's liability is capped at the fees paid or payable under the order in the 12 months before the claim. A separate data protection cap of twice the general cap covers breaches of data protection obligations. Fraud, wilful misconduct, negligence causing death or injury and indemnification obligations sit outside the caps. The AI supplementary terms exclude AI services from any service level agreement, and no insurance position is published.

DISCO Hold connects to a customer's systems, and the high speed uploader moves enterprise data straight into the platform. DISCO publishes guidance on Google Workspace collection through Google Vault and on migrating data from other ediscovery providers. A DISCO API is published for connecting the platform to a firm's other systems, and the subprocessor list names Box and Dropbox as file transfer tools. The consolidated integrations page now returns a not found page, and no documentation per integration sets out what moves, in which direction or what an administrator configures.

DISCO runs in the cloud on AWS, which its subprocessor list places in the United States, Ireland and Canada. Microsoft Azure and Google appear as further hosting providers in the United States, and OpenAI processes in the United States and the EU. The platform was designed to operate in the cloud, with AWS used to minimize data footprint and strengthen privacy controls. The data processing addendum sets out transfer mechanisms for data leaving the EEA, the UK and Switzerland. No customer choice of region, tenancy model or private deployment is described.

DISCO undergoes an annual SOC 2 Type 2 audit covering security, availability and privacy, holds ISO 27001 certification for the technical and operational delivery of its service, and commissions penetration testing. Data is encrypted in transit and at rest on AWS, and DISCO states GDPR compliance. The security page links a trust center at trust.csdisco.com, and the data processing addendum points to it for the subprocessor list.

Customers can use two factor authentication, expiring passwords and single sign on through SAML, and a vulnerability reporting route is published. The auditing firm and the SOC 2 coverage period are not stated on the public pages.

DISCO's subprocessor list names Writer and OpenAI as large language model providers, Writer in the United States and OpenAI in the United States and the EU, and Pinecone as the vector database. AWS, Microsoft Azure and Google are named as hosting providers. The data processing addendum gives customers 14 days to object after the list is updated on DISCO's trust center. Model vendors must hold SOC 2 Type 2 or ISO 27001 certification and may not train on or retain customer data. No model or version is tied to a particular feature.

DISCO publishes its unit and structure without a figure. Its pricing page bills on processed data at a rate per GB, with no additional charge for unlimited use of Cecilia AI on the platform. The per GB rate includes filters, Cecilia Q&A, single document Q&A, document summaries, definitions, timelines and deposition management, and a feature table sets out what is included. The rate itself comes through a quote. The annual filing records the 2026 move to usage based pricing.

DISCO sells to law firms, corporate legal teams and government, with dedicated material for IP litigation, construction litigation, plaintiffs and a pro bono program. Its annual filing counts 1,549 customers, including 330 large customers, at 31 December 2025. The platform spans the ediscovery lifecycle with hold, ediscovery, review, timelines, deposition management and case building, and pricing is quoted for customers across the United States, the United Kingdom, Europe and parts of Asia. Firm size segmentation, language coverage and any statement of what the platform is not built for are not published.