Hebbia is a New York company whose platform, Matrix, runs structured analysis in several steps across large sets of documents a customer uploads. It returns answers in a grid where each row is a document and each column a question, with sources shown for each cell; Max is its agent product. It is sold to asset managers, investment banks, corporate finance teams and law firms. Its legal page names due diligence, credit agreements, capital markets drafting, fund formation, databases of a firm's past matters and bespoke firm workflows, and shows Latham & Watkins, Cleary Gottlieb, Ropes & Gray and Seyfarth as customers.
The Main Services Agreement, Data Processing Agreement, acceptable use policy and privacy policy are published. The DPA names OpenAI, Anthropic, Google and Microsoft as model providers and five inference hosts, each with a processing location. Hebbia states it does not train on customer data, while its agreement permits improving models used solely by that customer. Hebbia holds SOC 2 Type II and states ISO/IEC 42001:2023 certification; the platform runs on AWS in United States and European regions, and pricing is quoted per order.
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Vendors in the same categories as Hebbia whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The artificial intelligence is the product. Matrix is described by the vendor as a platform for building AI agents that complete end-to-end tasks rather than chatting, decomposing a question into structured steps across thousands of uploaded documents and returning a grid where each row is a document and each column a question, with sourcing shown per cell; Max is the agent product sold alongside it. The subprocessor register makes the architecture concrete, naming four large language model providers that process user prompts and files and five separate services that host parts of the inference infrastructure.
There is no underlying document system, workflow tool or system of record that survives the removal of the models: strip them out and there is nothing left to sell.
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is asserted and never measured, and the vendor's own agreement contradicts the marketing claim. The security page states that Hebbia is creating the standard for trustworthy large language models that never hallucinate and give correct, verifiable answers. Section 7.1 of the Main Services Agreement states in capitals that Hebbia does not warrant that the platform is accurate or complete and that it is provided as is.
No accuracy figure, test set, evaluation or described retrieval method appears on any page from the vendor that was read. The grounding that exists is real but only asserted: outputs are described as verifiable and structured step by step, over documents the customer uploaded and can open. The Matrix product page was not read and may describe a method.
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Autonomy is claimed at length, and oversight is asserted without a described control. The product is sold as agents that complete whole tasks rather than answering questions, running analysis in several steps across whole document sets and carrying the work through to a memo, a deck or a model. The vendor calls it an operating system for complex work. On the oversight side there is transparency of output rather than a control structure.
Sourcing is shown for each cell of the grid so a user can check where an answer came from, and the structured format is presented as the guarantee of quality. No located material states what an agent may do without a person, at what point it stops, what review the vendor expects before an output is used, or what happens when it is wrong beyond the warranty disclaimer.
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Logos stand in for evidence on the vendor's own pages, and the figures live elsewhere. The legal page displays the marks of Latham & Watkins, Cleary Gottlieb, Ropes & Gray and Seyfarth with no statement of what any of them does with the product, no attributed quotation and no result. The quantified claims are on third party pages. OpenAI's case study on Hebbia states that law firms reduce credit agreement review time by 75 percent, saving $2,000 an hour in legal fees, and that investment bankers save 30 to 40 hours a deal.
Andreessen Horowitz's investment announcement reports unnamed customers saying analyses that took two to three hours now take two to three minutes. None of that is published by the vendor, none names the firm behind the figure, and no method is stated for any of it.
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive commitments are published and binding, without segregation or privilege treatment. Customer Materials are the customer's Confidential Information and the customer owns them (MSA 6.1, 3.3). Hebbia will not access or use Customer Materials to provide technical support without the customer's documented consent (1.2). Customer Materials are deleted within 30 days of termination (5.4(c)), and personal data is deleted on request at any time (DPA Annex II).
The DPA names OpenAI, Anthropic, Google and Microsoft as processing user prompts and files. Nothing located addresses segregation between users, matters or clients inside a customer tenant, which matters for a product sold to four named AmLaw firms. Privilege and work product are not addressed anywhere. The agreement also permits improving machine learning models with Customer Materials where those models are solely for that customer.
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
No position on the advice line is published, for a platform sold to law firms for due diligence, capital markets drafting and matter work. The Main Services Agreement, read in full, addresses use restrictions, warranties, indemnities, liability and arbitration without touching advice, competence or supervision. Its disclaimer at 7.1 is a warranty disclaimer rather than a statement of what the product is and is not. The acceptable use policy governs misuse, infringement and harassment, not the practice of law.
