Legal-specific · eDiscovery and litigation · Medium confidence
Nebula (including Nebula AI Case Explorer)
KLDiscovery (group; the Australian controller entity is published as KLDiscovery Ontrack Pty Ltd) · Nebula as published on the vendor's English product page, read with the Security & Compliance page and the Privacy Policy of 3 June 2026. The Nebula AI Case Explorer page, the Trust Center and any client MSA or DPA need separate review.
eDiscovery platform covering ingestion, early case assessment, analytics, review and production for legal teams, with machine learning, NLP and generative AI components and a promotion path into RelativityOne.
United States, Canada, United Kingdom, European Union / EEA, Another named location
Australian region
Unknown
Assurance
ISO/IEC 27001, SOC 2, HIPAA Security Rule compliance (independent audit stated), EU-U.S. Data Privacy Framework, UK Extension and Swiss-U.S. Data Privacy Framework
Training on customer content
Unknown
Retention summary
The Privacy Policy of 3 June 2026 sets a retention rule for personal data KLDiscovery holds as a controller: data is kept while an ongoing relationship exists or a lawful purpose applies, then for any applicable limitation period plus 'an additional two (2) month period following the end of such applicable limitation period', after which KLDiscovery will 'either: (i) permanently delete or destroy the relevant Personal Data; or (ii) anonymize the relevant Personal Data'. It does not set retention for client matter data in Nebula: section (N) states 'Where AI Technologies are used in the provision of Services to our clients, the processing of client data is governed by applicable data processing agreement between KLDiscovery and the relevant client.' No client-facing retention schedule for matter data, and no Nebula data processing agreement, is published on the pages read.
Integrations
RelativityOne - 'Select and promote only relevant, defensible data into RelativityOne when matters require enterprise-scale review', Microsoft Azure Cloud, named on the Security & Compliance page as the route to data centre locations beyond the eight listed
Pricing summary
No pricing is published on the pages read. Every call to action on the Nebula page is 'Request a Demo', 'Contact Us', 'Schedule a Demo' or 'Talk to Our Team', checked 2026-09-27. The page's commercial framing is cost control rather than price: 'Lower total matter cost by promoting only relevant, defensible data into high-cost review environments.' A press release titled 'KLDiscovery Introduces Nebula Singularity Global Subscription Service' appears in the site map and was not opened, so whether a published subscription model exists is unverified.
Legal content coverage
No legislation or case-law library is published. The platform operates on the customer's own collected data, with 'automated processing, deduplication, indexing, and metadata normalization' at ingestion.
Australian presence
Yes — Contracting entity and ACN or ABN: the Privacy Policy of 3 June 2026 lists controller entities by country, and the Australian row reads 'Australia | KLDiscovery Ontrack Pty Ltd | Australian Data Privacy Queries, 9/28 Donkin St, West End QLD 4101'. That is an Australian entity with a published Brisbane address; no ACN or ABN is published, and the policy does not say that this entity, rather than a United States or United Kingdom entity, contracts for a Nebula subscription. The policy also names KLDiscovery Ontrack, LLC, KLDiscovery Inc and KLDiscovery Holdings, Inc in the United States, KLDiscovery Ontrack Limited and KLDiscovery Limited in the United Kingdom, and entities in a further eighteen countries. Australian presence over time: a vendor press release dated 10 June 2019 announced 'the opening of a new office at 9 Barrack Street in Sydney, Australia', stated it was 'KLDiscovery's second location in Australia, with an existing data recovery facility in Brisbane under the Ontrack brand', that the office 'features a document review facility supporting 50 reviewers', and that 'customers can utilize Nebula'. The current published footprint does not repeat that: on the pages read on 2026-09-27 the footer office list names the United States, United Kingdom, Germany, France, the Netherlands, Japan and India and does not name Australia. Hosting and residency: the Security & Compliance page lists 'Global data center locations' as Austin TX, Eden Prairie MN, Brooklyn Park MN, Toronto, Slough England, Frankfurt Germany, Paris France and Tokyo Japan, with a footnote 'Other locations also available through the Microsoft Azure Cloud.' No Australian data centre is named and the Azure footnote names no region, so whether an Australian hosting region is available is unverified rather than excluded. Australian law is addressed in the Privacy Policy: 'Australia: We will comply with the Notifiable Data Breaches scheme for breaches likely to result in serious harm. We will notify the Office of the Australian Information Commissioner and you', and 'Australia: Under the Privacy Act 1988, you have the right to request access to and correction of your Personal Information and to complain to the Office of the Australian Information Commissioner.' Australia's Privacy Act 1988 and the Australian Privacy Principles are named in the policy's definition of Applicable Privacy Laws. Whether inference for Nebula's AI components runs in Australia is not published anywhere on the pages read.
Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and modules covered
Public claim only
The vendor describes Nebula as 'KLDiscovery's AI-powered eDiscovery platform built to help teams understand their data earlier and control cost across the matter lifecycle', supporting 'workflows from ingestion and early case assessment through review and production within a structured, defensible environment', checked 2026-09-27. Named core features are Interactive Timeline, Keyword Navigation, 'Predictive Coding and Machine Learning', 'Email Threading and Near-Duplicate Detection' and 'Flexible Promotion to RelativityOne'. A separately branded module, Nebula AI Case Explorer, is published in the Software navigation with its own page, which was not opened, so its capabilities are not reflected in the capability list here.
Ask: Is Nebula AI Case Explorer included in a Nebula subscription or licensed separately, and which of the named features are in the tier we are quoted?
Nebula is published as a hosted platform with an optional pairing: 'Run matters fully in Nebula or pair with RelativityOne depending on complexity and risk.' The Security & Compliance page lists eight 'Global data center locations' - Austin TX, Eden Prairie MN, Brooklyn Park MN, Toronto, Slough England, Frankfurt Germany, Paris France and Tokyo Japan - with the footnote 'Other locations also available through the Microsoft Azure Cloud.' It also states 'Backups performed every 15 minutes between primary and backup data centers.' No Australian data centre is named, and no on-premises or self-hosted option is published.
Ask: In which data centre would an Australian matter be hosted, where does its backup copy sit, and is an Australian Azure region available for Nebula?
Which components are AI and which are long-standing eDiscovery machine learning
Public claim only
Most of what the page presents as AI is machine learning the vendor itself names as such: 'Integrated machine learning models support prioritization, clustering, and continuous active learning strategies', email threading, near-duplicate detection, and an Interactive Timeline 'Automatically generated from system metadata'. Generative AI appears once, without detail: 'Leverage machine learning, NLP, and generative AI to surface patterns and prioritize content. Designed to accelerate understanding without introducing black-box automation.' The analysis step is described as applying 'analytics, entity recognition, sentiment analysis, and AI-driven categorization'. No model, method or measure is published for any of it.
Ask: Where exactly does generative AI operate in Nebula, as against predictive coding and analytics, and can it be disabled independently of the machine learning features?
Australian law addressed by the published documents
Public claim only
The Privacy Policy of 3 June 2026 names 'Australia's Privacy Act 1988 and Australian Privacy Principles' in its definition of Applicable Privacy Laws, commits that 'We will comply with the Notifiable Data Breaches scheme for breaches likely to result in serious harm' and that 'We will notify the Office of the Australian Information Commissioner and you', and records Australian access and correction rights under the Privacy Act 1988. The policy is issued by the controller entities it lists, which include KLDiscovery Ontrack Pty Ltd. These commitments are given in the vendor's capacity as controller of personal data about individuals it deals with; the policy expressly leaves client matter data to the client data processing agreement.
Ask: Which of the Australian commitments in the Privacy Policy are mirrored in the Nebula client agreement for the matter data we load, and under which State's law would that agreement be governed?
