M
Merlin Search Technologies
Merlin Search Technologies makes Alchemy, an AI ediscovery and investigations platform that runs the discovery lifecycle from processing through search, review and production and lets a legal team ask questions in plain language across millions of documents and receive sourced reports in minutes; five AI engines combine keyword, AI-enhanced and semantic search with analysis and answering models, and ReviewPartner applies AI reviewers to large-scale document review. Alongside the platform the company sells AI services delivered overnight, including medical record analysis, transcript analysis, document unitisation, OCR and metadata summaries, and from April 2026 uses TransPerfect's Reef ECA as the processing engine across its cloud instances. Its architecture is single-tenant by design: each client is deployed in its own Amazon Web Services account with separate servers, databases and storage, each matter has its own servers, URL and login, joint-defence teams share a site while keeping private work product, and environments can be placed in any AWS region, in a client's own AWS account or in a FedRAMP environment, with hosting stated across the United States, European Union, United Kingdom, United Arab Emirates, Australia and Singapore. Pricing is by the hour, with a lower rate when a site is switched off. The company was founded in 2019 in Denver, Colorado by John Tredennick, the founder of Catalyst, completed a SOC 2 Type II audit in November 2025 and an independent penetration test in September 2025, and has a chief information security officer reporting to the chief executive; it publishes a privacy policy and GDPR disclosure and no customer agreement.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the engine of a core capability layered on a product that would still function without them. Alchemy's answering and analysis engines and ReviewPartner's AI reviewers sit on a full ediscovery platform with keyword and algorithmic search, review, tagging, production and multi-party workspaces that the company has sold since 2019 under the Sherlock and DiscoveryPartner names; the vendor's own framing is three engines to find and two to analyse and answer. Remove the answering models and a search-and-review platform remains. Home page, security page and launch coverage read 6 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Grounding is real and documented with sourced outputs, short of a testable accuracy figure on the surfaces read. The home page states that questions return comprehensive, sourced answers and reports across the document set rather than search hits, the launch coverage describes a dual-window architecture separating analysis prompts from formatting prompts to keep formatting from interfering with document analysis, and the AI services page states that every service undergoes rigorous validation for accuracy, completeness and consistency at scale. No accuracy figure, test set or evaluation is published in the material read; the founder's published book on generative AI for discovery was not opened. The primary-authority limbs do not apply to a tool that reads the customer's own documents. Home page, AI services page and launch coverage read 6 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Review surfaces and constraints are published, short of the full control structure. Granular role-based access control exposes every function as an assignable permission, audit logs track each person's views, tags and searches, multi-party sites give user groups private tag sets and shared searches, and the platform delivers sourced reports a lawyer works from; ReviewPartner's AI reviewers are described as applying consistent judgment across files with validation. What is not published is the threshold at which AI review decisions stand without human sampling, what executes without approval, or a stated route back after a wrong classification. Security page, home page and AI services page read 6 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
A named customer without figures, and figures without a named customer. Dara Tarkowski, managing partner of Actuate Law, is quoted by name on the 2023 cloud utility pricing launch about adopting the pricing model, with no measured outcome; the home page states most clients save fifty to sixty per cent on hosting costs, unattributed, and the TransPerfect partnership announcement states Reef ECA reduces document sets by over ninety per cent on average, which is the partner's figure. US Legal Support and TransPerfect are named partners rather than customers. Nothing joins a named customer to a figure. Home page, 2023 launch release and April 2026 partnership release read 6 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive published commitments on segregation and work product, short of a training statement and an agreement. Segregation is the strongest in the pull: each client in its own AWS account with no shared database or infrastructure, each matter on its own servers, database and storage with its own URL and login, and multi-party sites with private fields, tag sets and searches that the security page describes as protecting group work products, which is work-product treatment in writing. Confidentiality controls include document lockdown with time-limited authorisation tokens, encryption in transit and at rest, and audit logging. Not located: any statement on training use, since no customer agreement is published and the privacy policy was not opened; any retention or deletion commitment; and the identity of the models the platform runs. Security page, Alchemy page and security FAQ read 6 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
