Xakia

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

FIRST C ON THIS AXIS IN THE INDEX. Artificial intelligence is present but peripheral: a feature layer on a product whose value stands without it. The decisive evidence is commercial rather than interpretive. The vendor sells its AI capabilities as a priced add on for the Advance and Professional tiers, included only in the Enterprise and All-In tiers, so a substantial share of its customers run the product with the AI switched off entirely and the vendor prices on that basis. That is the clearest possible statement that the core value stands alone. What the core is: matter management across the lifecycle, intake and triage, contracts, spend and budget management, document management, entity management and reporting, all of which are workflow and record keeping capabilities operating with no model behind them. MEMBERSHIP: the AI bar is nonetheless cleared, and this record is properly enrolled. Shipped AI features exist and are named individually: contract review and redlining, contract summarisation, key terms extraction, smart search and invoice review. The vendor's own framing is candid, describing AI as something it is continuing to expand rather than as what the product is.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Accuracy is asserted without measurement and without a described grounding method. The vendor's published position is that it expands AI capabilities with a focus on things that genuinely save legal teams time without compromising accuracy or security, which asserts accuracy as a constraint on its roadmap rather than reporting it as a result. Searched the platform pages, the FAQ, the security page, the pricing page and the in house hub articles on 29 Aug 2026 and located no accuracy figure, no hallucination rate, no test set, no evaluation methodology and no independent benchmark participation. Nothing describes how contract review, redlining, summarisation or key terms extraction ground their output, whether extracted terms link back to the clause they came from, or what a reviewer sees to check a suggestion. For a product performing redlining and key term extraction on contracts the customer will sign, the absence of any described verification surface is the material gap.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Autonomy is limited by design and the control structure is implied by workflow rather than published. The product's shape places the human at every decisive point: legal teams route and tag intake requests themselves, set up matters from templates, assign tasks, and the AI features act on documents the user is working in, offering redlines, summaries and extracted terms rather than executing anything. Nothing in the located material describes an agent that acts unattended. But that is a description of a workflow rather than a published oversight position. Searched the platform pages, the FAQ, the security page and the in house hub on 29 Aug 2026 and located no statement of what the AI features decide unaided, no review surface described as such, no threshold at which anything escalates, and no statement of what the vendor commits to when an output is wrong.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Testimonials and a logo strip stand in for deployment evidence. Attributed customer quotes are published including one claiming hundreds of hours saved and another that the platform transformed how a team works, alongside a leading brands strip and a stated base of in house legal teams of all sizes worldwide. Independent review presence exists on G2. Searched the site, the in house hub, the pricing page and the review platforms on 29 Aug 2026 and located no named customer paired with figures and a date, no case study with an assessable method, and no adoption count. Hundreds of hours saved is a testimonial rather than a measured result and was not treated as a figure.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Substantive published commitments, with segregation unusually well specified, short of the training and retention limbs. Segregation is the strongest element and is published at the level this axis asks for: role based permissions controlling access at individual user, team or matter level, with the vendor stating explicitly that sensitive matters can be restricted to specific individuals and that external parties such as outside counsel see only what the customer shares with them through the Xakia Connect portal. Matter level restriction plus a bounded external party view is a real confidentiality architecture rather than an assertion, and it addresses the in house version of the walls question directly. Single sign on through the customer's existing identity provider is supported. Certification covers ISO 27001, SOC 2 Type 2 and HIPAA with regular independent audits. Two gaps hold this off an A. No statement was located on whether customer content may be used to train or improve models. No retention or deletion terms were located. Attorney client privilege and work product are not addressed directly.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The audience is corporate and the position is unstated. The buyer is the in house legal team, with internal business users submitting requests through intake and outside counsel interacting through the Connect portal, so non lawyers touch the platform by design though the AI features sit on the legal side of that boundary. The product manages legal work rather than giving advice, so the advice line question arises less sharply than for a research or drafting tool. Searched the site, the FAQ, the in house hub and the pricing page on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits despite the platform being configurable in four languages and supporting all currencies for global teams.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Searched the site, the FAQ, the security page, the pricing page, the product updates section and the in house hub on 29 Aug 2026. No governance position for model behaviour was located: no AI principles or framework, no named owner of model governance, no pre release testing regime, no AI management certification such as ISO 42001, and nothing on uneven output across matter types, parties or populations. The vendor's only located statement touching governance is that it expands AI capabilities without compromising accuracy or security, which is an intention rather than a mechanism. Recorded as an absence on surfaces that were reached rather than assumed: the security page, FAQ and pricing page were all read and none addresses AI governance. Rebuttable with one link.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Certification and access control are published while the rest of the stewardship picture is not. Real and stated: ISO 27001, SOC 2 Type 2 and HIPAA certification, regular comprehensive independent audits of applications, systems and networks, enterprise grade cloud infrastructure, single sign on, role based permissions to matter level, and security documentation available on request with the SOC 2 report obtainable from the team. Searched the security page, the FAQ, the platform pages and the pricing page on 29 Aug 2026 and located no stated retention period or deletion control, no encryption specifics for data at rest or in transit, no named subprocessor list, no hosting provider or region, and no incident or breach notification practice. Recorded at C because access control and certification are covered well and the operational elements this axis names were not located.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Searched the site, the FAQ, the pricing page, the security page and the in house hub on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer terms of service was located as published on the property. Recorded as a pure absence on the surfaces reached. Worth noting the contrast within this record: the vendor is exceptionally clear about commercial terms, publishing tiers, per user pricing, trial conditions, no lock in and explicit statements that outside counsel are never charged and no percentage is taken on invoice value, and says nothing about who bears the loss when an AI redline or extracted term is wrong. Commercial transparency and liability transparency are different things and this record separates them sharply.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Integration routes are named without documentation an implementer could use. Published: an open API available free of charge, which the vendor frames as letting customers connect the platform to their existing tools without a commercial gate, and that is a real position since several vendors on this index treat API access as a paid or contact us item. SharePoint is named for document management, with the vendor offering to keep documents in the customer's own SharePoint rather than requiring migration. Single sign on integrates with the customer's existing identity provider. A dedicated LegalTech integrations section is published. Searched those pages and the FAQ on 29 Aug 2026 and located no API documentation reachable without contacting the vendor, no per integration description of what moves in which direction or what an administrator configures, and no other named connector.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Searched the security page, the FAQ, the platform pages and the pricing page on 29 Aug 2026. The only located statement on infrastructure is that the platform operates on enterprise grade cloud infrastructure, which names neither a provider nor anything else. No hosting provider, no named regions, no customer selectable residency, no tenancy model, and no statement of where processing happens or where data is stored was located. The product is evidently cloud delivered and multi tenant, but both are inference from how it is sold and inference earns nothing on this axis. The absence is notable for a vendor serving global teams in four languages and all currencies, where a European or Japanese customer would be expected to ask where their data sits.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certification is real, named and consistently stated across the property, short of scope and evidence detail. ISO 27001, SOC 2 Type 2 and HIPAA are all named, described by the vendor as third party accreditations, and repeated identically on the security page, the FAQ, the pricing page and each product page, which is more internal consistency than several records here manage. The vendor states it undertakes regular comprehensive independent audits of its applications, systems and networks, and publishes a dedicated information security page explaining what each standard covers rather than only displaying badges. Security documentation is available on request and the SOC 2 report is obtainable by contacting the team, which is a request flow rather than a sales gate. Short of an A because no coverage period, audit scope, report date or auditing firm was located for any of the three, and no trust portal exists, the route being a request to the vendor.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Searched the site, the FAQ, the security page, the pricing page and the product pages on 29 Aug 2026. No model, model provider, hosting location for model processing, or subprocessor was located, and no commitment to notify customers of supply chain changes. The vendor names its AI capabilities individually, covering contract review and redlining, summarisation, key terms extraction, smart search and invoice review, without identifying what powers any of them. A buyer cannot determine from published material whether their contracts are processed by a third party model provider at all, which is the first question a security review would ask about an AI add on.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

