eDiscovery services vs. software: which problem you are solving

Procurement discussions about eDiscovery services often collapse into a comparison of features. That misses the more consequential distinction: each delivery model allocates work, operational control, and defensibility differently. Licensed software puts the platform in the organization. A provider-operated matter puts the review process in the provider’s hands. A managed-services arrangement places a dedicated platform and its operators in the provider’s hands over time.

The right model depends less on the number of features in a demonstration than on who can operate the process, explain the decisions, and produce a defensible record when the matter becomes contentious. The following comparison uses that allocation of responsibility as its organizing principle.

Three delivery models, not one category#

“eDiscovery vendors” may sell any combination of software, people, and workflow. A provider can license its own platform, accept a matter for processing and review, or operate a dedicated environment under a managed-services agreement. The commercial label alone does not identify the risk profile.

Licensed software the organization runs#

In this model, the organization licenses the technology and assumes responsibility for operating it. Internal litigation support, legal technology, or IT personnel configure the environment, ingest and process data, build searches and review sets, manage exceptions, and prepare production files. Attorneys remain responsible for legal judgments, while technical staff connect those judgments to the platform.

The staffing shape is concentrated in the organization. Expenses extend beyond the license to implementation, training, administration, hosting, user support, and the time required to keep workflows current. The organization may control hosting and permissions more directly, but it also needs people who understand both the platform and the discovery process. Without that capability, an unused or poorly governed deployment can become an expensive repository rather than a working review system.

This model can fit a stable internal function with predictable matter volume and a clear division between technical administration and legal review. It is less attractive when the organization has few experienced users, inconsistent matter volume, or limited appetite for supporting specialist tooling. The comparison should therefore include the labor required to operate the software, not only the license and technical specifications.

A provider-operated matter#

In a provider-operated matter, the organization sends the matter data to the provider. The provider performs agreed processing and review activities and returns a review set, production materials, or both. The organization supplies custodians, scope decisions, legal holds, search instructions, coding decisions, and review of results. The provider supplies the workflow, tools, and personnel needed to execute that work.

The staffing shape is episodic. The provider can assemble a matter team around the project, while the organization directs a smaller internal group that must define the work, answer questions, and make substantive decisions. Costs follow the activity and scope in the statement of work, but they also depend on how much judgment is required, how much data must be processed, and how often the work returns for correction.

This structure reduces the need for permanent internal platform expertise. It does not eliminate internal involvement. A provider cannot determine relevance, privilege treatment, escalation paths, or final production scope without instructions. Nor does outsourcing processing establish that the resulting review set is adequate. The matter record must show who made each consequential decision and how the provider implemented it.

Managed services#

A managed-services arrangement gives the provider continuing responsibility for a platform dedicated to the organization over time. The provider may manage the environment, user access, workflows, data movement, and recurring operational tasks. The distinction from a provider-operated matter is continuity: the relationship is designed to support a program or an extended period of work rather than a single transfer-and-return project.

The staffing shape places more technical operation inside the provider and asks the organization to define governance, priorities, access rights, and escalation procedures. This can be useful for organizations that need mature discovery operations without building a permanent team around the underlying tools. It can also reduce flexibility if the provider’s operating model does not match the organization’s matters or if responsibilities for legal judgment are left unclear.

Managed services should not be evaluated as software hosted elsewhere. The relevant product may include environment administration, workflow design, reporting, queue management, issue resolution, and documentation. Contracts must make clear which services are continuous, which are exceptional, and which require a separate project scope. Without that separation, an eDiscovery managed-services agreement can become difficult to compare with either an internal deployment or a single provider-operated matter.

The inputs that should drive the decision#

Matter volume and predictability#

Volume affects more than processing time. Repeated matters involving similar custodians and data types may justify an internal platform and established workflows. Less predictable matters may make a provider-operated matter more practical because experienced personnel can be brought to the work when needed. The question is not simply whether there is “enough” data to justify software. It is whether the operating pattern will produce a steady, repeatable workload or a series of projects with different requirements.

