---
title: "DISCO (Cecilia AI) (CS Disco, Inc.)"
url: "https://ailawframework.com/software/disco"
type: "software_profile"
site: "AI Law Framework"
id: "disco"
vendor: "CS Disco, Inc."
category: "Legal-specific"
segment: "eDiscovery and litigation"
confidence: "medium"
last_reviewed: "2026-09-20"
---

# DISCO (Cecilia AI) (CS Disco, Inc.)

> Cloud e-discovery and litigation platform. Cecilia AI answers questions over the hosted database with cited passages, auto-reviews documents and generates summaries and timelines.

Canonical page: https://ailawframework.com/software/disco  
Last reviewed: 2026-09-20

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: DISCO Ediscovery SaaS with Cecilia AI (Q&A, Auto Review, Doc Summaries, Single-Doc Q&A, Definitions, agentic Advanced Research). Review Hold, Request, Case Builder, professional services, FedRAMP and Vault separately.

## Capabilities

- eDiscovery document review
- Chronology building
- Document summarisation
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | United States, European Union / EEA, Canada |
| Australian region | No |
| Model providers | OpenAI, Writer, Microsoft Azure, Pinecone |
| Assurance | SOC 2 Type II, SOC 3, ISO 27001, ISO 27701 |
| Training on customer content | No |
| Retention | Cecilia Q&A FAQ: LLMs are not permitted to train on customer data or usage and are not permitted to retain customer data after returning a response. Cross-matter AI builds organisation-owned predictive models from the customer's own tags. Platform retention of databases, Vault nearline storage and logs is not published as a numbered schedule. |
| Integrations | Okta / SAML SSO, Microsoft Azure AD, AWS, DISCO API |
| Legal content coverage | Cecilia answers from the customer's DISCO database only; it is not a licensed primary-law research service. |
| Pricing | No list prices. Cecilia AI Platform product terms measure authorised use by the size in GB of each AI-enabled database. Separate SKUs exist for Ediscovery, Hold, Request, Case Builder and professional services. Contact-us pricing only. |
| Australian presence | Unknown. Login regions advertised are United States, Canada and EU. The subprocessor list names AWS datacentres in US, EU and Canada only. No Australian region or named Australian customers were found on the pages reviewed. |
| Website | https://csdisco.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and SKUs in scope | Public claim only | This profile covers DISCO Ediscovery with Cecilia AI (Q&A, Doc Summaries, Single-Doc Q&A, Definitions, Auto Review and agentic Advanced Research). Hold, Request, Case Builder/Timelines, Vault, professional services (including managed review) and any government cloud are separate offerings with their own product terms. | Confirm the Order Form SKUs, whether Cecilia is enabled on every database, Auto Review versus Q&A, and whether professional-services reviewers will see our documents. | [Cecilia AI](https://csdisco.com/offerings/cecilia); [Cecilia AI Platform product terms](https://csdisco.com/legal/product-terms/cecilia-ai-platform-product-terms); [DISCO Platform (core) product terms](https://csdisco.com/legal/product-terms/core-platform-product-terms) |
| Cloud regions | Public claim only | DISCO is AWS-hosted SaaS. Logins are offered for US, Canada and EU. The subprocessor table lists AWS datacentres as US, EU and Canada. No Australian hosting region was listed. | Which AWS region will hold our production databases, backups and Cecilia inference, and is an Australia region available on request? | [DISCO security](https://csdisco.com/security); [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| Cecilia and platform AI features | Public claim only | Cecilia Q&A interrogates the database with cited, highlighted passages and optional document-set scoping. Related tools: Doc Summaries, Single-Doc Q&A, Definitions, Auto Review (plain-English tag descriptions plus narrative justifications), Timelines from a complaint, and agentic Advanced Research. Cross-matter AI builds organisation-owned predictive models from prior tags. | Which of these features will be on in our tenancy, which are generally available versus new/agentic, and how is Auto Review billed versus Q&A? | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa); [Cecilia AI](https://csdisco.com/offerings/cecilia); [DISCO Ediscovery — AI features](https://csdisco.com/offerings/ediscovery/features-ai) |
| No Australian region found | Public claim only | Available DISCO datacentres on the subprocessor list are US, EU and Canada. Cecilia LLM subprocessors include OpenAI (US, EU), Writer (US), Pinecone (US, EU) and Azure (US). An Australian law firm using DISCO would be sending matter data offshore unless a later Order Form says otherwise. | If we proceed, which country stores and infers on our matter data, and what APP 8 / client-consent wording do you provide? | [DISCO subprocessors](https://csdisco.com/legal/subprocessors); [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa) |
| Pricing unit | Public claim only | Cecilia AI Platform product terms measure authorised use by GB of each AI-enabled database. Public pricing pages do not list dollar amounts. Core platform terms describe Vault nearline storage for inactive databases. Website Terms of Use expressly do not govern the software. | Provide an itemised quote for our GB, Cecilia enablement, Auto Review, professional services and Vault, including term, auto-renewal and renewal uplifts. | [Cecilia AI Platform product terms](https://csdisco.com/legal/product-terms/cecilia-ai-platform-product-terms); [DISCO pricing](https://csdisco.com/pricing); [DISCO website Terms of Use](https://csdisco.com/legal/terms-of-use) |
| SSO and APIs | Public claim only | Security FAQ: two-factor authentication via email by default; optional SAML SSO with major IdPs including Microsoft AD FS, Okta and Azure AD. A DISCO API developer site is linked. Word/Outlook add-ins and SCIM were not documented on the pages reviewed. | Demonstrate SAML SSO-only with our Entra tenant, any SCIM option, and the API scopes we would use. | [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security); [DISCO security](https://csdisco.com/security) |
| Support and status | Public claim only | A Support Center, DISCO University and a public status page are linked. Professional services include document review staffing subprocessors in the US, UK and India. No public severity SLA or Australian-hours coverage was found. | What are contractual response times, the security-incident contact, and whether managed-review staff in India or the UK will see our documents? | [DISCO subprocessors](https://csdisco.com/legal/subprocessors); [About DISCO](https://csdisco.com/company/about-us) |
