K

KLDiscovery Nebula

The models are the engine of core capabilities layered on a platform that would function without them, which is the B band, and the vendor's own product architecture draws the line. Nebula is the platform; Nebula AI is described as a toolkit inside it, and the software navigation lists Nebula as the product with Nebula AI Case Explorer as a separate product beside it. What the toolkit does is substantial and named feature by feature: document-level summarisation, entity recognition, sentiment analysis, detection and categorisation of personally identifiable and protected health information, and supervised and unsupervised machine learning classification driving predictive coding across TAR 1.0, TAR 2.0 and continuous active learning, alongside email threading and near-duplicate detection.

Underneath it sits a full discovery platform with an independent existence: a processing engine the vendor describes as the culmination of fifteen years of data processing across email, documents, images, audio and video, deduplication and de-NISTing, language identification and machine translation, dynamic batching and automated routing through Nebula Workflow, a workflow reporting suite, spreadsheet redaction inside Excel files without conversion, and automated redaction.

Remove the AI and a buyer still has ingestion, processing, review management, redaction and production. What is worth recording is that the machine learning half is not new: technology-assisted review has been in the product for years and is described as award-winning and patented, so the generative additions are the recent layer on an older analytical one. Verified 13 September 2026.

Grounding is real and documented with outputs traceable to their sources, and no measured accuracy is published, which is the B band. The grounding claim is unusually consistent across the estate rather than appearing once. Insights are stated to be presented transparently with outputs tied directly to source documents for validation and review. Document-level summaries are described as allowing reviewers to retain full visibility into source material so that summaries accelerate understanding while maintaining defensibility.

The capability list includes document-level AI summaries with source traceability as a named item. And the machine learning layer is described as operating within a controlled environment allowing refinement and validation to ensure consistent and defensible results. On a product whose AI reads the customer's own collected evidence, that traceability is the meaningful form of grounding: a reviewer can always open the document a summary or an entity tag came from.

What is entirely absent is measurement. No accuracy figure, recall or precision statistic, error rate, test set, validation study or third-party evaluation is published for any Nebula AI feature, which is notable on a platform whose predictive coding is marketed as award-winning and patented and which competes in a lane where recall statistics are standard currency. Nothing names a failure mode, and no limitation is volunteered on document type, language or data quality.

R15 governs the citator and primary-authority limbs, which do not bite on a system that cites the customer's own documents rather than legal authority. Verified 13 September 2026.

A written commitment that the models work alongside human judgement, with real review surfaces, short of the full control structure, which is the B band. The commitment is stated plainly and repeated, which distinguishes it from a single line of marketing: the AI is said to enhance review strategy without replacing professional judgment; the published workflow ends with a step in which legal teams apply judgment to AI-generated results, using them to prioritise review, guide strategy and structure productions; summaries are described as preserving reviewer control and traceability and as maintaining professional oversight; and the whole toolkit is positioned against what the vendor calls unstructured AI tools that introduce opacity and defensibility concerns.

Review surfaces behind that are real. Outputs are tied to source documents so a reviewer can validate them, machine learning models operate in a controlled environment allowing refinement and validation, and audit trails and reporting are stated to preserve defensibility across the lifecycle of the matter. What the A band requires is not published. No threshold is stated at which any model acts without review, nothing describes a confidence signal on an individual classification or summary, no mode distinction separates what a model may do unattended from what needs sign-off, and nothing describes what happens after an output is found to be wrong.

R124(2) was applied and no qualifying constraint was found: the without-replacing-professional-judgment framing is a general assurance of human review across the toolkit rather than a boundary attached to a named tier stating what its output may not be used for. Verified 13 September 2026.

Customer types and organisational scale are described without a single named customer or measured outcome, which is the C band. What is published is real but is all about the company rather than about deployments. Global reach is evidenced concretely: offices in the United States, United Kingdom, Germany, France, the Netherlands, Japan and India, each with a street address and telephone number, and named data centres in Austin, Eden Prairie, Brooklyn Park, Toronto, Slough, Frankfurt, Paris and Tokyo.

Seven industries have dedicated pages, being healthcare, financial, pharmaceutical, energy, technology, insurance and automotive, which tells a reader who the platform is sold to by sector. An awards page and a company history page sit alongside. None of that is deployment evidence. No customer is named anywhere on the product, AI or security pages read, no case study or customer story section exists in the navigation, no testimonial is attributed to a named individual or organisation, and no figure of any kind is published for time saved, cost reduced, data culled or review accelerated.