Predictability also applies to subject matter and review behavior. Matters with complex issues, extensive document populations, or sensitive coding judgments may require substantial attorney involvement regardless of delivery model. A platform can accelerate routine steps, but it cannot supply the legal judgment needed to distinguish a relevant document from a similar document that falls outside the request or a privileged document that requires escalation.

In-house litigation-support capability#

The organization should identify what internal capability actually exists. A team may be strong in document review but weak in data processing, or able to administer a platform without having a defensible search and review methodology. A procurement comparison that treats “has litigation support” as a single capability can conceal the gap.

Licensed software generally requires enough internal ownership to administer users, preserve the work product of each matter, manage access, and coordinate with custodians and IT. A provider-operated matter shifts much of that execution to the provider, but still requires an internal decision-maker who can formulate instructions and evaluate the output. Managed services can absorb more operational work, although the organization remains responsible for defining legal priorities and reviewing exceptions.

Capability also includes continuity. If only one person understands the search protocol, production history, or escalation decisions, the arrangement remains fragile even when the platform is managed externally. A defensible arrangement identifies where critical knowledge resides and how it transfers if personnel or providers change.

Data residency and security constraints#

Security obligations may rule out models before the feature comparison begins. The organization may need to control where data is stored, who can access it, how it moves between systems, and whether provider personnel can examine it. Those constraints may favor an internally operated environment, an approved hosting configuration, or a provider able to meet specific operational requirements.

The inquiry should be concrete. What information leaves the organization? Under what controls? Which personnel have access? What records document access and administration? How are credentials separated from matter work? How does the provider handle returned data, derived files, temporary copies, and exports? The fact that a platform supports permissions or encryption does not by itself answer how those controls will be configured for the organization.

Legal teams should also distinguish security from privilege and work-product protection. A secure environment does not prevent a document from being produced. Federal Rule of Evidence 502(d) allows a federal court to order that privilege or work-product protection is not waived by disclosure in the proceeding before it, but the protection still must be managed through review, logging, and appropriate production controls.

How much defensibility the organization wants to own#

Every model creates a record, but the organization must decide how actively it will create, maintain, and explain that record. Provider personnel can document their work and support the matter team, but they do not own the organization’s litigation position. The internal team remains responsible for the scope decision and the legal basis for the search and review process.

Delegation can nevertheless be legitimate and valuable. A provider’s real product is often project management and defensibility rather than the software alone. That includes preserving chain-of-custody information, documenting processing and sampling decisions, tracking custodians and data sources, maintaining issue codes, recording exceptions, and supporting production preparation. These services deserve separate evaluation because their absence can leave a technically successful review with an inadequate explanation.

The relevant question is where accountability sits. If the provider performs the search under an attorney-written protocol and reports its implementation, the attorney may reasonably retain the legal judgment while delegating execution. If the provider designs the search, chooses the review method, and does not preserve the basis for its decisions, the organization is outsourcing more than processing. That may be acceptable, but it should be an informed choice reflected in scope, staffing, governance, and fees rather than an ambiguity in a sales description.

The defensibility burden across the workflow#

The Electronic Discovery Reference Model, or EDRM, describes information governance, identification, preservation, collection, processing, review, analysis, production, and presentation. It is a reference model, not a mandatory sequence. Real matters loop between stages, and a provider may use its own workflow without following each stage in a fixed order.

Technology-assisted review illustrates why process matters. In Da Silva Moore v. Publicis Groupe, Magistrate Judge Andrew Peck held in the Southern District of New York that computer-assisted review was an acceptable way to search for relevant electronically stored information in appropriate cases. The parties’ agreement to use it mattered, and District Judge Andrew Carter affirmed in April 2012. The decision is widely described as the first judicial opinion approving predictive coding.

Rio Tinto PLC v. Vale S.A. later reflected Judge Peck’s view that courts would permit technology-assisted review where the producing party wanted to use it, describing that proposition as black-letter law. In Hyles v. City of New York, Judge Peck held that a court would not force a producing party to use technology-assisted review when it preferred keyword searching. That approach is consistent with Sedona Principle 6, which places the responding party in the best position to decide how to search for and produce its own electronically stored information.

