Everlaw
Cloud native ediscovery, investigation and litigation platform covering upload and processing, search, review, production and trial preparation, sold to law firms, corporate legal departments and government agencies including United States attorneys' offices. EverlawAI Assistant, launched autumn 2024 and shaped by input from nearly 3,000 users, adds generative features: Review Assistant, Coding Suggestions for automated first pass review, Writing Assistant, custom extractions, automated deposition analysis, and Deep Dive, which answers natural language questions across millions of documents with answers grounded in extracted facts and citations back to source documents. Architecture is a closed loop system combining enterprise large language models under zero data retention terms with a vector database holding embeddings of customer documents, with no link following or web browsing. The first ediscovery vendor to have its full portfolio of generative AI features FedRAMP authorised, independently tested by a third party assessment organisation. In region AI processing is available for United Kingdom and European customers.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the engine of a core capability layered on a platform that would function without them. Everlaw is an end to end ediscovery system covering upload, processing, search, review, production and trial preparation, and that platform existed and sold before the generative layer arrived in autumn 2024. What the models drive is substantial rather than peripheral, which is why this is not a C: Coding Suggestions automating first pass review, Deep Dive answering natural language questions across millions of documents, Review Assistant, Writing Assistant, custom extractions and deposition analysis. Fifth B on this axis. Worth recording for a reader that ediscovery has used machine learning for predictive coding long before generative AI, so the underlying platform was never model free, but the reviewable document system stands without the generative layer graded here.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Grounding is real and documented with the retrieval architecture described, short of published figures. The mechanism is stated concretely: Deep Dive is powered by a vector database holding embeddings of the customer's own documents, answers are synthesised from facts extracted from specific documents, and results cite source documents with access to the underlying materials so users can verify outputs when checking their work. The vendor states plainly that it has taken steps to reduce hallucinations. Coding Suggestions is claimed to deliver recall and precision that rivals eyes on review, which uses the right metrics for the task and is the correct frame for first pass review quality. Searched the product pages, the AI Assistant framework page, the support knowledge base and the vendor blog on 29 Aug 2026 and located no numeric recall or precision figure, no accuracy rate, no test set, no published evaluation methodology and no independent benchmark participation. A claim to rival eyes on review with no measurement attached is exactly the kind of claim this axis exists to mark.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
A real published commitment with a documented verification surface, short of thresholds. Control is the first of three stated generative AI principles, alongside Confidence and Transparency, Privacy and Security. The verification path is described rather than asserted: the assistant cites source documents in its results for users to reference when checking their work so they can ensure accuracy and verify outputs, and Deep Dive provides access to underlying source materials. Architectural limits reinforce it: no link following or web browsing, and every task runs as a one time generation request rather than a persistent agent. Not located as of 29 Aug 2026: what proportion of a first pass review Coding Suggestions is expected to decide unaided, any threshold at which a document routes to a human, and what the vendor commits to when an output is wrong. That last matters here because the vendor claims automation rivalling eyes on review, which is a claim about replacing a human step rather than assisting one.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Adoption figures stand where deployment outcomes would go. Published and specific: EverlawAI Assistant was developed with input from nearly 3,000 users, more than 150 customers use the generative features, and the platform is used by numerous United States government agencies including United States attorneys' offices. Those are real adoption numbers rather than logo walls, and the government adoption is corroborated by the FedRAMP and GovRAMP authorisations, which are matters of public record. But adoption is not outcome. Searched the product pages, the vendor blog, the newsroom and the support knowledge base on 29 Aug 2026 and located no named customer paired with figures and a date, no case study a reader could assess, and no measured result from any deployment.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The most complete confidentiality posture on the index, and the only one where an outside authority has tested the generative features specifically. All three limbs are addressed in terms a buyer can read in advance. Training: the vendor states data submitted and responses received are not used to train models across customers and are not shared between customers, and separately that the enterprise language models it uses adhere to a zero data retention policy under which data is used solely to generate a response, deleted on completion, and never used to train their models. Segregation: stated between customers, and reinforced architecturally because the models hold no persistent knowledge of a customer's case. Retention: disclosed honestly and at the right level of detail, including the part most vendors would omit, that the vector database powering Deep Dive stores numerical embeddings created from customer documents and that this storage is necessary for retrieval. Privilege is named directly rather than implied: the vendor describes environments where sensitive case data, privileged communications and personally identifiable information must be safeguarded, and FedRAMP authorisation of the generative features means a third party assessment organisation has tested that claim. Short of nothing material on the three limbs; the one gap, no stated retention period for the vector database, is recorded on the retention signal row.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
