E

Exterro

Exterro's AI runs through the platform, but the product beneath it was built first and still works without it. Smart Labeling learns from a reviewer's labels on a sample set and applies them across a document pool, and image and video recognition have been part of the platform for more than a decade. Context Insights maps custodians and communications, and Smart Summarization, translation and transcription speed up review.

Exterro Assist, launched in August 2025, added agents that answer questions over collected data, classify documents and draft reports. Subpoena Manager runs subpoena intake and routing on agents. Legal hold, preservation, collection, processing, production, privacy requests and forensics all run as workflow software, and the AI makes those workflows faster rather than defining them.

Exterro Intelligence results carry source references back to the collected documents, and the audit trail links each step to its data, so a reviewer can open what an answer rests on. A validation agent checks the accuracy and integrity of retrieved information. Exterro publishes throughput rather than accuracy: 40,000 documents an hour for classification, 100,000 an hour of preprocessing for questions, and tasks up to 400 times faster than manual work.

In a global insurer's three week trial that Exterro describes, investigators compared summaries, timelines and citations with native documents. No precision, recall or error rate is published for classification, labeling, summaries or answers. In ediscovery the costly error is a responsive document culled by mistake, and no recall figure addresses it.

Autonomy is where Exterro is heading, and it sets limits in the same breath. Subpoena Manager, launched in May 2026, uses agents to take in subpoenas from any channel, extract deadlines and matter details, route requests, follow up and drive preservation, collection and review. Legal staff give the final approval on each action. ARMOUR's autonomy ladder lets a team raise automation in steps, from manual work to conditional and then high autonomy.

Exterro Intelligence agents classify content against relevance, reason and confidence thresholds, and a validation agent checks retrieved information and flags problems. Every action lands in the audit trail with chain of custody. What an agent may do without approval at each level, and where the thresholds sit, is not published.

The Hanover Insurance Group is a named Exterro customer. Its eDiscovery and information governance lead reports saving at least 75% a case on average, and more than $2 million over 12 months, by running discovery in house and tracking external against internal costs. A North American real estate company cut documents by 68% before review and those sent to outside counsel by 97% on one matter. A global insurer's three week ARMOUR trial covered 650GB, including a fraud investigation of 200,000 documents reviewed in an afternoon and a subject access request cut from about 60 hours to a few.

IDC named Exterro a Leader in its 2025 eDiscovery MarketScape and a Major Player for data privacy compliance software. Exterro reports more than 2,700 organizations as customers, with its Fortune 100 share given as 40% on its review pages and 50% on its legal and security pages. The Hanover figures rest on its own cost tracking, and none of the results carries a date.

Confidentiality binds both parties under the agreement, which limits Exterro's use of customer data to providing the subscription. Either party may disclose under a court order or law only with prompt notice where the law allows. Exterro states that customer data does not train its models and that Exterro Assist runs inside the platform with no external access. Review flags potentially privileged documents during processing and builds the privilege log as review proceeds.

Its single instance store keeps one copy of each document, so a privilege or redaction call made in one matter follows the document into every other matter. Outside counsel get role based access to specific matters. The no training statement is not in the agreement, and nothing describes how privileged material is walled off from privacy and IT users on the same platform.

Twice in its agreement, Exterro states that it does not practice law or give legal advice, and it disclaims any warranty that the software will assure legal compliance. Buyers are corporate legal, compliance and IT teams, law firms and government, and the AI is sold as review and workflow support with human approval on decisions. Exterro's guide for legal teams on AI in the courtroom says ethical duties and the rules of privilege and evidence still apply to AI generated material.

Nothing addresses a supervising lawyer's duties over classification, culling or agent actions, or limits on use by jurisdiction.

ARMOUR, short for Autonomous Risk Management, Orchestration and Unified Response, is Exterro's framework for agentic work. It sets out a six level autonomy ladder that moves a team from manual tasks to conditional and then high autonomy at its own pace. Exterro describes its AI capabilities as tested in real world use and keeps human approval on decisions, and it publishes analysis of the EU AI Act for customers. No AI policy, testing method, accuracy or bias result, model card or named owner for AI governance is published, and Exterro holds no AI management certification such as ISO/IEC 42001.

Classification and culling decide what a reviewer sees, and nothing describes how uneven results across custodians, languages or file types are tested.

Under its agreement, Exterro commits to commercially reasonable security for customer data and to prompt notice of a data breach, with each party paying for a breach it causes. A customer can ask for its data in a standard format within 30 days of termination, and Exterro takes no responsibility for keeping it beyond 45 days. Exterro names four subprocessors in its trust center, each with function and region. AWS hosts data in the United States, the EU or Canada as the customer selects and runs AI processing for Exterro Assist through AWS Bedrock.

