Law Ruler

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models are a feature layer on a product whose value stands entirely without them. What a firm buys is the CRM, the pipeline, the softphone with local presence dialling, the drip campaigns and the marketing source reporting; the AI is an OpenAI API integration that drafts emails, replies and intake questionnaires. Three published facts settle the placement. The AI is included at no separate charge on every paid tier, so nobody pays for inference. An administrator can switch it off entirely under setup and global settings, and the product continues to do everything it is sold for. And it carries a rate limit of eighty messages per hour per user, which is the shape of an add-on rather than a mechanism. This is not the membership floor: the capability is real, shipped and usable today, which distinguishes it from a marketing claim that cannot be located. Checked 4 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Nothing published on accuracy or grounding, on a product whose own published prompt library invites legal analysis. The AI page carries no accuracy figure, no test set, no evaluation, no method, no description of how an output relates to any source, and no statement about hallucination in either direction. That matters more than it would on a pure marketing tool because the vendor's own sample prompts include asking for the key provisions of a named law or regulation, the potential risks and liabilities of a legal issue, and guidance on handling a legal situation. One phrase touches accuracy and is recorded so a reader who finds it sees it was weighed rather than missed: uploaded PDF, Word and JPEG files are said to inform requests and generate more accurate responses. That describes why to attach a file, not a position on accuracy, and crediting it would be crediting a fragment. Searched the AI page, the ChatGPT FAQ set, the home page, the pricing page, the integrations page, the terms of use and the privacy notice on 4 September 2026.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Real review surfaces are published and the threshold at which the system acts alone is not. The drafting workflow puts a person in it explicitly, telling the user to review, send and move on, and the outputs are described as ready-to-send communications rather than sent ones. Three concrete controls exist: an administrator can disable the AI in global settings, the integration retains the last thirty messages so a user can review or clear the conversation, and a per-user hourly cap bounds throughput. Against that, the same page promises automated responses to new enquiries and instant response to every lead across channels, which cannot both be true of a system that always waits for review. Following the treatment for a vendor's own marketing statements conflicting with each other, the conflict is not itself the deduction: what it reveals is that the point at which the system sends without a person is never stated, and that unstated threshold is the limb this band commonly lacks. No confidence signal, no abstention behaviour and no supervision policy is published.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Named customers at named firms, with roles, and no figures anywhere. Three testimonials repeat across the pricing and integrations pages with full attribution: Adam Smallow, Managing Partner of the Law Offices of Adam M. Smallow; Samantha Stone, Supervising Paralegal at Hansen and Rosasco LLP; and Jennifer Gore-Cuthbert, Founder and Owner of Atlanta Personal Injury Law Group Gore LLC. That is attribution rather than a logo strip, which is what lifts this off the band below. What is absent is measurement: no date sits on any of them, no case study is published, and the claims are qualitative, running to higher lead capture, eliminated data entry errors and better visibility of which marketing works. A Happy Clients page exists in the navigation and was not opened in this pass; it is named here so the limit is visible, and the grade rests on the attributed testimonials that were read rather than on it.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Substantive commitments a buyer can read before signing, with the segregation limb silent. Section 10 of the published Software Licensing Agreement defines Confidential Information to include any and all client and client related information, binds each party to use it only in performance of the agreement, restricts disclosure to those with a need to know under equivalent duties, and survives termination in perpetuity for client and client related information against five years for other non-technical material. Section 4 restricts Authorized Users to the subscriber's employees and contractors and states expressly that clients may not be Authorized Users. The model provider limb, which this band usually finds missing, is answered: the AI page states that documents pass through the OpenAI API, that OpenAI does not use API submissions to train its models, and that OpenAI retains API data for thirty days. What holds this at B is that no privilege or work product treatment appears anywhere, and that limb is required rather than inferable from a strong confidentiality regime. Nothing describes tenancy, matter level separation or a permission model.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