That absence is more striking here than on a small vendor: this is a business with offices on three continents and a two-decade operating history, and the estate is built to demonstrate scale and security rather than results. The seed's figures for headcount, locations and countries were checked against the vendor's own pages and are corporate scale rather than outcome evidence, so they are recorded in the description and are not credited on this axis. Verified 13 September 2026.

Confidentiality is asserted through a strong security posture while the specific commitments a legal buyer needs are absent or sit in an unpublished agreement, which is the C band. The security substance is genuine and is graded on its own axis: ISO/IEC 27001 certification with annual audits, an independently audited SOC 2, HIPAA and HITECH compliance certified by independent audit, role-based access controls regularly audited for privilege levels, segmented networks, annual third-party penetration testing and monthly vulnerability scanning.

One published commitment reaches confidentiality directly and is unusually strong, being graded on the third-party request row: the transparency report commits to notifying an affected customer before any government access request is met and to legally challenging such requests. On the limbs the A band names, the record is thin. Training use of customer content is not addressed anywhere located, in either direction. Retention and deletion of customer data are not stated.

No model provider is identified, so nothing can be said about what any third party sees or keeps of a document sent for summarisation. Privilege and work product are not addressed by name, which is a real gap on a discovery platform where privilege review is a defined workflow with its own log. And the instrument that would carry these terms is not published: the website terms are dated May 2019 and state expressly that they do not apply to services, which are provided under a separate written agreement, so a buyer cannot read the confidentiality position before entering a sales conversation. Verified 13 September 2026.

A real published position on advice versus tooling, short of the supervision and competence dimension, which is the B band. The position is stated in the vendor's own voice and repeated in three places rather than buried in a disclaimer. The AI is described as enhancing review strategy without replacing professional judgment. The published workflow makes the human step explicit and final, ending with legal teams applying judgment to AI-generated results and using them to prioritise review, guide strategy and structure productions.

And summaries are said to accelerate understanding while maintaining defensibility and professional oversight, with reviewers retaining full visibility into source material. Taken together that is a clear statement about what the product is for and where the professional's responsibility begins, which is what this axis asks at B. The framing is reinforced by the whole marketing posture, which sets structured AI inside an auditable review environment against unstructured tools that introduce opacity and defensibility concerns.

What the A band requires is absent. Nothing addresses supervision or competence, no statement identifies who inside a customer may operate the AI features or what training is expected, no rule of professional conduct or bar authority is named in any jurisdiction, and no jurisdiction limit is stated despite the platform being sold across seven countries. Recorded and expressly not credited: the website terms carry a no legal advice notice, but it governs the informational content of the website rather than the product's output. Verified 13 September 2026.

Governance principles are published without a mechanism, a testing regime or an accountable owner, which is the C band. What exists is a consistent design philosophy rather than a governance programme, and it is stated repeatedly enough to be more than a slogan: the toolkit is described as designed for defensibility and transparency, machine learning models are said to operate within a controlled environment allowing refinement and validation to ensure consistent and defensible results, insights are presented transparently with outputs tied to source documents, and all AI features are said to run inside the Nebula environment preserving structured workflows, access controls and audit trails rather than introducing ungoverned data processing outside the review platform.

The vendor explicitly contrasts this with unstructured AI tools that introduce opacity, inconsistency and defensibility concerns. That is a governance posture aimed at auditability, and it is coherent. What the higher bands require is missing entirely. No AI policy, responsible AI page or set of published principles exists in the navigation. No external framework is named. No individual, committee or function is identified as accountable for model behaviour.

No pre-release testing regime is described and no evaluation result is disclosed. Bias is not addressed in any form, which is worth naming on this product specifically: sentiment analysis is sold as a way to surface emotionally charged communications and entity recognition as a way to identify people, and nothing published would let a buyer test whether either behaves evenly across languages, communication styles or populations in a cross-border data set. Verified 13 September 2026.

Substantive published policy covering most of the ground, short of the full set, which is the B band. The security half is among the most detailed in this lane and is specific rather than adjectival. Access control is described as role-based across all systems and networks with access regularly audited to confirm proper privilege levels for each employee, and the AI features are stated to run inside an environment preserving metadata, access controls and audit logs.

Infrastructure is described concretely: multi-zoned segmented networks isolating critical systems, all internet traffic over a firewall-to-firewall VPN, redundancy across critical systems with backups every fifteen minutes between primary and backup data centres, intrusion detection, security information and event monitoring, and anti-malware with daily scans and monthly patching. Testing is independent and periodic, with annual third-party penetration tests of both application and infrastructure and monthly vulnerability scans.