| Auto Review accuracy claims | Public claim only | Cecilia Q&A marketing states Auto Review 'achieves recall and precision rates 10-20% higher than typical human review'. No independent study, dataset, jurisdiction mix or date was linked from that sentence. Q&A cites source documents with highlighted passages, which aids verification even without a published error rate. | Provide the Auto Review evaluation method, sample, date and model version, and run it on a de-identified set of our documents against our gold standard. | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa) |
| Investigation, review and chronology | Public claim only | Cecilia Q&A is built to answer factual questions from the hosted database with citations. Auto Review automates first-pass tagging with narrative justifications. Timelines generate a chronology from an uploaded complaint with facts linked to sources. Outputs remain generative and need lawyer verification before filing or advice. | Which of our repeat review, privilege and chronology tasks will use Cecilia, and which (affidavits, advice, court documents citing authority) stay out of scope? | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa); [DISCO Ediscovery — AI features](https://csdisco.com/offerings/ediscovery/features-ai) |
| Client consent for offshore AI | Not confirmed | DISCO processes confidential discovery data. Hosting and LLM subprocessors are US/EU/Canada, not Australia. Cecilia can be scoped to a document set. No published client-exclusion or OCG flag was found. | Can we disable Cecilia per database or client, and what processing-location description can we give clients for APP 8 and OCGs? | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa); [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| LLM and vector subprocessors | Public claim only | The subprocessor list names OpenAI (LLM, US/EU), Writer (LLM, US), Pinecone (vector database, US/EU) and Microsoft Azure (cloud hosting, US), plus AWS. DISCO does not publish which Cecilia feature uses which model. Customers do not appear to choose the model. | Map each Cecilia feature to the provider, model version and country of inference for our instance, and whether we can exclude Writer or OpenAI. | [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| Published subprocessor list | Public claim only | A public list names software/support processors (AWS, Salesforce, Okta, Mailgun, Google, Netsuite, Box, Snowflake, Pendo, Planhat, Pinecone, OpenAI, FullStory), professional-services review/translation firms (including India and UK), forensics vendors and affiliates in India and Canada. Notice period and objection rights were not stated on that page. The master DPA was not found. | What notice and objection rights apply to new subprocessors, and will professional-services reviewers in India be used on our matters? | [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| LLM training versus cross-matter models | Public claim only | Cecilia Q&A FAQ: LLMs are not permitted to train on customer data or usage. The same statement appears on the AI features page. Separately, Cross-matter AI lets the organisation train predictive models on its own tags; DISCO says those models are owned by the customer and not accessible to other DISCO users. No signed DPA clause was reviewed. | Point to the Order/DPA clause covering prompts, documents, outputs, embeddings and cross-matter models, binding OpenAI, Writer and Pinecone. | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa); [DISCO Ediscovery — AI features](https://csdisco.com/offerings/ediscovery/features-ai) |
| Feedback and analytics subprocessors | Not confirmed | Pendo, FullStory and Snowflake appear as subprocessors for analytics, user insights and warehousing. Whether Cecilia ratings, Auto Review corrections or support tickets improve DISCO models was not stated. | Are reviewer corrections, Q&A ratings and Pendo/FullStory events used to improve Cecilia or cross-matter models, and can that be switched off? | [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| LLM non-retention versus platform storage | Public claim only | Cecilia FAQ: LLMs may not retain customer data after returning a response. DISCO still stores the ediscovery database, work product and Vault copies. Pinecone holds vectors in the US/EU. Privacy-policy retention language covers website personal information, not Customer Data in the product. | Provide a retention schedule for databases, prompts, Cecilia outputs, embeddings, audit logs, Vault and Pinecone, including any provider abuse-monitoring window. | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa); [DISCO privacy policy](https://csdisco.com/legal/privacy-policy); [DISCO Platform (core) product terms](https://csdisco.com/legal/product-terms/core-platform-product-terms) |
| Deletion and Vault | Not confirmed | Core platform terms describe Vault nearline storage for inactive databases (work product retained; restore required before use). A public deletion period, certified destruction, or flow-down to OpenAI/Pinecone was not found. Website privacy deletion rights do not govern matter databases. | On matter close or termination, what is deleted from AWS, Vault, Pinecone and LLM providers, within how many days, and will you certify it? | [DISCO Platform (core) product terms](https://csdisco.com/legal/product-terms/core-platform-product-terms); [DISCO privacy policy](https://csdisco.com/legal/privacy-policy) |
| Support and professional-services access | Not confirmed | The subprocessor list includes staffing providers for review services in the US, UK and India, plus DISCO India for IT and business support. Security pages do not describe a customer-controlled lockbox for DISCO employees. Box is listed as a file-transfer tool for customer support. | When can DISCO or review-vendor staff open our databases, is access logged to us, and will you notify us of legal process seeking our documents? | [DISCO subprocessors](https://csdisco.com/legal/subprocessors); [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security) |
| SSO, MFA and database permissions | Public claim only | SSO via SAML and email two-factor authentication are documented. Cecilia Q&A can be scoped to a document set. Query-time permission trimming for Q&A, ethical walls and SCIM were not demonstrated on the pages reviewed. | Demonstrate SAML SSO-only, immediate deprovisioning, and that Cecilia cannot retrieve documents a user is not permitted to open, including caches. | [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security); [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa) |