The legal page describes lawyers using the product to advise better and become the trusted adviser clients rely on, with no statement that the output is not legal advice. The audience is professional. A product disclaimer inside the application, if one exists, may say more.
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
A published, independently audited governance framework exists, without testing results or a named owner. The legal page displays ISO/IEC 42001:2023, the management system standard for artificial intelligence, alongside SOC 2 Type II, and the security page repeats an ISO mark. A certification against an AI management standard carries more weight than a principles page the vendor writes itself. No governance policy is published, nor any statement of who inside Hebbia is accountable for model behavior, what is tested before an agent ships, or any finding about uneven output across matter types or populations.
The certificate, its scope and its date are not published. The trust center, hosted on Vanta, returned page metadata with no body and may say more.
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention, deletion, access control, subprocessors and incident practice are all published and specific, in documents a buyer can read before signing. Annex II of the Data Processing Agreement is a full table of technical and organizational measures. It lists AES-256 encryption at rest through keys managed by AWS, TLS 1.3 in transit, multi factor authentication and single sign on with two factor required on all production access, hourly backups of production datastores that are periodically tested, monitored security logging with escalation, change management automated through CI/CD, and annual SOC 2 Type II audits.
Customers may request deletion at any time and delete through self service, all personal data is deleted following termination, and a subject access form is published for erasure and portability. MSA 5.4(c) deletes Customer Materials within 30 days of termination. Annex III names every subprocessor with its processing location, and the DPA commits to notifying any new one ten days before it touches personal data, with an objection right.
The incident clause requires Hebbia to inform the customer without undue delay rather than within a fixed number of hours.
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
What the vendor stands behind is published and specific, including where it stands behind nothing. Section 8.2 gives a defense and indemnity against third party claims that Hebbia's technology infringes a US patent, copyright or trade secret, with three named exclusions and the option to procure, replace, or terminate and refund. Section 8.3 makes the indemnities the only remedy for third party intellectual property claims.
Section 9.2 caps aggregate liability at fees paid or payable in the twelve months before the event, expressly including indemnity claims, so the indemnity sits inside the cap. Section 9.1 excludes indirect loss and data inaccuracy for both parties, and the Excluded Claims in 9.3 lift that exclusion for the intellectual property indemnities and for a customer breach of the use restrictions. Section 7.1 disclaims all warranties in capitals and states that the platform is not warranted accurate or complete.
The invocable remedy is the service level agreement: 99.9 percent monthly availability, with a service credit of one day's fees for each hour of downtime, capped at one week of fees a month and claimable within 24 hours. No insurance is stated.
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations are named in a binding document, without depth and without the systems legal work usually lives in. The Data Processing Agreement names Merge API as an opt in subprocessor that applies only to customers who configure a Salesforce or Outlook connector. It names Google LLC as providing email and document management capabilities through Google Workspace Enterprise alongside its model role. The connectors are therefore documented with what they carry and when they apply.
The Matrix 2.0 announcement adds Daloopa, a financial data feed, as a connected source. No description of direction, sync behavior or configuration is published. No document management system, matter management, electronic billing or practice management integration is published on any page read, so a firm's documents reach the platform by upload or through a connector set built for finance.
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Residency is published in detail, and deployment options are not. Annex III of the Data Processing Agreement gives a processing location for every subprocessor. Amazon Web Services is placed in the named regions us-east-1, us-west-1, eu-west-1 and eu-central-1, and each model provider and inference host is placed in all US locations or in EU regional processing, with document parsing and telemetry regional by tenant.
That answers where processing happens as distinct from where data is stored, provider by provider. Transfers out of the EEA and the United Kingdom run on the 2021 Standard Contractual Clauses with the UK Addendum, completed in the DPA down to the module, the docking clause and Irish governing law. DPA 3.5 states that processing may occur in any country where Hebbia, its affiliates and its authorized subprocessors keep facilities, subject to law.
No single tenant, private cloud or on premise option is described, no tenancy separation is stated beyond encryption and logical measures, and nothing states what a customer can select.
