Supio

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

An AI first company in the literal sense: founded in 2021 to build this, with no preceding product to attach models to. CaseAware AI is named as the proprietary technology and the vendor's framing is that it distinguishes facts from opinions across large volumes of records, which is a model capability claim rather than a workflow claim. Every deliverable is generated: chronologies from raw medical records, demand letters, case economics ledgers, litigation drafts and deposition analysis. Supio Agent, launched in the first half of 2026, is directed through natural language instruction rather than configured through forms, which is an agentic architecture rather than an assistant bolted onto a case system. Remove the models and there is no product, only a connection to case management systems the firm already owns. Fifth A on this axis in the pull and the second consecutive one in this category, which is itself a finding: plaintiff side vendors were built model first because the underlying task, reading a banker's box of medical records, was never automatable any other way.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

The best grounding architecture in this category and still no published measurement. Citations are stated to be page level, back to the source document, for any claim made in a demand, which is finer grained than EvenUp's document level citation and is the right resolution for medical record work where a single treatment note inside a 400 page file is the evidence. The vendor also builds verification into the workflow rather than leaving it to the reader: for high value cases human experts verify medical bill summations and damage calculations before delivery, which targets the arithmetic most likely to be wrong and most consequential if it is. Held at B because nothing measured is published: no extraction accuracy, no recall on treatment events, no error rate on bill summation, no evaluation of the fact versus opinion distinction that CaseAware is named for, and no statement of behaviour when records are illegible, contradictory or incomplete. The one circulating figure, 80 plus hours saved per case, is throughput and not accuracy, and independent material reporting it notes that most such benchmarks come from vendor marketing.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Oversight is differentiated by case value, which is a more thoughtful design than a single tier and is published plainly. For high value cases human experts verify medical bill summations and damage calculations, so the human check is targeted at the numbers that determine settlement rather than applied uniformly or not at all. The agentic layer is directed by the attorney through explicit natural language instruction, with published examples showing the lawyer specifying what to emphasise and asking the system to double check a medical bill total, which places the attorney in the loop by design rather than by policy. Every output is positioned as a draft carrying linked sources for verification. Held at B because the boundaries are undefined: no statement of what makes a case high value enough to trigger expert verification, no description of what those experts check or against what standard, no confidence indication on generated content, and no account of what Supio Agent may do unattended once instructed.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Company milestones are well evidenced and customer outcomes are not. Strong and checkable on the company: approximately $85m to $91m raised across three rounds, a $25m Series A on emergence from stealth in August 2024 and a $60m Series B in April 2025 led by Sapphire Ventures, with a named investor list including Thomson Reuters Ventures, Mayfield, Greylock and Menlo Ventures. A strategic partnership with Thomson Reuters, expanded in 2026, is meaningful third party validation because that counterparty is also an investor and a competitor's parent. Supio Agent launched in the first half of 2026. What is missing is the customer side: no law firm is named anywhere in located material, no case study with methodology, and no usage figure. The single outcome claim, 80 plus hours saved per case when combining chronologies with demand generation, carries no baseline, sample or definition and is reported in independent material that flags the whole class as vendor supplied. Funding is not evidence that the product works, and this record has a great deal of the former and little of the latter.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The broadest health privacy credential set in the category, and privilege itself remains unaddressed. Stated: SOC 2 Type II certification alongside compliance with HIPAA, PHIPA and GDPR. PHIPA is the notable one and no other record on this index names it: Ontario's Personal Health Information Protection Act governs health information custodians in Canada, and naming it alongside Canadian data centres indicates the vendor addressed a specific regional health privacy regime rather than treating HIPAA as sufficient everywhere. For a platform ingesting complete medical records for injured claimants, protecting a third party's health information under the right regime for the jurisdiction is the core confidentiality question and it is answered. Held at B because nothing addresses legal professional privilege or attorney work product: demand strategy, case economics ledgers and litigation drafts are work product, and the published posture covers health data and general security without reaching the legal dimension. Same placement as EvenUp, reached the same way.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Not located. The platform drafts demand letters sent under the firm's name to adverse insurers, produces litigation drafts, and generates case economics that inform settlement advice to an injured client. Nothing published addresses the supervising attorney's duty over machine drafted advocacy, the professional responsibility dimension of relying on generated damage calculations when advising a client whether to accept an offer, or any bar guidance. The human expert verification tier is a quality control mechanism operated by the vendor rather than a statement about the attorney's own professional obligations. Checked the product pages, the demand letter page, the press page and the site navigation on 29 Aug 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Nothing published about how the models are governed, evaluated or monitored. No AI policy, no model card, no bias or fairness testing, no evaluation methodology or result, no accuracy monitoring, no drift statement, no named governance body and no ISO 42001. The category specific risk flagged on the EvenUp record applies here in a different form and is equally untested: this product generates case economics ledgers and damage calculations that shape what an injured claimant is told their case is worth, and any systematic tendency in how the models weigh treatment, life impact or pain and suffering evidence would fall on claimants rather than on the firm. CaseAware is named for distinguishing facts from opinions in medical records, which is an interpretive judgement about clinical documentation, and nothing published indicates that judgement has been evaluated. Checked the product pages, the press page, the company material and the site navigation on 29 Aug 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Handling is credentialed across multiple regimes and the training question is unanswered. SOC 2 Type II, HIPAA, PHIPA and GDPR compliance establish that safeguards over health and personal data have been addressed, and stated data centres in three countries indicate deliberate architecture rather than incidental hosting. What was not located is any statement on whether medical records, case files, demand drafts or deposition transcripts submitted by firms are used to train or improve CaseAware, how long client content is retained, or whether a firm can require deletion at matter close. GDPR compliance implies data subject rights machinery for personal data, and an injured claimant whose records sit in the platform is a third party to the customer relationship rather than a party to it, which makes the deletion question harder rather than easier. A credential describing how data is protected is not a statement about what it is used for. Checked the product pages, the press page and the site navigation on 29 Aug 2026.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No published position located. Nothing was found on liability for AI output, warranty, service levels or remedy. The exposure is specific and asymmetric: an understated medical bill summation or a missed treatment event flows into a demand and can settle a claim below its value, and the person who bears that loss is the injured claimant, who is not a party to the contract between the firm and the vendor and has no visibility into how the number was produced. The vendor's own answer to this risk is operational, being human verification on high value cases, rather than contractual, and no contractual position is public. Checked the product pages, the demand letter page and the site navigation on 29 Aug 2026.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