| Encryption | Public claim only | Ediscovery security FAQ: TLS 1.2 or greater in transit over the public internet; AES-256 or greater at rest. AI features are stated to use the same encryption and access controls. Customer-managed keys were not mentioned. | Confirm TLS 1.2+ and AES-256 cover databases, Cecilia prompts/outputs, embeddings, logs, backups and the OpenAI/Writer/Pinecone links, and whether CMK is available. | [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security) |
| SOC 2 and ISO | Public claim only | Security pages claim SOC 2 Type 2 (security, availability and privacy), SOC 3, ISO 27001 and display an ISO 27701 badge. Annual penetration testing is stated. Report dates, exceptions and whether Cecilia/OpenAI/Writer sit in scope were not inspected. ISO 42001 is not listed. | Provide current SOC 2 Type II and ISO 27001/27701 artefacts under NDA with Cecilia and named LLM subprocessors in scope. | [DISCO security](https://csdisco.com/security); [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security) |
| Master terms not public | Not confirmed | Website Terms of Use state they do not govern the ediscovery software. Public product-term supplements exist for Cecilia (GB metric) and the core platform (Vault). The master Terms and Conditions, DPA, liability cap, output ownership and governing law for the software were not found on the public legal index. | Provide the master Terms and Conditions and DPA for DISCO Ediscovery and Cecilia, including APP alignment, confidentiality of prompts/outputs, IP indemnity and Australian law/forum options. | [DISCO website Terms of Use](https://csdisco.com/legal/terms-of-use); [Cecilia AI Platform product terms](https://csdisco.com/legal/product-terms/cecilia-ai-platform-product-terms); [DISCO Platform (core) product terms](https://csdisco.com/legal/product-terms/core-platform-product-terms) |
| Cross-border processing | Public claim only | A Data Privacy Framework notice exists for EU/UK/Swiss transfers. Datacentres listed are US, EU and Canada. LLM/vector processing includes US (Writer, Azure, Pinecone, OpenAI) and EU (OpenAI, Pinecone). No Australian region. Privacy policy covers website personal information transfers separately. | For APP 8, list every overseas recipient of our matter data if we buy US or EU hosting with Cecilia enabled. | [DISCO subprocessors](https://csdisco.com/legal/subprocessors); [DISCO privacy policy](https://csdisco.com/legal/privacy-policy) |
| Incident notice | Not confirmed | Security FAQ says DISCO has information-security incident management controls. A public numbered notification period and NDB cooperation clause were not found. A status page is linked from the site footer. | What contractual hours apply from discovery of a suspected incident affecting our data, including OpenAI/Writer/Pinecone, and will you support our Notifiable Data Breaches assessment? | [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security) |
| Model and product change | Not confirmed | Weekly/monthly release notes are published on a support article. Cecilia product terms do not state model-pinning or notice before changing OpenAI or Writer. Subprocessor-list change notice is not specified on the list page. | Will you notify us before changing Cecilia's model provider or inference region, and can we re-test Auto Review first? | [Cecilia AI Platform product terms](https://csdisco.com/legal/product-terms/cecilia-ai-platform-product-terms); [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| Export and Vault on exit | Not confirmed | Productions and Vault restore are product features. No public post-termination export window, certified deletion or escrow was found. Website Terms of Use do not apply to the software. | On termination, how long can we export natives, productions, tags, Cecilia outputs and audit logs, and when is remaining data deleted from AWS, Vault and Pinecone? | [DISCO Platform (core) product terms](https://csdisco.com/legal/product-terms/core-platform-product-terms); [DISCO website Terms of Use](https://csdisco.com/legal/terms-of-use) |
| Collection and API connectors | Not confirmed | A high-speed uploader and AWS hosting are described. A DISCO API exists. Box and Dropbox are listed as file-transfer subprocessors. A published catalogue of M365/Google connectors and MCP was not found on the pages reviewed (unlike some competitors). | List every collection connector and API scope we would enable, and how we disable them without a ticket. | [DISCO security](https://csdisco.com/security); [DISCO subprocessors](https://csdisco.com/legal/subprocessors) |
| Answers limited to the database | Public claim only | Cecilia Q&A FAQ states answers are based on information within the customer's database, with citations to source documents. Scoping can further limit the set. Open-web search as a Cecilia tool was not described. | Confirm Cecilia Q&A, Auto Review and Advanced Research cannot call the open web on our databases. | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa) |
| Agentic Advanced Research | Not confirmed | Cecilia Advanced Research is marketed as autonomous multi-step reasoning with 'full visibility along the way'. What the agent may do without a click (search, tag, export, produce) is not specified in the public Q&A FAQ. Auto Review writes tags into the database. | Which Cecilia agent actions require per-step approval, and how do we disable Auto Review and Advanced Research immediately? | [Cecilia AI](https://csdisco.com/offerings/cecilia); [DISCO Ediscovery — AI features](https://csdisco.com/offerings/ediscovery/features-ai) |
| Citations and human checking | Public claim only | Cecilia Q&A returns cited source documents and highlighted passages. Auto Review supplies narrative justifications for tags. No contractual clause requiring human review before reliance was found in the public Cecilia product terms; those terms mainly set the GB metric. Professional-services managed review is a paid human layer, not a product gate. | Can we require named reviewer sign-off before Auto Review tags or Cecilia answers are produced or exported, with an audit export? | [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa); [Cecilia AI Platform product terms](https://csdisco.com/legal/product-terms/cecilia-ai-platform-product-terms) |

