Tavrn

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

Model first from founding, and the most operationally aggressive use of models in this category. The retrieval layer is the distinguishing case: AI voice agents contact medical providers the same day a request is placed and keep calling until records arrive, across thousands of providers in all fifty states, handling fax, email and portal channels. That is a model acting in the world on the firm's behalf rather than analysing documents it was handed, and it is the part of the product a firm cannot replicate without the models. Downstream, page classification and indexing categorise document types, chronology construction is generated, intake scoring extracts facts and classifies injury severity, and demand letters are generated from the structured output of the pipeline. Remove the models and what remains is a fax inbox. Fourth consecutive A on this axis in this category, which confirms the pattern noted from the first record: plaintiff side vendors were built model first because the underlying work was never automatable any other way.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is page level, structurally reinforced by owning the pipeline, and unmeasured. Chronology entries are hyperlinked with navigation back to the specific source page, output is stated to link directly to its source, and Bates stamping gives every page a stable identifier a reader can cite. The architectural argument the vendor makes is a real one and no competitor in this category can make it: because the same platform retrieved the records, classified the pages and built the timeline, the structured data carries into the demand without manual re keying, which removes a documented failure mode where a model drafts from unstructured files and misstates what the records show. Held at B because nothing is quantified: no extraction accuracy, no page classification error rate, no recall on treatment events, no measure of whether retrieval actually obtained the complete file, and no evaluation. One published phrase is noted and not credited, that where doubt is expected proof is embedded, which reads as an uncertainty commitment and specifies nothing. Checked the home page, the MedChrons page, the medical retrieval page and the published blog material on 29 Aug 2026.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Visibility is documented and boundaries are not, which are different things and are treated as such. The vendor publishes real oversight mechanics for the retrieval workflow: complete oversight to create and track requests, real time status tracking on every request, all fax and email inbounds in one place, and real time editing control over generated demand letters. A firm can see what the system is doing at any moment. What is absent is any statement of what it may do unattended. Autonomous voice agents contacting medical providers and persisting until records arrive is outbound action on a firm's behalf to third parties holding a claimant's health information, and nothing published describes what an agent is authorised to say, whether it identifies itself as automated, what happens when a provider disputes a request, or where a human must intervene. Tracking an action after the fact is not a bound on it. Checked the medical retrieval page, the home page, the MedChrons page and the blog material on 29 Aug 2026.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Operational figures are specific and no customer is identifiable. Published: 50 to 70 percent reductions in record review time, average retrieval turnaround cut by 12 days against standard practice, 70 percent faster turnaround than standard retrieval methods, chronologies delivered in under 24 hours, roughly 1,000 retrieval requests handled daily across all fifty states, and intake conversion improved by 35 percent. Throughput claims of that specificity are useful and the daily request volume is the kind of number a vendor cannot easily inflate without being caught by its own customers. Against that: no law firm is named anywhere in located material, and the one return on investment claim, a reported 6x return on platform cost within a single quarter, is published with the parenthetical that the testimonial is on file, which is a claim whose evidence the vendor states exists and declines to show. Held at C on that basis. Same placement as Supio and for the same reason: the operation is described, the customers are not.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

The right instrument for this category is offered, which no prior record on the index has done, and privilege itself is still unaddressed. The vendor states a business associate agreement for HIPAA covered workflows. A BAA is the actual contractual mechanism HIPAA requires between a covered entity and a business associate handling protected health information, and offering one is materially different from stating HIPAA compliance as a posture: it is the document a firm's compliance review asks for and can execute. Alongside it, a SOC 2 Type II attestation, AES 256 bit encryption at rest and TLS 1.2 in transit, which is the first record in this category to name the transit protocol as well as the storage cipher. What is absent is the legal dimension: no treatment of attorney client privilege or work product, and nothing about the confidentiality of the demand strategy and case valuation the platform generates. Graded B alongside EvenUp and Supio, and the note records that this record earns its B on a different and arguably more practical basis than either.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Not located. Two aspects of this product engage the question and neither is addressed. The platform scores incoming cases on a numeric scale with configurable thresholds, which is a machine assessment feeding a decision about whether to accept a client, and nothing published addresses the attorney's role in that determination. Separately, generated demand letters go out under the firm's name to adverse insurers. No statement that output is not legal advice, no positioning on the supervising attorney's duty, and no engagement with any bar guidance was located. Checked the home page, the products pages, the blog material and the site navigation on 29 Aug 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Nothing published about how the models are governed, evaluated or monitored. No AI policy, no model card, no bias or fairness testing, no evaluation methodology, no accuracy monitoring, no drift statement, no named governance body and no ISO 42001. The category risk recurs in its sharpest form on this record: intake scoring assigns a numeric case score with configurable thresholds based on extracted facts and injury severity classification, which is a model deciding which injured people a firm is likely to take on. Any systematic tendency in that scoring falls on prospective claimants who are never told a score existed, and nothing published indicates it has been examined. Fourth consecutive D on this axis in this category. Checked the home page, the products pages, the blog material and the site navigation on 29 Aug 2026.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Protection is specified with unusual technical precision and use is not addressed at all. Published: AES 256 bit encryption for stored data, TLS 1.2 for network communications in transit, a secure upload portal, a SOC 2 Type II attestation and a BAA for HIPAA covered workflows. Naming the transit protocol version alongside the storage cipher is more specific than any other record in this category manages. What was not located is any statement on whether medical records, chronologies, demand drafts or intake data are used to train or improve models, how long content is retained, or whether a firm can require deletion at matter close. The gap is wider here than for peers because this vendor holds records it retrieved itself directly from providers, so it is the original recipient of claimant health information rather than a processor of files a firm already had. Checked the home page, the products pages, the blog material and the site navigation on 29 Aug 2026.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No published position located beyond the BAA, which allocates HIPAA obligations rather than product liability. Nothing was found on liability for AI output, warranty, service levels or remedy. The exposure has a shape unique to this record: the retrieval layer's failure mode is an incomplete file rather than a wrong sentence, and a chronology built on records that were never obtained will look complete and consistent while omitting an entire course of treatment. Nothing published addresses what happens when retrieval misses a provider, and no service level commitment was located for a platform whose value proposition is turnaround time. Checked the home page, the medical retrieval page, the products pages and the site navigation on 29 Aug 2026.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