Check for vendor content directing how AI describes the product
Not confirmed
A deliberate check for content telling AI models, assistants or crawlers how to describe the product found none on this vendor's site as at 2026-09-27. Checked: a site map run with a 60-URL limit, which returned a sitemap.xml but no /llms.txt, /ai-info, /ai or /for-ai path; the 75 links on the Nebula page and the full navigation and footer link sets of the Security & Compliance page, the Privacy Policy and a press release, none of which contains such a path; and the text of those pages, which contains no block addressed to AI models, assistants or LLMs. No file at /llms.txt or /robots.txt was fetched directly, so this is an absence in what was indexed and read rather than a proven absence.
Ask: Does KLDiscovery publish any file or page addressed to AI models or crawlers, such as /llms.txt, describing how Nebula should be presented?
Record the practical work needed to introduce and maintain the software.
Support and training arrangements
Public claim only
The Nebula page states a '24/7/365 global support model' and that 'Every Nebula deployment is supported by KLDiscovery professionals who can step in at any point.' The support navigation on the pages read links a Nebula Academy, a Nebula help site at help.kldiscovery.com/nebula, and client logins; a vendor article in the site map refers to a 'Nebula Academy advanced reviewer course launch'. None of those pages was opened, so response targets, service credits and whether Australian-hours support is staffed locally are unverified.
Ask: Are support hours covered from an Australian or Asia-Pacific location, what are the response targets by severity, and are they contractual or a stated aim?
Compare complete work at the required quality, including checking and correction.
Published evidence behind the defensibility and scale claims
Public claim only
The page publishes defensibility framing - 'AI With Transparency', 'Designed to accelerate understanding without introducing black-box automation', 'Generate defensible productions with comprehensive audit trails' - and scale figures of '1,800+ Nebula customers' and '550+ TB actively hosted', checked 2026-09-27. No method, validation report, benchmark, court decision or audit supports any of it on the pages read, and the figures are unaudited vendor statements. The one artefact named that a firm could test is the audit trail on a production.
Ask: What does the production audit trail actually record, and is there any published or client-shareable validation of the predictive coding and analytics results?
Nothing published addresses Australian practice: no Australian court or tribunal, no Federal Court practice note on technology assisted review, no discovery protocol and no Australian regulator is named on the pages read. The published use cases are 'Litigation and Investigations', 'RelativityOne Environments', 'Regulatory and Cross-Border Matters' and 'Internal Reviews and Corporate Matters', and the regulatory services named are United States ones - antitrust and 'HSR Second Request and Phase II Merger Reviews'. No Australian customer is named.
Ask: Which Australian matters has Nebula been used on, and does the platform produce load files and production formats that Australian courts and regulators accept?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to load client and third-party material
Not confirmed
Nothing published addresses the customer's authority to load data, any customer warranty, or the controller and processor characterisation for matter data. The Privacy Policy states at section (N) that 'Where AI Technologies are used in the provision of Services to our clients, the processing of client data is governed by applicable data processing agreement between KLDiscovery and the relevant client', and that agreement is not published. No Nebula master services agreement or subscription terms were found on the pages read.
Ask: In the Nebula client agreement, what does KLDiscovery require us to warrant about our authority to load custodian data, and does it treat us as controller and KLDiscovery as processor?
Which models and model providers operate inside Nebula
Not confirmed
No model, model family, model version or model provider is named for Nebula anywhere on the pages read. The Privacy Policy section (N) says only that 'AI Technologies may be provided by KLDiscovery or by third-party providers subject to due diligence and appropriate contractual safeguards. Such providers are engaged as Processors and are subject to binding data processing agreements, confidentiality obligations, and security requirements', and that 'KLDiscovery may update the AI Technologies it uses from time to time'. The Nebula page names the techniques - machine learning, NLP, generative AI - but no provider. Microsoft Azure is named on the Security & Compliance page as a cloud location option, which is hosting rather than a statement about models.
Ask: Which provider and which model serve Nebula's generative AI and AI Case Explorer, in which region is inference run, and will we be told before the model changes?
