Legal hold software that keeps every source held, checks it every morning and stops disposal before it runs
Disposal stopped before it happens, and a Rule 37(e) record verified every day.
See one case, screen by screen ↓Software that runs a legal hold from the trigger to the release: dating the duty to preserve, choosing custodians, sending the hold notice and tracking acknowledgements, preserving data in each system and releasing it when the matter ends. Legal Hold Management adds seven agents that also check every held source each morning and stop a leaver's reimage, wipe or deletion before it runs, while counsel signs every change and release.
How to choose AI solutions for back-office and enterprise work →
Updated
When litigation is reasonably anticipated, the duty to preserve starts. Legal sends the hold notice, chases acknowledgements by email and keeps a spreadsheet of who answered. But the data lives in systems Legal never sees: Microsoft 365, Slack, laptops, company phones, Salesforce, a PLM vault, HR files. Each needs its own hold, placed by IT, and nobody checks next month that it is still there.
Meanwhile the business keeps running its routines. A leaver's laptop is reimaged within days, the mailbox is deleted 30 days after leaving, the phone is wiped on exit, and someone shortens a retention policy. When a Rule 37(e) motion arrives, the question is whether the company took reasonable steps — and the record is rebuilt by hand from emails, tickets and spreadsheets, weeks later.
Estimated split for one mid-size litigation hold over its first months, by hand and with the solution.
Seven specialist agents scope, notify, hold, check daily and watch HR and IT; counsel signs every change and release.
Kessler Instruments says two of its former engineers, hired by Northbay Components, a Kestrel & Vane company, brought its pressure-sensor designs into the PX-400 programme. Its lawyers' letter arrives on Monday 21 September. Here is how the hold runs, screen by screen, in the working solution.
Rhea runs 31 active holds for the group. Hold HLD-2026-0147 opens as a grid: 24 custodians down the side, nine systems across — mailbox, OneDrive, Teams, Slack, laptop, phone, Salesforce, PLM vault, HR file. This morning 130 of 138 sources are preserved and verified, 21 of 24 custodians have acknowledged, and one row is red: Julia Moreno, who leaves on 16 October.
“Four disposals were scheduled on her data. The agent stopped each one on its own, under rule W-1, and needs two decisions.”
The intake agent reads Albright Fenn LLP's four-page letter and classifies it as a demand letter that threatens suit: “Kessler intends to commence proceedings.” It dates the duty to preserve from receipt, proposes the scope — Kessler, PX-400, PX-200 and the two hires, from 1 January 2023 — and sets the clock to issue by Tuesday 17:00. The hold goes out at 10:14 on Tuesday, 25 hours after the letter.
Search and collection stay locked until the hold is issued.
From the letter, the complaint, the org chart and message counts, the scoping agent proposes 25 people, each with the reason and a confidence: Elena Petrov ran the Kessler supply negotiations, with 412 messages to kessler-instruments.com. Sofia Grant approves 21, removes three with a reason each, and keeps a former employee's archived mailbox without a notice. It counts messages only; no content is read before the hold.
The scoping agent never adds or removes a custodian — counsel decides.
Notice v2 goes out in English, German and Spanish, in plain words: what this is, what to keep, what not to do, what IT has already done. The notice agent reminds on day 3 and day 7, escalates to the manager on day 10 and re-notices every 90 days. On this hold the median time to acknowledge is 1.1 hours; Diego Fuentes, after three reminders, has been escalated twice to Marcus Webb.
The notice agent never edits an approved notice; a new version goes to counsel.
Each custodian answers six questions when they acknowledge. Elena Petrov names Wen Liu, who ran the Kessler price comparisons; Wen Liu is added on 29 September. Hannah Brooks mentions a WhatsApp group, “PX400 bench”, with a contractor from Pellow Engineering. Arjun Mehta has a USB drive from his time at Kessler. Each answer becomes a proposal for Sofia, quoted word for word.
The interview agent never adds a source or a person itself.