The strongest integration footprint in this category. Four case management systems named, being Filevine, Litify, Clio and Smokeball, which is more than any plaintiff side peer, and the Smokeball relationship is corroborated by a listing in that vendor's own partner marketplace rather than asserted only by Tavrn. API access is separately offered for connection to systems without a native connector, which is the element independent review identified as missing from a competitor in an adjacent category. Records are stated to be delivered pre organised, named and tagged directly into the case file, which describes the integration doing useful work rather than merely existing. Held at B rather than A because no API documentation was located, nothing states what moves in which direction with any named system, and no authentication, permission or field mapping detail is published. Top of the B band. Checked the products pages, the blog material, the partner marketplace listing and the site navigation on 29 Aug 2026.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Nothing located. No hosting provider is named, no region or data residency commitment is published, and no single tenant or dedicated instance option is described. A passing reference to the broader cloud environment appears in security material without identifying it. For a platform that retrieves claimant medical records directly from providers across all fifty states and holds them, the location and tenancy of that data is a question a firm's HIPAA diligence asks alongside the BAA, and the BAA governs obligations rather than geography. Checked the home page, the products pages, the security material and the site navigation on 29 Aug 2026. Compare Supio at B, which names data centres in three countries.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

A named attestation, the right HIPAA instrument, specific cryptography, and an inconsistency in the vendor's own language that is recorded rather than smoothed over. Published: a SOC 2 Type II attestation, a BAA for HIPAA covered workflows, AES 256 bit encryption at rest and TLS 1.2 in transit. THE INCONSISTENCY: vendor material elsewhere describes the same posture as a security program aligned with SOC 2 criteria and HIPAA compliance standards. Aligned with criteria and holding a Type II attestation are materially different claims, the first being a self assessment and the second an independent examination over a period, and a reader encountering only the weaker formulation would conclude no attestation exists. Under the check the noun rule this is exactly the kind of slippage that matters. The stronger claim is credited because the vendor makes it in its own material, and the inconsistency is named here so a later reader can resolve it against the actual report. Held at B on the standard absences: no auditing firm named, no examination period or date published, and no trust centre or self serve documentation request route located. Correction candidate in both directions.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Nothing located. No foundation model provider, model family or version is named, no subprocessor list was found, and nothing states whether third party models sit underneath any component. The gap is broader than for peers because this product runs more distinct model types: voice agents conducting telephone calls with providers, page classification, chronology generation, intake scoring and document drafting. Voice in particular almost certainly involves a speech provider and none is identified. For a platform operating under a BAA, every subprocessor touching protected health information is a party the covered entity is entitled to know about, and none can be identified from public material. Checked the home page, the products pages, the blog material and the site navigation on 29 Aug 2026.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No price published at any level, with one genuine differentiator that does not reach the bar. A free trial is offered, which is the only self serve entry point in this category and is materially better than the universal demand a demo pattern of its peers, since a firm can evaluate the product without a sales conversation. But a trial discloses the product, not the price. No figure, range, tier structure or unit of charge is published, and nothing states whether pricing runs per record page, per retrieval request, per chronology, per demand or per seat, which for a retrieval driven product are wildly different economics. Independent material describes the target as contingency fee practices requiring predictable costs, which implies a predictable model without disclosing it. The contingency fee point applies as it does across this category: undisclosed per case cost is undisclosed cost to an injured claimant. Checked the home page, the products pages, the pricing navigation and independent review material on 29 Aug 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The broadest practice coverage in this category and the most concrete operational reach. Practice areas named: personal injury, medical malpractice, workers compensation, SSDI and general liability, which is wider than the personal injury and mass tort focus of the peers built so far and reaches into disability and comp work with different record profiles. Operational coverage is stated numerically: thousands of providers nationwide, all fifty states, roughly 1,000 retrieval requests handled daily, with fax, email and portal channels supported, which for a retrieval product is the coverage question that matters since a provider the platform cannot reach is a record the firm chases by hand. Independent material identifies the firm size target as roughly 10 to 75 professionals. Held at B rather than A because the reach is asserted rather than characterised: no provider network is enumerated or described, no success rate on retrieval requests is published, and nothing indicates whether coverage is even across states or concentrated where the largest provider systems sit.