No advice line or supervision statement was located. The product is sold to law firms, corporate legal departments and investigators and its AI reviewers are described as applying senior attorney-level judgment, which is a capability claim rather than a position on where the lawyer's responsibility sits; no surface read states that outputs are not legal advice or how the product supports a supervising lawyer's duties, and no customer agreement exists on the site to carry such a statement. Home page, security page and AI services page read 6 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Security governance is published and AI governance is not. The security page names a chief information security officer reporting to the chief executive and a Technology Governance Committee co-chaired by the CISO and COO providing executive oversight, and the AI services page states rigorous validation of every service; security governance is a different subject from AI governance under the standing rule, and no responsible AI framework, ISO 42001 or equivalent, testing results or statement about uneven output across document types or languages is published. Security page and AI services page read 6 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy covering most of the ground, with retention and notification not located. Access control: granular role-based access control, document lockdown by time-limited token, audit logs of every view, tag and search, private subnets with no public IP addresses, TLS and AES-256 encryption. Hosting and sub-processors: Amazon Web Services named as the infrastructure provider, with per-client accounts and regions chosen by the client; AI model providers are not named. Incident practice: the SOC 2 Type II scope covers monitoring and incident response, and the single-tenant design is described as limiting the blast radius of any incident to one environment; no customer notification commitment was located. Not located: a retention period or deletion commitment, since no customer agreement is published and the privacy policy was not opened. Security page and security FAQ read 6 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
No liability position is published. The site's page inventory, taken from the navigation and footer on 6 September 2026, carries a privacy policy, a GDPR disclosure and a contact page and no terms of service or customer agreement; the security page describes controls and invites contact for security requirements without any warranty, indemnity, cap or insurance statement. This is an absence on the vendor's surfaces rather than a retrieval limit. Security page and footer read 6 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
One integration is named with its function and no documentation an implementer could use was read. The April 2026 partnership release states that TransPerfect's Reef ECA is deployed as the processing engine across all Alchemy cloud instances, giving a unified workflow from ingestion through review; the security page offers hosting in a client's own AWS environment. No document management, review-platform or load-file integration is described with what moves and in which direction, and no integration documentation was located. Partnership release and security page read 6 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Deployment options are published with tenancy, regions and processing location. The security page states a single-tenant architecture with a separate AWS account, network, servers, databases and storage per client and dedicated resources per matter, deployment into any AWS region to meet local residency rules within forty-eight hours, hosting stated across the United States, European Union, United Kingdom, United Arab Emirates, Australia and Singapore, and the options of hosting in a client's own AWS environment or a government-approved FedRAMP environment; all processing and communication with cloud services occurs inside the client's private VPC over private links. The vendor contrasts this explicitly with shared multi-tenant platforms. Security page, security FAQ and partnership release read 6 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real, dated and scoped, short of a report reachable without a sales conversation. The security page states a SOC 2 Type II audit completed in November 2025 by an independent third-party service auditor covering control environment and governance, risk assessment, logical access, system operations and change management, and monitoring and incident response; a penetration test completed in September 2025 by AppSecure, a CREST-accredited firm, with all findings remediated and verified; and a plan to pursue ISO 27001 in 2026, which is roadmap and not credited. The auditor is not named, and the SOC 2 report and pen-test summary are available to qualified prospects under NDA by contacting the team, which is the sales-gated tier. Security page read 6 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The vendor refers to multiple AI models without identifying them on the surfaces read. The Alchemy AI page is headlined three search engines and multiple AI models, the home page describes five AI engines, and a 2024 third-party directory entry refers to GPT-4, which is not credited; the vendor states that all processing occurs inside the client's locked-down AWS VPC, which places inference location with the client environment without naming the provider or model. No change-notification commitment is stated. The Alchemy AI page was not opened and is the rebuttal route. Home page, security page and navigation read 6 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure are stated without the figure on the surfaces read. Cloud Utility Pricing charges by the hour while a site is in use and a much lower rate, stated as seventy per cent less, when it is switched off, with scheduling of operating hours and an energy-saver power-down, and the vendor states most clients save fifty to sixty per cent on hosting; the 2023 launch describes a low hourly rate without naming it. A pricing page exists in the navigation and was not opened on 6 September 2026, and is the rebuttal route in either direction. Home page and 2023 launch release read 6 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment and coverage are described with substance; the boundaries are left open. The platform is sold to law firms, corporate legal departments and investigators for investigations, discovery and litigation, with the Alchemy page naming complex criminal matters, multi-defendant civil cases and joint defence groups as design targets, AI services extending to medical records, transcripts and scanned documents, review stated in any language, and hosting across six named jurisdictions. No matter type, data type or jurisdiction is named as unsupported. Home page, Alchemy page, security page and AI services navigation read 6 September 2026.
No published figure
- You pay by the hour, only while your site is switched on.
- Switch the site off and the rate drops by about 70 percent; you can schedule it to power down at night and on weekends.
- The company says most customers cut their hosting bill by half or more this way.
- The company does not say what the hourly rate is on the pages we could read.
