V

Vulcan Technologies

The AI is the product. Justinian is sold as an agent that plans a research path, reads a knowledge graph of American law and policy, follows citations forward and backward, and drafts the memo, redline, comment response or cite check report, running as many parallel copies as a task needs, one per state for a 50 state survey. The source collection underneath has value of its own, but the vendor does not sell it as a search database; every surface presents it as what the agent reads.

The September 2026 release adds a built in office suite in which the agent fills spreadsheets and drafts documents and slides alongside the user.

Grounding is real and described, and accuracy has not been measured in public. The vendor says every claim is tied to the source passages Justinian read and that the agent follows the citation graph rather than treating authorities as isolated search hits. Release notes describe vector search tuned for legal text across all corpora, and exported documents carry clickable links from each regulation to its enabling statute, so a reader can open the authority behind a statement.

What is missing is measurement. No accuracy figure, error rate, test set or independent evaluation is published, and nothing names the failure modes a reviewer should watch for, which matters for a product whose output is drafted rule text and memos that a principal or a court will read.

A real control structure is described, without saying what the agent does on its own. Each agent run is tied to the user, workspace and task that authorized it, and tool access is scoped to the matter or agency environment and the class of action. High impact actions such as a filing, an outbound message, a decision or a record update can stop for human review, and elsewhere the vendor says humans approve sensitive actions.

Nothing says which actions always stop for approval and which only can. The agent also builds and deploys applications and runs recurring briefings inside the customer's environment, with no review step described.

Named deployments come in quantity, with no measured outcome that belongs to the product. The public deployment list names the EPA Office of Inspector General, statewide deployments across 20 Louisiana and 16 Arkansas departments and offices, and state offices such as the Virginia Office of Regulatory Management and the North Carolina General Assembly. The Virginia work is documented outside the vendor: a July 2025 executive order directed agencies to respond to AI generated analysis of their regulations, and trade press reported a three month pilot with Vulcan that summer.

The 26.8 percent reduction in Virginia's regulatory requirements often reported alongside that pilot was achieved before it began, and a later case study says the pilot's results are hard to separate from the wider effort. No law firm or corporate legal customer is named.

Substantive commitments are published, on policy pages rather than in any agreement. The security page puts each deployment in its own boundary, says customer data is never commingled across tenants, and states that privileged matter material, citizen records and government material still under deliberation never leave the boundary. With no agreement published, none of this is yet a contract term. For the commercial deployment a law firm would buy, nothing names the model provider or says what it may retain.

Nothing published addresses the advice line. No terms of service or usage policy exists on the site, and no page says the product is not legal advice, who may use it, or that a lawyer must review what it produces. The vendor's pages describe Justinian as advising on law and policy and sell it to policy teams, trade associations and startups as well as lawyers; the startup page offers launch risk memos and regulatory diligence to small teams that may have no counsel.

No governance position for the AI is published. The security and FedRAMP pages are detailed about controls, monitoring, identity and encryption, and none of it concerns the models: nothing names who inside the company is accountable for AI output, what is tested before a release, or how uneven results across jurisdictions, agencies or populations are checked. That gap has weight here, because the product drafts rule text and regulatory reduction recommendations for governments and reviews permit applications, where an error or a skew falls on the public rather than only on the customer.

Most of the ground is covered on published pages, without a subprocessor list or incident practice. Retention is set by the customer, and public pages take requests to delete data or an account. Access runs through Okta single sign on with multifactor authentication and least privilege by role. Encryption uses FIPS 140-2 validated cryptography in transit and at rest with keys rotated annually, and the federal boundary is monitored with named tooling and a tamper evident audit log kept for several years.

No list of the companies that process customer data, and no statement of how and when customers are told of a security incident, is published.

Nothing published says who bears the loss when the output is wrong. No terms of service, customer agreement, warranty or indemnity exists on the site, so no liability cap or allocation of risk can be read before signing. The question is live for this product: it drafts rule text, comment responses and permit review memos that a government acts on, and cite check reports a law firm relies on before filing.

Integrations reach the channels users work in, one is documented, and none reaches the systems legal work is filed in. The Slack integration is described in useful detail. An admin installs it once through Slack's own authorization flow, each Slack user is matched to their Justinian account by email, files attached in a thread go in, and generated DOCX, PDF and spreadsheet files come back to the same thread. Justinian is also reachable in Microsoft Teams, by email and through desktop apps, and documents export as DOCX.

No document management, practice management or Word integration exists, and the September 2026 release goes the other way, adding an office suite inside the product so the work no longer has to live in Microsoft.

The federal deployment is specified exactly, and the commercial one is not. VulcanGov runs entirely in AWS GovCloud (US), in us-gov-east-1, with data stored and processed inside that boundary and model inference through AWS Bedrock in the same boundary. For commercial customers the vendor says each deployment runs in the customer's tenancy, data is kept in the US and private deployment is available, but it names no region and does not say where processing happens as distinct from storage.

Certifications are stated, and the evidence sits behind a request. The vendor states a SOC 2 audit covering security, availability and confidentiality and an ISO 27001 certified management system, with the report and certificate available on request; it does not say whether the SOC 2 report is Type 1 or Type 2, or give dates or an auditor. The federal deployment is designated FedRAMP Ready after assessment by an accredited third party assessment organization and is listed on the FedRAMP Marketplace, where it can be checked without a sales call. The control matrix, system security plan and a penetration test summary are offered in a security review.

The models underneath are not named. Inference for the federal deployment runs on AWS Bedrock, which says where the models run but not which models or whose. The Slack integration accepts flags to choose a model and a provider, so more than one sits behind the product, and none is named anywhere on the site. Nothing commits to telling a customer when the models change.

No pricing is published at any level. There is no pricing page, no tier names and no unit of charge; the route to a price is a briefing request. The only public figure comes from trade press, where the chief executive put the Virginia pilot at $150,000 for three months, which is one government contract rather than a published price.

Who the product serves is described with substance, and the boundaries are left open. Government coverage is mapped by function across agencies, executive offices and legislative counsel, from regulatory review and rule drafting to legislative tracking, audit and permitting. Commercial coverage has its own pages for six kinds of buyer, among them law firms, corporate legal teams and startups, each listing the work it supports.

The sources page states jurisdictional scope in detail: 51 jurisdictions, every municipal code, and local research in more than 40 cities and counties. No page states which courts, practice areas or kinds of matter the product should not be relied on for.