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real and stated in a binding annex, without accessible evidence. Annex II of the Data Processing Agreement records that Hebbia has undergone a SOC 2 Type 2 audit covering the security trust service criteria and undergoes annual SOC 2 Type II audits, and the customer pages display SOC 2 Type II and ISO/IEC 42001:2023 marks. The DPA gives a real audit right: the customer or its appointed auditors may audit compliance once in any twelve months, and more often after a security incident.
Hebbia must make relevant information, policies, records and staff available. No auditor, audit period, report date or scope statement is published. The trust center at trust.hebbia.ai, hosted on Vanta, returned page metadata with no body, so whether any report is available without asking could not be established; it may say more.
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The supply chain is disclosed in depth and stops short of naming the models. Annex III of the published Data Processing Agreement names OpenAI, Anthropic, Google and Microsoft as providing large language model capabilities through their APIs. For each it states that the subject matter processed is user submitted prompts and files, and gives the processing location as all US locations or EU regional processing. Cerebras, Groq, Baseten, Fireworks AI and Modal Labs are each named as hosting part of Hebbia's own inference infrastructure, with Elasticsearch for search and indexing over prompts, files and generated artifacts, MongoDB for embedding and reranking, and Reducto for document parsing.
Change notification is contractual: any new subprocessor is listed and notified ten days before it accesses personal data, with an objection right. No specific model or version is identified on any page from the vendor. OpenAI's own case study names o3-mini, o1 and GPT-4o inside Matrix, and Anthropic's names Claude, but those are third party statements rather than the vendor's disclosure.
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
There is a page called Pricing, and it contains no price. It publishes positioning, a product name and three industry links, and every button on it requests a demo; no figure, range, plan or unit appears. The agreement supplies the mechanics. Fees are set in an Order Form and payable in US dollars unless the Order says otherwise. The license is per seat, since administrators may provision Authorized Users up to a maximum stated in the Order Form.
Orders renew automatically for one year terms unless either party gives 30 days' notice, and Hebbia may notify different renewal pricing at least 45 days in advance, so renewal increases are set by the vendor within a fixed notice period. Payment is due within 30 days, late amounts carry 1.5 percent a month, and invoices must be disputed within 60 days. The unit and the mechanics are readable before a sales call, and the number is not. Seat prices on third party review sites are not evidence and are not recorded.
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is described with substance, and one significant limit is published. The legal page names six areas of legal work: banking and finance documentation, buy side and sell side due diligence, capital markets drafting from filings and precedent transactions, private equity fund formation and portfolio governance, matter intelligence built from a firm's past work, and workflows tailored to a firm. The wider platform serves investing, banking and corporate finance, so the product spans transactional and financial work rather than litigation, and no dispute, court or regulatory practice area is claimed.
The limit is contractual. MSA 2.4 with definition 12.13 prohibits the customer from submitting Restricted Information without Hebbia's prior written approval. Restricted Information covers sensitive personal identifiers, protected health information and personal data as defined in the GDPR, and DPA Annex I separately prohibits special categories. A firm running European matters, employment work or anything touching health records needs that approval first. Firm segments are not broken down, and government and in house use are not addressed.
The public pages on file for Hebbia, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
Primary Law Corpus Provenance, Good Law Verification, Bar Guidance Alignment and 1 more
Read Sep 7, 2026
Client Data in Training, Ethical Walls and Matter Segregation, Third Party Request and Subpoena Notice
Read Sep 7, 2026
Prompt and Output Retention, Outside Counsel Guideline Readiness
Read Sep 7, 2026
Refusal and Uncertainty Behavior, Court Disclosure Support
Read Sep 7, 2026
Fabricated Citation Record
Read Sep 7, 2026
Hebbia added a live integration with Octus, built on the Octus MCP Connector, that brings every Octus product a firm subscribes to into Hebbia at once. Users can query Octus legal analysis, covenant and restructuring data, deal documents and court filings alongside their own documents in one question, with answers cited to the source.
Hebbia's October update brings memory and version history to its Max assistant. Admins switch memory on for the whole organisation and users can review and delete what Max remembers, while version history lets users compare and roll back decks and documents. The update also adds a Microsoft Word plugin that runs workflows and research and drafts sections, Intralinks and Dynamo content syncs, scheduled agents, and the option to run several skills in one message.
