H
Hanzo
Hanzo is an ediscovery and preservation platform for dynamic and collaborative data, sold to corporate legal and compliance teams. Chronicle preserves websites and social media; Illuminate handles legal hold, collection and review across Slack, Microsoft Teams, Google Workspace and email, preserving messages in place with threading, reactions, edits and deletions intact, applying holds by custodian, channel and timeframe and capturing new messages posted after a hold. Spotlight AI, an optional switch-on layer within Illuminate, is an automated relevancy engine that breaks a case into facets, ranks and tags content by contextual understanding, explains why each item was flagged, and detects personal data and toxicity during early case assessment; the vendor states it runs on local language models deployed inside the customer's tenant so that data does not leave the customer's environment, and published a ninety-five per cent recall figure at launch in 2023. The company is Hanzo Archives, Inc., a Delaware corporation with its North American headquarters in Portland, Oregon and a European office in London, and states annual SOC 2 Type 2 audits since 2019 by a CPA firm with a twelve-month evidence period. Its published master services agreement for purchases through the IBM Marketplace commits to prior notice of compelled disclosure, prompt breach notification, an intellectual property indemnity, a twelve-month liability cap with carve-outs, five million dollars of general and professional liability insurance, and transfer then deletion of client content thirty days after termination; purchases made directly are governed by a separate agreement the vendor does not publish.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Artificial intelligence is present and peripheral by the vendor's own construction. The Illuminate page describes Spotlight AI as an optional switch-on element within the platform, and the FAQ describes two core products, Chronicle for website and social preservation and Illuminate for collaboration-data hold, collection and review, that function without it; the vendor's own 2023 account of Spotlight AI's origin describes it as a feature added to a culling and preservation platform whose strength was big-data culling. This is the legacy-platform case the axis is asked to discriminate. Illuminate page, FAQ and 2023 origin post read 6 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
A measured figure is published and the outputs are explained, short of a described test set and a current republication. The November 2023 launch release states ninety-five per cent recall in identifying documents pertinent to a case, with no test set, method or date of measurement and no republication against the current product located; the FAQ and Spotlight AI page state that results are ranked and tagged so reviewers know why something was flagged, and the vendor's engineering post describes facets written by generative AI that users can adjust and supply examples for, which is documented grounding to the case description. The figure is three years old and the primary-authority limbs do not apply to a review tool. Launch release, FAQ, Spotlight AI page and engineering post read 6 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The modes, the constraints and the review surface are published, short of the full control structure. Spotlight AI is optional and switched on per matter, it flags anomalies and relevant content for human review with an explanation per flag, and the facets that drive relevancy assessment are generated by the model but can be supplemented, tweaked and clarified with examples by the user, which the vendor describes as giving the user control over first-pass review while computers take the laborious steps; explanations are stated to make every decision defensible. What is not published is the threshold at which content is excluded from review without a person or a stated route back after a wrong relevancy call beyond adjusting the facets. FAQ, Spotlight AI page and engineering post read 6 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Figures without a named customer on the surfaces read. The FAQ states that for some teams first-pass review moved from weeks to hours and that teams using Illuminate with Google Workspace data work up to fifty per cent faster, both unattributed; the vendor states it serves large corporations worldwide and is audited by several enterprise clients, none named. A case studies page exists in the navigation and was not opened, and is the rebuttal route. FAQ and navigation read 6 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive published commitments on segregation, provider exposure and deletion, short of a training statement and of privilege named as such. Third-party model providers: the FAQ and About page state that Spotlight AI runs on local language models with tenant-level deployment so data never leaves the customer's environment, which is the strongest possible answer on provider exposure if accurate. Segregation: the Illuminate page describes controlled access for users, teams and third parties. Retention and deletion: the IBM Marketplace MSA transfers client content on request within thirty days of termination and then deletes it. Confidentiality and legal process: MSA section 4 with prior notice of compelled disclosure. Not located: any statement on training use, since the MSA licenses client content solely to provide the service without naming training and the direct-purchase agreement is unpublished; and any treatment of privilege or work product. FAQ, About page, Illuminate page and IBM Marketplace MSA read 6 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
