S
Smarsh
Smarsh is a communications capture, archiving, surveillance and discovery platform from Smarsh Inc. of Portland, Oregon, used mainly by financial services firms, and also by public sector bodies, energy and utilities and life sciences companies, to meet recordkeeping and supervision rules such as SEC Rule 17a-4 and FINRA supervision requirements. It captures email, instant messaging, collaboration tools, mobile messaging including WhatsApp, voice and social media into a retained archive with legal holds and exports.
Its AI layer includes an Intelligent Agent and Noise Reduction Agent that suppress low-relevance surveillance alerts and detect misconduct in full conversational context across languages, an AI Assistant that summarises and translates communications, and a Discovery Agent for legal investigations that produces summaries, timelines and custodian mapping to narrow what is exported to outside counsel. Smarsh publishes its Services Agreement, which provides for client-set retention, annual ISO 27001 and SSAE 18 audits and notice of compelled disclosure, and it holds ISO 27001 certification. Pricing is by quotation, licensed per connection.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models drive the capabilities the vendor now leads with, on a capture and archive platform that works without them, which is the B band. The Intelligent Agent and Noise Reduction Agent filter and detect risk in surveillance, the AI Assistant summarises and translates, and the Discovery Agent produces summaries, timelines and custodian mapping for investigations. Underneath is a capture, retention, legal hold, search and export platform, sold for decades as a recordkeeping system of record under SEC Rule 17a-4, that functions fully without models. Verified 18 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Performance is asserted with figures that carry no method, and grounding is claimed rather than described, which is the C band. The vendor's releases and pages say the Noise Reduction Agent cuts false positives by 60 per cent, review volumes fall by up to 50 per cent, the Intelligent Agent surfaces three to five times more real risk, and the Discovery Agent cuts investigation costs by up to 75 per cent, with no sample, baseline or test described.
The innovations FAQ says AI summaries and risk signals rest on traceable source data and are reproducible, but does not describe how a summary links back to the messages it relies on or what happens when the AI misreads a conversation. Verified 18 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Automated suppression of surveillance alerts is described without a published human control, which places this at C. The Noise Reduction Agent and Intelligent Agent suppress low-relevance alerts so supervisory teams see fewer, and the vendor describes these as autonomous systems that augment rather than replace human expertise, with audit trails and chain of custody. Nothing published says whether suppressed alerts can be reviewed or are sampled, what threshold governs suppression, or who approves the agent's configuration, which matters because supervisory review of communications is a regulatory duty for the vendor's financial services customers. Discovery Agent output is presented as input to investigators. Verified 18 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
A commissioned study with a described method and a named customer with figures, neither both at once, which is the B band. Smarsh publishes a Forrester Consulting Total Economic Impact study (September 2024) that interviewed six representatives of financial services firms, built a composite organisation, and risk-adjusted each benefit: 124 per cent ROI over three years, archive costs down 25 per cent, e-discovery time down 65 per cent, and false-positive surveillance alerts down 25 to 45 per cent by interviewee estimate; the interviewees are anonymous and Smarsh chose them.
Its customer story for Securities America, a named broker-dealer, reports messages flagged for review falling from 19 to 10 per cent (8,000 a day) in three months, but that 2020 result came from professional services tuning of policy rules, not the current AI agents, and no method is given. The 2026 release figures for the AI agents still carry no method. Verified 18 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Contractual confidentiality is in place while the AI data position is not addressed, which places this at C. The Smarsh Services Agreement treats the client's data as the client's property and confidential information, with notice before compelled disclosure, and licenses Smarsh to use client data to provide support and improve the services on the client's behalf. No published term addresses whether client communications are used to train or adapt the domain-adapted models behind the AI agents, which model providers if any see client data, or privilege and work product in data held for discovery.
The innovations FAQ describes AI running inside governed environments with role-based access and chain of custody. Verified 18 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
A clear position that the product is a compliance tool and not legal advice, short of the supervision dimension, which is the B band. The Services Agreement states that Smarsh does not guarantee that use of the services, or its advice or consulting, will ensure the client's legal compliance, and the legal documents page says Smarsh materials are not legal advice and customers must consult an attorney. The audience is compliance, legal and records professionals in regulated firms.
