T

Turivius

The models are the engine of a core capability layered on a product that functions without them, which is the B band, and this vendor draws the line itself more clearly than most because it sells the two halves as separate environments. Turivius Clássica is the established product covering jurisprudence search, jurimetrics and knowledge management over a corpus the company reports at more than 130 million decisions from over 100 Brazilian courts.

GPTuri+ is the AI environment, launched in 2025, with its own login and its own subdomain, and the company states plainly that the two accesses are independent and that a user signs in to whichever environment they hold. So a buyer can hold the platform without holding the AI, which settles the axis. What sits on the AI side is substantial and named: a generative assistant that builds the search from a natural-language or spoken description of the case rather than requiring Boolean syntax, reads uploaded contracts and pleadings and answers against them with the exact source passage, produces finished work product including opinions, comparative tables, risk maps and draft pleading structures, and runs a Jurimetria Agent that takes a legal thesis, analyses up to 500 selected decisions and returns tables, trend charts, divergences between courts and outcome predictions.

The company describes that agent as the first of its kind in Brazil. What keeps it off A is the A band's own test: remove the models and the corpus, the search, the collections and the jurimetric analytics remain, and those are what the company sold for the six years before GPTuri shipped. Verified 13 September 2026.

Grounding is real and documented with linked primary sources and a described retrieval method, and no measured accuracy is published, which is the B band. The grounding is the product's central claim and it is specific rather than atmospheric: every answer is built on the platform's own corpus of Brazilian decisions, each analysis cites the decision it rests on, source traceability is named as a feature, and the vendor's own formulation is that the user verifies before using.

For uploaded documents the answer carries an exact reference to the passage it came from. The retrieval method is described in outline: the assistant identifies the legal elements in a natural-language description and assembles the search itself, and the vendor contrasts this with general-purpose assistants in a published comparison table covering whether the tool works from real case law, whether the full text is reachable and whether sources are traceable.

What is absent is measurement. No accuracy figure, error rate, test set or evaluation of GPTuri is published, and the one quantified claim on the estate, up to 70 per cent time saved in analysis, measures effort rather than correctness. Two disclosures cut against the product and are recorded because they are the vendor's own and a buyer should see them: the terms state that Turivius exercises no editorial control over the database, limiting itself to organising and reproducing publicly accessible data without warranty as to quality or content; and the terms state that reports, charts and decision classifications are generated automatically, may contain errors, are not exact predictions and are to be used solely as a non-exhaustive guide. Verified 13 September 2026.

A written commitment that the models work alongside a supervising lawyer with real review surfaces, short of the full control structure, which is the B band. The commitment is explicit and appears in the product's own framing rather than in a disclaimer: the assistant delivers material ready for the user to review and finalise, the vendor's formulation being that you direct, it prepares, you finalise. The review surfaces behind that are real.

Each analysis cites the decision it rests on and the user is told to verify before using; answers about uploaded documents carry the exact source passage; the full text of every cited decision is reachable inside the platform; and the vendor publishes guidance of its own on validating a legal AI whose stated aim is answers that can be checked rather than answers requiring blind trust. Mode selection is also published, the user choosing GPT, Claude or Gemini per task.

What the A band asks for is missing: no threshold at which the system stops or escalates, no confidence signal, no statement of what happens after the system is wrong, and nothing describing what the Jurimetria Agent does when the evidence is thin across the up-to-500 decisions it processes. R124(2) was applied to the one candidate constraint and it does not qualify. The terms state that automatically generated reports may contain errors, are not exact predictions and must be used only as a non-exhaustive guide, which reads as the tier-and-boundary shape until the dates are checked: those terms are dated 21 September 2020 and the constraint attaches to the jurimetrics reporting that existed then, not to the generative assistant launched in 2025.

What GPTuri itself publishes is a general assurance of human review, which R124(2) holds is not enough. Verified 13 September 2026.

Real deployment evidence with substance, short of joining the names to the figures, which is the B band in its own words. The naming is the strongest in this lane and it is specific. A client wall carries Deloitte, Nestlé, Gerdau, Suzano, BASF, Unimed, BTG Pactual and the law firms Tozzini Freire and Machado Meyer. Ten named case studies are published, each with its own page, covering Nestlé, Cosan and Suzano on the corporate side and Velloza, Bichara, KLA, FNCA, Bergamini, Benvenutti and GDM Consultoria Jurídica on the firm side.

