T
Theta Lake
Theta Lake captures, archives and supervises the communications regulated firms run on, across voice, video, chat, mobile messaging, email and whiteboards, through more than 100 integrations including Microsoft Teams, Zoom, Webex, Slack and Symphony. Its machine learning flags compliance, conduct and data protection risks in what is shared, shown, spoken and typed. Legal teams use it for legal hold, preservation and eDiscovery, including through a Relativity integration, and the archive supports SEC 17a-4 retention with customer set rules and a choice of storage region.
A separate module governs employees' use of AI assistants such as Microsoft Copilot, Claude and OpenAI tools, detecting prompt injection, jailbreaks and shadow AI.
Theta Lake, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Alternatives to Theta Lake
Vendors in the same categories as Theta Lake whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
- BBriefCatchBriefCatch is legal writing and citation checking software for lawyers, judges and courts, used in Microsoft Word, Outlook or a browser.
- EEpiq AIEpiq AI is the AI product line of Epiq Systems, Inc., a New York legal services and technology company whose other businesses include class action and bankruptcy administration, managed…
- LLighthouseLighthouse is an eDiscovery, review and information governance company founded in 1995 as a Seattle document copy shop.
- OOpenText eDiscoveryOpenText eDiscovery is an electronic discovery platform covering collection, processing, analysis, review and production, sold to corporate legal departments, law firms and investigating…
- TThreadeoThreadeo sells cloud software to court reporting and litigation support firms and to the lawyers they serve.
- VVerbitVerbit is a transcription and captioning platform whose legal line records depositions, hearings, trials, arbitrations and witness interviews.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Without the models, a capture, archive, search and legal hold platform remains. Capture and archiving run across more than 100 certified API integrations, and the SEC 17a-4 archive, eDiscovery export and legal hold workflow all work without a model. Proactive Compliance is where models drive a core feature: patented machine learning and language processing detect risk in what is shared, shown, spoken and typed, using more than 80 built in and custom policies, plus classifiers for prompt injection, jailbreaks, shadow AI and steered summaries. Theta Lake's AI governance page (modified 14 July 2026) presents this as a detection layer over the capture platform.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Legal authority is not cited. Every detection links to the captured interaction it came from, with investigation, timeline, replay and add to case views, so a reviewer opens the source rather than a summary. Proactive Compliance includes audit and explainability reporting for its ML and AI. Clause 10(d) of the MSA, updated 12 March 2026, states that output is machine generated, carries no warranty of accuracy or reliability, may differ between runs, and must be evaluated by the customer, including by human review. No detection accuracy, recall or precision figure and no test set is published.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Theta Lake documents review tools: multi party review workflows routed by detection, investigation and timeline views, role based access on private links, two way alert links to SIEM and SOC tools, and customer set compound detection rules. It also states that the system acts on its own in places: risk remediation and prevention, automatic legal hold on AI summaries for custodians in matters, real time notices and disclaimers inserted into Teams chats, and retention rules deciding what is not kept.
No threshold is published at which any of that runs without a reviewer. MSA clause 10(d) leaves evaluating output to the customer.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
A customer is named with a role and a use, the Head of Technology at Longview Partners, on MiFID II compliance for Microsoft Teams, quoted on the Theta Lake site. No figures come with it. Analyst recognition includes Furthest in Vision in the 2025 Gartner Magic Quadrant for Digital Communications Governance and Archiving and first in five of six use cases in the companion Critical Capabilities report, which rate the product rather than a customer deployment. Theta Lake also publishes a case studies library.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
MSA section 1(d) makes Customer Data, Reports and Output the customer's confidential information. Section 5(a) limits Theta Lake's use of Customer Data to providing the service, producing output and reports, and creating usage and anonymized data, for the subscription only. The DPA's US schedule bars retaining, using, selling or sharing personal data except to provide the services on instructions, or combining it with other data.