Nothing addresses how supervisors or counsel should treat AI-suppressed alerts or AI summaries in meeting their own obligations. Verified 18 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Transparency features are described without a governance framework, which places this at C. The innovations FAQ says AI runs within preserved, governed environments with full audit trails, traceable source data, chain of custody and role-based access so outputs are transparent and reproducible, and press coverage quotes the vendor on auditability aligned with regulator expectations. No accountable owner, pre-release testing regime or disclosure of uneven performance across languages or communication styles is published, although the misconduct detection agent is pitched on reading slang, jargon and multilingual exchanges.
Smarsh also sells AI governance products to financial firms; under R126 that purpose earns nothing on this row. Verified 18 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The agreement covers retention, deletion, access and part of the subprocessor picture, short of a published incident commitment, which is the B band. The Services Agreement lets the client set retention periods (up to seven years by default in Professional Archive), sets temporary retention of up to 30 days for capture services with deletion after, provides for deletion of client data after termination, and lists subprocessors for mobile capture by name and location; the trust page states encryption in transit and at rest, SSO and MFA, and regular penetration testing.
The Information Security Addendum and DPA are available on request and were not read, no incident notification timeline is published, and the agreement's post-termination terms conflict between deletion as soon as practicable and retention for up to six months. Verified 18 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
A detailed published liability position with an indemnity and cap, with nothing on AI output, which is the B band. The Services Agreement gives a vendor indemnity against claims that use of the services infringes a U.S. patent, trademark or copyright, caps Smarsh's liability at fees received in the prior twelve months, provides service-level credits as the remedy for availability failures, and disclaims any guarantee that use of the services ensures legal compliance.
No term addresses AI-generated summaries or suppressed alerts, and no insurance position is published. Verified 18 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Broad named connections with some depth described, short of documentation read, which is the B band. The Services Agreement and pages describe capture from email, collaboration, mobile carriers such as Verizon and AT&T, apps such as WhatsApp and Signal, voice, social media, websites and Microsoft 365 Copilot, and the platform offers Audit, Identity and Review Alert APIs and exports to outside counsel tools. Product documentation sits in the Smarsh Central support portal and was not read. Verified 18 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Hosting model and region are stated per service in the agreement, without the AI processing location, which is the B band. The Services Agreement states that Professional Archive and Web Archive run in a Smarsh-managed environment in the United States, Cloud Capture runs in a multi-tenant AWS environment in the United States, and mobile capture stores data in the United States unless agreed otherwise. Where the AI agents process data, and whether other regions are offered for them, is not stated in the documents read. Verified 18 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Named certifications with a contractual route to the reports, short of evidence read, which is the B band. The trust page shows ISO 27001 certification under ANAB accreditation and third-party SOC audits, and the Services Agreement commits Smarsh to annual independent audits under ISO 27001 or SSAE 18 and to give clients its most recent ISO 27001 and SSAE 18 reports and a penetration test summary as standard audit documentation.
The certification scope, auditor and report periods are not stated on any page read. The trust.smarsh.com portal, hosted on Vanta, was opened and returned only its page description, so its contents could not be read. Verified 18 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Models are referred to without being identified, which is the C band. The vendor describes production-ready AI models for global institutions, press coverage quotes it on domain-adapted large language models built with an in-house team, and its APIs support customers' own models; no model, provider or version is named in the agreement or on the pages read, and nothing commits to notice when the models behind surveillance decisions change. Verified 18 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure are published without the figure, which is the B band. The Services Agreement explains that Professional Archive is licensed per connection (a mailbox, account, phone number or social profile) and Web Archive per domain and per page, with minimum commitments equal to the recurring fees, usage-based overage fees, a renewal uplift capped at ten per cent, and additional fees for retention beyond seven years; the Intelligent Agent was announced as a priced add-on.
No price or rate is published and buying runs through sales. Regraded from C on 18 September 2026 under R45: the band text for B names unit and structure without the figure. Verified 18 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segments and the regulatory regimes served are described with substance, short of limits on the AI, which is the B band. The vendor serves wealth management, broker-dealers, RIAs and banks, public sector bodies handling FOIA, energy and utilities under FERC, NERC and CFTC oversight, and life sciences, with separate small and mid-sized and enterprise offerings, and names SEC Rule 17a-4 and FINRA supervision among the rules it supports.
The agreement sets use limits, such as capturing only employees' communications. Nothing states which languages, channels or misconduct types the AI agents handle less well. Verified 18 September 2026.