Physical security is described down to biometric or PIN access and secure evidence storage across eight named data centres. Two limbs fail and one is unusual for a vendor this security-conscious. No subprocessor list is published: the only third party identified anywhere is Microsoft Azure, named as providing additional data centre locations, and no model or analytics supplier is named. And no incident or breach notification commitment to customers was located, which is notable given the company sells cyber incident response as a service. Retention and deletion of customer data are also unstated. Verified 13 September 2026.

No published position on liability for the product or its AI output was located, which is the D band, and the cause is a publishing choice rather than a retrieval limit. The only agreement published is the Website Terms of Use, last revised 1 May 2019, and it removes itself from scope in its own second paragraph: it states that the agreement shall not apply to any services provided by KLDiscovery, which shall be provided according to the written agreement for the applicable services.

So a customer agreement exists and is not published, and a buyer cannot read the allocation of risk before entering a sales process. That is the same shape recorded on three vendors in the previous pull and on Contract Logix in this one. Consequently nothing is established on any limb this axis tests. No warranty attaches to any AI output, no liability cap applicable to the services is published, no indemnity in either direction, no service level or uptime commitment, and no insurance position.

Nothing addresses who bears the loss when a machine learning classification wrongly codes a responsive document as non-responsive, or when a PII detection model misses regulated material before a production goes out, both of which are foreseeable and consequential on this product. Recorded and expressly not credited because it governs a different thing: the website terms disclaim all warranties for website content and cap KLDiscovery's liability arising from use of the website at 10,000 dollars, with Virginia law and exclusive Virginia jurisdiction. Verified 13 September 2026.

Real integrations exist and named connections are documented, short of the depth the A band describes, which is the B band. The most substantive one is named and is a competitor's platform rather than a convenience connector: Nebula is stated to pair with RelativityOne so that targeted data can be promoted into enterprise review, letting a customer run a matter in Nebula, cull it, and move only the relevant and defensible material into a higher-cost environment.

That is an interoperability position with a commercial logic behind it, and it is corroborated by KLDiscovery maintaining a Relativity help centre alongside its Nebula one. Around it sit adjacent products a customer can combine, being Nebula Archive for information governance and retention outside discovery, ReadySuite, and a Client Portal, each with its own help documentation. Collection reaches into custodian systems through the Remote Collection Manager, and Microsoft Azure is named for additional data centre locations.

A Microsoft commercial marketplace listing exists for the platform. What the A band asks for and was not established is depth: no catalogue of source-system connectors is published with the platform, no direction of flow is described for the RelativityOne pairing, nothing states what a customer must configure to move data between the two, and no API or developer documentation was located in the navigation. The connector inventory and the RelativityOne mechanics are what would move this row. Verified 13 September 2026.

Data residency is published at a level of precision almost nothing else in this corpus reaches, with the tenancy model unstated, which under R38 is a strong B because tenancy and region are co-equal limbs and publishing either clears C. Region is answered by naming the actual facilities rather than by naming a cloud region: data centres in Austin, Texas; Eden Prairie, Minnesota; Brooklyn Park, Minnesota; Toronto, Canada; Slough, England; Frankfurt, Germany; Paris, France; and Tokyo, Japan, with a note that other locations are available through the Microsoft Azure cloud.

For a buyer with data sovereignty obligations, a named city list across six countries answers the question directly, and it is supported by descriptions of the physical controls at those sites, covering 24-hour monitoring, redundant power and cooling, PIN or biometric access and secure media and evidence storage. Backups run every fifteen minutes between primary and backup data centres, which locates the replication as well as the primary.

What is not published is tenancy. Nothing states whether a customer's matters sit in a shared or dedicated environment, no separation model is described beyond multi-zoned segmented networks at the infrastructure level, and no single-tenant option is offered or refused. Deployment options are also thin on the vendor's own surfaces: cloud and on-premises delivery are described in third-party listings and an older vendor white paper mentions deployment flexibility, but no current first-party page sets out the choice, so it is recorded rather than credited. Verified 13 September 2026.

