Needl.ai

The removal test is decisive. There is no terminal beneath this product, no workflow system of record, and no licensed content estate that would hold value on its own. What the customer buys is retrieval, synthesis and causal reasoning over material the customer already owns, which is model output end to end.

The company is explicit that the models and the data are commodity and that the product is the context layer built on top, and it holds seven patents on the retrieval and reasoning engine. Strip the models and what remains is a set of connectors and a permissions layer, which is a pipe to somebody else's data rather than a product.

Provenance is applied as a default rather than an option: every answer is returned with a citation the user can open, a full audit trail is claimed on every conclusion, and retrieval is bounded in advance by the user's own entitlements, so the system cannot answer from material the person is not cleared to see. The report products add automatic trust scores and red flag alerts, and the stated design intent is that analysts review flags rather than blank pages.

Held at B rather than the intellectai route to an A, which requires provenance and confidence surfaced together at every decision, because the trust score is never defined: no scale, no basis, no statement of what happens at a low score, and no abstention behaviour described. An undefined confidence signal earns nothing, on the same principle the credential test applies to an ambiguous certification claim.

The strongest external model evidence in this pocket and the direct answer to the unverifiable comparative that Hudson Labs was marked down for. Needl cites a placement on the Long-document QA leaderboard of S and P AI Benchmarks by Kensho, naming the evaluator, the benchmark and the systems it was measured against.

That benchmark is real and independent: a 225 question evaluation set built with S and P Global experts on the DocFinQA research dataset, published at ACL 2024, with a submission process requiring only model outputs. Two things cap it at B. The standing index rule is that being tested by somebody else is not the same as helping an institution validate the model itself, and no validation pack, error taxonomy or customer testable evaluation is offered.

And the claim hygiene around it is poor: no hallucination as a headline, accuracy quoted at 97 percent, 98 percent and in one case study as 95 to 100 percent and above, which is not a number that can exist, against an unsourced assertion that industry LLM accuracy is 16 percent. Best third party measurement in the pocket sitting beside the weakest self reported claims in it.

Both halves of an A are present and they are never joined. Named customers exist: GrayArch Partners, Scotia Wealth Management, Oaklane Capital Management, MSquared. Quantified outcomes exist: diligence work of three months completed in one week, analyst effort down more than 60 percent, a single alert credited with a 250,000 dollar gain on a trading desk, first draft reports in under ten minutes, deployments described at 750 million dollars and 10 billion dollars of assets.

But every quantified outcome is attributed to an anonymous role at an unnamed firm, a Managing Director at a US private equity firm, a Chief Analytics Officer at a global ratings agency. The evidence bar for an A is a named customer carrying a number. This vendor publishes named customers and publishes numbers and pairs none of them.

A direct answer to the pooled corpus question, which is the third this sweep has recorded after Mortgage Capital Trading and AlphaSense: the company states plainly that it never trains shared models on customer data, and pairs it with zero data leakage, no shadow AI, and a permission aware layer that keeps retrieval inside each user's entitlements. Held below AlphaSense's A because that vendor added the second clause and this one does not.

AlphaSense binds its model providers to zero data retention, extending the commitment to parties the customer never contracts with. Needl settles the question inside its own platform and says nothing about what the frontier providers in its architecture do with content routed to them, which matters more here rather than less, because routing to external models is an explicit part of the design.

A published privacy policy, terms of service and a GDPR posture, and nothing beyond that. No subprocessor list, no retention schedule, no deletion commitment, no data processing agreement referenced, no residency detail beyond the general claim that the system runs in the customer's own environment, and no mention of GLBA at all despite banking and wealth management buyers.

The architectural claim that data stays inside the customer perimeter is genuinely privacy relevant, but it is a deployment fact and it is already credited on the deployment and stewardship axes. Crediting it a third time here would be double counting a single design decision as three separate disclosures.

Three real audited credentials, enumerated rather than asserted: ISO 27001, SOC 2 with the Type stated as II, and a Google CASA assessment, presented on the homepage and backed by a dedicated Trust and Security page. Enumeration with the Type named is exactly what the credential test rewards and it puts this well clear of the bare certified claims catalogued elsewhere in this index.