A real published position on the advice line, short of the supervision and competence dimension. Section 11.14 of the agreement states that Law Ruler Software is not a law firm and does not provide legal advice whatsoever, and that it is not providing legal advice or legal services by or through its website or by any other means. The closing words matter: this disclaimer reaches the software rather than stopping at the marketing site, which is the failure mode on several records in this corpus. The audience is limited contractually as well, with the recital defining the subscriber as a law firm authorised to provide legal services as defined by the state bar association where it is located, and section 4 barring clients from being Authorized Users, so there is no consumer facing surface. What is missing is everything past the disclaimer: no rule of professional conduct, no ethics opinion, no jurisdiction limit beyond a licence to display within the United States, and nothing on competence or supervision of AI output. The tension worth naming is that the AI page publishes sample prompts asking for the legal implications of a business decision and the risks and liabilities of a legal issue, which describe the product in advice terms; the agreement governs where the two conflict.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

No governance position of any kind was located. There is no responsible AI page, no principles statement, no management system, no named owner accountable for model behaviour, no pre-release testing regime, and nothing at all on uneven output across matter types or populations. The platform navigation and footer were inventoried across six pages on 4 September 2026 and carry no governance surface: the only policy documents published are the terms of use, the privacy notice and a disaster recovery procedure, none of which addresses model behaviour. The nearest statement is a security assurance about what OpenAI does not do with API data, which is a confidentiality commitment about a supplier rather than a governance framework, and it is graded on the confidentiality and supply chain rows instead of twice here. The absence is more consequential on a product whose users work Social Security disability, immigration and mass tort intake, where qualification logic decides which enquiries a firm pursues.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Unusually specific on continuity and effectively silent on the rest, with the privacy notice not reaching the product at all. The published disaster recovery procedure is the strongest artifact: hosting on Azure across regions, Azure Blob Storage redundancy for client documents, and exact restore schedules, with SQL server backups taken daily at 07:30 UTC, instant recovery snapshots held two days, daily points fifteen days, monthly points three months and an annual point one year, plus a runbook the team is trained on and rehearses in scheduled tabletop exercises. Exhibit B adds daily backups, a built-in export at no charge and a one-time full export within ten business days for 250 dollars. What is absent is the set that governs client data in normal operation. The privacy notice states in its first line that it applies solely to information collected by the website, so nothing published covers intake records, documents or prompts inside the platform. No retention period, no deletion certification, no subprocessor list and no breach notification commitment was located. A ProfitSolv-operated data request hub is linked in the footer and was not opened.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

A real published allocation of loss with scope, a cap and a carve out, and nothing that reaches the output. Section 8(b) runs an indemnity from the vendor to the subscriber, defending and holding it harmless against third party claims that its use of the service infringes a registered patent, trade secret, copyright or trademark, which is a genuine vendor-side obligation rather than the one-directional indemnity common in this lane. Section 9 caps liability at the aggregate paid in the twelve months preceding the event, excludes indirect and consequential damages, and expressly carves intellectual property infringement out of the cap, so a buyer can read the scope, the ceiling and the exception before signing. What keeps it off the top band is that none of it addresses the thing the product now does: section 7 provides the service as is and disclaims all warranties including fitness, there is no warranty on output of any kind, no insurance position was located, and the indemnity is confined to infringement rather than to a drafted communication being wrong. The whole instrument predates the AI feature in substance and never mentions it.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

A logo wall with no documentation an implementer could use, and it is the stalest surface on the site. The integrations page was last modified 29 December 2023 while the rest of the estate carries 2026 dates, and it presents roughly thirty marks with no accompanying text: Tabs3, TimeSolv, CosmoLex and Rocket Matter among the sibling products, then HelloSign, Smith.ai, ApexChat, Gmail, Zapier, Twilio, Office 365, CallRail, Scorpion, Ngage, Thomson, Nolo and Lawyers.com alongside lead generation vendors. Nothing states what syncs, in which direction, on what trigger or what a firm must configure. The page also contradicts itself against its own metadata, describing dozens of integrations in the body while the page description claims hundreds, which is recorded because a reader who finds it unaided trusts the rest less. Two fragments of real depth exist elsewhere and are not enough to carry the band: the pricing FAQ says client data from contact and intake forms imports automatically into case management systems, and Exhibit B establishes an open API on all tiers with a request limit scaled to user licences and no API fee. A support knowledge base at support.lawruler.com was not opened and is the cheapest available upgrade on this record.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Residency is stated with the provider named, and tenancy is not addressed. The disaster recovery procedure states that the platform is hosted on Azure following their best practices, using regions to decentralise the location of stored data, with Azure Blob Storage redundancy for client documents and backups stored in a geographically redundant manner. A second region is identifiable rather than merely implied, since the same page schedules weekly backups for an Azure SQL Canada database. Exhibit B of the agreement adds that prices are for hosting at the vendor's United States based cloud provider unless otherwise specified, and section 1.1 licenses access and display within the United States. Tenancy is the missing limb: nothing states whether the platform is single or multi-tenant, no dedicated or isolated option appears at any of the three tiers, and no region choice is offered to a buyer. The processing location for the AI feature is a separate gap, since documents are passed to the OpenAI API and no location is given for that leg. The residency material is also dated, sitting on a page last modified 23 January 2024.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