Certification is real and stated across four regimes, short of accessible evidence, which is the B band. The claims are specific and framed as completed independent work rather than alignment: ISO/IEC 27001 certification, with the page setting out what the standard required of the company including systematic risk examination, a coherent suite of controls, an overarching management process and annual audits to maintain compliance; SOC 2, described as an independent audit of the controls relevant to the security of the systems processing client data and to the confidentiality and privacy of that information; HIPAA and HITECH, described as an independent audit resulting in a certification of compliance; and accreditation under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. DPF, with the vendor directing the reader to the public register to view the certification.

Independent testing is stated as recurring, with annual third-party penetration tests and monthly vulnerability scans. A trust centre exists at a dedicated subdomain, described as combining security measures with secure, transparent access to essential documentation. Two things hold it at B. No scope or date is published for any certification: nothing states which entities, services or facilities sit inside the ISO or SOC boundary, when the current certificate or report period runs, or which auditor performed the work.

And the access flow was not established, the trust centre being named and linked but not opened, so under R25 it is recorded as what would move this row to A and under R5 no credit is taken for a portal whose gate has not been seen. Verified 13 September 2026.

The vendor refers to advanced models without identifying what sits underneath, which is the C band word for word. The references are frequent and specific about function while silent about origin. Nebula AI is described as harnessing the power of large language models to create summaries of authored content including complex medical records; machine learning classification is described as supervised and unsupervised; predictive coding is said to use true machine learning across TAR 1.0, TAR 2.0 and continuous active learning; natural language processing drives entity extraction and sentiment analysis; and machine translation is described as based on neural networks, characterised as the current gold standard in translation AI.

The technology is also claimed as the vendor's own, described as award-winning and patented and as developed through collaboration between its data scientists, software engineers and legal professionals. What is never stated is which model performs any of it. No model is named, no version is given, no provider is identified, and nothing distinguishes proprietary models from third-party ones, which matters because the summarisation feature is expressly attributed to large language models and those are rarely built in-house.

Nothing states where inference runs relative to the named data centres, what any provider may retain of a document sent for summarisation, or whether a customer would be told if the underlying model changed. Recorded and expressly not credited under ground rules section 3: Microsoft Azure is named as providing additional data centre locations, which is infrastructure rather than a model supplier. Verified 13 September 2026.

No pricing information is published at any level, including the unit of charge, which is the D band. The page inventory was taken from the navigation and footer under R20 and covers the four software products, the nine service lines, seven industry pages, the why-KLDiscovery pages including security and global capabilities, insights, about, support and the six legal pages. There is no pricing page and no purchase path.

Every commercial route on the product and AI pages resolves to Request a Demo, Contact Us, Contact Sales, Schedule a Demo or Discuss Your Matter. Nothing published identifies the charging model, so a buyer cannot establish even the shape of the commercial arrangement: not whether the platform is charged per gigabyte ingested, per gigabyte hosted per month, per user, per matter or per document reviewed, which are the competing conventions in this lane and differ enormously in effect, and not what processing, hosting and production each cost relative to one another.

No tier names, no feature-based packaging and no minimum commitment are published. Under R10's closing discipline no structure means no row, and a page that only invites a sales conversation is an absence belonging in this note alone, so no VendorPricing row is written for this record. The gap is worth naming plainly because of the buyer: discovery cost is the single largest variable in most matters and is routinely passed to a client, and this vendor publishes a detailed account of its data centres and its certifications while publishing nothing at all about what any of it costs. Verified 13 September 2026.

Coverage is described with real substance across matter types, sectors and geographies, with the boundaries left open, which is the B band. Matter coverage is published as four named use cases with detail behind each: litigation strategy development through early summaries, entity mapping and sentiment analysis before committing to large-scale review; internal investigations, aimed at surfacing key participants and significant communications; privacy and regulatory response, using PII and PHI detection to support compliance reviews and notification workflows; and data reduction before enterprise review.

The service estate around the platform names the specialist proceedings a buyer would ask about, including antitrust and competition investigations and HSR second request and Phase II merger reviews, alongside cross-border litigation, computer forensics and cyber incident response. Sector coverage is set out as seven industries each with its own page, being healthcare, financial, pharmaceutical, energy, technology, insurance and automotive, which maps onto the regulated sectors that generate the largest discovery exposures.

Geographic coverage is evidenced by offices in seven countries and data centres in six, which for cross-border matters is coverage in the operative sense. What is left open is every limit. No matter size floor or ceiling is published, nothing states which file types or languages the AI features handle well or poorly, no jurisdiction is named as unsupported, and nothing distinguishes what Nebula is suited to from what the vendor would route to RelativityOne beyond a general statement about enterprise scale. Verified 13 September 2026.