Novo

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The artificial intelligence is the product and nothing survives its removal. Novo sells two outputs, a medical chronology and a demand letter, both generated from uploaded records, and the whole estate is organised around exactly those two things: the navigation has two product pages and no others. There is no case management system, no document repository, no intake pipeline and no workflow layer underneath that a firm would still pay for; a buyer uploads records and receives drafts. The terms confirm the architecture rather than leaving it to marketing, defining an AI Feature as any component of the services incorporating AI Technology and defining that as machine learning, deep learning, large language models and neural networks generating content from user prompts, and then defining the demand letters and chronologies created under the agreement as Outputs of an AI Feature. Checked 4 September 2026.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Completeness is asserted on the product pages and disclaimed in the agreement, and nothing is measured. The marketing claim is specific: the chronology captures every injury, treatment and medical event so a firm never misses a critical detail. No accuracy figure, test set, evaluation, error rate or failure-mode statement accompanies it, and no accuracy or benchmark page exists on the estate. Nothing describes grounding either: no statement says whether an entry in a chronology carries a citation back to the page of the record it came from, which is the single control that would let a paralegal verify the output at speed. The agreement runs directly against the marketing and governs where they conflict, providing the services as is with all faults, disclaiming any warranty that they will achieve intended results or be error-free, and making it entirely the user's obligation to review, revise, edit and proofread all outputs for accuracy and completeness. A vendor cannot both promise that nothing is missed and require the buyer to check everything; the gap between those two sentences is the finding here.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The review point is written into the agreement rather than implied by marketing, which is unusual, and the rest of the control structure is missing. Section 16 states that it is entirely the user's obligation to review, revise, edit and proofread all outputs for accuracy and completeness, and that the user shall not act upon an output, or decide not to act based upon one, without first doing so and seeking professional counsel from an attorney licensed in the applicable jurisdiction. It adds that outputs are for convenience and informational purposes and cannot be relied on to guarantee any outcome. That is a written commitment placing a supervising lawyer between the model and the client, and the review surface is real, since the deliverable is an editable draft the firm finishes. What is absent is everything on the system's own side: nothing describes what runs unattended, no confidence signal or uncertainty indicator is mentioned, nothing states how a firm should verify a chronology against the underlying records, and nothing addresses what happens when an output is wrong. The obligation is allocated; the mechanism for discharging it is not described.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Named customers without figures alongside figures without a named customer, which is this band exactly. Three testimonials carry full attribution: Tanya Hardin, a paralegal at Johnson Law, who reports the program cut her time by half; Chris Carsten, a partner at Armada Law; and Daniel Swenson, an attorney at Robert Wilson, who says settlement offers came back higher after adoption. None carries a measured figure beyond the halving claim, and none is dated. Separately the home page publishes five and a half hours saved per case, and the company's own February 2025 announcement states that early adopters cut total time on demand packages by more than 50 per cent, with no firm named against either. One display element does not survive inspection and is recorded because a reader who checks will find it: a logo wall headed that the product is trusted by lawyers and recognised by six organisations, which resolve to Best Lawyers in America, the Million Dollar Advocates Forum, Lawyers of Distinction, Premier Lawyers of America, the Top 100 National Trial Lawyers and Best Law Firms 2024. Those are attorney award and directory marks, not recognitions of this product. A separate row of Fox, CBS and BBC logos under a featured-on heading links to no coverage.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The privilege limb is expressly present, which is rare, and two other limbs are missing. Section 14 defines confidential information to include, by name, any information protected by attorney-client privilege and any sensitive or protected health information, and commits Novo to protect it with at least a reasonable degree of care, to use it only to perform its obligations, and to restrict disclosure to those who need it. The privacy policy repeats the commitment, stating that Novo will employ industry standard security measures for information protected by attorney-client privilege and protected health information. Section 16 also has the customer warrant that it holds the rights and consents needed for privileged client data it uploads, so the agreement engages the question head on rather than skirting it. What holds it here is the other side of the same document. Section 7 reserves an unlimited licence to use anonymised outputs to improve the services and to create training data, so privileged material is protected in one clause and mined in anonymised form in another. And nothing anywhere describes separation between firms or matter-level walls, or what the named model providers retain.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