The audience is professional and the position is unstated. Users are law firms, corporate legal departments and government legal teams including United States attorneys' offices, with no consumer surface located, and the product is a document review platform rather than an advice tool, so the advice line question arises less sharply here than for a research or drafting product. Searched the product pages, the AI Assistant framework page, the support knowledge base and the vendor blog on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits. Recorded at C because the position is inferable from what the product is rather than published.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Third A on this axis and the first earned on bias disclosure rather than certification alone. The vendor publishes a named AI Governance Framework as a standing document, structured on three stated generative AI principles of Control, Confidence, and Transparency, Privacy and Security. The framework describes specific governance decisions with their reasoning: third party technologies are evaluated from technical, legal, privacy and security perspectives before adoption, subprocessors including each language model are vetted with the appropriate internal teams, tasks run as one time generation requests, and link following and web browsing are excluded to keep the system closed loop, with the stated rationale that a model holding no persistent case knowledge cannot have it exfiltrated by prompt or data injection. Independent validation exists and is specific to the AI: a third party assessment organisation tested the generative features for FedRAMP authorisation, with an attestation letter, as part of the 2025 annual assessment. And the vendor makes the bias disclosure almost nobody on this index makes, stating plainly that if the case materials contain bias or toxicity that may be reflected in the output. Not located: pre release testing results, and a named individual owner of model governance.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy covering most of the ground, on an unusually broad certification base. Published: zero data retention at the language model layer with data deleted on completion, a closed loop architecture excluding link following and web browsing, one time generation requests rather than persistent agents, subprocessor vetting including each language model, in region AI processing for United Kingdom and European customers, and a certification set spanning FedRAMP Moderate, GovRAMP Moderate, SOC 2 Type 2, ISO 27001:2013, Cyber Essentials Plus, GDPR, HIPAA and UK G-Cloud. The vendor also discloses that the platform is developed and operated by United States citizens with its research and development team in California, which is a personnel sovereignty statement few vendors make. Not located as of 29 Aug 2026: a retention period or deletion control for the vector database that stores customer document embeddings, a published subprocessor list as distinct from a statement that subprocessors are vetted, and an incident or breach notification practice.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Searched the product pages, the AI Assistant framework page, the support knowledge base, the vendor blog and the newsroom on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer terms of service or master agreement was located on the surfaces reached. Recorded as a pure absence on those surfaces. Rebuttable, and worth noting the shape: this vendor publishes more than almost anyone on this index about how its AI is governed and secured, and nothing about who bears the loss when an output is wrong. Governance and recourse are different questions and only the first is answered.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Searched the product pages, the AI Assistant framework page, the support knowledge base entry point and the vendor blog on 29 Aug 2026. No integrations page was reached, no named connector for document management, practice management or productivity tools was located, and no API documentation was located. Recorded as an absence on the surfaces reached rather than as a finding about the product. Two things a reader should weigh. First, the platform is deliberately end to end, covering upload through production and trial preparation, so it substitutes for a workflow chain rather than connecting into one, which reduces how much integration it needs. Second, this axis was not the focus of the research pass and an ediscovery platform of this scale almost certainly documents data ingestion routes somewhere. Rebuttable with a single link and flagged for revisit.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Deployment model is stated clearly with real residency options, short of the full picture. Cloud native delivery is stated throughout, and residency is offered concretely rather than described: in region AI processing is available for United Kingdom and European customers, introduced explicitly to meet data security and sovereignty requirements and keep data within local boundaries, with the vendor confirming the same zero retention and no training terms apply as in the United States implementation. Government deployment is authorised separately under FedRAMP Moderate and GovRAMP Moderate in the United States and G-Cloud in the United Kingdom. Personnel location is also disclosed, the platform being developed and operated by United States citizens with research and development in California. Not located as of 29 Aug 2026: a tenancy model, a named hosting provider, an enumerated region list, and any statement of where processing happens for customers outside the named regions.