No advice line or supervision statement was located. The product is sold to corporate legal and compliance teams for preservation, collection and review, the IBM Marketplace MSA places responsibility for determining whether the services are accurate or sufficient on the client, and no surface read states how the AI sits with a supervising lawyer's duties or names a jurisdiction limit. The site's own terms page states it is non-binding and informational. FAQ, MSA and terms page read 6 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Transparency principles are published without a governance framework, testing regime or accountable owner. The vendor states three core philosophies for Spotlight AI, client data security, decision transparency and practicality, and describes prompt-engineering practice and facet design in an engineering post; the FAQ states the company follows NIST standards and the ISO 27001 framework, which is security rather than AI governance. No responsible AI framework, ISO 42001 or equivalent, pre-release testing results or statement about uneven output is published on the surfaces read. Origin post, engineering post and FAQ read 6 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy covering most of the ground, with the agreement's scope named. Retention and deletion: IBM Marketplace MSA section 7.3 gives thirty days after termination for transfer of client content in the format set by the offer, then deletion unless legally prohibited. Access control: MSA section 5.4 commits to commercially reasonable security measures against unauthorised access, the Illuminate page describes controlled access, and the FAQ states annual SOC 2 Type 2 audits with a twelve-month evidence period. Incident practice: section 5.4 commits to prompt notification of any breach that may expose unencrypted client confidential information, stating the information at risk, with immediate steps to stop continued access. Sub-processors: no list was located; the vendor states the AI runs inside the customer's tenant. The MSA governs IBM Marketplace purchases and the direct-purchase agreement is unpublished. MSA, FAQ and Illuminate page read 6 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
What the vendor stands behind is published and specific, and it includes insurance, which no other record in this pull states. The IBM Marketplace MSA of June 2023, section 9.1, gives a defence and indemnity for third-party intellectual property claims with listed exclusions and procure, replace or terminate-and-refund remedies; section 6.1 caps each party's liability at fees received in the preceding twelve months and excludes consequential loss, carving out gross negligence, wilful misconduct, breach of confidentiality and the IP indemnity; section 5.2 warrants material conformity with documentation with remedial services, section 5.5 places responsibility for accuracy and sufficiency on the client; and section 10.2 commits Hanzo to maintain five million dollars of commercial general liability and five million dollars of professional liability insurance for the term and two years after, with a certificate on request. The agreement governs purchases through the IBM Marketplace; the agreement for direct purchases is not published and the site's terms page states it is non-binding. IBM Marketplace MSA read in full 6 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations with depth described, because the connectors are the product. The vendor describes preserve-in-place for Slack with holds by custodian, channel and timeframe and dynamic synchronisation of new messages, capture of Teams and Google Workspace data with threading, reactions, edits and deletions intact, and a Data Connectors page in the navigation; the 2023 launch states Spotlight AI leverages IBM's watsonx.ai studio. What a customer must configure and any connection to a review platform or document management system are not described on the surfaces read, and the Data Connectors page was not opened. FAQ, Slack guide and 2021 preservation announcement read 6 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The deployment model for the AI layer is stated clearly and the platform's residency detail is partial. The FAQ and About page state that Spotlight AI runs on local language models with tenant-level deployment inside the customer's environment so data does not leave the perimeter; the platform itself is cloud-hosted with no region, hosting provider or residency election stated on the surfaces read, and the security page was not opened. FAQ, About page and MSA read 6 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real, dated and audited by a named class of auditor, short of a report reachable without asking. The FAQ states SOC 2 Type 2 certification achieved in October 2019 and renewed annually with a twelve-month evidence period, audited by a