Structure published without a figure on the surfaces read. Cloud Utility Pricing, launched March 2023: an hourly rate while a site is in use and a lower rate, stated on the home page as seventy per cent less, while it is switched off; sites can be scheduled to operate only during working hours or powered down automatically when idle; the vendor states most clients save fifty to sixty per cent on hosting and, at launch, up to eighty per cent for sites not needed around the clock. AI services are priced separately with what the vendor calls clear pricing to address generative-AI cost concerns. A pricing page exists at merlin.tech/pricing and was not opened on 6 September 2026; a figure there would replace this null. Null means no figure was located, not that the product is free. Home page and 2023 launch release read 6 September 2026.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
No customer agreement, terms of service or equivalent contract is published on any surface located, and no policy page states a position on training. Nothing is granted and nothing is withheld, so a client has no term to hold the firm to. Where a policy page does state a position, the row takes the matching policy value instead and the summary records that no agreement exists.
No customer agreement is published and no training statement was located. The site's page inventory on 6 September 2026 carries a privacy policy, a GDPR disclosure and a contact page and no terms of service; the security page, security FAQ, Alchemy page and AI services page address isolation, encryption and validation without stating whether customer content trains any model. The privacy policy was not opened and is the rebuttal route. Surfaces checked 6 September 2026.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
No located public material states how long prompts and outputs are retained.
No located public material addresses how long prompts, answers or matter data are retained. The security page describes data protection from ingestion through final disposition without a retention period or deletion commitment, no customer agreement is published, and the privacy policy was not opened and is the rebuttal route. Surfaces checked 6 September 2026.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
The product maintains its own separation model and documents it at matter level, the most specific in the pull. The security page states a separate AWS account per client, separate servers, database, search and storage per matter, matter-specific URLs with independent authentication, granular role-based access control with every function assignable as a permission, and multi-party sites in which user groups keep private fields, tag sets and searches while sharing folders; the security FAQ adds that each case has its own encryption keys. Surfaces checked 6 September 2026.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
No located term or policy addresses third party requests for customer data.
No located public material addresses whether the customer is told when its data is demanded by a third party. No customer agreement is published, the security page is silent on legal process, and the privacy policy and GDPR disclosure were not opened and are the rebuttal route. Surfaces checked 6 September 2026.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
No located public material identifies a legal corpus behind the product's answers, and the product is not built on one: it searches, reviews and answers over the customer's own collected documents and cites its sources to them. Home page and Alchemy page checked 6 September 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No located public material addresses whether authority is checked for subsequent history, and the product does not retrieve or cite primary law; its output is sourced reports, review decisions and productions from the customer's documents. Recorded as the honest value for a product without a citator function. Surfaces checked 6 September 2026.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No located public material describes what the answering or review models do when they cannot ground an answer or classify a document with confidence. The platform returns sourced reports and the services are described as validated, but no abstention path or confidence signal is described on the surfaces read; the Alchemy AI page was not opened. Home page and AI services page checked 6 September 2026.
Fabricated Citation Record
Does a public court record exist involving output from this product?
No court order, opinion or disciplinary record naming this product has been located as of the date shown. This is a statement about the public record, not a finding about the product.
No court order, opinion or disciplinary record naming Merlin Search Technologies, Alchemy, DiscoveryPartner or Sherlock was located as of 6 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on the company and product names together with a general search for court findings on ediscovery review; results returned directory entries and commentary, none of which is a court record naming this product. This is a statement about the public record, not a finding about the product; a review platform that cites the customer's own documents carries a remote exposure on this signal.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No located public material names an ethics opinion, bar rule or professional responsibility framework. The founder publishes books and webinars on generative AI in discovery, which is education rather than guidance alignment, and no customer agreement exists to carry a reference. Home page, security page and headlines navigation checked 6 September 2026.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Public materials claim time savings without addressing billing or disclosure, and the product sits inside a fee relationship between a lawyer and a client where those savings would change the bill.
Law firms are a named buyer segment and the published position on the bill is a savings claim: most clients save fifty to sixty per cent on hosting under hourly on-off pricing, and AI review is offered at a fraction of the cost of manual review. Hosting cost is a technology pass-through a firm may bill onward, and nothing addresses how AI-assisted review is recorded or disclosed on a client's bill. Home page and 2023 pricing release checked 6 September 2026.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
No located public material supports a client side disclosure obligation.
No sub-processor list or model provider list was located. Amazon Web Services is named as the infrastructure provider, which says where data is hosted and not whose models see it, and the vendor refers to multiple AI models without naming them; no customer agreement or DPA is published, and the SOC 2 report is available only under NDA to qualified prospects. The privacy policy and GDPR disclosure were not opened and are the rebuttal route. Surfaces checked 6 September 2026.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a disclosure record are available and no export of an AI-use record is described. The security page states extensive audit logging of every person's document views, tags, searches and other actions, and the platform's answers are sourced to documents, which together record what was reviewed and by whom; nothing states that a record of the model used, its classifications and the human verification can be exported for a court, and the product's outputs are productions and reports rather than court-facing certifications. Security page and home page checked 6 September 2026.