No sub-processor list for Nebula is published. The Privacy Policy describes categories of recipients rather than named sub-processors, states that intra-group transfers 'are governed by data sharing agreements', and undertakes that where 'we engage a third-party Processor ... we will conclude a data processing agreement and sufficient guarantees as required by the Applicable Privacy Laws', adding that 'KLDiscovery is primarily liable for the acts and omissions of such third parties'. The only third party named anywhere on the pages read is Microsoft Azure, as a cloud location option. There is no published right to be notified of, or object to, a new sub-processor.
Ask: Please provide the sub-processor list for Nebula and AI Case Explorer, with each one's country, and the notice and objection rights we would have when it changes.
Nothing published states whether client matter data loaded into Nebula is used to train, fine-tune or improve any model. The Privacy Policy's AI section is expressly limited: 'This section applies only to Personal Data for which KLDiscovery acts as a Controller. Where AI Technologies are used in the provision of Services to our clients, the processing of client data is governed by applicable data processing agreement between KLDiscovery and the relevant client.' The Nebula page says nothing on the point. The client data processing agreement, which would answer it, is not published.
Ask: Will the Nebula agreement warrant that our matter data, and any model output on it, is never used to train or improve any KLDiscovery or third-party model, including for other customers?
Nothing published addresses what happens to reviewer coding decisions, tagging or other feedback beyond training the customer's own model in the matter. The Nebula page describes 'continuous active learning strategies', which by design learn from reviewer decisions within a matter, but no statement says whether those decisions, or any derived model, remain confined to the matter and the customer. The Privacy Policy does not cover client matter data.
Ask: Do coding decisions and any classifier trained on them stay inside our matter and our tenancy, and are they destroyed with the matter data?
The Privacy Policy of 3 June 2026 sets retention only for personal data KLDiscovery holds as a controller: it is kept while an ongoing relationship or lawful purpose exists, plus any applicable limitation period and 'an additional two (2) month period following the end of such applicable limitation period', after which the data is permanently deleted, destroyed or anonymised. It does not address retention of client matter data in Nebula, which section (N) leaves to the client data processing agreement; that agreement is not published, and no hosting or retention schedule for matter data was found.
Ask: What is the retention and destruction schedule for matter data, indexes, work product, audit logs and the 15-minute backups after a matter closes?
The Privacy Policy states that once the retention periods conclude KLDiscovery will 'either: (i) permanently delete or destroy the relevant Personal Data; or (ii) anonymize the relevant Personal Data', and that in the case of anonymisation 'we ensure such data cannot be re-identified using reasonable technical and organizational measures'. A data subject access request page is linked at /legal/dsar and was not opened. For client matter data in Nebula no deletion right, timeframe or certificate is published; the Security & Compliance page refers to 'secure storage for media and evidence' at the data centres without stating a destruction process.
Ask: On matter closure or termination, within how many days are matter data and backups destroyed, will KLDiscovery certify the destruction, and does anonymisation ever substitute for deletion of matter data?
The Privacy Policy states that KLDiscovery processes personal data 'subject to all contractual requirements of confidentiality, imposing equivalent measures upon employees and subcontractors with access to such Personal Data'. The Security & Compliance page states 'Role-based access controls to all systems and networks to ensure confidentiality. Access is regularly audited to ensure proper privilege levels for each employee.' Beyond that, human access is a live question for this vendor because it also sells managed review: the Nebula page states 'Every Nebula deployment is supported by KLDiscovery professionals who can step in at any point', a Global Document Review service is published, and the 2019 Sydney press release described a 'document review facility supporting 50 reviewers' as part of a total of '1300 seats across 12 facilities'. Which countries those facilities are in today, and whether support staff can read matter data without the customer's instruction, are not published.
Ask: Which KLDiscovery personnel can open documents in our workspace without our request, in which countries are they located, and can we obtain an access log?