DPA section 8 commits to deletion or return on request, retention is customer set, and MSA section 8(c) requires notice before compelled disclosure. Both documents are published and readable before signing; the MSA was updated 12 March 2026 and the DPA 2 July 2025. Privilege and work product are not addressed, and nothing says what any third party model provider may keep.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
MSA clause 10(d) says output is machine generated, may contain errors or be incomplete, does not represent Theta Lake's views, and is the customer's responsibility to evaluate, including by human review. Users are Authorized Users named in an order form, for internal business use. Real Time Advisor shows the customer's own policies, training links and disclaimers rather than legal conclusions. Nothing addresses a supervising lawyer's competence and supervision duties, and no jurisdiction limits are stated for a product sold in the US, UK and EU. The product has no public facing advice surface.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Theta Lake holds ISO/IEC 42001:2023 certification, an independently audited AI management standard, and lists the CSA AI Trustworthy Pledge 2025 on its trust center. It describes its classifiers as certified, safe and transparent. No accountable owner or testing before release is published, and nothing covers uneven output across content types, languages or groups, though missed detections are themselves compliance failures.
The AI governance page claims CSA STAR for AI Level 2, while Theta Lake's trust center lists CSA STAR Level 1. A How We Use AI document sits behind an access request on the trust center.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention is set by the customer, including no retention, per the DPA and privacy policy. DPA section 8 covers deletion, with certification on request, and customers can export to their own S3, Azure Blob or O365 storage under MSA section 4(b). Access control includes encryption in transit and at rest, customer specific keys that can be held in the customer's AWS or Azure key service, SAML single sign on, role based access and two factor authentication.
DPA section 4(b) commits to breach notice without undue delay, with details, mitigation and recommended steps. The DPA requires a Subprocessor Site giving each subprocessor's name, location and activities, with notice of changes, an objection right and termination if unresolved.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
MSA section 11(a) defends and indemnifies against third party patent, trademark and copyright claims, with named carve outs and a repair, replace or refund choice as the sole remedy for IP claims. Section 12 caps liability at twelve months of fees, with gross negligence, recklessness, intentional misconduct and IP violation uncapped. Exhibit A warrants 99.999% availability with service credits at three thresholds and a claim procedure.
Clause 10(d) disclaims any warranty on the accuracy, completeness or reliability of machine generated output, no output indemnity is offered, and no insurance is named.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
More than 100 API capture integrations, built in house and certified by the platforms, each have a page: Microsoft Teams, Zoom, Webex, RingCentral, Slack, Symphony, Verizon, Asana, Mural, CrowdStrike Falcon SIEM and more, across communications, contact center, whiteboards, content, mobile, email, voice, storage, social and financial messaging. Depth is described: what is captured per channel, two way SIEM and SOC alerts, an open developer platform for workflows and data extraction, export to the customer's S3, Azure Blob or O365, and a Relativity integration for eDiscovery and legal hold. Relativity is the only legal system integrated, and no document or practice management connection is published.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Dedicated server environments on AWS and Azure are described on Theta Lake's security page. The AI governance page says customers can set retention rules deciding which records to keep, for how long and in which region, and can store in any and multiple locations to meet data sovereignty rules. Its trust center lists AWS and Azure separately. The list of available regions, what changes by tier, and where processing happens as distinct from storage are not published.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A SafeBase trust center at trust.thetalake.com is reachable without a sales call, though not linked from the main Theta Lake site. It names SOC 2, PCI DSS, SEC Rule 17a-4, ISO/IEC 42001:2023, ISO/IEC 27001, TruSight, CSA STAR Level 1, the CSA AI Trustworthy Pledge 2025, GDPR, CCPA, CPRA and PIPEDA, and lists the documents behind them, including the SOC 2 report, ISO 42001 certificate, PCI DSS attestation, penetration test report and subprocessor list.
The privacy policy says SOC 2 Type II and PCI DSS audits are annual, and the MSA makes the latest audit report available to customers. The reports sit behind an access request of unstated type, and no scope, date or auditor is shown openly. Two claims conflict: CSA STAR Level 1 against STAR for AI Level 2, and ISO 27001 listed against controls described as aligned with it.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The detection stack is described as patented, in house machine learning and language processing with built in classifiers and compound rules, with no model or provider named. The AI vendors on its integrations page, such as Anthropic, OpenAI, Microsoft Copilot and Zoom AI Companion, are what it governs, not its suppliers. Customers can bring their own classification tools and models. A How We Use AI document is on the trust center behind an access request.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Part of the price appears on an AWS Marketplace listing, where Theta Lake is the seller and writes the content. Two annual platform tiers are listed: SMB, up to 999 users, at $15,000 for twelve months, and Enterprise, 1,000 users or more, at $50,000. The platform is charged per app integration, and both tiers also need a per user per year content charge by type (video, voice, chat). That per user rate, the part that grows with the organization, is not published, and nothing covers implementation.
