Hona

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Hona has repositioned around the model but the platform underneath still stands. The company now markets itself as AI for personal injury firms and Lia as an AI case manager, and the FAQ confirms Lia is priced and contracted separately from what the vendor calls Hona's core platform. That core — client portal, case-progress updates, two-way messaging, drip campaigns, branding, education — is conventional communication software that predates Lia and is still sold. Remove the models and a working client-update product remains. B on the band: the models are the engine of a core capability layered on a product that would still function without them. Pages read 1 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Accuracy is asserted in operational metrics and never measured as accuracy. The site publishes a 94% check-in rate, a response time under four minutes, and a claim that 100% of treatment updates are auto-captured, but none of those describes how often Lia records a symptom, provider or appointment correctly, and no evaluation, test set or error rate was located on any page read on 1 September 2026. That matters because the extraction is the product: Lia reads free-text client replies and writes structured treatment records that later support a settlement demand, so a misread provider name or date propagates into the case file. The primary-authority and citator limbs of the higher bands do not apply, since Lia is expressly barred from producing legal assertions. C: accuracy asserted without measurement.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The most complete control structure located in this pull, and it is published rather than implied. What runs alone is stated: Lia manages routine treatment-phase communication on her own, opening contact by text and running check-ins without per-message approval. What constrains her is customer-written and specific — escalation rules composed in plain language, with the vendor's own worked examples being alerts when a client mentions stopping treatment or when a provider appears that is not on the preferred list. Thresholds are published: missed physical therapy twice in a row, no response for 48 hours, and high-priority issues re-pinging the case manager every hour until resolved. Review surfaces are published: every conversation is visible to the team, staff can step in at any time, each case manager sees their own book, and provider-facing drafts require human sign-off before anything goes out. The route back to human judgement is explicit and covers the highest-risk case — a legal question escalates immediately to the assigned case manager, and a call placed from the dashboard is transcribed back into Lia. Enrolment is optional case by case, with the vendor advising firms to exclude clients unlikely to respond well to text.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Named users at named firms, and figures that belong to the platform rather than to any of them. Individuals are on record with titles and employers: Sofia Escobedo, Assistant at The James Law Firm; Crisely Gonzalez, Case Manager at Omega Law Group; Alexandria Zant at Zant Law Firm; Domenic Martini at Singleton Schreiber; Bridgett Sanne at Inserra Kelley Cooper Sewell. Firm logos include Isaacs & Isaacs and Nachawati Law. Separately the vendor publishes 500-plus personal injury firms, a 94% average client intake completion rate and a sub-four-minute average response time. None of the quoted users carries a figure and none of the figures carries a customer, a date or a stated method. The market statistics on the product page — a 30% reduction in payouts where treatment gaps occur, 20%-plus of cases showing a two-week gap in the first six weeks — are claims about the industry rather than about Hona, and are not treated as outcome evidence. B.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The agreement is published and substantive on confidentiality, and silent on the question that decides this axis. Terms and Conditions clause 8 runs a mutual confidentiality regime with a three-year tail and perpetual protection for trade secrets, clause 13.4(b) requires Provider to cease all use of Customer Data on termination and return or destroy it with certification in a signed instrument, and the compliance section states PHI is handled under a BAA with end-to-end encryption. Clause 9.2 leaves the customer owning Customer Data. But nothing anywhere addresses training on client content, and clause 9.1 runs the other way: the customer unconditionally and irrevocably assigns to Provider all right, title and interest in Resultant Data, a term defined only in a separate Definitions Exhibit that was not read. No matter-level or tenant segregation is documented, and privilege and work product are not addressed for a system carrying communications between a firm and its clients. C rather than B because B requires substantive commitments on training use and there are none.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Two published commitments that are rare anywhere in this index and unique in this lane. First, the advice line is stated as a product guardrail rather than a disclaimer: Lia is configured never to provide legal advice or legal opinions, and any question touching legal strategy is escalated directly to the assigned case manager. Second, and more unusual, the vendor commits to disclosing the AI to the client — Lia introduces herself as an AI from the firm in her very first message, described as a requirement rather than an option, with the recommended practice that a human sends an intro first. In a category whose editorial turns on a client being unable to tell whether an answer is legal advice, that is the disclosure the category asks for. B rather than A because no jurisdiction limits are named, nothing addresses the firm's own supervision and competence duties beyond the escalation route, and ABA Formal Opinion 512 is not mentioned on any page read on 1 September 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

No governance position published for a system that talks to injured claimants unsupervised. The home page, the AI case agents product page with its compliance and FAQ sections, the privacy policy and the full Terms and Conditions were read on 1 September 2026; there is no responsible AI page, no named accountable owner for the AI, no pre-release testing regime and no ISO 42001 or equivalent. Nothing addresses whether Lia performs evenly across client populations, which is a live question for a product that runs in English and Spanish and whose vendor advises firms to exclude elderly clients and catastrophic-injury cases from enrolment — an exclusion that implies known performance limits that are never described. The legal-advice guardrail and escalation rules are real but they are oversight controls graded on Autonomy, and TCPA and HIPAA compliance are regulatory posture rather than model governance.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Deletion is well handled and almost nothing else is. Terms clause 13.4 requires Provider on termination to cease use of Customer Data and return or destroy it, certified in a signed written instrument, with carve-outs for legal retention and for backups, archives and disaster recovery systems until deleted in the ordinary course. The compliance section states end-to-end encryption and PHI handled under a BAA, and clause 5 commits to routine backups with restoration as the sole remedy for data loss. Against that: no retention period during the term, no incident or breach notification practice, and no subprocessor list — clause 1.6 reserves the right to engage subcontractors from time to time in Provider's discretion with no list and no notice obligation. Clause 6 defines the security commitment by pointing at the privacy policy, which is dated 12 September 2022 and predates Lia entirely. C: the policy covers the product without addressing what happens to client messages and generated records after processing.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