The Security & Compliance page states 'Multi-zoned, segmented networks to ensure isolation of critical systems and data. All internet traffic transmitted over a firewall-to-firewall VPN', 'Role-based access controls to all systems and networks', and that access 'is regularly audited to ensure proper privilege levels for each employee'. The Privacy Policy refers to 'access controls once data reaches our environment'. Nothing published addresses reviewer-facing account controls in Nebula: no single sign-on, multi-factor authentication, session timeout, IP restriction or password policy is published for customer users, and the Trust Center that may hold that detail was not opened.
Ask: Does Nebula support single sign-on and enforced multi-factor authentication for our reviewers, and can access be restricted by IP range or workspace?
The Privacy Policy states 'we do take measures to secure data in transit using encryption protocols (e.g., TLS/SSL), and access controls once data reaches our environment', and the Security & Compliance page states 'All internet traffic transmitted over a firewall-to-firewall VPN.' Neither page states that data is encrypted at rest, names a cipher or key length, or addresses key management or customer-managed keys, checked 2026-09-27. The Trust Center was not opened.
Ask: Is matter data encrypted at rest, with which cipher, and who holds and rotates the keys - is a customer-managed key option available?
The Security & Compliance page states, checked 2026-09-27, that KLDiscovery is 'ISO/IEC 27001- Certified' with annual audits, that it 'has been independently audited for SOC 2 compliance', that it 'has completed an independent audit resulting in a certification of compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA)', and that it 'is accredited with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF'. It also states 'Annual third party penetration tests and monthly vulnerability scans.' The Privacy Policy confirms the DPF certification is held by KLDiscovery Ontrack, LLC and KLDiscovery Holdings, Inc. No certificate, report, scope statement, audit period or certification body is published on the pages read; the vendor directs readers to a Trust Center at trust.kldiscovery.com for 'essential documentation', which was not opened. No Australian assurance such as IRAP is claimed.
Ask: Can we see the ISO/IEC 27001 certificate and the SOC 2 report through the Trust Center, and do their scope statements cover the Nebula platform and the data centre our matter would sit in?
What we would be contracting to, and with which entity
Not confirmed
No Nebula master services agreement, subscription terms, service level agreement or data processing agreement is published. The site footer on the pages read links a website Terms of Use, a Transparency Report, a cookie policy and a DSAR page under /legal/, none of which was opened, and none of which is a subscription agreement. The Privacy Policy lists 24 controller entities by country, including KLDiscovery Ontrack Pty Ltd in Australia, but does not say which entity contracts for software or services; it also records that 'KLDiscovery operates under the following brands: KLDiscovery, Ontrack, Ibas and Complied.'
Ask: Which KLDiscovery entity would contract with us for Nebula, is it KLDiscovery Ontrack Pty Ltd, what is its ACN, and can we see the standard agreement and data processing agreement before a demonstration?
The Privacy Policy states 'Because of the international nature of our business, we may need to transfer your Personal Data within the KLDiscovery Group, and to third parties ... For this reason, we may transfer your Personal Data to other countries that may have lower standards for data protection than the EU due to different laws and data protection compliance requirements to those that apply in the country in which you are located', and that intra-group transfers are governed by data sharing agreements. Transfers to the United States rely on the EU-U.S. DPF, its UK Extension and the Swiss-U.S. DPF, certified by KLDiscovery Ontrack, LLC and KLDiscovery Holdings, Inc. No equivalent mechanism is published for outbound transfers of Australian data, and no Australian data centre appears in the published data centre list, so where an Australian matter would sit and who would reach it is unresolved.
Ask: For an Australian matter, in which countries will data be stored and accessed, and what APP 8 mechanism does KLDiscovery rely on for any disclosure outside Australia?
The Privacy Policy of 3 June 2026 sets out breach notification by jurisdiction and includes an Australian commitment: 'Australia: We will comply with the Notifiable Data Breaches scheme for breaches likely to result in serious harm. We will notify the Office of the Australian Information Commissioner and you.' For the European Union, European Economic Area and United Kingdom it commits to notifying the supervisory authority 'without undue delay and, where feasible, within 72 hours'. These commitments are given for personal data KLDiscovery holds as a controller. No customer notification period for an incident affecting client matter data in Nebula is published, and the incident response detail sits in the unopened Trust Center.
