Nextpoint

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Machine learning is present, real and peripheral, and the vendor's own marketing says so by omission. The flagship eDiscovery product page was read in full on 31 Aug 2026 and contains no mention of AI, machine learning, technology-assisted review or predictive coding. Every capability it names is deterministic or classical text processing: deduplication, email family threading, near-duplicate detection, OCR, search hit reports, coding panels, folders, Bates stamping, production and privilege log templates, and auto-redactions that match social security numbers, phone numbers and custom terms. The privilege workflow is explicitly human: documents are tagged privileged during review using custom categories and the system generates the log from those coded documents. What does exist sits on the trust page and the blog: search and ranking on models the vendor hosts in its own cloud, and AI Transcript Summaries, a generative feature running on Amazon's managed foundation-model service. Remove all of it and the product a buyer is actually paying for, unlimited data hosting at a flat per-user rate across discovery and trial preparation, remains intact. This is the only vendor in this pull that under-markets its AI rather than over-marketing it, which is worth recording, but it does not change the grade.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Accuracy is addressed honestly and never measured. The trust page states that every AI feature is validated through extensive testing before release, and then says something most vendors avoid: that generated summaries and results are meant as starting points and the customer is encouraged to trust but verify. That is a franker posture than the no-hallucination absolutes seen elsewhere in this pull, and it is still an assertion. Searched the eDiscovery platform page, the pricing page, the trust and security page and the terms of use on 31 Aug 2026 and located no accuracy figure, no test set description, no recall or precision statistic, no error rate and no published evaluation of any kind, so nothing supports the extensive testing claim from outside. Grounding is not described either: nothing states whether a transcript summary cites or links back to the passages it rests on, which is the verification surface a reader would need to act on the trust-but-verify instruction. The source material is at least inherently at hand, since a summary is generated from a transcript the customer already holds. One limb does not apply and is neither credited nor penalised: a citator or good-law check is out of scope for a platform operating on the customer's own collected evidence. The AI summarisation blog post and the downloadable AI overview PDF were not opened and are the rebuttal route.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A human is said to review and nothing describes where that happens. The published position is short and clear: the AI is built to accelerate review rather than replace judgement, generated summaries and results are starting points, and the customer should trust but verify. That places responsibility with the lawyer, which is the right instinct, but it is a caution rather than a control structure. Searched the eDiscovery platform page, the trust and security page, the pricing page and the terms of use on 31 Aug 2026 and located nothing on what the system does when the transcript does not support a summary, no confidence or uncertainty indicator surfaced to the user, no threshold at which a feature declines, no correction or feedback route, and no description of a review step inside the product where generated text is checked before it is used. Two real control surfaces exist on the platform and are not tied to the AI in anything published: tamper-resistant per-document activity logging covering view, edit and markup history with timestamps, and six permission levels reaching case, folder and document level. Both bands have some purchase here and the lower is taken, because what is published states that a person should check the output without describing what they would be looking at.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Substantial named deployment evidence, short of dated outcomes. The vendor claims more than 600 law firms and legal teams and backs it with an unusually large attributed set rather than a bare logo wall. Named organisations appearing with logos include McDermott, Foley & Mansfield, Jackson Walker, Seyfarth Shaw, Simmons Hanly Conroy, Clyde & Co, O'Hagan Meyer, Bates Carey, Maron Marvel, Cline Williams, Bell Davis Pitt, Miller Starr, Stein Ray, McCarthy Lebit, Williams Kastner, Kercsmar, Yates Construction and Augusta University. Eight testimonials carry a full attribution of name, job title and firm, which is more than most vendors in this pull manage even once. One of them carries a figure: a litigation support services manager at Foley & Mansfield describes migrating 180 databases and running close to 250, and reports significantly decreased training time against the firm's previous review platform. What is missing is the measured outcome. The recurring claims of up to 50 per cent cost reduction and review time cut in half are unattributed to any customer, no case study was opened, and no testimonial carries a date. Checked the eDiscovery platform page and the pricing page on 31 Aug 2026; the case studies library was not opened and is the rebuttal route.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Substantive published commitments on both confidentiality and training use, short of contractual force. The training position is the clearest in this pull: the trust page states flatly that AI features run entirely inside the vendor's secure Amazon environment, that customer case data is never used to train or improve any AI model, and that inputs and outputs are never shared with or retained by any outside model provider. The terms of use help rather than undercut it, which is unusual. They describe the service as a platform for attorney-client privileged data and work product, confirm that the customer or the party that entrusted the data to them owns all user content, and limit the vendor's own use to what is necessary to provide the service, with no licence to improve products or services anywhere in the document. Segregation is granular and documented: six permission levels reaching case, folder and document level for internal teams and outside parties, mandatory multi-factor authentication on every user and device, single sign-on through Okta or Azure AD, employee access restricted to a subset of staff with a documented request and approval trail and prompt revocation, and confidentiality agreements for employees and third-party associates. What holds it below the top band: the training commitment lives in a website FAQ rather than in the agreement, the terms contain no AI clause at all, no retention period is stated for prompts or generated output held by the vendor, and the master services agreement that actually governs the relationship is not published.