A real published position, more specific than most, with no engagement with the professional rules themselves. Section 16 states that the services and outputs are for convenience and informational purposes only, do not constitute legal advice, are not an offer to represent the user or their clients, and do not create an attorney-client relationship. It goes further than a disclaimer by imposing conduct: the user must review, revise, edit and proofread every output, and must not act on an output or decline to act on one without first seeking counsel from an attorney licensed in the applicable jurisdiction. It closes by stating that outputs cannot be relied on to guarantee any outcome in a matter. That is a coherent account of where the product stops, published where a buyer reads it before signing. What is absent is the professional layer: no bar association, rule of professional conduct or ethics opinion is named, nothing addresses the supervision and competence duties that attach when a machine drafts a demand, and nothing addresses what a client is told.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

No governance position of any kind was located. There is no responsible AI page, no principles statement, no accountable owner or function named, no pre-release testing regime, no management system and no certification. Nothing addresses uneven output, and the gap has a concrete shape on this product rather than a formal one: a demand letter is an argument about how much an injury is worth, and nothing published states whether the drafting has been examined for systematic variation across injury types, treatment histories, or the demographic characteristics that appear throughout a medical file. The estate is small and was inventoried in full on 4 September 2026, comprising two product pages, a blog, a service providers page, terms of service and a privacy policy; none of them addresses governance.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Most of the ground is covered, with the retention period the notable hole. Storage location is stated, the privacy policy confirming that data is held on Novo's servers within the United States and naming what is stored, including account information, resultant data and training data. Deletion and access rights are published with a process and a clock: access, rectification, erasure, restriction, portability and objection, exercised by email, with a best-efforts response in forty-five days extendable to ninety. Incident practice is committed rather than implied, the policy stating that in the event of a breach Novo will notify by email or by a notice on the services. The supplier picture is disclosed rather than described in categories, with a published service providers list naming eight named companies and components. Two limits keep this off the top. No retention period is stated at all, the policy saying only that data is kept as long as necessary and that the length may vary. And the anonymisation commitment before data reaches the AI providers is qualified as best efforts rather than absolute.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

The allocation of loss is published, readable before signing, and runs one way throughout. Section 16 provides the services as is and with all faults, disclaiming all warranties including merchantability, fitness for purpose and non-infringement, and expressly warranting nothing about meeting requirements, achieving intended results or being error-free. Section 17 caps direct damages at the total amount paid in the six months before the event giving rise to the claim, which on a product with a free tier and low entry pricing is a small number, and excludes lost profits, data loss and consequential damages entirely. Section 18 runs the indemnity from the user to Novo, covering use or misuse of the services and breach of the terms; there is no vendor-side indemnity anywhere, not even for intellectual property. No warranty on output, no service credit, no insurance position and nothing addressing a chronology that omits a treatment or a demand that misstates damages was located. This is the middle band because the exposure the product creates is addressed through a standard limitation clause that disclaims it rather than left unstated.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Four case management systems are named on the vendor's own estate and nothing published describes what moves between them. The home page carries CASEpeer, Smokeball, SmartAdvocate and MyCase under a heading identifying them as case management integration partners, presented as logos with no accompanying description, and a blog post announces integrations with MyCase and CASEpeer by title. That is a real and relevant set of counterparties for a plaintiff product, and it is the reason this sits above the floor. What is missing is everything an implementer would use: no statement of what syncs, in which direction, on what trigger, no field mapping, no configuration guide, no API or developer documentation, and nothing about what a firm must do to connect the two systems. No document management, e-signature or billing integration is named. The integrations announcement post was not opened in this pass and is named here as the limit; the grade rests on the material that was read.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The residency limb is answered plainly and the tenancy limb is not. The privacy policy states that personal data about end users and visitors is stored within the United States, that the services are intended for use only inside the United States, and that a user in the European Economic Area or elsewhere is consenting to transfer of their data to the United States; the terms reinforce it with a geographic restriction section stating the services are based in the United States and provided for access and use only by persons located there. That is a stated storage location, published where a buyer can read it, which is more than most records in this lane offer. Against it, nothing states whether the platform is single or multi-tenant, no dedicated or isolated option appears at any tier, and no region choice is offered. The named infrastructure providers, Railway and Supabase, are published on the service providers page but no statement ties them to a region or describes the hosting arrangement. This is the documented band gap where a vendor publishes one limb cleanly and the other not at all.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