Testimonials are attributed to a named individual at a named firm rather than to a role, which under R122(2) is what makes a testimonial evidence: Julia Moreira at Tortoro, Madureira & Ragazzi, Sávio Andrade at Machado Meyer, and Walter Cesar Vasconcelos at Laerte Fonseca & Advogados Associados. Third-party validation of a kind is published too, the company having won Nestlé's global innovation prize in 2022 for a project integrating jurimetrics and AI, which is notable because Nestlé is also a named customer.

What holds it off A is that the figures and the names never meet. The only outcome figure published is up to 70 per cent time saved in analysis, which is unattributed, undated and carries no method, and the reach counters on the site render as zeroes to this index because they animate client-side. The ten case study pages were not opened; under R25 they corroborate a grade that already stands on the client wall and the attributed testimonials, and they are precisely what would move this row to A if any of them joins a named client to a measured result with a stated basis. Verified 13 September 2026.

Confidentiality is asserted in general terms while the specific commitments a legal buyer needs are either absent or run the other way, which is the C band. The general assertion exists: the privacy policy states that all data about the user is treated as confidential, that only authorised personnel with a need may reach it, that access to the servers is through previously authorised channels with access records kept internally, that stored information is encrypted and passwords are hashed.

That is a security posture rather than a confidentiality posture for client material, and the distinction matters on a product that invites lawyers to upload contracts, pleadings and case files. On the limbs the A band names, the record is weak and in one place adverse. Training use is permitted rather than excluded, the policy listing among its authorised purposes the use of user data in artificial intelligence models to personalise the platform, analyse use and improve services, and separately reserving the right to anonymise data submitted to the platform and use and share it in aggregate for other reasonable commercial purposes.

Segregation is not documented: the policy states that where the platform is contracted by a firm or company the employer may access the user's profile data and colleagues may see name, photograph and email, and nothing describes walls between matters, clients or users, though Projects organise material by case or client. Retention is stated only as access logs for six months and otherwise for as long as necessary. On third-party model providers the position is unstated: GPT, Claude and Gemini are named as selectable models but nothing says what any of them may retain of a prompt or an uploaded document. Privilege and professional secrecy are not addressed anywhere. Verified 13 September 2026.

A real published position on advice versus tooling, short of the supervision and competence dimension, which is the B band and the common shape it names. The position is published in the terms and is more substantive than a boilerplate disclaimer. Reports, charts, decision classifications and statistical outputs are stated to be generated automatically, to be capable of containing errors, not to be exact predictions, and to be used solely as a non-exhaustive guide to jurisdictional activity.

The product framing repeats it: material is delivered for the user to review and finalise. The terms also impose a purpose limitation on the user that is unusual in this corpus and is professional-responsibility material in substance: the database and platform outputs may be used only for conducting and analysing legal proceedings, and expressly not for marketing, campaign targeting, profiling individuals, candidate selection, transferring data to third parties or business intelligence, nor for anything incompatible with the purpose for which the underlying public data was released or that would invade the privacy of the people named in it or discriminate against them.

Editorially the vendor goes further than most, publishing analyses of Brazilian courts sanctioning lawyers for fabricated citations and a guide to validating a legal AI, and connecting its own product to the verification duty those cases create. What is absent is the A band's core: no statement of who may use the product, no supervision or competence dimension, no jurisdiction limit stated though the corpus is wholly Brazilian, and no rule of professional conduct engaged. Verified 13 September 2026.

A published governance framework with real substance, short of testing results or a named owner, which is the B band, and R36 is the ruling that puts it there: ISO 42001 is an AI management system standard and its presence alone earns B, as it did for Ontra. The About page carries an ISO 42001 mark alongside ISO 27001 and ISO 27701 and a DPO as a Service arrangement, under a heading stating commitment to the highest standards of security, privacy and artificial intelligence governance.

The limit is real and is named rather than glossed, because it is what a buyer would want to test: the mark is presented as a badge with no scope statement, no certificate number, no certifying body, no issue or expiry date and no report available, so what is established from the vendor's own surfaces is the claim to the standard rather than a verifiable audited framework. Nothing else on the estate supplies the substance a certification would imply.

No responsible AI or ethics page exists, no AI policy or acceptable use position, no accountable owner for model behaviour is named, and the DPO as a Service arrangement is a data protection function rather than an AI governance one. No testing regime is described and no evaluation result is disclosed. Bias is not addressed anywhere, which is worth naming on this product specifically: the Jurimetria Agent produces outcome predictions and success rates by court and by rapporteur, and nothing published would let a buyer test whether those predictions are even across courts, regions or parties. Verified 13 September 2026.