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Nothing published addresses the advice line. Searched the eDiscovery platform page, the pricing page, the trust and security page and the complete terms of use, updated June 2026, on 31 Aug 2026. Nothing states that generated output is not legal advice, nothing addresses whether an attorney-client relationship arises with the vendor, nothing allocates responsibility for a summary a lawyer relies on, no bar or ethics authority is named including ABA Formal Opinion 512, and no jurisdictional limit is stated. The terms come closest without arriving: their disclaimer expressly denies any representation that information obtained through the service will be accurate or reliable, which allocates risk rather than describing the line between tooling and advice. One thing does exist and is recorded rather than credited, because it is the inverse of what this band usually describes: a supervision and competence posture is published, in that the AI is stated to accelerate review rather than replace judgement and output is framed as a starting point to verify. There is a supervision statement and no disclaimer, where the band above describes a disclaimer with no supervision statement. The exposure is also narrower than for a research tool, since the platform advises on nothing, though the summarisation feature does produce work a lawyer acts on.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

A governance position with a real mechanism behind it, and complete silence on bias. The trust and security page carries a dedicated artificial intelligence section answering five questions directly: whether case data trains the models, where documents are actually processed, how the arrangement differs from using a consumer chatbot on case files, whether generated output can be trusted, and which compliance framework covers the AI. The last is the substantive one. AI features built within the platform are stated to fall inside the vendor's SOC 2 Type II compliance and its annual IT risk assessment, which puts model behaviour inside an existing third-party-audited scope rather than in a separate unaudited space, and that is a mechanism a buyer can ask an auditor about. A downloadable document titled Security, Compliance, Privacy and AI at Nextpoint is published without a form or gate and is said to set out the principles, architecture and safeguards behind every AI feature; it was not opened on 31 Aug 2026 and nothing in it is credited here. What is absent is the second half of the axis. No accountable owner is named, the extensive pre-release testing is asserted without a single result, and nothing anywhere addresses bias, fairness or uneven output across custodians, document types or languages.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Detailed, specific and current across most of the ground, with one artifact missing. Access control is the strongest element: six permission levels from view-only to dashboard administrator with granular control at case, folder and document level, mandatory multi-factor authentication for every user and device, single sign-on through Okta or Azure AD with custom integrations available, Amazon environment access IP-restricted and locked after five failed attempts, and application access limited to a subset of employees under a documented request-and-approval trail with prompt revocation. Deletion is specific rather than gestured at: customers export and download without limit at any time, deletion follows a Data Archive Form, and decommissioned media are sanitised under DoD 5220.22-M or NIST 800-88, with degaussing or physical destruction where those procedures cannot run. Incident practice is published in detail, including daily review of firewall notifications and operating system event logs, notification of affected users as soon as possible without compromising investigation, four enumerated cooperation obligations, and a provision leaving the customer with sole right to decide whether and how a breach is notified onward. A public status dashboard publishes service state and incident reports. Also published: background checks and security training on hire plus annual retraining, confidentiality agreements, a secure development lifecycle, an annual IT risk assessment, redundant multi-location storage at no charge and eleven nines of stated object durability. Missing: no named subprocessor list beyond Amazon as infrastructure, no retention period for customer data during the term, and no breach notification timeframe.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Liability is addressed through a standard limitation package and nothing runs toward the buyer. The terms of use, updated June 2026, cap aggregate liability at the total amounts paid in the twelve months preceding the event, exclude indirect, incidental, special, consequential and exemplary damages including lost profits, revenue, goodwill, content and data, and impose a one-year limitation period, under Illinois law with exclusive venue in Chicago. The disclaimer is broad and provided on an as-is basis, expressly denying any representation that information obtained through the service will be accurate or reliable, which is the exposure a generative summary creates, stated as a disclaimer rather than as an allocation. A separate release runs from the customer to the vendor with a California Civil Code 1542 waiver, and the only indemnity in the document runs from the customer to the vendor covering user content and breach. What is not there: no carve-outs from the cap are named at all, no vendor indemnity of any kind, no warranty on output, no insurance position and no AI-specific term anywhere in the agreement. This sits a band below the eDiscovery and research vendors in this pull that publish caps with named carve-outs, and a band above the one that publishes no agreement at all. The commercial terms that would carry more, the Subscription Agreement and Master Services Agreement, are referenced repeatedly in the published terms and are not themselves published.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Named connections that work, described at the level of what they do rather than how they are configured. Data import integrations are named and their function stated: OneDrive, Dropbox and Google Drive for pulling evidence directly from cloud storage without manual export, with drag-and-drop as the alternative. Identity integration is named and specific: single sign-on through Okta or Azure Active Directory, with custom SSO integrations available through Client Success, and multi-factor authentication mandatory for every user and device. That identity layer is the deepest enterprise integration on this record and is genuinely useful to a firm's IT function. Beyond it the estate is thin. No document management system integration is named, with nothing located for iManage or NetDocuments, and nothing for matter management, e-billing, court filing, Word or Outlook. An application programming interface exists but is referenced only as an invitation to talk about custom integrations, with no public documentation, no endpoint list and no schema located on 31 Aug 2026. Checked the eDiscovery platform page, the pricing page, the trust and security page and the navigation.