Two things hold it below an A. First, nothing is obtainable: no report request route, no bridge letters, no policy library, no penetration test disclosure, and a targeted trust portal search under the standing rule returned nothing further. Second, the badge row itself fails part five of the credential test in two places. GDPR sits in the row as though it were a certification, and it is a regulation nobody can be certified against, the same shape as the statutes Vodex listed. The ISO entry is versioned as 27001:2023, which is not an edition of that standard, the current edition being 27001:2022.

A software vendor sitting outside the regulatory perimeter. No licence, no registration, no supervised programme, no regulator run sandbox, and no enrolment in a data or access scheme of the kind that earns a B elsewhere in this index. Its customers are regulated and it is not, which is the ordinary position for this pocket.

No fairness disclosure, no evaluation across document types, issuer sizes, languages or filing conventions, and ISO 42001 explicitly not held, shown on the badge row as coming soon. The exposure here is sharper than for a pure research tool because two of the eight named workflows produce judgments about third parties rather than summaries for the buyer.

Credit rating report generation and credit memo drafting turn model output into a credit opinion about an issuer or borrower who is not the customer, and if the models read some filing styles, sectors or non native English disclosure less reliably than others, some issuers are drafted worse than their finances warrant. A third exposure sits in the alerting layer: ranking and routing decide which arguments a desk meets first, and nothing states whether that ranking is even across coverage.

Nothing states who bears the cost when a figure in a drafted investment committee memo or credit opinion is wrong, how an error is reported, whether corrections propagate to reports already circulated, or what the customer is owed. The gap is made pointed by the vendor's own headline, which asserts no hallucination as a product property. A vendor claiming an absolute has a stronger obligation to describe the failure case, not a weaker one, and this one describes none.

The second party problem also appears, as it did with Hudson Labs: an issuer whose filings are drafted into an unfavourable credit opinion is not a customer, has no relationship with the vendor, and no route to contest what was written about it.

Five foundation model families named outright in the published architecture, GPT, Claude, Gemini, Llama and Mistral, positioned as commodity and interchangeable, with the customer able to bring their own model instead. That is two more families than Terminal X named and it adds the strongest structural answer available on this axis, which is letting the buyer choose the provider.

Off an A for the usual omissions and one specific to the design: no versions, no country of processing, no statement of which content categories may be routed to which external model, and no disclosure of what the default is when a customer brings nothing of their own.

Eleven source systems named outright: Gmail, Outlook, Google Drive, SharePoint, Slack, Teams, Dropbox, Box, Salesforce, HubSpot and Snowflake, plus an open API for anything else, unified into what the company calls a governed, permission aware layer. Naming the systems is the thing Terminal X was marked down for omitting in this same pocket.

Held below an A because every named system is general enterprise software, email, file storage, chat, CRM and a data warehouse, and no financial system of record appears: no portfolio accounting platform, no order management system, no named virtual data room, no core banking. The integration is broad across the office and shallow into the finance stack.

A genuine and unusual deployment answer on an axis that is C 271 times across this index: the system runs inside the customer's own environment under the customer's access controls, in cloud or on premise, with customer supplied models supported. Held below an A on resolution and on an unresolved tension.

No cloud regions, providers or supported topologies are named, and the flat claim that nothing is sent out sits directly above an architecture diagram whose foundation layer lists GPT, Claude and Gemini alongside Llama and Mistral. The last two are open weight and can run inside a perimeter; the first three cannot, so either the claim applies only to open weight deployments or content does leave when a frontier model is used. Nothing published resolves which, and a buyer would need that answered before a residency review.

No pricing published at any level. No list price, no tier structure, no seat or usage basis, no indication of what a deployment costs or how it scales. Every commercial route on the site terminates in a demo booking, and the company describes itself as a consultative partner building a custom platform per customer, which points to fully negotiated pricing. For a product sold on lowering cost per unit of assets under management, no cost figure of any kind is available to a buyer.

Five named buyer segments sitting on genuinely different sides of the same information problem: private equity and private credit, asset management, banking and capital markets, wealth management and private banking, and credit rating agencies. Eight distinct named workflows across them, from investment committee memos to suitability checked client answers to credit opinion drafting. Four named customer logos plus described deployments at a large consultancy and a major ratings agency.

Held below an A on scale rather than breadth: roughly 45 staff, a small disclosed customer count, and no figure for total institutions served, against the A tier in this pocket where AlphaSense states 6,500 organisations including 88 percent of the S and P 100.