A complete, readable and openly published allocation, which is more than most of this pull offers. Terms clause 12.2 caps aggregate liability at the fees paid in the twelve months before the act giving rise to it, clause 12.1 excludes the usual heads of consequential loss, and clause 11.1 gives the customer a genuine indemnity — Provider defends and holds the customer harmless against third-party US intellectual property claims arising from use of the Services, with the carve-outs itemised and clause 11.4 obliging Provider to procure rights, modify or terminate if the Services are enjoined. Clause 10.2 carries an express warranty that Provider will perform using personnel of required skill and in a professional and workmanlike manner to generally recognised industry standards, and clause 4 adds a 95% availability commitment with service credits. B rather than A because none of it reaches output: clause 10.4 expressly warrants nothing about results being accurate, complete or error free, the indemnity covers infringement rather than a wrong treatment record, and no insurance position is published.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Real, numerous and precisely aimed at the systems this buyer actually runs. Fifteen platforms are named on the product page, including Filevine, Clio, MyCase, CASEpeer, SmartAdvocate, Assembly, Smokeball, Lawcus, Salesforce, Lead Docket, Cerenade, Lexamica and AttorneyShare — the plaintiff-side stack rather than a generic connector list, and eight of them are vendors this index already covers. Direction is stated at a high level, with the vendor saying Lia lives alongside the case management system and pulls data both ways, and the mechanism is named: enrolment happens through a Chrome extension that gives Lia the case context, with enrolment optionally triggered by case status changes in the underlying system. B rather than A because no page read on 1 September 2026 describes which fields move, in which direction, or what a firm must configure, and the FAQ routes specifics to a sales rep. The dedicated integrations page was not opened and is the rebuttal route.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Cloud delivery is evident and neither dimension is stated. No tenancy model is published anywhere, and no region option is offered. The only location material is in the privacy policy of 12 September 2022, which states personal data may be stored and processed in any country where Hona or its service providers do business, including the United States, and that officials in those countries may be entitled to access it, with EU Standard Contractual Clauses used where required for transfers out of the EEA, UK or Switzerland. That is a transfer disclosure, not a residency offering, and it fixes no processing location. Nothing distinguishes where data is processed from where it is stored. C on the band's words.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

The compliance section of the product page states SOC 2 Type II audited annually with the report available on request, alongside HIPAA with PHI handled under a BAA and end-to-end encryption, and TCPA with consent tracked per outreach and opt-outs honoured — the last being the right standard to name for a product whose core function is automated texting to consumers. Full documentation is said to be available on request. What is absent is everything that would let a buyer test it: no auditor is named, no scope or trust services criteria are given, no coverage period or report date appears, and there is no trust centre or portal of any kind. The request route is stated but not described, so under the three-tier rule it does not reach the top band. B rather than C because the standard is named in prose with an annual cadence rather than appearing only as a badge.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Nothing published about the model supply chain a customer inherits. Hona markets an AI agent that texts and calls clients, transcribes calls, extracts structured medical information and operates in two languages, and across the home page, the AI case agents page including its compliance and FAQ sections, the privacy policy and the full Terms and Conditions read on 1 September 2026, no model, no model provider, no inference location and no change-notification commitment appears. There is no subprocessor list, and the agreement runs the other way: clause 1.6 reserves the right to engage subcontractors to perform the Services from time to time in Provider's sole discretion, with no obligation to name them or notify the customer. D rather than C because C requires the vendor at least to refer to the models underneath, and no reference to a model layer was located at all.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

An unusual case: there is no pricing page, and the charging structure is nonetheless published in detail — in the contract. The site's Pricing link routes to a demo booking and the FAQ answers both pricing and contract-term questions by referring the buyer to a sales rep. But the Terms and Conditions publish the whole model: fees are structured as Recurring and One-Time Fees against an Initial User Count and a Case Tier Limit, with Excess User Fees, Case Overage Fees and Text Overage Fees defined; the text allowance is stated as a formula, the Case Tier Limit multiplied by fifty, with the vendor's own worked example of 12,500 texts for a 250-case tier over twelve months; and one real rate is published, 1.5 cents per text beyond the allowance. Fee increases require thirty days' notice and renewal is annual and automatic. B on the band's second limb, the unit and structure stated without the figure. No plan price is published at any level, which is what keeps it off A.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The focus is stated more sharply than most vendors dare. Hona describes itself as built for personal injury firms and repeats it in the site footer, and the product page is written entirely around the treatment phase of a PI case — providers, appointments, treatment gaps, symptom capture. Eight practice types carry their own pages: personal injury, workers compensation, bankruptcy, mass tort, employment, criminal, immigration and family law. The vendor also states real limits, which is rare: enrolment is optional per client and firms are advised to start with active-treatment soft-tissue cases and to exclude clients unlikely to respond well to text outreach, naming elderly clients and catastrophic-injury cases. B rather than A because firm segmentation is absent — nothing addresses solo versus large firm, in-house or government use — and the practice pages beyond personal injury are not evidenced as deeply as the core.