One badge, no scope, no date, no report. The home page displays a HIPAA compliance mark as an image, with no statement of what was assessed, by whom, over what period or against which controls, and the underlying asset filename misspells the statute. HIPAA is in any case a statutory regime a business associate self-attests to rather than an independent attestation, and no business associate agreement is offered or mentioned anywhere despite the product being built to ingest medical records. No SOC 2 of either type, no ISO certification, no penetration test summary and no named auditor appears on the estate, and there is no trust centre or security page, so there is nothing gated to request and this is an absence rather than a retrieval limit. What the vendor does publish in this territory is described in general terms only, the privacy policy referring to physical, electronic and managerial control procedures and to vetting of outsourced providers, without naming a single control. The estate was inventoried in full on 4 September 2026.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The supply chain is disclosed by name on a dedicated published page, and stops short of the models themselves. The service providers page, incorporated into the terms by reference and reachable without an account, lists eight suppliers with links to each one's terms: GPT by OpenAI and Claude by Anthropic as the AI services used in the platform, Google OCR and the Tesseract open-source engine for optical character recognition, Railway for infrastructure and deployment, Supabase as the backend platform, Gotenberg for PDF conversion and Redis for caching. Naming both AI providers and the hosting layer puts this well above the vendors in this lane that describe an AI without identifying anything behind it. Three things keep it off the top band. The models are identified only at product-family level, as GPT and Claude, with no version stated, so a buyer cannot tell which model reads a medical file. The page states in terms that the list is not exhaustive and may be updated as the platform evolves, with no notice commitment. And section 13 of the terms authorises Novo to allow third-party providers to process user data whether or not those providers are disclosed to the user or white labelled.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information is published at any level, including the unit of charge. There is no pricing page in the site navigation, which carries only the two product pages and a blog, and the two calls to action are a free draft and a booked demo. The only commercial statement on the marketing estate is an invitation to get started on a free plan and upgrade when ready, which names no paid tier, no rate, no unit, no included volume and nothing about what the free plan contains or where it stops. The terms describe payment mechanics without any figures, stating that portions of the service may be offered free, that certain features are charged, that fees are payable within thirty days of invoice in US dollars, that late payment accrues interest at one and a half per cent per month, that payments are final and non-refundable, and that Novo reserves the right to establish, remove and revise prices at any time; the amounts themselves live in an order form the buyer only sees through a sales process. A buyer cannot establish whether the product is charged per user, per case, per document or per page. No pricing row is owed on this record.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The segment is stated without ambiguity and one real boundary is drawn. Every surface addresses personal injury plaintiff practice, the home page headlining the AI built for PI, and the scope is narrower still within it: pre-litigation specifically, built around the demand package rather than the whole matter, with the company's own announcement framing the market as the roughly eighteen million demand packages US personal injury firms send each year. The terms name the users as law firms, attorneys and legal staff. A genuine limit is published, unusually: the services are stated to be based in the United States and offered only to persons located there, so a buyer outside the country is told plainly that the product is not for them. What is absent is the rest of the boundary. No firm size is addressed, nothing states whether the product suits mass tort, medical malpractice or workers compensation work as against motor vehicle claims, no state or jurisdictional variation in demand practice is discussed, and nothing says which record types or matter types it handles poorly.