The integration story this category actually needs, and the gap that held EvenUp at C is closed here. Named case management systems: Litify, MyCase and CasePeer, which are the platforms plaintiff firms genuinely run on and where intake, treatment tracking, deadlines and the matter file already live. Named research integration: Westlaw Advantage through a strategic partnership with Thomson Reuters, giving generated documents an established legal citation source. Document management platform integration is stated at category level. The vendor's positioning is that the platform connects to a firm's case management, records and intake systems rather than replacing them, which is the correct posture for a firm that has already bought its system of record. Held at B rather than A because depth is undocumented: no statement of what moves in which direction with any named system, no authentication or permission detail, no API or export documentation located, and no indication of whether finished work product returns to the matter file automatically.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The first substantive residency disclosure in this category and one of very few in the pull. The vendor states data centres in the United States, the United Kingdom and Canada, which names three jurisdictions rather than gesturing at global availability, and pairs them with the matching regional health privacy regimes, HIPAA for the US and PHIPA for Canada, alongside GDPR. That combination indicates residency was designed against regulatory requirement rather than mentioned as a feature, and it answers the question a firm's compliance review asks first about a vendor holding claimant medical records. Held at B rather than A because the detail stops at the country list: no hosting provider is named, nothing states whether a customer can select or is guaranteed a region, no single tenant or dedicated instance option is described, and nothing addresses whether processing, backup and model inference all occur in the same jurisdiction as storage, which is where residency commitments usually leak.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Four regimes named, none of them evidenced, and no route to the underlying documents. Stated: SOC 2 Type II certification with HIPAA, PHIPA and GDPR compliance. Naming four distinct regimes including a Canadian provincial health statute is a broader claim than most of this index makes and it aligns with the stated data centre geography, so the set is coherent rather than decorative. Held at B rather than A on the same absences that separate this tier from the top: no auditing firm named, no examination period, scope or certificate date published so currency cannot be established, and no trust centre, security page or self serve documentation request route was located. Under the three tier test the artifact is absent rather than gated. The contrast with EvenUp is the useful calibration point for this category: EvenUp reaches A on a Trust Center with a request route, a dated April 2026 recertification and a stated four criteria SOC 2 scope, and Supio names more regimes while evidencing none of them.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Nothing located. CaseAware AI is named and presented as the vendor's own technology, which is an ownership statement rather than a supply chain disclosure. No foundation model provider is named, nothing states whether third party models sit underneath CaseAware or process any part of the pipeline, and no subprocessor list was located. The Thomson Reuters and Westlaw Advantage integration establishes at least one external data relationship, and the stated three country data centre footprint implies infrastructure providers, and none of those parties is identified. For a platform processing protected health information across three regulatory regimes, the identity of every processor is a question a customer's HIPAA and PHIPA diligence asks directly and it cannot be answered from public material. Checked the product pages, the press page, the company material and the site navigation on 29 Aug 2026.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing published at any level. No price, no range, no unit of charge, and no indication of whether the model is per case, per seat, per page of records processed or per demand produced, which matters because those scale very differently for a plaintiff firm and determine whether the cost is a case expense or firm overhead. Independent review notes the product is sold entirely behind a demo with no published pricing. Every route is a sales conversation. The absence carries the same additional weight noted on EvenUp: contingency fee firms advance case costs and recover them from a claimant's settlement, so undisclosed per case pricing is undisclosed cost to an injured person. Checked the product pages, the pricing navigation and independent review material on 29 Aug 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Deliberately narrow scope, stated honestly, with genuine depth inside it and one dimension beyond the category norm. The vendor is explicit that the platform is built exclusively for plaintiff law and is of no use outside it, and independent review confirms the same. Within scope the coverage runs the full lifecycle rather than a single document: intake, medical chronologies, demand generation, case economics ledgers, litigation drafting, deposition analysis and firm level analytics, which is broader than EvenUp's demand centred product. Mass tort is named alongside personal injury, which is a materially different workload of thousands of claimants against common defendants and is not a given for vendors in this space. Held at B rather than A because coverage is not characterised at the level a buyer checks: no statement of which record types, providers or formats the ingestion handles, no jurisdictional scope for the litigation drafting, and no indication of practice depth in mass tort as distinct from single plaintiff work.