Substantive published policy covering most of the ground, missing a stated incident practice, which is the B band and one of the two gaps it names. Retention is addressed with one specific figure and one general rule: site access records, meaning IP with date and time, are kept for six months, and everything else is kept only while necessary or relevant to the stated purposes or where law or a legitimate interest requires.

Deletion is addressed as a right, with data removed from the servers on request or when no longer necessary, subject to legal retention. Access control is described: only authorised personnel with a need may reach the data, server access runs through previously authorised channels, and records of those accesses are kept internally, with encryption at rest, hashed passwords and TLS in transit. Subprocessors are named rather than described by category, which is more than most records manage: Amazon AWS for hosting, Mixpanel, Hotjar, Google Analytics and PostHog for product analytics, and Mercado Pago, Stone, Pagar.me and PagSeguro for payments.

What is missing is incident practice. No breach notification commitment to customers was located, no notification window, no incident response description and nothing stating what a subscriber would be told or when. Two provisions are recorded because a buyer should weigh them here as well as on the confidentiality row: the policy permits use of user data in AI models to personalise and improve the service, and reserves anonymised aggregate data for other reasonable commercial purposes. Verified 13 September 2026.

A real published position on liability, short of the full picture, which is the B band. What lifts this above a standard disclaimer is a warranty the vendor gives about the thing a Brazilian legal buyer would actually worry about. The terms record that to make the platform available Turivius had to collect, store and process a large body of publicly available data including judgments and other decisions, related data and legal doctrine, which may contain personal data, and that Turivius assumes full and exclusive responsibility for the legality of that database and its use, and for questions of title, originality and any breach of third-party secrecy, intellectual property or image rights, expressly relieving the user of responsibility in those situations.

That is a scoped vendor warranty with a hold-harmless attached, on the exposure the product creates by supplying scraped court data. Against it the exclusions are sweeping. Turivius, its controller, affiliates, partners and employees are stated not to be liable in any circumstance for direct or indirect damage from use of the jurimetric outputs, including outcomes that diverge from the platform's predictions, nor for direct or indirect damage, material or moral, including lost profit or revenue, arising from use of or inability to use the platform.

What the A band asks for and is not published: no liability cap of any kind is stated, no service level, no insurance, and no warranty at all attaches to the AI output as distinct from the database. Verified 13 September 2026.

No integration into the systems legal work already lives in was located, which is the D band. The page inventory was taken from the navigation and footer under R20 and there is no integrations page, no developer or API documentation, no connector catalogue and no authentication model anywhere on the estate. Not one practice management system, document management system, billing platform or CRM used by Brazilian firms is named as supported, so a buyer cannot establish whether the platform connects to anything it already runs.

The product is designed as a destination rather than a layer, and the features that might look like integration on a quick read are internal and are recorded here so they are not mistaken for it: Projects hold files and saved decisions inside the platform, documents are uploaded to the platform rather than synchronised from elsewhere, and the web search complement pulls legislation and doctrine into the platform's own context rather than pushing anything out.

The one outbound provision located is contractual rather than technical: the terms permit the user to present platform-generated reports to third parties, individually and without altering their format. Nothing describes exporting structured data, and the terms separately prohibit running any program to scrape or index the platform, which forecloses the route a firm might otherwise take. Verified 13 September 2026.

Cloud delivery with an express residency commitment and no tenancy model described, which under R38 is B because tenancy and region are co-equal limbs and publishing either clears C. Residency is stated on the home page as one of three named security commitments: data storage exclusively in Brazil, with the information remaining in national territory on trusted infrastructure. Alongside it the vendor publishes full LGPD compliance and encrypted traffic over HTTPS, SSL and TLS.

The privacy policy identifies the hosting arrangement, stating that all data provided is stored on servers external both to the user's employer and to Turivius, for example on Amazon AWS, and directing the reader to that provider's own policy. What is not described is tenancy. Nothing states whether a firm's uploaded documents and saved collections sit in a shared or isolated environment, no separation model is published, and there is no on-premises or private deployment option offered or refused.

One tension is named rather than smoothed, because a buyer evaluating the residency claim needs it: the storage commitment is written about storage, and the AI environment sends the user's prompts and uploaded documents to GPT, Claude or Gemini, none of which is a Brazilian service. Nothing on the estate reconciles the two, states where inference runs, or says whether anything leaves the country in the course of generating an answer. Verified 13 September 2026.