3 public documents
The public pages on file for Smarsh, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Prompt and Output Retention, Ethical Walls and Matter Segregation, Third Party Request and Subpoena Notice and 1 more
Read Sep 18, 2026
-
smarsh.com/platform/innovation2 signals
Billing and Fee Posture, Court Disclosure Support
Read Sep 18, 2026
-
Fabricated Citation Record
Read Sep 18, 2026
Quoted per connection
- Smarsh charges for each thing it captures, called a connection, such as a mailbox or a phone number.
- Web archiving is charged per website and per page.
- You commit to a minimum amount, and pay extra if you go over.
- The price can rise by up to ten per cent a year at renewal.
- No prices are published, so you have to ask sales for a quote.
Per connection for Professional Archive (a mailbox, account, phone number or social profile), per domain and per page for Web Archive, with a minimum commitment equal to the recurring fees, usage-based overages, renewal uplift capped at ten per cent, and extra fees for retention beyond seven years. Source: Smarsh Services Agreement v.10/25, https://www.smarsh.com/legal-docs/SmarshServicesAgreement-v1025.pdf, read 18 September 2026.
Implementation: Professional services for historical data imports, exports and migrations are charged at Smarsh's then-current rates under a statement of work; onboarding and data migration fees are set on the order form. No figures published.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The customer agreement or data processing addendum contractually limits use of Customer Data to providing the contracted service, and no surface names training either way. The limit is bound, which a policy page is not, but it is not an express training prohibition. If any surface names training in either direction, one of the other values is true and this one is not.
The published Services Agreement grants a use right over client data bounded to support and improvement of the services, and never names training. Section 4.2 licenses Smarsh to access and use client data as necessary to provide support and improve the services on the client's behalf. No published term addresses whether client communications train or adapt the models behind Smarsh's AI agents.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The customer controls the retention window, by product configuration or by contractual instruction, but zero retention is not stated as available.
The client sets retention. The Services Agreement retains archived data for client-set periods (up to seven years by default, longer for a fee), keeps capture data for a client-configured temporary period of up to 30 days before deletion, and provides for deletion after termination, though one section says as soon as practicable and another allows up to six months. Retention of AI summaries and prompts is not addressed separately.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Segregation is asserted in public materials with no published detail on how it is enforced.
Role-based access is described without published detail on separating matters or investigations. The agreement lets clients set user roles with different access levels, and the innovations FAQ refers to role-based access and chain of custody around AI outputs. How access is walled between investigations or legal holds is not documented in the materials read.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
The Services Agreement commits to reasonable notice before compelled disclosure of confidential information, including client data, where feasible and legally permitted, so the client can contest the order, and to cooperate at the client's expense.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
Searched the innovations and trust pages and the Services Agreement on 18 September 2026. The AI works over the client's own captured communications; no external legal corpus is described.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Searched the same surfaces on 18 September 2026. The product does not cite legal authority, so no subsequent-history check arises and none is described.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
Searched the innovations page and FAQ, the trust page, the Services Agreement and the 2026 press releases on 18 September 2026. No abstention path, confidence score or grounding indicator is described for AI summaries or risk signals; the agents suppress low-relevance alerts rather than flagging uncertain ones.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
Searched the AI Hallucination Cases database maintained by Damien Charlotin and trade press reporting on 18 September 2026 for court records addressing fabricated or hallucinated content in output from Smarsh products. None located. This signal does not record litigation history of any other kind.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
Searched the same surfaces on 18 September 2026. The vendor names securities regulations such as SEC Rule 17a-4 and FINRA supervision rules, which are regulatory recordkeeping and supervision requirements, but no bar ethics opinion or court rule on AI.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
The product is bought by regulated firms for their own compliance and investigations, where no client is billed for the work. Savings are claimed for the buyer's own costs, including reduced outside counsel spend and investigation costs cut by up to 75 per cent.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
No located public material supports a client side disclosure obligation.
Searched the Services Agreement, trust page and legal documents index on 18 September 2026. The agreement lists subprocessors for mobile capture only (TeleMessage, Microsoft Azure, AWS and CallCabinet entities); no AI or model provider is named, and the DPA and Information Security Addendum are available on request rather than published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a defensible record exist, short of an AI disclosure record. The vendor describes chain of custody, full audit trails, traceable source data and reproducible AI outputs, and the archive supports legal holds and exports. Nothing records which model produced a summary or risk signal, or who reviewed it.