M

Midpage

The artificial intelligence is the product. Midpage is a legal research and brief generation platform where retrieval, synthesis and drafting are all model driven; there is no underlying workflow or document management system that would remain if the models were removed. The company was founded in 2022, after the generative wave rather than before it, and the product is distributed both standalone and as an integration inside ChatGPT, which is a distribution model only an AI native product can have.

Accuracy is independently measured, with a published method and published figures for each criterion. Midpage submitted its standalone research product to the 2025 Vals Legal AI Report legal research study, run by an outside evaluator. The evaluator published its rubric and weights in advance: accuracy 50 percent, authoritativeness 40 percent and appropriateness 10 percent. The study used 200 United States legal research questions from attorneys at named firms, including Reed Smith, Fisher Phillips, McDermott Will and Emery, Ogletree Deakins, Paul Hastings and Paul Weiss.

Midpage scored 78 percent accuracy, 74 percent authoritativeness and 70 percent appropriateness, a 76 percent weighted aggregate. That beat the lawyer baseline by 7 points on accuracy and 6 on authoritativeness. The figures sit on the evaluator's own site, where anyone can check them. The evaluator also published the failures: three cases where Midpage returned no response because of technical issues, and eight where it explained it could not locate supporting documents.

All evaluated systems, this one included, did worse than a general model when asked to survey all fifty states for a single statute, and struggled on questions spanning several jurisdictions.

No published position is published on what the system does unaided, what a lawyer must review, where a workflow stops, or what the vendor commits to when an output is wrong. The evaluator's report records that the product sometimes explained it could not locate supporting documents rather than answering, which is observed behavior rather than a published oversight model, and it was not treated as one.

Independent benchmark results stand where deployment evidence would go. The strongest evidence attached to this vendor is test set performance measured by an outside evaluator. That is real, but it is not a production outcome: it shows how the system performs on 200 constructed questions, not what changed at a firm that adopted it. The vendor site, product pages and third party coverage were searched. No named customer, case study pairing an organization with figures and a date, or assessable deployment method is published.

The study questions came from attorneys at named firms, but those firms supplied test material and were not disclosed as customers.

The vendor's security page answers two of the three questions precisely. Training is addressed at both layers: Midpage does not use customer data to train or fine tune AI models, and its agreements with model providers do not let them train on Midpage customer data. Retention is published with actual periods. Web app data, including queries, uploads and outputs, is held while an account is active and deleted within 60 days of account deletion or a valid deletion request.

Plugins and integrations store no queries, uploads or outputs, though those workflows may share queries with model providers, who may keep them for up to 60 days. The page discloses the providers' retention window as well as its own. Encryption is AES-256 at rest and TLS 1.2 or higher in transit, subprocessors must maintain measures no less protective, and an annual SOC 2 Type II audit validates the controls. The third question is unanswered.

No separation model between customers, users or matters is published, and attorney client privilege and work product are not addressed directly.

The stated audience is litigators and law students, a population of lawyers and trainees rather than consumers, and the vendor is explicit about it. The student audience is worth noting, because it includes people who are not yet admitted, which raises a professional responsibility question of a different shape rather than an unauthorized practice problem. The vendor site, product pages and third party coverage were searched.

No published position on the advice line, no treatment of competence or supervision duties, and no jurisdiction limits are published. The audience is stated clearly and the position is not.

Submitting to independent evaluation is the governance act here, and it is a real one. Midpage was one of only four systems that agreed to be measured and named in the Vals legal research study. The evaluator and trade press both recorded that major vendors declined to take part, and at least one took part but withheld permission to publish its results. Agreeing to publication, including your own failure cases, is a meaningful accountability position.

But it is a single evaluation, not a management system. The vendor site and third party coverage were searched. No AI governance framework, AI management certification, named owner of model governance or testing regime before release is published, and nothing on uneven output across matter types, parties or populations.

The vendor's security page covers most of the ground. It publishes AES-256 encryption at rest and TLS 1.2 or higher in transit using industry standard algorithms. It states a retention and deletion practice with a 60 day outer limit after account deletion or a valid deletion request. Queries, uploads and outputs from plugin and integration workflows are not stored at all, and the page discloses that model providers may keep submitted queries for up to 60 days.

Subprocessors are contractually required to maintain security measures no less protective than the vendor's own, and the whole control set is validated by an annual SOC 2 Type II audit. More detail on service providers and data handling is available on request. Three things are not published: a named subprocessor list, as distinct from the contractual requirement; a hosting provider or region; and an incident or breach notification practice.

No published indemnity, liability cap, carve out, warranty on output or insurance position is published, and no customer terms of service is published as published on the property. Recorded as a pure absence on the surfaces reached. The exposure is worth naming: this is a litigation research product whose output is authority bound for filings, in a market where the published sanctions record for fabricated citations is growing, and nothing published addresses who bears the loss.

One integration is named and none is documented. The product is available inside ChatGPT through what the evaluator calls a bespoke integration, which is a distribution channel into a general assistant rather than a connection to a firm's own systems. The vendor site, product pages and third party coverage were searched. No document management connector such as iManage or NetDocuments, practice management or court filing integration, or Microsoft Word add-in is published, and nothing documents what the ChatGPT integration passes or what an administrator configures. For a product sold to litigators inside firms, the lack of any connector to firm systems is the main gap.

The vendor site, product pages and third party coverage were searched. Nothing is published on the deployment model: no tenancy statement, hosting provider, region, residency option or statement of where processing happens, and the security page names no host or region. The product is evidently delivered from the cloud, through a browser and through ChatGPT, but that is inferred from how it is sold, not a published position.

The vendor states directly on its security page that its controls are independently validated through an annual SOC 2 Type II audit, which supplies the cadence as well as the standard, and states that on request it can provide SOC 2 documentation, questionnaire responses and additional detail on service providers and data handling. That is a published request route to substantive diligence material rather than a sales gate.

A customer of this vendor, GC AI, separately publishes that Midpage is SOC 2 Type II compliant, which corroborates the vendor's own statement. No coverage period, audit scope, report date or named auditing firm is published, and no trust portal exists; the route is a request to the vendor.

No model, provider, hosting location or subprocessor is published, and no commitment to notify customers of supply chain changes. The evaluator's report distinguishes Midpage's standalone research product from its ChatGPT integration, which tells a reader the product runs independently of that channel, but nothing published identifies what powers the standalone product. A buyer cannot determine from published material which company processes their research queries.

No pricing page is published, no rate is published, no unit of charge is stated and no tier structure appears. No free trial or self serve entry point is published on the vendor's own property, and no third party pricing figure is published either. Noted for a reader: the product being reachable through a ChatGPT integration may mean some access runs on that platform's commercial terms rather than the vendor's, which published material does not clarify.

Practice focus and jurisdictional coverage are both stated with substance. The practice position is narrow and explicit: the product is built for litigators, and the evaluator independently confirms it focuses on litigator workflows, with responses suited to the research questions litigation produces. Jurisdictional coverage is listed by court system: United States federal and state courts, tribal courts and military courts, plus statutes, regulations and selected administrative decisions.

Naming tribal and military courts is precise. Two things are missing. The segment is described by practice type without addressing firm size. No statement of what the product does not cover is published; the measured weakness on fifty state surveys and questions spanning several jurisdictions comes from the evaluator, not the vendor.