M

Merlin Search Technologies

The models are the engine of a core capability layered on a product that would still function without them. Alchemy's answering and analysis engines and ReviewPartner's AI reviewers sit on a full ediscovery platform with keyword and algorithmic search, review, tagging, production and multi-party workspaces that the company has sold since 2019 under the Sherlock and DiscoveryPartner names; the vendor's own framing is three engines to find and two to analyze and answer. Remove the answering models and a search-and-review platform remains.

Grounding is real and documented with sourced outputs, short of a testable accuracy figure on the surfaces read. The home page states that questions return comprehensive, sourced answers and reports across the document set rather than search hits, the launch coverage describes a dual-window architecture separating analysis prompts from formatting prompts to keep formatting from interfering with document analysis, and the AI services page states that every service undergoes rigorous validation for accuracy, completeness and consistency at scale.

No accuracy figure, test set or evaluation is published in the material read; the founder's published book on generative AI for discovery was not opened. Questions about primary authority do not apply to a tool that reads the customer's own documents.

Review surfaces and constraints are published, short of the full control structure. Granular role-based access control exposes every function as an assignable permission, audit logs track each person's views, tags and searches, multi-party sites give user groups private tag sets and shared searches, and the platform delivers sourced reports a lawyer works from; ReviewPartner's AI reviewers are described as applying consistent judgment across files with validation.

What is not published is the threshold at which AI review decisions stand without human sampling, what executes without approval, or a stated route back after a wrong classification.

A named customer without figures, and figures without a named customer. Dara Tarkowski, managing partner of Actuate Law, is quoted by name on the 2023 cloud utility pricing launch about adopting the pricing model, with no measured outcome; the home page states most clients save fifty to sixty percent on hosting costs, unattributed, and the TransPerfect partnership announcement states Reef ECA reduces document sets by over ninety percent on average, which is the partner's figure. US Legal Support and TransPerfect are named partners rather than customers. Nothing joins a named customer to a figure.

Published commitments on separation and work product are substantial, short of a training statement and an agreement. Each client has its own AWS account with no shared database or infrastructure. Each matter has its own servers, database, storage, URL and login. Sites shared by several parties give each group private fields, tag sets and searches, which the security page describes as protecting each group's work product, so work product is addressed in writing.

Confidentiality controls include document lockdown with time limited authorization tokens, encryption in transit and at rest, and audit logging. Not found: any statement on training, since no customer agreement is published and the privacy policy was not opened; any retention or deletion commitment; and the identity of the models the platform runs.

No advice line or supervision statement is published. The product is sold to law firms, corporate legal departments and investigators and its AI reviewers are described as applying senior attorney-level judgment, which is a capability claim rather than a position on where the lawyer's responsibility sits; no surface read states that outputs are not legal advice or how the product supports a supervising lawyer's duties, and no customer agreement exists on the site to carry such a statement.

Security governance is published and AI governance is not. The security page names a chief information security officer reporting to the chief executive and a Technology Governance Committee chaired jointly by the CISO and COO providing executive oversight, and the AI services page states rigorous validation of every service; security governance is a different subject from AI governance, and no responsible AI framework, ISO 42001 or equivalent, testing results or statement about uneven output across document types or languages is published.

Substantive published policy covering most of the ground, with retention and notification not located. Access control: granular role-based access control, document lockdown by time-limited token, audit logs of every view, tag and search, private subnets with no public IP addresses, TLS and AES-256 encryption. Hosting and sub-processors: Amazon Web Services named as the infrastructure provider, with per-client accounts and regions chosen by the client; AI model providers are not named.

Incident practice: the SOC 2 Type II scope covers monitoring and incident response, and the single-tenant design is described as limiting the blast radius of any incident to one environment; no customer notification commitment is published. Not located: a retention period or deletion commitment, since no customer agreement is published and the privacy policy was not opened.

No liability position is published. The site's page inventory, taken from the navigation and footer on 6 September 2026, carries a privacy policy, a GDPR disclosure and a contact page and no terms of service or customer agreement; the security page describes controls and invites contact for security requirements without any warranty, indemnity, cap or insurance statement. This is an absence on the vendor's surfaces rather than a retrieval limit.

One integration is named with its function and no documentation an implementer could use was read. The April 2026 partnership release states that TransPerfect's Reef ECA is deployed as the processing engine across all Alchemy cloud instances, giving a unified workflow from ingestion through review; the security page offers hosting in a client's own AWS environment. No document management, review-platform or load-file integration is described with what moves and in which direction, and no integration documentation is published.

Deployment options are published with tenancy, regions and processing location. The security page states a single-tenant architecture with a separate AWS account, network, servers, databases and storage per client and dedicated resources per matter, deployment into any AWS region to meet local residency rules within forty-eight hours, hosting stated across the United States, European Union, United Kingdom, United Arab Emirates, Australia and Singapore, and the options of hosting in a client's own AWS environment or a government-approved FedRAMP environment; all processing and communication with cloud services occurs inside the client's private VPC over private links. The vendor contrasts this explicitly with shared multi-tenant platforms.

Certification is real, dated and scoped, but the report is reachable only through sales. The security page says a SOC 2 Type II audit was completed in November 2025 by an independent service auditor. It covered the control environment and governance, risk assessment, logical access, system operations and change management, and monitoring and incident response. A penetration test was completed in September 2025 by AppSecure, a CREST accredited firm, with all findings fixed and verified.

The vendor plans to pursue ISO 27001 in 2026, which is a plan, not a certification. The auditor is not named, and the SOC 2 report and penetration test summary are available to qualified prospects under NDA by contacting the team.

The vendor refers to several AI models without naming them on the pages read. The Alchemy AI page is headed three search engines and multiple AI models, and the home page describes five AI engines. A 2024 third party directory entry mentions GPT-4, but that is not vendor material. The vendor says all processing happens inside the client's locked down AWS VPC, which places inference in the client's environment without naming the provider or model. No commitment to notify customers of model changes is stated. The Alchemy AI page was not opened and may say more.

The unit and structure of pricing are stated, but not the figure. Cloud Utility Pricing charges by the hour while a site is in use and a much lower rate, stated as seventy percent less, when it is switched off. Customers can schedule operating hours and use an energy saver power down, and the vendor says most clients save fifty to sixty percent on hosting. The 2023 launch describes a low hourly rate without naming it. A pricing page exists in the navigation and was not opened; it may show the figure.

Segment and coverage are described with substance; the boundaries are left open. The platform is sold to law firms, corporate legal departments and investigators for investigations, discovery and litigation, with the Alchemy page naming complex criminal matters, multi-defendant civil cases and joint defense groups as design targets, AI services extending to medical records, transcripts and scanned documents, review stated in any language, and hosting across six named jurisdictions. No matter type, data type or jurisdiction is named as unsupported.