S

Smarsh

The capabilities the vendor now leads with are driven by models, on a capture and archive platform that works without them. Two agents filter surveillance alerts and detect risk, the AI Assistant summarizes and translates, and the Discovery Agent builds summaries, timelines and custodian maps for investigations. Underneath sits a capture, retention, legal hold, search and export platform, sold for decades as a recordkeeping system of record, that functions fully without models.

Performance figures are published without a method, and grounding is claimed rather than described. Releases and pages say the Noise Reduction Agent cuts false positives by 60 percent, the Intelligent Agent surfaces three to five times more real risk, and the Discovery Agent cuts investigation costs by up to 75 percent. No sample, baseline or test is described for any of them. The same FAQ grounds AI summaries and risk signals in traceable source data, but does not describe how a summary links back to the messages it relies on, or what happens when the AI misreads a conversation.

Alert suppression is automated, and no human control over it is published. The Noise Reduction Agent and Intelligent Agent suppress alerts of low relevance so supervisory teams see fewer, and the vendor calls these autonomous systems that augment rather than replace human expertise. Nothing published says whether suppressed alerts can be reviewed or are sampled, what threshold governs suppression, or who approves the agents' configuration.

That matters because supervisory review of communications is a regulatory duty for the vendor's financial services customers. Discovery Agent output is presented as input to investigators.

Two kinds of evidence are published, a commissioned study with a described method and a named customer with figures, and neither joins both. Smarsh publishes a Forrester Consulting Total Economic Impact study (September 2024) that interviewed six representatives of financial services firms, built a composite organization and adjusted each benefit for risk. It reports a 124 percent ROI over three years, archive costs down 25 percent and electronic discovery time down 65 percent.

The interviewees are anonymous and Smarsh chose them. A customer story for Securities America, a named broker dealer, reports messages flagged for review falling from 19 to 10 percent (8,000 a day) in three months. That 2020 result came from professional services tuning of policy rules, not the current AI agents, and no method is given.

Confidentiality is contractual, and the AI data position is not addressed. The Services Agreement treats the client's data as the client's property and confidential information, with notice before compelled disclosure, and its use license is limited to support and improvement. No published term covers the AI side: which model providers, if any, see client data, or how privilege and work product are handled in data held for discovery.

The product is positioned clearly as a compliance tool, not legal advice, and supervision is left out. The Services Agreement states that Smarsh does not guarantee that use of the services, or its advice or consulting, will ensure the client's legal compliance. The legal documents page says Smarsh materials are not legal advice and customers must consult an attorney. The audience is compliance, legal and records professionals in regulated firms.

Nothing addresses how supervisors or counsel should treat alerts the AI suppressed, or AI summaries, in meeting their own obligations.

Transparency features are described, and no governance framework is. The innovations FAQ says AI runs within preserved, governed environments with full audit trails, traceable source data, chain of custody and access by role, so outputs are transparent and reproducible. Press coverage quotes the vendor on auditability aligned with regulator expectations. No accountable owner, testing regime before release or disclosure of uneven performance across languages or communication styles is published, although the misconduct detection agent is pitched on reading slang, jargon and multilingual exchanges. Smarsh also sells AI governance products to financial firms; those are products, not a policy for its own AI.

Retention, deletion, access and part of the subprocessor picture are covered in the agreement, and no incident commitment is published. The client sets retention, capture data is held only briefly before deletion, client data is deleted after termination, and subprocessors for mobile capture are listed by name and location. The trust page states encryption in transit and at rest, SSO and MFA, and regular penetration testing.

No incident notification timeline is published, and the Information Security Addendum, available on request, was not read.

A detailed liability position is published with an indemnity and a cap, and AI output is not covered. The Services Agreement gives a vendor indemnity against claims that use of the services infringes a U.S. patent, trademark or copyright, and caps Smarsh's liability at fees received in the prior twelve months. Service level credits are the remedy for availability failures. No term addresses AI summaries or suppressed alerts, and no insurance position is published.

Connections are broad and named, with some depth described; the documentation was not read. The Services Agreement and pages describe capture from email, mobile carriers such as Verizon and AT&T, apps such as WhatsApp and Signal, and Microsoft 365 Copilot, among other channels. The platform offers Audit, Identity and Review Alert APIs and exports to outside counsel tools. Product documentation sits in the Smarsh Central support portal, which stayed unopened.

Hosting model and region are stated per service in the agreement; the AI processing location is not. Professional Archive and Web Archive run in an environment Smarsh manages in the United States, Cloud Capture runs in a multitenant AWS environment in the United States, and mobile capture stores data in the United States unless agreed otherwise. Where the AI agents process data, and whether other regions are offered for them, is not stated in the documents read.

Certifications are named, with a contractual route to the reports, and no evidence was read. The trust page shows ISO 27001 certification under ANAB accreditation and SOC audits by third parties. The Services Agreement commits Smarsh to annual independent audits under ISO 27001 or SSAE 18 and to give clients its latest ISO 27001 and SSAE 18 reports and a penetration test summary as standard audit documentation. The certification scope, auditor and report periods are not stated on any page read.

The trust.smarsh.com portal, hosted on Vanta, returned only its page description when opened, so its contents could not be read.

Models are referred to and not identified. The vendor describes AI models ready for production at global institutions, press coverage quotes it on large language models adapted to the domain and built by its own team, and its APIs support customers' own models. No model, provider or version is named in the agreement or on the pages read, and nothing commits to notice when the models behind surveillance decisions change.

The unit and structure of pricing are published, and the figures are not. The Services Agreement licenses its archives by connection and by site, with a minimum commitment, overage fees, a capped renewal uplift and extra fees for long retention, all recorded in the pricing structure. The Intelligent Agent was announced as a separately priced addition. No price or rate is published, and buying runs through sales.

Segments and the regulatory regimes served are described with substance, and limits on the AI are not. The vendor serves financial services firms from broker dealers and RIAs to banks, along with public sector bodies handling FOIA requests, energy and utilities companies under FERC and NERC oversight, and life sciences. Small and midsized firms and enterprises have separate offerings, and SEC Rule 17a-4 and FINRA supervision are named among the rules supported.

The agreement sets use limits, such as capturing only employees' communications. Nothing states which languages, channels or misconduct types the AI agents handle less well.