The preservation agent placed holds the way each system supports them — litigation and case holds in Microsoft 365, Slack's legal hold, reimage blocks on laptops, wipe blocks on phones, retention locks in the PLM vault. Each morning it confirms every one is present: 2,974 checks since 22 September. Today the PLM vault timed out once and passed on retry at 07:10.
“A source counts as preserved only if it passed in the last 24 hours.”
The HR system records Julia Moreno's resignation, last day Friday. The watch agent matches her to the hold — she is named in the complaint — and finds what IT already has queued: ticket RITM-48213 to reimage laptop KV-LT-20931 on Friday at 17:00, an exit wipe of her phone, mailbox and OneDrive deletion 30 days after leaving, and Slack deactivation. By 09:14 the ticket is on hold, the wipe blocked, both deletions paused and Slack confirmed to keep her messages.
The watch agent may only stop a disposal. It never deletes, releases or drops a custodian.
The agent hands Sofia the two decisions it may not make, with the HR event, the ticket, the complaint paragraphs and its confidence of 0.98. She picks the reason code “Key custodian — keep after departure”, ticks that the decision is hers and types her name. The mailbox is kept as an inactive mailbox under hold, and Owen Mbeki images the laptop remotely: 238 GB, SHA-256 verified.
“I have read the evidence and this decision is mine.”
A joint stipulation filed on 9 October withdraws the PX-200 claims. The release agent proposes releasing the six PX-200 custodians and checks their 34 sources against 30 other open holds. Four of Marta Kowalski's — mailbox, OneDrive, Teams and Salesforce — are still needed by the Alder Systems warranty claim, so they stay held. Sofia signs; retention resumes on 30 sources, and each release notice says what stays held.
A full release stays closed until a dismissal, settlement or judgment is on the docket.
The defensibility record has every step with its time and source: letter to hold in 25 hours, 24 of 24 custodians told in writing, 2,974 daily checks with 3 exceptions cured, 0 sources lost, and the release with its authority. A draft preservation declaration is written from the log for Sofia to edit; nothing is filed until she approves it.
Every export is logged with who took it and why.
The same hold, seen by the four people who carry it — what their week looked like, and what it looks like now.
Seven specialist agents scope, notify, hold, check daily and watch HR and IT; counsel signs every change and release.
Reads each trigger — demand or preservation letter, complaint, subpoena, agency charge — classifies it, dates the duty to preserve, proposes subjects, period and key people, and sets the issue-by clock.
Proposes custodians and their systems from the trigger, the complaint, the org chart and message counts, with the reason and a confidence for each.
Sends notices in plain words and the custodian's language, tracks acknowledgements, reminds on day 3 and day 7, escalates to the manager on day 10 and re-notices every 90 days.
Places the hold each system supports and checks every held source each morning at 07:00, retrying failures three times and reporting pending, failed and cured.
Reads HR, identity, service-desk, device and retention events, matches each to every open hold, stops or pauses a scheduled disposal of held data and hands any keep, release or imaging decision to counsel with its evidence and confidence.
Reads every questionnaire answer within a minute of its return, turns a “yes” or a name into a proposal for counsel with the answer quoted, and drafts interview agendas.
Watches the docket for stipulations, orders, settlements and judgments, proposes releases source by source, restores retention and sends notices after counsel signs, and keeps the defensibility record and the draft declaration current.
Signs every custodian change and release. The agents propose; a named person decides.
Ask about a hold, a custodian, a system or a release. Every answer points to its source, and opens the screen it is about.
Why is Julia Moreno's data at risk?
She resigned this morning; her last day is Fri 16 Oct. Four disposals were scheduled: the reimage of laptop KV-LT-20931 in ticket RITM-48213, the exit wipe of her phone, mailbox and OneDrive deletion 30 days after leaving, and Slack deactivation. The watch agent stopped each one by 09:14 under rule W-1. She is named in the complaint, so Sofia Grant must decide to keep her in the hold and approve the image.
Who hasn't acknowledged the Kessler hold?
3 of 24: Diego Fuentes (escalated to Marcus Webb on 1 Oct and 13 Oct), and Priyanka Rao and Leo Martins (added 5 Oct, 2 reminders each). All their systems are already held, so nothing is at risk while we wait.