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The infrastructure is described in unusual technical detail and the residency question is never asked. What is published: the platform runs on Amazon Web Services; objects are stored redundantly across multiple facilities with eleven nines of stated durability and integrity verified by checksums; data is designed to survive the concurrent loss of two facilities with a tertiary facility activating without downtime; network isolation uses Virtual Private Cloud, monitoring uses CloudWatch, and employee access uses Identity and Access Management with IP restriction. Nextpoint's own office holds client data in a keyed office within a keyed building with a security system, and server access requires a password over a secure virtual private network, which is a candid disclosure most vendors omit. What is not published is anything a buyer would need on residency: no region is named, no residency option is offered, no tenancy model is stated, and nothing distinguishes where data is stored from where processing or model inference happens beyond the statement that AI runs inside the same Amazon environment. Amazon GovCloud appears once, in a paragraph about Amazon's own physical access controls, without being offered as a deployment option. One unexplained lead recorded for a later pass: custom account headquarters is listed as an Advanced plan feature and is nowhere defined.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

A real, current, annually renewed attestation with its scope stated, and no date or auditor attached to it. The trust and security page states that the vendor's independent security certification is SOC 2 Type II, describes it as an annual third-party audit of its own security controls, and names the criteria it covers as security, availability, confidentiality and privacy. It then does something rare and creditable by stating the access tiers explicitly rather than leaving a buyer to discover them: SOC 3 reports are available on request, and SOC 2 reports require an executed non-disclosure agreement. It also draws a distinction most vendors blur, separating its own certification from the certifications of the infrastructure it runs on, noting that Amazon Web Services maintains SOC 1, SOC 2, SOC 3, ISO 27001 and FedRAMP for the underlying cloud without implying that any of those attach to Nextpoint. Supporting material sits alongside it: a public status dashboard with incident reports, an annual IT risk assessment described as maintaining the certification, and an ungated overview document. What holds it below the top band is narrow but real: no auditor is named, no report date or coverage period appears anywhere, and the SOC 2 itself is behind an executed agreement rather than a self-service request.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The most specific model disclosure in this pull, and the service is now named. The vendor states that its AI features are built on Amazon Bedrock, Amazon's fully managed service for foundation models, and splits the architecture between that and models it hosts itself, with search and ranking running on the vendor's own models inside its private cloud and generative features such as transcript summaries running on Bedrock within the same environment. Naming the service rather than gesturing at a cloud provider lets a buyer read the downstream terms directly. Three protections are published against it and each is specific: Bedrock does not use customer data to train or improve foundation models; it does not store or log prompts or completions; and input and output data are never shared with model providers. Those answer the questions a firm is asked about a generative feature in the order they are usually asked. What is still not established: which foundation model within that service actually generates a summary, since Bedrock hosts many and none is named; no model version appears; and no commitment obliges the vendor to notify customers when the model or its configuration changes, which matters because the service makes substitution easy. The published security and AI overview documents were read only in extract on 31 Aug 2026 and are the rebuttal route for a named model.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

The shape is published completely and the number is nowhere. Three plans are named with per-tier feature splits: Essential for smaller-scale review, production and deposition practice; Advanced adding discovery analytics, per-document auto-redactions, custom and standard production templates, advanced permissions and activity reporting; and Apex as a customised enterprise plan that may include near-duplicate scoring, search hit reporting, universal auto-redactions, global account search and migration services. The unit of charge is stated plainly as a flat monthly rate per user, and what is never charged is itemised: data storage, processing, hosting, OCR, deduplication, productions, exports and sharing, against an industry norm of per-gigabyte fees that the page sets out in a comparison table. Discounts for upfront annual payment and volume pricing for larger firms are acknowledged. No figure appears at any tier, and every plan's call to action is to talk to an expert. One discrepancy belongs in the record: the marketing describes unlimited data throughout, while the terms of use state that the service is offered under user-based or plan types and that each tier determines the data hosting and processing limits, as detailed in a master services agreement that is not published. A buyer reading only the pricing page would not know that data limits exist.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is documented along three axes with real substance, and the boundary is left open. By buyer: law firms, corporations, government agencies and education institutions, each with its own page. By specialty: construction litigation, insurance defence, mass tort and intellectual property litigation. By use case: data collection, internal investigations, Freedom of Information Act requests and transcript management. Data coverage is enumerated rather than claimed, naming email formats PST, MSG, EML and MBOX, Office documents, images, audio and video, compressed archives, and specialised formats including source code, CAD files and building information models, with automatic text extraction and OCR applied to images and scanned material. Scale is addressed directly, with the platform stated to handle millions of documents and multi-party MDL matters, and the mass tort page describing reuse of processed data across hundreds of related cases. What is absent is any statement of where the product stops: no practice area is excluded, no matter size floor or ceiling is given, no jurisdiction is named as unsupported, and the only limiting language located is that specialised formats may require more specific processing workflows. Checked the eDiscovery platform page, the pricing page and the navigation on 31 Aug 2026.