FIRST A ON THIS AXIS IN THE INDEX, and by a wide margin. A published pricing page sets out named tiers being Advance, Professional, Enterprise and All-In, states the unit of charge as per user per month, offers month to month plans with no lock in alongside discounted annual subscriptions, and provides a free 14 day trial requiring no credit card. Onboarding is disclosed as a separate one off fee with light and full options covering data migration and training, so implementation cost is surfaced rather than discovered later. AI is priced explicitly: an add on for Advance and Professional, included with Enterprise and All-In, so a buyer knows before contact whether the capability they want carries an extra charge. Two further disclosures go beyond what this axis requires and are recorded because they are rare: the vendor states outside counsel are never charged to use the Connect portal to submit invoices, and that it takes no percentage of the value of invoices processed, naming and rejecting the clip of the ticket model some competitors use. Not captured in this pass: the specific rates at each tier, which the pricing page presents but which were not retrieved here. The grade rests on the published structure, unit, trial terms and fee disclosures, which together let a buyer understand the commercial model without contacting anyone.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Segment coverage is described with substance and includes an explicit self limit, which is rare on this index. The target is stated numerically rather than vaguely: in house legal teams of roughly 2 to 200, which tells a prospect outside that band to look elsewhere. Language coverage is enumerated and used as a differentiator, the platform being configurable in English, Japanese, Spanish and French with the vendor claiming it is the only multi lingual platform in its market, and the spend module supports all currencies for global teams. Functional scope is stated at module level across matters, intake, contracts, spend, documents, entities and reporting. Not located as of 29 Aug 2026: any industry segmentation, jurisdictional coverage stated as such, and any statement of which practice areas or work types the platform is not built for beyond the team size band.