## Notes

Could not verify: master Terms and Conditions/DPA, Australian hosting, named AU customers, SCIM, Word add-in, numbered breach-notification hours, deletion timelines, or which Cecilia feature uses OpenAI versus Writer. Auto Review 10–20% accuracy claim is unsourced. Cross-matter AI trains customer-owned models on the organisation's own tags — distinguish from Cecilia LLM no-training claims.

## Sources

- [DISCO security](https://csdisco.com/security) (checked 2026-09-20)
- [DISCO website Terms of Use](https://csdisco.com/legal/terms-of-use) (checked 2026-09-20)
- [DISCO Ediscovery — security features FAQ](https://csdisco.com/offerings/ediscovery/features-security) (checked 2026-09-20)
- [DISCO privacy policy](https://csdisco.com/legal/privacy-policy) (checked 2026-09-20)
- [Cecilia AI](https://csdisco.com/offerings/cecilia) (checked 2026-09-20)
- [DISCO subprocessors](https://csdisco.com/legal/subprocessors) (checked 2026-09-20)
- [DISCO Ediscovery — AI features](https://csdisco.com/offerings/ediscovery/features-ai) (checked 2026-09-20)
- [Cecilia Q&A FAQ](https://csdisco.com/offerings/cecilia/cecilia-qa) (checked 2026-09-20)
- [Cecilia AI Platform product terms](https://csdisco.com/legal/product-terms/cecilia-ai-platform-product-terms) (checked 2026-09-20)
- [DISCO Platform (core) product terms](https://csdisco.com/legal/product-terms/core-platform-product-terms) (checked 2026-09-20)
- [About DISCO](https://csdisco.com/company/about-us) (checked 2026-09-20)
- [DISCO pricing](https://csdisco.com/pricing) (checked 2026-09-20)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.