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The strongest certification position on the index, and the only one where the generative AI features themselves have been independently authorised. FedRAMP Moderate Authorization and GovRAMP Moderate Authorization are held, and critically the generative features were included in the 2025 FedRAMP Annual Assessment where a third party assessment organisation independently tested and endorsed the authorisation, with an attestation letter issued. FedRAMP is a continuous authorisation regime with annual reassessment rather than a point in time report, and its status is a matter of public record rather than a vendor claim, which is a materially stronger form of evidence than any private attestation elsewhere on this index. Alongside it: SOC 2 Type 2, ISO 27001:2013, Cyber Essentials Plus, GDPR and HIPAA compliance, and UK G-Cloud status. The vendor is stated to be the first ediscovery provider to have its full portfolio of generative AI features FedRAMP authorised. Short only of a published report request route or trust portal, which was not located on the surfaces reached.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The architecture and the terms binding it are disclosed clearly while the components are not named. Published: enterprise grade large language models from what the vendor calls highly reputable AI service providers, operating under a zero data retention policy with data deleted on completion and never used to train their models, plus a vector database storing embeddings to power retrieval, plus a statement that all subprocessors including each language model are vetted with the appropriate internal teams and that technology is chosen on the quality of the foundation models and on providers' willingness to support the vendor's data commitments. A buyer therefore knows the shape of the chain and the commercial terms governing it, which is more than most disclose. Searched the product pages, the framework page, the support knowledge base and the newsroom on 29 Aug 2026 and located no named model provider, no named vector database provider, no published subprocessor list, and no commitment to notify customers when the supply chain changes.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Checked the product pages, the vendor blog, the newsroom and the support knowledge base entry point on 29 Aug 2026. No pricing page was located, no rate is published, no unit of charge is stated and no tier structure appears on the surfaces reached. Access to the generative features specifically is directed through a customer success manager or a request for a call, which is a sales gated route. No free trial or self serve entry point was located, and no third party pricing figure was located either.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment coverage is described with substance and the public sector position is unusually well defined. Segments named: law firms, corporate legal departments and government agencies at federal, state and local level, with United States attorneys' offices named specifically. Use cases are enumerated concretely for the public sector, covering litigation, investigations and Freedom of Information Act requests, and for the private sector covering document review, evidence based writing, coding and deposition analysis. Practice scope is clear and consistently stated as ediscovery, investigation and litigation end to end from data upload through production to trial preparation, with no claim to transactional or advisory capability. Geographic coverage extends to the United Kingdom and Europe with in region processing. Not located as of 29 Aug 2026: firm size segmentation, industry breakouts, and any statement of what the platform is not built for.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A public policy or trust page states no training on customer content, with no matching term located in the published agreement.
The question is answered at both layers, which few records here manage. At the vendor layer the support documentation states that the data a customer submits and the responses they receive are not used to train models across customers and are not shared between customers. At the provider layer the published AI governance framework states that the enterprise language models used adhere to a zero data retention policy, under which data sent for processing is used solely to generate a response, is deleted on completion, and is never used to train their models. The vendor sets out the consequence rather than leaving it implied: because customer data does not train or fine tune the models, the models hold no inherent proprietary knowledge of a case that could be exfiltrated through prompt or data injection. Recorded at policy never on the strength of both statements together.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
Retention is disclosed honestly at both layers with a period stated at neither. At the model layer the answer is zero: data sent to the language models is deleted on completion and is not retained once the request finishes. At the platform layer the vendor volunteers what most would omit, that a vector database stores numerical embeddings created from customer documents and that this storage is necessary for retrieval to work. Disclosing that derived representations of client documents persist, and explaining why, is a materially more candid answer than the zero retention headline alone would give. Searched the framework page, the support knowledge base, the product pages and the newsroom on 29 Aug 2026 and located no retention period for the vector database, no customer control over it, and no deletion commitment for embeddings when a case closes. Recorded at disclosed without a period on that basis.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Segregation is asserted in public materials with no published detail on how it is enforced.
Segregation between customers is asserted and segregation within a customer is not addressed. The vendor states that data submitted and responses received are not shared between customers, and the architecture supports that claim, since the models hold no persistent knowledge across requests. What was not located, after searching the framework page, the support knowledge base and the product pages on 29 Aug 2026, is any published detail on how separation is enforced between users, teams or matters inside a single customer, which is where walls actually operate. That question has real weight for this product type: an ediscovery platform holds the whole document universe for a matter, and a firm running two adverse matters needs to know retrieval cannot cross between them. No document management integration was located whose permissions could be inherited. Recorded at claimed but not documented.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
No located term or policy addresses third party requests for customer data.