Google Cloud hosts Exterro managed AI infrastructure in the United States and the EU, and Microsoft Azure hosts in the United States. Snowflake holds analytics and legal hold archives for customers hosted in AWS in the United States. Restricted production access and data retention and classification procedures are listed among the controls, and incident statements are posted, the latest on 5 October 2026. No retention period is stated for data or AI output during a subscription, and no notice period applies to subprocessor changes.

Exterro's master subscription agreement, updated June 2025, is public and sets out what Exterro stands behind. Exterro defends the customer against third party claims that the software infringes a patent, copyright or trademark, with the usual exclusions, and can secure a license, modify or replace the software, or end its use. It also defends claims arising from its own breach of confidentiality or of applicable law.

Production software is warranted to run without a defect that causes a material failure against the documentation. The remedy is a fix or workaround, then termination with a refund of prepaid fees if the defect persists 30 days after notice. Liability is capped at $1,000,000, and breaches of security or confidentiality and the IP indemnity sit under a separate cap of $3,000,000. Exterro carries general liability and cyber insurance in commercially reasonable amounts.

The agreement disclaims any warranty that the software is accurate or error free, and no term addresses AI output on its own.

Exterro's connector library reaches more than 190 sources across email, chat, collaboration tools, cloud storage, endpoints and business applications, and works on data in place without exports or copies. Each listed connector states what it does. Microsoft 365 covers holds and collection across Exchange, OneDrive, OneNote, SharePoint Online and Yammer, and Google Workspace covers Gmail, Drive, Calendar, Cloud Storage and Vault.

Slack and Teams capture threads and shared files in context, and Box, Dropbox, Amazon S3, Salesforce and SharePoint on premises are listed the same way. Connectors use modern authentication, granular scopes and role based controls, run delta sync and throttling, report health in one console and log every action against the matter. Exterro says it can build a missing connector in about two weeks. Configuration steps and field level detail are not published.

Exterro sells hosted software that it runs and on premises software that the customer deploys, and its comparison material adds private cloud, hybrid and managed options. Its trust center places hosting in AWS regions in the United States, the EU and Canada, as the customer chooses. Google Cloud adds the United States and the EU, and Microsoft Azure the United States. AI processing for Exterro Assist runs through AWS Bedrock and on Exterro managed infrastructure in Google Cloud.

A FedRAMP Moderate authorized cloud serves United States government customers. Which region runs AI processing for a given hosting region, and what differs between hosted, private cloud and on premises editions, is not published.

Exterro holds ISO/IEC 27001:2022, SOC 2, FedRAMP Moderate authorization, TISAX, HITRUST e1 and UK Cyber Essentials. The ISO certificate, the 2025 SOC 2 Type II report and bridge letter, the 2026 HITRUST e1 certificate and a SIG questionnaire are released through an access request. Controls are listed by area, and incident statements are posted, such as the 5 October 2026 note on the Canny.io incident. FedRAMP Moderate status appears in the public FedRAMP marketplace.

ISO 27001 certification was announced in January 2026, with CISO Anthony Diaz describing a risk based security management system under continuous audit. Reports come through the access request rather than as open downloads.

Exterro's subprocessor list names where its AI runs. AWS Bedrock processes Exterro Assist requests, and Exterro managed AI infrastructure is hosted on Google Cloud in the United States and the EU. Exterro says it owns every layer of its stack, that data is not transferred to, stored or processed by third party language model vendors, and that it does not wrap models such as OpenAI's. Smart Labeling and image and video recognition are older models built into the platform.

The models used through Bedrock or on Exterro's own infrastructure are not named, and no notice is promised before the list changes.

Exterro publishes the structure of its pricing without the figures. Its agreement bills subscriptions annually in advance in USD, on licensed rights rather than usage, and lets Exterro raise the annual fee at renewal by the greater of CPI or 6%. Exterro Review is sold with unlimited annual user licensing and single instance storage instead of per GB hosting fees. Subpoena Manager is priced on the volume of subpoenas processed, on demand or in bulk.

At its August 2025 launch, Exterro Assist came with unlimited questions and topic classification for a customer's first matter up to 250GB. Modules are sold one at a time or as a suite, and no rate, tier price or implementation fee is published.

Exterro serves corporate legal, compliance, privacy, security and IT teams, with editions for law firms, government and law enforcement. In discovery it covers legal hold, custodian interviews, preservation in place, collection, processing, early case assessment, review, production, subpoena response and public records requests. FTK covers forensic acquisition from endpoints, cloud sources and mobile devices. Governance and privacy modules handle data mapping, retention and defensible deletion, records of processing, assessments, data subject requests and consent.

Industry editions name financial services and insurance, healthcare and life sciences, energy, technology, government and manufacturing. No jurisdiction list is given for the privacy modules, and nothing says which modules run on premises, in which region or under FedRAMP.