Luthor

Nothing survives the removal test. The product is real time checking of marketing claims against regulations, firm policy and approved sources, delivered through models the company describes as proprietary and trained on regulatory data. Strip them and what remains is an approval queue and an archive, which is the process the company was founded to replace.

The human expert tier does not change this reading and is worth stating explicitly so it is not misread later: former regulators are an escalation path for complex cases, not the base service, and the volume of ordinary review that makes the economics work is done by the models. Placed with the agent native cohort.

The oversight tier is structural rather than asserted, which is what earns the grade. Complex cases escalate to named categories of human expert, former securities regulators, examiners and compliance officers, so the boundary between what the model decides and what a qualified person decides is staffed rather than described. Content is checked before publication and every message is logged for audit.

The company also publishes a clear statement of where automation should stop, that a model may draft, flag, classify and recommend but should not publish, approve exceptions, change policy or override required disclosures without human approval. Held at B because that statement is guidance offered to the market rather than a description of this platform's own thresholds, and no confidence measure, escalation trigger or sampling audit of automated decisions is published.

No accuracy, precision or recall figure, benchmark or validation method was located. Describing the models as proprietary and trained on regulatory data is provenance rather than performance, and the published efficiency claims measure speed, which is the category wide substitution recorded against every vendor in this pocket. There is a sharper version of the point here than elsewhere.

The company's own published guidance instructs firms to log the model version alongside every response and reviewer decision, so it understands precisely what a defensible model record contains, and reports none of the equivalent for the system it sells.

The B bar is met properly rather than by argument: a named customer at a named firm is quoted by name and title, a commercial mortgage broker describing the specific regimes the product has to satisfy for his materials. Alongside it sits a scale claim that customers collectively represent more than 850 billion dollars in assets under management, and a stated buyer mix spanning financial services firms, mortgage lenders, banks, credit unions, marketing agencies and venture firms, with a large law firm in pilot.

Held off an A because no quantified outcome is attached to any named customer: the efficiency figures that circulate, review cycles falling from weeks to hours and manual review time cut by up to 80 percent, are unattributed, and the comparison articles carrying several of them are published on the vendor's own domain, which is content marketing rather than independent evaluation.

One fact points the right way and is recorded rather than credited: the models are described as trained on regulatory data, which is public source material, rather than on customer content, so the most obvious pooling risk may not arise by construction. Nothing published confirms that reading or addresses the rest.

No boundary statement covers whether reviewed content, flag outcomes or reviewer corrections inform anything shared, and the customer mix makes the question live in an unusual way, because marketing agencies serving several competing financial firms sit on the same platform as those firms, so material from one client of an agency and material from that client's rival can reach the system by two different routes.

The trust centre asserts full data privacy controls and portability alongside immutable record retention, which is more than most peers state and less than a position. Portability is a real right to offer and the retention architecture is the correct shape for a regulated archive, but neither is a policy: no lawful basis, no retention period, no deletion commitment on termination and no subject rights process was located.

The exposure is moderated by scope, since the material under review is a firm's own marketing rather than consumer records, but the platform also scans live websites and social channels belonging to the customer, and marketing agency customers bring third party client material into the same system.

Notably better disclosed than several vendors in this competitor set that are ten times its age, which is worth recording because it shows the gap elsewhere is a choice rather than a function of maturity. A trust centre exists as a published destination, and the controls behind it are named rather than gestured at: independent auditing with regular penetration testing, 256 bit encryption at rest, current transport layer security in transit, and immutable record retention built for regulatory archival.

Held at B rather than A because the audit is described without naming the framework or the report, so a buyer learns that an independent assessment happens without learning which standard was assessed against, its scope, or when it was last performed.

Correct posture for a technology supplier, with rule level mapping that is specific and unusually wide for the company's age, naming the securities marketing rule, advertising rules, federal trade standards, the consumer protection prohibition, consumer credit rules, state requirements, mortgage licensing obligations and the securities records retention standard. Domain provenance is genuine and staffed rather than claimed, since former regulators and examiners work inside the service.

Graded at B because none of that is admission: employing former supervisors is credibility, not supervision, and no regulator run programme, supervised test or formal authorisation of the product was located.

The company publishes a genuinely useful governance framework for artificial intelligence in compliance work, covering how to define the limits of automated authority, restrict which systems and data a model may reach, log prompts, responses, source documents, model version, reviewer and final decision, and require human approval for high risk categories including performance claims, fee comparisons and lending terms. All of it is addressed to customers about their own programmes.

None of it is disclosure about Luthor's own models: no fairness position, no testing programme, no independent assessment and no per category accuracy. Publishing a governance standard while not reporting against it is a pattern this competitor set repeats, and it is worth naming because the vendor best placed to demonstrate the standard is the one that wrote it.

No accuracy warranty, service commitment or remedy was located, and this vendor raises a question the pure software peers do not. Former securities regulators and compliance officers validate complex cases inside the service, which sits close to a line: a determination by a former examiner about whether a marketing claim satisfies a rule looks materially like professional judgement, and nothing published describes whether it is delivered as advice, who stands behind it, or what happens when it proves wrong.

The same structural question was recorded against another vendor in this index operating an affiliated law practice. Downstream, the investors and borrowers who receive an approved communication have no relationship with either party.

The company states that it uses proprietary large language models trained on regulatory data, which asserts ownership and training corpus while naming no base model, no provider, no version and no hosting arrangement, so a buyer cannot tell whether proprietary means models built from scratch, fine tuned from a foundation model, or a general model behind a domain specific layer.

The asymmetry is pointed because the vendor's own published guidance tells firms to record the model version behind every automated compliance decision, which is advice it does not follow in what it discloses about itself, and a customer taking that advice literally could not comply using public information about this product.

Coverage of the content estate is real and runs across three surfaces, with continuous scanning of live websites, email and social channels in real time rather than review of uploaded files alone, which is what allows the platform to catch material that never passed through a compliance queue.

The stated design intent is to operate inside existing marketing workflows rather than as a separate application, which is the right principle and the one that separates a tool people use from a tool people forget. Held at B because that intent is asserted without a list: no named integration to a project tool, design tool, content platform, storage system or customer relationship system was located, and no public application programming interface documentation or connector catalogue was found.

Delivered as cloud software with no hosting region, tenancy model, residency option or subprocessor list located. The trust centre addresses how data is protected in transit and at rest and how records are retained, which is the security question rather than the residency one, and the two are routinely conflated in vendor material.

For a United States focused product serving United States regulated firms the question arises less often than for a global vendor, but immutable retention of a regulated archive makes the location and control of that archive a reasonable procurement question, and nothing published answers it.

No rate card, tier ladder or billing basis was located and the route to a number is a conversation. The gap is more awkward for this vendor than for a pure software peer because the offering bundles two things that are normally priced very differently: software review at volume, and on demand access to former regulators for complex cases. A buyer cannot tell from public material whether expert time is included, metered, or sold separately, which is the single most useful thing a published price would settle here.

Buyer breadth is wide for a company two years old, covering registered investment advisers, wealth advisers, asset managers, broker dealers, mortgage lenders, banks, credit unions and fintechs, plus the marketing agencies that serve them and a large law firm in pilot.

Regulatory breadth matches it across the United States, spanning securities marketing and advertising rules, federal trade standards, consumer protection prohibitions, consumer credit rules, state requirements and mortgage licensing. Held at B on two grounds. The encoded regimes are United States ones, and while international frameworks appear in the vendor's published comparison material, they are not evidenced as shipped coverage. And no customer count is given, with the assets under management figure describing the size of customers rather than how many there are.