Hebbia launched Headless Hebbia, an API and MCP server that brings its retrieval, orchestration and analysis into a firm's own applications, which Hebbia builds with each team. Through the MCP server, Claude and ChatGPT can call Hebbia and receive answers with links back to the underlying evidence. The post gives no pricing, limits or release stage, and access starts with a demo request.
A signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Can material a lawyer puts into this product be used to train a model?
The published agreement expressly reserves a right to train on customer content, with no opt out located. Any de identification, anonymization or aggregation qualifier is recorded in the summary.
The published agreement expressly permits training on customer content in a bounded form, while the marketing says the opposite. Main Services Agreement clause 3.2 grants Hebbia a license to use Customer Materials to provide and support the platform. It adds that Hebbia may use Customer Materials to improve machine learning models that are solely for use by that customer, and may not license or otherwise make models improved with Customer Materials available to any third party.
No opt out was located. The security page states that Hebbia is one of the only AI companies that never trains on customer data, and the legal page carries a badge reading no training on user data. The privacy policy is drafted more carefully and is consistent with the clause, saying that personal data in customer data is not used to train or improve generalized or third party models. The permission is real, names machine learning models and operates on customer content, but it is confined to a model only that customer uses and barred from reaching anyone else. MSA, security page, legal page and privacy policy read 7 September 2026.
How long does the product keep what a lawyer typed, and can that be set to zero?
The customer controls the retention window, by product configuration or by contractual instruction, but zero retention is not stated as available.
The customer controls deletion, no retention period is fixed, and zero retention is not offered. Annex II of the Data Processing Agreement states that customers determine what data they route through the service and may request deletion at any time. Hebbia deletes personal data on written request where self service deletion is not available, and all personal data is deleted following termination. A subject access form is published for erasure and portability, and the Main Services Agreement deletes Customer Materials within 30 days of termination.
Annex III states for each model provider and inference host that the subject matter processed is user submitted prompts and files, so prompts and generated artifacts are inside the regime, and Elasticsearch is named as indexing prompts, files and generated artifacts. No retention period during the subscription is published, nor any statement of how long prompts persist while it runs, nor a setting for no retention. DPA and MSA read in full 7 September 2026.
Does retrieval respect the firm’s ethical walls, or can the model read across them?
No located public material addresses walls or matter level segregation.
Separation between customers is covered, and walls between matters inside one customer's workspace are not. The agreement covers administrator provisioning of Authorized Users and account credentials, and the security measures annex covers encryption, authentication and logical protections between Hebbia's customers, but nothing read describes whether retrieval inside a customer's own workspace respects walls between matters, clients or teams, or whether an agent running across an uploaded corpus can reach material a particular lawyer should not see.
That is a live question for a platform whose legal page names four large law firms and whose core function is analysis across an entire document set at once. The Matrix and Max product pages and the gated trust center were not read. MSA, DPA and legal page checked 7 September 2026.
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
The agreement commits to prior notice where permitted, with assistance to contest. Main Services Agreement clause 6.3 lets either party disclose the other's confidential information when required by law or regulation only after giving prior notice of the compelled disclosure, to the extent permitted, and reasonable assistance at the disclosing party's cost to contest or limit it. Customer Materials are the customer's Confidential Information under 6.1, so the clause reaches uploaded documents rather than only account data.
The Data Processing Agreement adds that Hebbia will promptly inform the customer, with full details, of any request or complaint from a data subject, regulator or third party unless prohibited by law. No transparency report, request statistics or law enforcement guidelines page was located. MSA and DPA read in full 7 September 2026.
Where does the law in this product come from, and does the vendor have the right to use it?
Sources are identified without stating the license or rights basis.
The sources are identified, and no license basis is stated for the ones Hebbia supplies. The product analyzes documents the customer uploads, and the agreement puts the rights basis on the customer, who warrants at 2.4 that it has the necessary rights, licenses and permissions to provide the materials. Two connected sources sit outside that. Google Workspace Enterprise reaches email and documents through a connector, and the Matrix 2.0 announcement adds Daloopa, a financial data feed now available to Hebbia customers, with no statement of the license, coverage or update cadence behind it.
No collection of law, filings or public authority is claimed. Legal page, MSA, DPA and Matrix 2.0 announcement read 7 September 2026.