Ask: Within what period will we be told of an incident affecting our matter data, what will the notice contain, and who makes the Notifiable Data Breaches assessment - us or KLDiscovery?
How changes to the platform and the policies are notified
Public claim only
The Privacy Policy states 'This Policy may be amended or updated from time to time to reflect changes in our practices ... We encourage you to read this Policy carefully, and to regularly check this page to review any changes we might make', and carries a version date of 3 June 2026 with no change log and no advance-notice commitment. On AI specifically, section (N) states 'AI Technologies and their applications evolve rapidly. KLDiscovery may update the AI Technologies it uses from time to time. Any material changes to how Personal Data is processed in connection with AI Technologies will be reflected in updates to this Policy.' The product page is not versioned, and no release notes were opened; a Nebula Academy and a Nebula help site are linked in the support navigation.
Ask: How will we be notified before an AI component, model or default in Nebula changes, and is there a release-notes feed and a version we can hold for the life of a matter?
Nothing published addresses termination, transition assistance or the return of matter data. The Nebula page describes 'export options designed to support regulatory, litigation, and investigative requirements' as part of production, and 'Flexible Promotion to RelativityOne', but a production and promotion path is not an exit right: no format list, no cost, no timetable and no post-termination access window is published. The relevant terms sit in an unpublished client agreement.
Ask: On termination, in what formats and over what period can we take out the full matter - data, images, work product, coding decisions and audit trail - and at what cost?
The Nebula page publishes one named integration, 'Flexible Promotion to RelativityOne' - 'Select and promote only relevant, defensible data into RelativityOne when matters require enterprise-scale review' - and describes ingestion as 'Securely upload data into Nebula for automated processing, deduplication, indexing, and metadata normalization.' The vendor also publishes a Remote Collection Manager under its services, and ReadySuite and Client Portal as separate software. No API documentation, connector catalogue or list of supported collection sources was opened, and no practice management or document management integration is published.
Ask: Which collection sources and firm systems can feed Nebula directly, is there a documented API, and does the RelativityOne promotion require a RelativityOne subscription of our own?
Whether the platform reaches outside the collected data
Not confirmed
Nothing published states whether any Nebula AI component retrieves material from outside the data collected for the matter. The published pipeline is internal - ingestion, processing, deduplication, indexing, metadata normalisation, analytics, review and production - and the Interactive Timeline is 'Automatically generated from system metadata', but no statement excludes external retrieval or web access, and the unopened Nebula AI Case Explorer page may address it.
Ask: Can any Nebula or AI Case Explorer feature retrieve content from outside the matter workspace, and can that be switched off for our matters?
Whether AI components act without a human instruction
Not confirmed
The published AI functions are analytical - prioritisation, clustering, continuous active learning, categorisation, entity recognition, sentiment analysis - and the page states the design intent as accelerating understanding 'without introducing black-box automation'. No statement says what an AI component may do without a human instruction, whether automatic coding, culling or production decisions can be applied to documents, or whether an administrator can constrain them. The AI Case Explorer page, which introduces intelligence 'upstream' at ingestion according to the vendor's own module naming, was not opened.
Ask: Can any AI component code, cull, withhold or produce a document without a reviewer's decision, and what administrator controls limit that?
The Privacy Policy section (N) states 'KLDiscovery does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Where AI Technologies inform decisions, individuals are required to review and verify AI-generated outputs before relying on them, and final decisions remain the responsibility of the relevant human reviewer.' That provision is expressed for personal data KLDiscovery controls, not for matter data. On the product side the page states the platform is 'Designed to accelerate understanding without introducing black-box automation' and that machine learning tools 'accelerate review while preserving defensibility and analytical transparency', with no published validation method, sampling protocol or accuracy measure.
Ask: What defensibility documentation does Nebula produce for a predictive coding or AI-assisted cull - sampling, recall estimates, validation reports - that we could put before an Australian court?