Fees are non cancellable and non refundable except as law requires. The thetalake.com site has no pricing page; every route is a demo request. RingCentral MVP customers get archiving and eDiscovery features through that reseller.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Theta Lake's industry pages cover financial services, state and local government, healthcare and telemedicine, education, and manufacturing and technology. Buyers are named as security and governance, compliance, retention and technology, and legal and eDiscovery teams, with specific promises on preservation, evidence sets and productions. Regulation pages cover SEC 17a-4, CFTC 1.31, MiFID II, GDPR, HIPAA and CCPA. It is bought by an enterprise compliance and legal function, not a law firm practice group. No jurisdiction or platform limits are stated, and nothing says what it does not support.
5 public documents
The public pages on file for Theta Lake, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Prompt and Output Retention, Billing and Fee Posture, Court Disclosure Support
Read Sep 12, 2026
-
Ethical Walls and Matter Segregation, Third Party Request and Subpoena Notice, Outside Counsel Guideline Readiness
Read Sep 12, 2026
-
Primary Law Corpus Provenance, Good Law Verification
Read Sep 12, 2026
-
Client Data in Training, Refusal and Uncertainty Behavior
Read Sep 12, 2026
-
Bar Guidance Alignment
Read Sep 12, 2026
From $15,000 per year
- These figures are the AWS Marketplace price, published by Theta Lake as the seller on that marketplace; buying direct from the vendor may cost something different.
- Theta Lake charges an annual platform fee plus a charge for every person whose messages it watches.
- The platform fee is $15,000 a year for up to 999 people, or $50,000 a year for 1,000 or more.
- The charge per person depends on whether you keep chat, voice or video, and that number is not published anywhere.
- Nothing about price appears on the company's own website, and once you sign up the fees cannot be canceled or refunded.
Two annual platform tiers are published on Theta Lake's AWS Marketplace listing, where it is the seller: SMB, up to 999 monitored users, at $15,000 for twelve months, and Enterprise, 1,000 users or more, at $50,000. The platform is charged per app integration. Both tiers also require a per user per year content charge by type (video, voice, chat), which is not published, so the figure is a platform floor rather than a total.
A user is a person whose communications are captured, and the same count sets the tier and the per user charge. Crossing 999 users moves a customer to Enterprise, not automatically. Fees are non cancellable and non refundable except as law requires. thetalake.com shows no price, and every route is a demo request. RingCentral MVP customers get archiving and eDiscovery features through that reseller.
Confidentiality and data terms: The Data Processing Addendum is published in full on the vendor's support portal and is accepted by conduct rather than negotiated; it incorporates the EU Standard Contractual Clauses and, for UK transfers, the IDTA or UK Addendum. HIPAA controls are stated as implemented and mapped through the annual SOC 2 Type II audit. No business associate agreement is published.
Note: Figures are from Theta Lake's AWS Marketplace listing, which Theta Lake writes as seller, with its own EULA and refund policy, so it is the vendor's own publication rather than a third party directory. No pricing page exists on thetalake.com. The per user per year content charge, required on both tiers, is not published.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The customer agreement or data processing addendum contractually limits use of Customer Data to providing the contracted service, and no surface names training either way. The limit is bound, which a policy page is not, but it is not an express training prohibition. If any surface names training in either direction, one of the other values is true and this one is not.
The MSA (updated 12 March 2026) limits Theta Lake's use of Customer Data to providing the service, producing output and reports, and creating usage and anonymized data, under a license for the subscription only. The DPA's US schedule bars use of personal data except to provide the services on instructions. Nothing names training either way: not the MSA, the DPA (2 July 2025), the privacy policy (updated 8 January 2026) or any product page.