No independent security attestation of any kind was located, and no security or trust page exists to hold one. The platform navigation and the footer were inventoried across six pages on 4 September 2026 and carry no security, compliance or trust centre entry; the three policy documents published are the terms of use, the privacy notice and the disaster recovery procedure. No SOC 2 of either type, no ISO certification, no penetration test summary, no named auditor, no report period and no scope statement appears on any of them. This record does not even reach the band above, which describes unsupported badges, because the badges the site does carry are review directory marks from Software Advice, Capterra and GetApp rather than security claims, and they are recorded as what they are. The disaster recovery procedure is genuine operational disclosure and is credited on the stewardship and deployment rows rather than here, because a self-published continuity description is not an independent attestation. Nothing is gated: there is no portal to request a report from, which is why this is an absence rather than a retrieval limit.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The provider and the model are both named and the change notification limb is absent. The AI page identifies OpenAI as the provider and ChatGPT as the model, references ChatGPT version 4 in setting the hourly rate limit, and describes the architecture rather than gesturing at it: the feature runs through the OpenAI API rather than the consumer product, uploaded documents are passed through that API for analysis, OpenAI does not use API submissions to train its models, and OpenAI retains API data for thirty days for abuse monitoring accessible to a limited number of authorised employees and contractors under confidentiality obligations. That is a fuller account of what sits underneath than most records in this lane publish. Two limbs fail. Where the models run is never stated for the OpenAI leg, and no commitment to notify customers if the model, version or provider changes was located anywhere. Azure appears on the disaster recovery page and is not counted here: naming a cloud host says where the vendor's own platform sits, not whose model reads the content.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

The marketing page is gated and the published agreement is a rate card, which is the reverse of the usual gap. The pricing page names three tiers, Pro, Premium and Enterprise, with contact limits of 10,000, 15,000 and unlimited, automation limits of 3, 100 and unlimited, seat structure at up to three users on the first two and a ten user minimum on Enterprise, a stated annual term billed monthly, a 15 per cent discount for annual prepayment, a one-time onboarding fee and a feature comparison table, but no subscription figure anywhere and a personalised quote on all three. Exhibit B of the ungated terms of use then publishes real rates for part of the range: local calls at 0.05 dollars per minute, toll-free at 0.08, SMS at 0.05 and MMS at 0.06 each, tracking numbers at 3.00 and 5.00 per month, task routing at 0.075 per route, e-signature at 1.00 per request, 2,500 emails per user licence with overage at 0.02, 5GB of storage per licence with additional gigabytes at 10.00 per month, professional services at 150.00 per hour, a 250.00 full data export fee and a 50.00 minimum prepaid voice and messaging refill. Unit and structure are stated throughout and real pricing is published for part of the range, which is this band rather than the one below. A buyer still cannot learn the subscription cost without a sales conversation, and the vendor confirms there is no free version.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Practice coverage is documented with substance and the boundary is left open. Eight practice areas each carry a dedicated solutions page: personal injury, criminal defence, consumer protection, mass tort, business, Social Security disability, immigration and employment. The material is specific about the operating model it suits rather than listing labels, addressing high intake volume, fast case turnover, referral and co-counsel arrangements common in mass tort, and multilingual client communication in immigration. Firm size is handled through the tier structure and stated plainly, with Pro and Premium capped at three users and described as suited to small firms, and Enterprise carrying a ten user minimum. The buyer is bounded contractually as well, since the agreement recites that the subscriber is a law firm. What is not stated is where the product stops: in-house and government legal are not addressed anywhere, no practice area is identified as unsuitable, and the integrations page invites a request for anything not already covered.