CPA firm to AICPA standards, alongside adherence to NIST standards and the ISO 27001 framework and audits by enterprise clients; the IBM Marketplace MSA section 5.4 commits to provide the most recent audit report on written request as confidential information. The auditor is not named and no trust centre was located; the security page in the navigation was not opened. FAQ and MSA read 6 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The supply chain is partly disclosed. The FAQ states Spotlight AI runs on local language models deployed at tenant level inside the customer's environment, which states where inference runs and that no external model provider sees content; the 2023 launch states the solution leverages IBM's data science and machine learning studio, now part of watsonx.ai, which names the platform provider; the engineering post describes generative models writing case facets. No specific model is named and no change-notification commitment is stated. FAQ, launch release and engineering post read 6 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure are stated in the agreement without the figure. The IBM Marketplace MSA prices by data ingestion, storage or other metrics set in the offer with overage charges above volume limits, on annual subscription periods that auto-renew for the shorter of the prior term or one year with thirty days' notice, with fees increasable annually by the greater of three per cent or CPI, and billing through IBM; no figure, tier or pricing page was located on the vendor's site. MSA read in full 6 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment and coverage are described with substance; the boundaries are partly stated. The buyer is corporate legal and compliance, with industry pages for government, healthcare and corporations and use cases for legal hold, investigations, website preservation, ediscovery, early case assessment, DSAR and PCAOB evidence; data coverage is stated as Slack, Teams, Google Workspace, email, websites and social media. The product's scope, dynamic and collaborative data rather than the whole ediscovery estate, is a stated boundary; no jurisdiction or matter type is named as unsupported. Navigation, FAQ and use-case pages read 6 September 2026.
No published figure
- You pay by how much data you bring in and store, on a yearly deal.
- Go over your limit and you pay extra at the rate on your order.
- The price can rise each year by 3 percent or by inflation, whichever is higher.
- The company does not say what the rates are on the pages we could read.
- If you buy through IBM's marketplace, IBM sends the bill.
Structure published in the IBM Marketplace master services agreement of June 2023 without a figure. Section 2.3 licenses use up to data ingestion, storage or other metrics in the offer with overage charges or capacity upgrades at new annual pricing above the limits; section 3.1 sets annual subscription periods with fees increasable annually by the greater of three per cent or CPI-U, and billing through IBM; section 7.1 auto-renews for the shorter of the expiring term or one year with thirty days' notice, each renewal subject to the annual increase. No pricing page, tier or figure was located on the vendor's site on 6 September 2026. The agreement governs IBM Marketplace purchases; direct pricing is by quotation. Null means no figure is published, not that the product is free. MSA read 6 September 2026.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A published agreement or policy exists and none of it addresses the question either way, or the document that would answer it could not be read and the summary names the retrieval limit. The summary states which shape the silence takes: an improvement right granted that never names training, or no improvement right granted at all.
The published agreement does not name training either way. The IBM Marketplace MSA licenses client content to Hanzo solely as necessary to provide the subscription service under section 8.2, and section 8.1 permits collection and use of aggregated, anonymised analytics that could not identify the client; a licence confined to providing the service does not permit training, but no clause names model training, and the direct-purchase agreement is unpublished. The FAQ and About page state that Spotlight AI runs on local models inside the customer's tenant, which addresses where data goes rather than whether it trains. Surfaces checked 6 September 2026.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
A specific retention period is published and the customer cannot change it.
A specific period is published for the agreement's channel. IBM Marketplace MSA section 7.3 provides that on request within thirty days of termination Hanzo transfers client content in the format and process set by the offer, and after that period deletes all client data in its possession unless legally prohibited; section 7.3 also requires return or destruction of confidential information. Nothing states a configurable window for AI facets, tags or outputs during the term, and the direct-purchase agreement is unpublished. Surfaces checked 6 September 2026.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Segregation is asserted in public materials with no published detail on how it is enforced.
