L

Legalyze

The models are the whole product, and the vendor says so in the strongest form: there is no human in the loop, and that is what keeps costs low. The absence of human review is the commercial pitch. Everything delivered is model output: building chronologies from uploaded records at ten pages per minute, classifying events by visit type, linking each to its source page, answering plain English questions about the case file, and detecting missing records, treatment gaps, prior injuries and inconsistencies.

Handwritten, scanned and electronic records are all handled, which means extraction across three quite different kinds of input. Remove the models and there is no product.

Grounding to the page is applied to both kinds of output, with throughput published and accuracy not. Every medical event opens in one click to the exact page in the original record, and each Case Chat answer is cited to its location in the source documents, so citations cover the chat as well as the chronology. Independent material notes that linking to the original page is what counts when opposing counsel challenges a timeline.

The published numbers measure speed, not correctness: ten pages per minute, and a thousand page file cut from fifteen to twenty hours to about two. No accuracy figure, extraction recall, error rate on handwritten records, evaluation or test set was found. The vendor publishes its processing rate to the page and nothing about whether the output is right.

The oversight model is disclosed by being disclaimed. The vendor says plainly there is no human in the loop and presents that as why its costs are lower than services that employ reviewers. A buyer therefore knows exactly what they are getting. What is missing is any account of what replaces human review. Nothing says whether output is checked by automated means before delivery, whether a low confidence extraction is marked, what happens when a page is illegible, or what review the vendor expects the attorney to do.

The product does flag missing records, treatment gaps and inconsistencies, but that checks the records, not the model. The whole verification burden sits with the firm, and the vendor does not say so.

Published benchmarks are specific and no customer is identifiable. Stated: ten pages per minute processing, a thousand page file moving from fifteen to twenty hours of manual review to roughly two, and thousands of records reviewed in hours. Independent material attributes those figures to Legalyze's published benchmarks, which is a vendor source relayed rather than an independent measurement. Two further items carry weight without naming anyone: the vendor states it has passed extensive security reviews at large law firms, which is an assertion about procurement outcomes at unnamed firms, and independent material describes Legalyze as among the most widely adopted tools for personal injury medical chronology work alongside Supio and DigitalOwl.

Partner listings with Smokeball and CASEpeer are corroborated on those vendors' own surfaces. No law firm is named, no case study exists, the one user quote located is anonymous, and no funding, analyst placement or award was found.

Control of infrastructure is stated, with one useful specific, and there is no privilege position. All data is said to be encrypted and stored on servers under Legalyze's own control, a statement about custody rather than a generic secure cloud reference. Business associate agreements are said to be in place with the AI providers, covering protected health information further down the chain. Against that, no business associate agreement is described as being offered to customers, and that is the document a law firm actually needs to sign.

Independent guidance names a signed BAA before any protected health information is processed as the first baseline check. No SOC 2 or other independent attestation was found, and attorney client privilege and work product are not addressed.

No position was found. Having no human in the loop makes the question sharper: the vendor has removed the professional review step, so the attorney is the only reviewer between generated output and reliance on it, and nothing published addresses that responsibility. There is no statement that output is not medical or legal advice, nothing on the supervising attorney's duty to verify a machine built chronology, and no engagement with bar guidance.

Nothing is published on how the models are governed, evaluated or monitored. There is no AI policy, model card, bias or fairness testing, evaluation method, accuracy monitoring, drift statement, named governance body or ISO 42001. The vendor publishes comparison content ranking platforms on performance and cost, so it engages evaluation commercially but not for its own system. The risk has a specific edge here. The product reads handwritten and scanned records, where documentation quality varies systematically by provider and setting, and nothing published evaluates performance across record types or populations.

Three published statements do the work, and one of them reaches down the supply chain. First, Legalyze never uses customer data to train its AI models, stated without qualification and not limited to third party, public or shared models. Second, business associate agreements are in place with the AI providers, which contractually covers protected health information reaching the downstream models. Third, all data is encrypted and stored on servers under the vendor's own control.

Naming the contract that governs the model providers speaks to what they may do with the data, not only what the vendor does. The gaps: these are policy statements rather than customer facing terms, no retention period is published, no deletion right is described, and the providers are not named.

No published position was found on liability for AI output, warranties, service levels or remedies. The exposure is concentrated because there is no human in the loop. An omitted provider, a misread handwritten entry or a missed treatment date reaches the attorney with no check in between, and a chronology built on an extraction error will read as complete. Gap detection flags missing records and treatment gaps, which helps with one failure but not with errors in extraction itself. Nothing published addresses any of it.

Two case management integrations are named, and both are corroborated outside the vendor's own site. Smokeball is published with a dedicated integration generating chronologies directly from documents already in Smokeball, and it is listed in Smokeball's own partner marketplace, which confirms independently that the relationship exists. CASEpeer has a dedicated integration page describing upload from CASEpeer into Legalyze, with a one week trial offered to CASEpeer firms.

Both are case management systems plaintiff firms run on. The depth is shallow and one directional: both integrations bring documents in, and nothing describes finished chronologies returning to the matter file. No API is offered, no authentication or permission detail is published, and only two systems are covered.

Custody is stated and geography is not. The vendor says data is stored securely and encrypted on servers under Legalyze's own control, which answers who holds the infrastructure but not where it is. No country, region or residency commitment is published, no hosting provider is named, and no single tenant or dedicated instance option is described.

There is a real document with a real request route, but no certification of any kind. The vendor says it has had an extensive third party penetration test with the report available on request, that it has periodic external security testing, and that it has passed extensive security reviews at large law firms. A penetration test examines technical weaknesses at one point in time; it is not an attestation over a control environment across a period.

No SOC 2 of either type, ISO 27001, named auditor, examination scope or date, or trust center was found. Independent guidance names a current SOC 2 Type II report as a baseline check, and this vendor does not have one.

The supply chain is confirmed to exist and to be under contract, but no one in it is named. The statement that business associate agreements are in place with the AI providers does two things. It establishes that third party model providers process customer data, and it says the relationship is governed by the instrument HIPAA requires for protected health information. What is missing is identity. No provider, model family or version is named, no subprocessor list is published, and nothing says how many providers are involved or what each processes. A firm can tell its client that the downstream models are under a BAA, but not whose models they are.

The vendor claims transparent pricing, the pages found lead to a demo request, and independent material reports a specific price structure. The vendor's comparison pages say transparent and competitive pricing keeps costs low, beside a Request a Demo button, and a free trial is offered separately. Independent material says Legalyze publishes monthly pricing tied to page volume, starting around $500 a month for 2,000 pages, which suggests a pricing page exists that was not opened.

The structure, monthly pricing by page volume, can be found; no figure was found in vendor material. Pricing by page suits a contingency firm, because case cost then scales with record volume rather than being a flat fee.

Practice scope is stated, and the types of input handled are listed in detail, which is the coverage question that matters for a record review product. The practice areas named are personal injury, medical malpractice and workers compensation. Word documents, PDFs, images and spreadsheets are accepted, and handwritten, scanned and electronic health records are all said to be processed. Handwritten records are the hardest case in medical review, and provider notes are often the only record of a symptom.

Nothing goes beyond the list. Nothing says whether accuracy or speed holds up across handwritten and electronic records, no jurisdictional scope is given, and nothing shows depth in workers compensation, which involves different records and statutes from personal injury.