Searched the framework page, the support knowledge base, the product pages, the vendor blog and the newsroom on 29 Aug 2026, and no published customer agreement or data processing agreement was reached. No clause committing to notify a customer of a government or law enforcement request for their data was located, and no transparency report was located. Worth recording as context rather than as an answer: this vendor serves United States government agencies including attorneys' offices under FedRAMP and GovRAMP authorisation, which makes the question of what happens when a government requests data from the platform a live one for its private sector customers, and nothing located addresses it.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
No primary law corpus is identified because the product does not hold one. Retrieval runs entirely against the customer's own case documents, uploaded into the platform and indexed as embeddings in a vector database, so the corpus is the evidence in the matter and its provenance is the discovery process itself. Searched the product pages, the framework page and the support knowledge base on 29 Aug 2026 and located no vendor supplied legal corpus, no licence basis and no update cadence, and none would be expected. Same architectural shape as the contract platforms on this index, where the absence describes the product design rather than a disclosure failure.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Searched the product pages, the framework page, the support knowledge base and the vendor blog on 29 Aug 2026. No material was located addressing whether authority carries a treatment signal or whether subsequent history is checked, and no commercial citator licence was located. Noted for context: this is an ediscovery and investigation platform whose corpus is the evidence in a matter rather than published case law, so a citator is outside its design entirely, notwithstanding that the Writing Assistant produces evidence based writing which may in practice sit alongside legal authority drawn from elsewhere.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
Searched the framework page, the support knowledge base, the product pages and the vendor blog on 29 Aug 2026. No published material describes what the product does when the documents do not support an answer, and no explicit no answer path or confidence signal exposed to the user was located. Two adjacent statements were considered and not treated as satisfying this signal. The vendor says it has taken steps to reduce hallucinations, which is an assertion about frequency rather than a described behaviour. And answers cite source documents so a user can verify them, which supports checking an answer that was given rather than telling a user when the corpus contained nothing. For a product whose central claim is that Deep Dive answers questions across millions of documents, what it says when the evidence is absent is a live question and is unaddressed.
Fabricated Citation Record
Does a public court record exist involving output from this product?
No court order, opinion or disciplinary record naming this product has been located as of the date shown. This is a statement about the public record, not a finding about the product.
No court order, opinion or disciplinary record naming this product has been located as of 29 Aug 2026. Instrument searched: the AI Hallucination Cases database maintained by Damien Charlotin, which tracks court decisions worldwide involving AI generated hallucinated content and records the AI tool implicated where it is known. Also checked published 2026 sanctions summaries and secondary sanctions trackers. The entries located name filers, and in some rows other products, rather than this one. This is a statement about the public record on the date shown and not a clearance. Note the exposure differs from a research tool: this product generates from case evidence rather than from case law, so its characteristic failure would be a mischaracterised document or a fact unsupported by the record rather than an invented citation, and that failure mode is far less likely to be catalogued in a hallucination database.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Searched the product pages, the AI governance framework page, the support knowledge base, the vendor blog and the newsroom on 29 Aug 2026. No engagement with any named ethics opinion or bar guidance was located, including ABA Formal Opinion 512 and state bar guidance. The vendor publishes a substantial AI governance framework and a set of generative AI principles, which govern its own conduct rather than engaging with the professional responsibility rules binding the lawyers who use it. Also not located: engagement with the Federal Rules of Civil Procedure or with case law on technology assisted review, which would be the natural professional touchstone for an ediscovery product using AI for first pass review.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Public materials claim time savings without addressing billing or disclosure.
Savings are claimed and nothing is published on the client's side of the equation. The vendor's framing is throughput rather than hours: automating first pass review with recall and precision that rivals eyes on review, streamlining processes, eliminating manual tasks, and answering questions across millions of documents in seconds. Automating first pass review is the single largest displaceable cost in litigation support and the claim is squarely about replacing billable human review time. Searched the product pages, the framework page, the support knowledge base and the vendor blog on 29 Aug 2026 and located no per matter record of AI assisted work intended for fee purposes, and no guidance on billing, fee or client disclosure treatment. Recorded at savings claims only.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The material exists behind a sales conversation or an executed agreement.
Substantial diligence material is published openly and the specific artifact this signal names is not. Available without a sales conversation: a named AI governance framework describing the architecture and the terms binding the model providers, a support knowledge base answering the training question directly, and a certification set including FedRAMP Moderate and GovRAMP Moderate authorisation whose status is a matter of public record, alongside SOC 2 Type 2, ISO 27001, Cyber Essentials Plus and G-Cloud. A firm could evidence a great deal from that. What was not located as of 29 Aug 2026 is a subprocessor list: the vendor states it thoroughly vets all subprocessors including each language model, which is a statement about process rather than a disclosure of who they are, and no model provider is named anywhere located. No client facing consent or notification pack was located either. Recorded at on request on the strength of the published material falling short of the named artifacts.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Several elements of a record are available, assembled from the product's design rather than offered as a disclosure artifact. Outputs cite the source documents they rest on, with access to the underlying materials, so what was relied on is traceable per answer, and an ediscovery platform necessarily maintains production and review histories at document level. Two elements are missing: no single per document export covering model used, sources retrieved and human verification together was located, and no model is named in published material so the model used could not be stated. Recorded at partial record. Noted for a reader: courts have engaged with technology assisted review in ediscovery for well over a decade, so this is one of the few product categories on the index where a defensibility record has an established judicial context, and the vendor does not connect its AI disclosure material to it.