K

KLDiscovery Nebula

Nebula is the platform; Nebula AI is a toolkit inside it, and the navigation lists Nebula AI Case Explorer as a separate product. The toolkit is substantial: document summaries, entity recognition, sentiment analysis, detection of personal and health information, and machine learning classification for predictive coding across TAR 1.0, TAR 2.0 and continuous active learning, plus email threading and near duplicate detection.

Underneath sits a full discovery platform. The vendor describes its processing engine as the result of fifteen years of work, handling email, documents, images, audio and video, with deduplication, NIST filtering, language identification, machine translation, batching, routing, reporting and redaction. Without the AI, ingestion, processing, review management, redaction and production remain. The machine learning half is not new: technology assisted review has been in the product for years and is described as award winning and patented, so the generative features are a recent layer on an older one.

The grounding claim is consistent across the site. Outputs are tied directly to source documents for validation and review. Summaries let reviewers keep full sight of the source material. The capability list includes document summaries with source traceability as a named item. And the machine learning layer is said to run in a controlled environment that allows refinement and validation. Because the AI reads the customer's own evidence, a reviewer can always open the document a summary or entity tag came from.

No accuracy figure, recall or precision statistic, error rate, test set, validation study or outside evaluation is published for any Nebula AI feature, even though its predictive coding is marketed as award winning and patented. No failure mode is named, and no limit is stated by document type, language or data quality. The system cites the customer's documents rather than law.

The AI is said to improve review strategy without replacing professional judgment. The published workflow ends with legal teams applying judgment to AI results to prioritize review, guide strategy and structure productions. Summaries are said to preserve reviewer control, traceability and professional oversight. Behind that, outputs are tied to source documents so a reviewer can check them, models run in a controlled environment that allows refinement and validation, and audit trails and reporting are said to preserve defensibility for the life of the matter.

No threshold says when any model acts without review, and no confidence signal is described for an individual classification or summary. Nothing separates what a model may do unattended from what needs sign off, and nothing says what happens after an output is found to be wrong. The statement about not replacing professional judgment is a general assurance, not a limit tied to a named feature.

What is published is about the company rather than deployments. Offices in the United States, United Kingdom, Germany, France, the Netherlands, Japan and India are listed with street addresses and phone numbers. Data centers are named in Austin, Eden Prairie, Brooklyn Park, Toronto, Slough, Frankfurt, Paris and Tokyo. Seven industries have their own pages, and there is an awards page and a company history page. No customer is named on the product, AI or security pages, there is no case study section, and no testimonial is attributed to a named person or organization. No figure is published for time saved, cost cut, data culled or review accelerated.

Security controls are published: ISO/IEC 27001 certification with annual audits, an independently audited SOC 2, HIPAA and HITECH compliance certified by independent audit, role based access regularly audited, segmented networks, yearly third party penetration testing and monthly vulnerability scans. One published commitment reaches confidentiality directly. The transparency report promises to notify an affected customer before meeting any government access request, and to challenge such requests legally.

Training on customer content is not addressed either way. Retention and deletion are not stated. No model provider is named, so nothing can be said about what a third party sees or keeps of a document sent for summarization. Privilege and work product are not addressed by name, on a discovery platform where privilege review is a defined workflow. And the agreement that would carry these terms is not published; the website terms date from May 2019 and expressly do not apply to services.

The AI is described as improving review strategy without replacing professional judgment. The published workflow makes the human step explicit and final, ending with legal teams applying judgment to AI results to prioritize review, guide strategy and structure productions. And summaries are said to speed understanding while keeping defensibility and professional oversight, with reviewers keeping full sight of the source material.

The marketing sets structured AI inside an auditable review environment against unstructured tools. Supervision and competence are not addressed. Nothing says who inside a customer may use the AI features or what training is expected, no conduct rule or bar authority is named in any jurisdiction, and no jurisdiction limit is stated, though the platform is sold in seven countries. The website terms carry a no legal advice notice, but it covers the website's content, not the product's output.

The toolkit is described as built for defensibility and transparency. Models are said to run in a controlled environment that allows refinement and validation, and outputs are tied to source documents. All AI features run inside Nebula with access controls and audit trails rather than outside the review platform. The vendor contrasts this with unstructured AI tools that bring opacity and defensibility problems. There is no AI policy or responsible AI page, no external framework, no person or committee accountable for model behavior, no testing before release and no evaluation result.

Bias is not addressed, although sentiment analysis is sold to surface emotionally charged messages and entity recognition to identify people. Nothing published shows whether either works evenly across languages, writing styles or populations in a data set that crosses borders.

Access control is role based across all systems and networks and regularly audited for each employee's privilege level, and the AI features run inside an environment that keeps metadata, access controls and audit logs. The infrastructure uses segmented networks across multiple zones, all internet traffic over a VPN between firewalls, backups every fifteen minutes between primary and backup data centers, intrusion detection, security monitoring, and anti malware tools with daily scans and monthly patching.

A third party runs penetration tests of the application and infrastructure every year, with vulnerability scans monthly. Physical security is described down to biometric or PIN access and secure evidence storage across eight named data centers. No subprocessor list is published: the only third party named is Microsoft Azure, for additional data center locations, and no model or analytics supplier is named. No breach notification commitment to customers is published, although the company sells cyber incident response. And retention and deletion of customer data are not stated.