Badges appear on the site with no scope, no date and no report available, which is the C band word for word. The About page carries marks for ISO 27001, ISO 27701 and ISO 42001, together with a DPO as a Service arrangement, under a heading stating commitment to the highest standards of security, privacy and artificial intelligence governance. That set is a serious one, covering information security, privacy information management and AI management, and the AI standard in particular is held by very few vendors in this corpus.

What cannot be established from the vendor's own surfaces is anything behind the marks. No certificate number, no certification body, no issue or expiry date, no statement of the certified scope, no surveillance audit record and no report obtainable by any route, gated or otherwise. There is no trust centre, no security page and no compliance page anywhere in the navigation or the footer. The heading's own wording is commitment to standards rather than certification against them, which leaves a buyer unable to tell whether the marks record completed audits or an alignment programme.

What is published in place of evidence is a short set of assertions on the home page, being LGPD compliance, storage exclusively in Brazil and encrypted traffic, and a longer description of controls in the privacy policy covering authorised access, internal access logging, encryption at rest and hashed passwords. Those are the vendor's own statements, not independent attestation. Verified 13 September 2026.

The supply chain is partly disclosed, providers named without change notification, which is the B band exactly as written. The naming is unusually direct and it is a purchasable feature rather than a compliance footnote: GPTuri offers GPT, Claude and Gemini in one interface and the buyer selects which runs each task, with the vendor publishing a short characterisation of each, versatility and speed for everyday analysis and synthesis, deep reasoning for complex analysis, long contracts and strategic argument, and extended context across multiple documents.

All three are stated to read the same corpus of more than 130 million decisions. So a buyer learns which model families process its work and can choose between them, which is more control than any other record in this pull offers. Hosting is identified separately in the privacy policy, which names Amazon AWS as the external server platform. What the A band requires and is not published: no model version is named for any of the three, so a buyer cannot establish which release is running or when it changes; the provider entities behind the product names are never written out; nothing states where inference runs, which matters against the home page's commitment to store data exclusively in Brazil; nothing states what any model provider may retain of a prompt or an uploaded document; and no commitment to notify customers of a change to any of it was located. Verified 13 September 2026.

Pricing is gated behind a demo request while the tier names and the feature split are published, so the shape is visible and the number is not, which is the C band word for word. The shape is genuinely visible. Two environments are named and differentiated on the vendor's own surfaces, Turivius Clássica covering jurisprudence, jurimetrics and knowledge management and GPTuri+ covering advanced legal AI for research, documents and jurimetrics, sold as independent accesses with separate logins, and the feature content of each is described at length across dedicated pages.

The unit and the commercial mechanics are published in the terms, which is more than the C band assumes: the subscription is monthly, renewing automatically every thirty days, the licence is personal and non-transferable with password sharing prohibited and grounds for suspension, cancellation may be made at any time and takes effect at the end of the paid month with no refund for the unused remainder, and the vendor reserves the right to change the price at any time while guaranteeing the rate in force on the first day of the current billing month.

What is absent is any figure. The terms direct the reader to the site or to email for prices; the site's every purchase path, including the button labelled create an account, resolves to a single page headed schedule your demonstration, which is a booking form carrying client logos and no rate card. No entry price, no band, no per-seat rate and no minimum is published at any level, and enterprise arrangements are contracted separately under the terms' own carve-out. Verified 13 September 2026.

Segment coverage is described with substance and the boundaries are left open, which is the B band. The two buyer segments are addressed separately and in their own terms rather than as a single audience. For law firms the published propositions are faster research, more relevant results, centralised organisation of theses and collections, and quicker delivery to clients. For in-house legal departments they are more reliable data, clearer reporting that translates legal complexity for the business, less operational work in favour of strategy, and faster internal responses to other functions.

The named customer base evidences both halves, running from Deloitte, Tozzini Freire and Machado Meyer on the firm side to Nestlé, Gerdau, Suzano, BASF, Unimed and BTG Pactual in-house. Jurisdictional coverage is stated with a figure, more than 100 courts across Brazil and more than 130 million decisions, updated daily, and the company describes jurimetrics as covering the principal areas of law. What is left open is everything the A band asks for at the edges.

No practice area is named as supported or unsupported, and the claim to cover the principal areas of law is exactly the unevidenced breadth claim the band below is written for, saved from it by the court and volume figures that are specific. Nothing states which courts or which years the corpus reaches, whether coverage differs between the two environments, or whether the Jurimetria Agent works across the whole corpus. Jurisdiction is Brazil throughout and is never stated as a limit. Verified 13 September 2026.