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
A treatment signal has no role where every citation points back to customer documents. The product analyzes credit agreements, filings, offering memoranda, fund documents and a firm's own past matters, and cites back to the documents the customer supplied. Nothing read describes a citator, a treatment signal or a verification prompt for reported authority, and the vendor does not claim to retrieve case law. Legal page, security page and Matrix material checked 7 September 2026.
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
An ungrounded question has no described abstention path in the product. The vendor's position is the opposite claim, that it is building large language models that never hallucinate and give correct, verifiable answers, which asserts the problem away rather than describing an abstention path. Nothing read sets out a no-answer state, a confidence or grounding score, or any published evaluation in which the system declines.
The same page's claim sits against the agreement's disclaimer that the platform is not warranted accurate or complete. Security page, MSA, legal page and Matrix 2.0 announcement checked 7 September 2026.
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
No court order, opinion or disciplinary record naming Hebbia or Matrix was located as of 7 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on both names alongside a general search of sanctions coverage; the decisions that name legal-specific products name other vendors. This is a statement about the public record, not a finding about the product. The exposure profile is worth stating: the platform analyses documents a customer supplies and cites back to them rather than generating legal authority, so the fabricated-citation risk runs through what a user does with an output rather than through invented case law.
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Bar guidance and lawyers' professional obligations find no place in how the product is presented, even in general terms. The legal page speaks to winning and keeping clients, closing deals faster and becoming the trusted adviser, which is commercial framing. The security page's responsibility section commits to responsible use of the platform, and the acceptable use policy addresses illegal, deceptive or infringing use; both concern misuse of software rather than a lawyer's duties.
Nothing names an ABA formal opinion, a state bar opinion, a regulator's AI guidance or a court standing order. Legal page, security page, acceptable use policy and MSA checked 7 September 2026.
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Public materials claim time savings without addressing billing or disclosure, and the product sits inside a fee relationship between a lawyer and a client where those savings would change the bill.
The product sits inside law firms' fee relationships with their clients, and the published position is a savings claim. The legal page is built on three promises to a firm: close deals faster by speeding up due diligence and contract review, grow the book by freeing the team from repetitive document work, and go deeper on every deal. Third party material puts numbers on the claim. OpenAI's case study reports that law firms cut credit agreement review time by 75 percent and save $2,000 an hour in legal fees, which describes billable work compressing.
Nothing located addresses what happens to the client's bill when it does: no guidance on recording AI assisted work on a matter, no disclosure treatment, and no record per matter of what the agents did. Legal page, MSA and third party material checked 7 September 2026.
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A subprocessor and model provider list plus client facing disclosure material is published or available without an agreement in place.
A firm can answer a client's AI clause from published material without asking for anything. Annex III of the Data Processing Agreement is a complete subprocessor register. OpenAI, Anthropic, Google and Microsoft are each named as providing large language model capabilities through their APIs, processing user submitted prompts and files in all US locations or EU regional processing. Cerebras, Groq, Baseten, Fireworks AI and Modal Labs are named as hosting parts of the inference infrastructure, and Amazon Web Services, Auth0, Elasticsearch, MongoDB, Reducto, Merge API and Datadog complete the list with their roles and locations.
The DPA itself is the material to forward. It is published in full with the EU Standard Contractual Clauses and UK Addendum completed, the security measures in Annex II, and a commitment to notify any new subprocessor ten days before it accesses personal data, with an objection right. The agreement prohibits submitting personal data as defined in the GDPR without prior written approval. DPA read in full 7 September 2026.
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
One element of a record exists and no export is built for disclosure. Outputs are described as verifiable, with sourcing shown for each answer in the grid so a user can trace a cell back to the document it came from, which is source attribution and is genuinely one of the three things a disclosure needs. The other two are absent from everything read: no per-document export covering which model produced an output, and no record of human verification.
Nothing addresses court disclosure obligations, standing orders on AI use, or a certification a filer could attach, and no template or guidance is published. The security annex's logging is monitoring of access to systems rather than a user-facing record of what an agent did. Security page, MSA, DPA and legal page checked 7 September 2026.
Every grade and every signal on this index is drawn from public sources and dated. If a record is wrong, out of date, or missing an artifact the index did not locate, send the source and it will be reviewed and the record redated. Vendors are welcome to submit documentation. Nothing on this index is for sale, including a listing, a placement, or a grade.