P

Paxton AI

The models are the product. Research, drafting, document analysis, medical chronologies and the citator are all generative or machine learning capabilities, and there is no underlying practice system that would function without them.

The disclosure is substantive, with a real gap. The vendor built its own citator and publishes precision, recall and F1 tables for it. It publishes measured accuracy of 93.82 percent on average on the Stanford Legal Hallucination Benchmark, broken out by task including case existence, citation retrieval and court identification. It also publishes 94 percent on the Stanford Casehold dataset of 2,400 examples for the citator.

Both are public academic datasets, so an outsider can in principle run them again. Two gaps remain. The published results date from 2024, and no republication against the current product was found. The AI Confidence Indicator is a confidence signal rather than an explicit path for declining to answer.

The product is user directed rather than agentic, and the vendor states plainly across the site that it provides self help services at the user's specific direction and cannot give advice, which is an oversight posture of a kind. The AI Confidence Indicator is a real review aid. What is not published is a described control structure: what the system does on its own, what a lawyer must approve, and what happens after an output is wrong.

An unlabeled customer logo strip and three attributed testimonials from named individuals at named organizations stand in for deployment evidence. No figures, no dates, no described method, and no case study were found. A 2025 Legalweek Leaders in Tech Law award and a 22 million dollar Series A are recognition and funding rather than production evidence. Individual logos in the strip were not corroborated.

Confidentiality is asserted in general terms, and the documents behind it point the other way. The home page describes a secure closed model prioritizing the privacy of legal inquiries. The sitewide footer states that communications with the vendor are not protected by attorney client privilege or as work product. The terms of service require a user to warrant that submissions do not constitute confidential information, in a section scoped to questions, comments, feedback and other information about the Services rather than to uploaded documents.

The privacy policy is scoped to website and account information, lists no document or prompt data, and states that the vendor does not process sensitive information, on a product that takes in medical records. No training prohibition, retention period for uploaded documents or segregation by matter was found in any of them.

Paxton publishes a real position on the advice line in a footer on every page. It states that Paxton is not a law firm and not a substitute for an attorney, that communications are not protected by attorney client privilege or as work product, and that it gives no advice, explanation, opinion or recommendation about legal rights, remedies, defenses, options, selection of forms or strategies. Jurisdiction is addressed in part: the terms state the service is not intended for use where that would be contrary to local law.

Nothing published addresses a lawyer's competence and supervision duties. The self help framing sits oddly against marketing aimed at attorneys, so it is not clear who the disclaimer is written for.

No governance position for model behavior was found: no named internal owner, no testing regime before release, no responsible AI statement, and nothing on uneven output across matter types, parties or populations. The trust center lists security control families, which is a different subject. The white papers index was not reviewed item by item and may say more.

A generic privacy policy covers the website without addressing what happens to documents and prompts after processing. The security page does publish real controls: encryption in transit and at rest, quarterly access reviews on a least access principle, vendor risk management and a security development lifecycle, and the open trust center lists control families. But the privacy policy is scoped to account and marketing data, its retention section speaks only to the life of an account, and the terms say only that certain transmitted data is maintained to manage performance of the service.

No retention period for uploaded documents, no subprocessor list, and no incident or breach notification practice is published.

Liability is addressed only through a standard limitation clause that disclaims the exposure the product creates. The published terms disclaim all warranties, including any representation about the accuracy or completeness of content, and cap total liability at the amount paid in the six months before the claim. They require the user to indemnify the vendor and state that the vendor has no liability for loss or corruption of transmitted data.

No indemnity running to the customer, warranty on output or insurance position was found. The allocation of loss is published, and a buyer can read it before signing.

No integration into document management, matter management, contract lifecycle or filing systems was found in vendor material, and the platform navigation lists none. A third party review reports a Microsoft Word add in; that is not vendor material. The product is positioned as a browser based tool for solo and small firm users.

The service is hosted, and the tenancy model is not stated. The terms of service state that the service is hosted in the United States and that a user accessing it from elsewhere consents to transfer and processing there, which is a real residency statement. Not found: any tenancy model, regional option, single tenant or private deployment, or statement of where processing happens as distinct from where data is stored.

Badges appear with no scope, no date and no report available. There is an open trust center that anyone can reach. It lists SOC 2, ISO 27001 and HIPAA as compliant and GDPR as in progress, and names security control families. It carries no attestation report, coverage period, audit scope or auditor name. The security page says the vendor rigorously adheres to these standards, which is adherence rather than attestation.

The pricing page describes the platform as HIPAA certified, though HIPAA has no certification scheme. Its annual plan card cites ISO 20701, which is not an existing standard, while the monthly card on the same page cites ISO 27001. Separately, section 1 of the terms of service states that the services are not tailored to comply with industry specific regulations including HIPAA, and that a user whose interactions are subject to such laws may not use them. The product sells medical chronology and medical billing features alongside its marketing claim of HIPAA compliance.

No model provider is named, no architecture is described, no subprocessor list exists, and there is no commitment to notify customers when the supply chain changes. The vendor refers to operating within a secure closed model without identifying what sits underneath.

Real pricing is published for part of the range, and Enterprise pricing is withheld. The pricing page publishes a figure, a unit and a term: $499 per user per month, or $2,999 per user per year billed annually, with the plan contents itemized. Signup is self serve with a 7 day free trial, and the terms of service disclose the exact card authorization hold of $499. The Enterprise plan is custom and based on volume, with no figure, floor or seat minimum published. What implementation adds is not stated for either plan.

Segment and practice coverage is described with substance. Named segments are solo attorneys, small and midsize firms and in house teams, with dedicated pages for personal injury, family law, employment law, criminal law and corporate law. The research coverage page names every federal and state database included by jurisdiction and court, which tells a buyer where research coverage stops. Not found: any treatment of government or court use, and any statement of which firm sizes or practice areas the product is not built for.