Two qualifiers: anonymized data, stripped of identifiers and aggregated, may be used to improve the service, and customers can opt out by emailing the legal address; and usage telemetry is also used to improve the service. Neither names models or training.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The customer sets the retention window and no retention is an available setting.
Retention is set by the customer, and no retention is an option. The AI governance page says customers choose which records to keep, for how long and in what region, and what not to keep, with WORM storage and 17a-4 attestation options. The privacy policy says customers control retention and can apply several periods, and the DPA records retention defined by the customer. DPA section 8 commits to deletion. What is retained is captured communications, AI interaction records and reports. Theta Lake also keeps backups for business continuity and disaster recovery.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
Theta Lake runs its own permission model rather than applying a document system's access rules at query time. It documents role based access, including on private investigation links, group and role based notices, SAML single sign on to the customer's identity provider, two factor authentication, and DPA measures for user identification and authorization. Its trust center lists access control and logging entries behind a request.
No ethical wall, conflicts check or matter level boundary is published; legal hold cases are a workflow, not an access boundary, so walls depend on how a firm sets roles.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Both documents commit to notice, and no transparency report is published. MSA section 8(c) allows disclosure of confidential information when law or a court subpoena requires it, only after written notice so the other party can contest, limit or seek a protective order, and only the required portion, treated confidentially. Customer Data, Reports and Output are the customer's confidential information. DPA section 6(b) commits to notify the customer of a binding public authority order for personal data unless prohibited, and the SCC schedule directs notice to the customer rather than data subjects. No request figures are published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
Answers come from the customer's own captured communications, not from case law or statute, so no legal corpus is used or licensed. In its place is a library of more than 80 built in and custom detection policies mapped to named rules, including SEC 17a-4, CFTC 1.31, MiFID II, GDPR and HIPAA, each with its own page.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
The product does not cite legal authority, so no published material addresses checking later history, and none would be expected of it. Detections reference the customer's own captured content and the vendor's policy library rather than decided cases.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
Nothing published describes what the system does when it cannot ground an answer. MSA clause 10(d) says output may contain errors, be incomplete or differ between uses, and must be evaluated by the customer, which assigns responsibility rather than describing behavior. Detections appear as prioritized alerts in a review workflow, and no confidence or grounding score is published.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
The AI Hallucination Cases database maintained by Damien Charlotin records no case naming Theta Lake or Theta Lake, Inc., and no court order, opinion or disciplinary record naming the product or the company appears in other published trackers of AI hallucination decisions. This is a statement about the public record rather than a finding about the product. The product does not generate legal citations, which is the conduct those records address.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No public material engages with bar or ethics guidance. Theta Lake publishes widely on regulatory obligation, with a page each for SEC, CFTC, MiFID II, GDPR, HIPAA and state privacy law, and an Ethics Policy is named on its trust center behind an access request. A corporate ethics policy is not engagement with the professional responsibility guidance a lawyer is bound by, and nothing published addresses ABA Formal Opinion 512 or any state bar opinion on generative AI.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
Theta Lake does not touch a lawyer's fee to a client. It is bought by a company's compliance, security or in house legal function to supervise and archive its own communications, and no client is billed for its detection work. Its savings claims, such as fewer alerts, lower investigation and review cost, and less over retention, concern the buyer's own costs.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
A subprocessor list is published and maintained by contract; model providers are not named. DPA section 7 and Annex III put the list at a named URL on the support portal, with each subprocessor's name, location and activities, notice of changes, and an objection right with termination as remedy. The trust center has a subprocessor entry behind a request, and the published DPA can be forwarded to clients. No statement of which model providers see customer content is published; a How We Use AI document sits behind the same request.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Theta Lake captures AI interactions, identifying the assistant used with prompts and responses, puts them on a timeline, applies legal hold automatically for custodians in a matter, keeps review actions and policy notices in an audit history, produces conversation audit reports, and exports to the customer's storage. It does not produce a certification for each document tying a model, sources and a human reviewer to a filing, because it records communications rather than brief drafting, so a firm would assemble any certification itself from that material.