Can we release the PX-200 team?
Yes, with one exception. The joint stipulation of 9 Oct withdraws every PX-200 claim, so six custodians are held only for it. Four of Marta Kowalski's sources — mailbox, OneDrive, Teams, Salesforce — are still needed by HLD-2026-0122 and stay held. 30 sources would resume retention. Julia Moreno is not affected. Sofia Grant signs.
Draft the preservation declaration for Kessler
Drafted for Rhea Castellano to sign, from the log: the duty from the letter of 21 Sep, the hold 25 hours later, 24 custodians told in writing, 2,974 daily checks with 3 exceptions each cured within two hours, and the leaver disposals stopped before they ran. Nothing is filed until Sofia Grant approves it.
13 screens from the working solution, on its sample data. Pick one to see it large.
The clocks and guardrails the agents follow are settings — versioned, and approved by counsel before they change.
| Setting | Default | Choose from |
|---|---|---|
| Issue a hold within | 1 business day of the duty date | Any number of business days |
| Reminders | Day 3 and day 7 after the notice | Any two days after the notice |
| Escalate to the manager on day | 10 | Any day after the notice |
| Re-notice every | 90 days | Any number of days |
| Daily verification at | 07:00, local time of the business | Any time of day |
| Retry a failed check | 3 times, 10 minutes apart | Any number of retries |
| Look ahead for leavers | 14 days | Any number of days |
| Two counsel sign a release on holds open over 3 years | Off | On · Off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample hold · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Association of Corporate Counsel survey with a legal technology vendor, 2024 — 51% of US in-house teams manage holds by email, 35% by spreadsheet, vendor-sponsored; Beard Research v. Kates, Del. Ch. 2009 — adverse inference and $76,906.80 in fees and costs). Context: FRCP 37(e) on reasonable steps; Hoffer v. Tellone, 2d Cir. 2025. People, companies, matters, tickets and devices named on this page are fictional — characters and sample data in the working solution.
Software that runs a legal hold from the trigger to the release: dating the duty to preserve, choosing custodians, sending the hold notice and tracking acknowledgements, preserving data in each system and releasing it when the matter ends. Legal Hold Management adds seven agents that also check every held source each morning and stop a leaver's reimage, wipe or deletion before it runs, while counsel signs every change and release.
The watch agent reads HR, identity, service-desk, device and retention events and matches each to every open hold. When a custodian resigns, it puts the reimage ticket on hold, blocks the phone wipe and pauses the mailbox and OneDrive deletion under its rule, then asks counsel whether to keep the person in the hold and image the device.
Yes. The preservation agent checks every held source each morning, retries a failed check three times, and writes the result to the grid and the record. A source counts as preserved only if it passed in the last 24 hours; on the sample hold that is 2,974 checks in 23 days.
The scoping agent proposes people from the letter, the complaint, the org chart and message counts — never message content before the hold — with the reason and a confidence for each. Counsel approves every addition and removal, and questionnaire answers that name new people or sources come back as proposals.
The release agent proposes a release from a stipulation, order, settlement or judgment, and checks every source against all other open holds. Sources another hold needs stay held and the release notice says so; retention resumes on the rest only after counsel signs.
It keeps the record the reasonable-steps question turns on, as the hold runs: when the duty arose and the hold went out, who was told and acknowledged, what was held and every daily check, every exception and its cure, and every release with its authority. It also drafts the preservation declaration from that log for counsel to edit.
Yes. The agents propose and the watch agent may only stop a disposal. Counsel signs every custodian change, leaver decision, image and release with a reason code, and every action by a person or an agent is on an audit trail that cannot be edited.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your hold policy, notice templates and the systems your data lives in — and it goes live once every quality gate has passed. We will walk you through it on one of your own open matters first.
Every deadline met, and every page traced to the request it answers.
1-min demoPublic Records Request ManagementEvery withheld line cites its law, and every release goes out before the clock runs.
1-min demoLegal Intake & TriageRoutine questions answered in minutes; anything risky reaches a lawyer first.
1-min demoWe'll run Legal Hold Management on one of your own open matters and the systems it touches.