No position on liability for the product or its AI output is published, because the vendor does not publish its customer agreement. The only published agreement is the Website Terms of Use, last revised 1 May 2019, and its second paragraph says it does not apply to any KLDiscovery services, which are provided under a separate written agreement. No warranty on AI output, liability cap for the services, indemnity either way, service level or uptime commitment, or insurance position is published.

Nothing addresses who bears the loss when a classifier wrongly codes a responsive document as not responsive, or a detection model misses regulated personal data before a production goes out. The website terms, which cover only the website, disclaim all warranties for site content and cap KLDiscovery's liability for website use at 10,000 dollars, under Virginia law and exclusive Virginia jurisdiction.

The main integration is with another vendor's platform: Nebula pairs with RelativityOne so that targeted data can be moved into enterprise review. A customer can run a matter in Nebula, cull it, and move only the relevant material into a more expensive environment, and KLDiscovery keeps a Relativity help center alongside its Nebula one. Related products can be combined with it: Nebula Archive for information governance and retention, ReadySuite, and a Client Portal, each with its own help documentation.

Collection reaches custodian systems through the Remote Collection Manager, Microsoft Azure provides additional data center locations, and the platform is listed on the Microsoft commercial marketplace. No catalog of source system connectors is published, and the direction of flow for the RelativityOne pairing is not described. Nothing says what a customer must configure to move data between the two, and the navigation lists no API or developer documentation.

The vendor names its data centers: Austin, Texas; Eden Prairie, Minnesota; Brooklyn Park, Minnesota; Toronto, Canada; Slough, England; Frankfurt, Germany; Paris, France; and Tokyo, Japan, with other locations available through Microsoft Azure. The physical controls at those sites are described, covering round the clock monitoring, redundant power and cooling, PIN or biometric access and secure media and evidence storage.

Backups run every fifteen minutes between primary and backup data centers, which shows where copies go as well. Tenancy is not addressed. Nothing says whether a customer's matters sit in a shared or dedicated environment, no separation model is described beyond segmented networks at the infrastructure level, and no single tenant option is offered or refused. Cloud and on premises delivery appear in third party listings and an older vendor white paper, but no current page from the vendor sets out the choice.

ISO/IEC 27001 certification is described with what the standard required, including systematic risk examination, a coherent set of controls, an overall management process and annual audits. SOC 2 is described as an independent audit of the controls for systems processing client data and for the confidentiality and privacy of that data. HIPAA and HITECH compliance is described as certified after an independent audit. The vendor is accredited under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. DPF, and points readers to the public register.

Third party penetration tests run yearly and vulnerability scans monthly. A trust center exists at its own subdomain, described as giving secure access to key documentation. No scope or date is published for any certification: nothing says which entities, services or facilities are covered, when the current certificate or report period runs, or who the auditor was.

Nebula AI is said to use large language models to summarize content, including complex medical records. Classification uses supervised and unsupervised machine learning, predictive coding uses machine learning across TAR 1.0, TAR 2.0 and continuous active learning, natural language processing drives entity extraction and sentiment analysis, and machine translation is based on neural networks, described as the current gold standard.

The technology is also claimed as the vendor's own, described as award winning and patented and developed by its data scientists, engineers and legal professionals. No model, version or provider is named, and nothing separates proprietary models from third party ones. Summarization is expressly attributed to large language models, and nothing says where inference runs relative to the named data centers, what any provider may keep of a document sent for summarization, or whether customers would be told of a model change. Microsoft Azure is named, but as a data center provider, not a model supplier.

No pricing is published at any level, not even the unit of charge. The navigation and footer, covering the four software products, nine service lines, seven industry pages, the security and global pages, insights, about, support and six legal pages, carry no pricing page and no way to buy. Every commercial link on the product and AI pages leads to Request a Demo, Contact Us, Contact Sales, Schedule a Demo or Discuss Your Matter.

Nothing shows the charging model: whether the platform is charged per gigabyte ingested, per gigabyte hosted each month, per user, per matter or per document reviewed, conventions that differ greatly in effect. Nothing compares the cost of processing, hosting and production. No tiers, packages or minimum commitments are published. Discovery cost is often the largest variable in a matter and is routinely passed to the client. The vendor publishes detail on its data centers and certifications but nothing on what any of it costs.

Four named use cases are published: litigation strategy, through early summaries, entity mapping and sentiment analysis before large scale review; internal investigations, surfacing key participants and communications; privacy and regulatory response, using detection of personal and health information for compliance reviews and notifications; and data reduction before enterprise review. The vendor's services cover specialist proceedings, including antitrust investigations, HSR second requests and Phase II merger reviews, cross border litigation, computer forensics and cyber incident response.

Seven industries have their own pages: healthcare, financial, pharmaceutical, energy, technology, insurance and automotive. Offices in seven countries and data centers in six give real cross border coverage. No limit is stated. There is no matter size floor or ceiling, nothing on which file types or languages the AI handles well or poorly, and no jurisdiction named as unsupported. Nothing separates what Nebula suits from what the vendor would send to RelativityOne, beyond a general reference to enterprise scale.