Some language in Rio Tinto and Hyles is dicta rather than holding. Those passages therefore signal judicial attitude rather than create a binding rule. They still matter when an organization selects a process: the responsible legal team should decide the search method, explain its suitability, and document its application rather than assume that a particular tool is legally required.

What a statement of work must name#

A statement of work is the primary instrument for comparing quotes. It should make the work visible at the level needed for evaluation, not merely list capabilities that may or may not be used.

• Scope by data volume and custodian count. Identify the sources, estimated volume, custodian population, and any known exclusions. The scope should also address data that may arrive later or require collection from difficult sources.
• Included processing. Specify whether the scope covers ingestion, de-duplication, email threading, near-duplicate detection, field extraction, family analysis, or other processing. “Processing included” is not comparable unless the included steps are named.
• Search protocol authorship. State who designs and approves the search terms, Boolean/keyword structure, filters, date restrictions, and any technology-assisted review workflow. A protocol should connect the requests and issues to the search method and explain why its performance can be evaluated.
• Quality control. Identify who performs quality control, what it measures, when it occurs, and who receives exceptions. Quality assurance should address more than system completion; it should test whether the executed work follows the agreed protocol.
• Turnaround commitments. Tie promised dates to defined dependencies and milestones. A general commitment to complete the matter obscures whether it covers processing, first review passes, production, or remediation after an issue is raised.
• Production responsibilities. State who prepares native files, TIFF images, PDFs, load files, privilege logs, redactions, or other agreed formats. Production format should reflect the receiving party’s instructions and the handling of exceptions.
• Data disposition at matter close. Specify what happens to source data, processed data, review databases, load files, logs, and privileged material. The agreement should provide a defined export or return process, confirm what the provider may retain, and address deletion of remaining copies.

The rules add procedural checkpoints that should appear in the plan. Rule 26(f) of the Federal Rules of Civil Procedure requires the parties to confer before the scheduling conference, while Rule 16(b) governs the scheduling order. Rule 26(b)(1) places proportionality factors within the definition of discovery scope and includes the parties’ relative access to relevant information. Rule 34(b)(2)(B) requires specificity in the grounds for an objection, and Rule 34(b)(2)(C) requires the objection to state whether responsive material is being withheld on that basis.

These are not administrative details to be deferred until production. They affect who must investigate missing information, how objections must be framed, and what the matter record must show. A statement of work should assign those tasks without preventing counsel from making legal decisions.

Warning signs in a proposal#

A quote with no unit of measure. If the proposal does not identify data volume, custodian count, sources, processing steps, review assumptions, or deliverable volume, the parties are not comparing the same work. A total figure may conceal differences in scope, but the organization is prohibited from stating actual prices, so a structured scope is the practical baseline for evaluation.

“Unlimited” anything. Unlimited processing, storage, review, or revisions can transfer an undefined obligation to the provider and an undefined expectation to the organization. The statement should state the assumptions and the process for handling matters outside them.

No named project manager. A provider may assign personnel differently as the matter changes. A named project manager with defined authority can preserve accountability, but the agreement should also identify escalation contacts, staffing substitutions, and who communicates legal decisions.

No exit or export terms. The organization should know how to retrieve matter data, review decisions, logs, load files, and production materials if the provider changes or the engagement ends. A proprietary environment with no usable export can become a lock-in issue rather than a service advantage.

Judge the operating model, not the feature grid#

The most useful comparison asks five operational questions: Who runs the platform? Who performs the work? Who owns the legal decisions? Who maintains the record? Who can retrieve the matter data when the engagement changes?

Licensed software offers control at the cost of internal capability. A provider-operated matter offers experienced execution at the cost of episodic involvement and clear boundaries. Managed services offer continuing operation at the cost of governance and contract precision. None is inherently more defensible than the others.

Defensibility comes from documenting scope, applying a defensible search and review process, testing quality, recording decisions, and preserving the ability to explain what happened. That burden may be shared with a provider, but it cannot be hidden inside a feature list. Price and judge the work accordingly, even when the provider’s most valuable contribution is project management rather than the software itself.