Segregation is claimed without documentation of a permission model. The Illuminate page states controlled access for users, teams and third parties such as outside counsel, and the FAQ states that Spotlight AI is deployed at tenant level inside the customer's environment, which separates one customer from another; nothing describes matter-level walls within a tenant or how the relevancy engine respects them. Surfaces checked 6 September 2026.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
The published agreement commits to notice, for its channel. IBM Marketplace MSA section 4.2 permits disclosure of confidential information required by law, legal process or regulation provided the receiving party gives the disclosing party reasonable prior written notice to permit it to contest the disclosure and limits disclosure to what is required; client content is confidential information under section 4.1. The MSA governs IBM Marketplace purchases; the direct-purchase agreement is unpublished and the site's terms page is non-binding. No transparency report is published. Surfaces checked 6 September 2026.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
No located public material identifies a legal corpus behind the product's output, and the product is not built on one: Spotlight AI assesses relevancy across the customer's own collected collaboration data against facets generated from the case description, citing no law. FAQ and engineering post checked 6 September 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No located public material addresses whether authority is checked for subsequent history, and the product does not retrieve or cite primary law; its output is preserved collaboration data and relevancy assessments. Recorded as the honest value for a product without a citator function. Surfaces checked 6 September 2026.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
The vendor describes refusal or abstention behaviour in public materials.
The product documents how a reviewer can see why an item was flagged rather than what the model does when it cannot decide. The FAQ states results are ranked and tagged with reasons, the Spotlight AI page describes transparent explanations for every decision, and the engineering post describes facets a user can clarify with examples for edge cases; no abstention path or confidence threshold for uncertain relevancy calls is described. Recorded as documented on the strength of the explanation design, with the abstention gap noted. FAQ, Spotlight AI page and engineering post checked 6 September 2026.
Fabricated Citation Record
Does a public court record exist involving output from this product?
No court order, opinion or disciplinary record naming this product has been located as of the date shown. This is a statement about the public record, not a finding about the product.
No court order, opinion or disciplinary record naming Hanzo, Illuminate, Chronicle or Spotlight AI was located as of 6 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on the company and product names together with a general search for court findings; results returned the vendor's own launch material and commentary, none of which is a court record naming this product. This is a statement about the public record, not a finding about the product; a preservation and review tool that cites no authority carries a remote exposure on this signal.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No located public material names an ethics opinion, bar rule or professional responsibility framework. The vendor's material addresses defensibility of preservation and review and PCAOB audit evidence, which are procedural standards rather than bar guidance on lawyers' use of AI. FAQ, use-case navigation and MSA checked 6 September 2026.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
The buyer is an in-house corporate legal or compliance team that bills no client, so the product sits outside a lawyer-to-client fee relationship. The published savings framing is operational, weeks of first-pass review reduced to hours and collection scope reduced; nothing addresses how AI-assisted review is recorded or disclosed on any bill, and no law firm is a named buyer segment. FAQ and Spotlight AI page checked 6 September 2026.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
No located public material supports a client side disclosure obligation.
No sub-processor list or model provider list was located, and the vendor's answer to the model-provider question is that there is none: the FAQ states Spotlight AI runs on local language models deployed inside the customer's tenant so data never leaves the customer's environment, which a firm could forward to a client, and the 2023 launch names IBM's watsonx.ai as the studio the solution leverages. No published register of processors, no DPA on the site, and the direct-purchase agreement is unpublished; the security page was not opened and is the rebuttal route. Surfaces checked 6 September 2026.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a disclosure record are available and no export of an AI-use record is described. The Spotlight AI page states that every relevancy decision carries a transparent explanation so it is defensible, and the platform captures collaboration data in a format the vendor states holds up to legal scrutiny with edits and deletions intact; nothing states that a record of the model used, the facets applied and the human verification can be exported for a court. Spotlight AI page and FAQ checked 6 September 2026.