Legal Hold Software vs. Managed Service

The evaluation usually starts the same way. Someone tracked hold acknowledgements in a spreadsheet through one matter too many, a demo gets scheduled, and within a fortnight there is a shortlist of platforms and a rough budget number. Somewhere in that fortnight the actual question changes shape without anyone noticing: it stops being "how do we make our hold process defensible" and becomes "which of these three tools do we buy."

Those are different questions, and the second one only has a good answer if the first one already does. This is a comparison of the two ways organizations solve the problem, written by people who sell one of them, so read the section on when you do not need us with appropriate suspicion and then check it against your own numbers.

What legal hold software genuinely does well

Start with the honest part: the category works. Legal hold platforms automate a set of tasks that are tedious, error-prone by hand, and directly relevant to defensibility.

• Notice distribution. Templated notices, sent to a defined population, with the sent date recorded automatically rather than reconstructed later from an inbox.
• Acknowledgement tracking. The single largest source of manual effort in hold administration, and the one a spreadsheet handles worst.
• Escalation and reminders. Automatic follow-up on a schedule, escalating to a manager after a defined interval, without anyone remembering to do it.
• Custodian questionnaires. Structured interview responses captured against the custodian record instead of scattered across email threads.
• Release and refresh workflows. Periodic re-issuance, and a controlled release at matter close, which is where organizations most often leave holds running indefinitely.
• The audit trail. A timestamped record of who was noticed, when, what they were told, and when they acknowledged. Building that record after the fact is expensive and looks exactly like what it is.

If your current process is a distribution list and a spreadsheet, a platform is a real improvement in a real risk area. Nothing below is an argument against buying one.

What legal hold software does not do

Every capability in that list operates on inputs the software does not produce. A hold platform sends a notice to the custodians you give it, about the scope you define, covering the systems you identify. It has no view on whether that list is right.

The decisions that determine whether your preservation is defensible all sit upstream of the tool:

• When the duty attached. A judgment call about when litigation became reasonably anticipated, made on facts a platform never sees.
• Who the custodians are. Derived from the claims, the org chart, and interviews. A tool can hold a list; it cannot tell you the list is missing the departed regional manager whose successor inherited the account.
• Where the data lives. Preservation reaches systems, not just people. Mapping data sources is a standing exercise the software assumes you have already done.
• What the notice has to say. Scope language that is too narrow leaves data unpreserved; too broad and custodians ignore it. This is drafting, and drafting is judgment.
• The systems side of the hold. Suspending auto-delete, preserving a departing employee's mailbox before deprovisioning, dealing with chat and collaboration retention. Most of that happens in administrative consoles the hold platform does not touch.
• Defending any of it. When the process is challenged, the platform produces a report. Someone still has to explain why the scope was reasonable.

The failure mode nobody demos

The predictable way this goes wrong is deploying a tool onto a process that was never defined. The platform is configured, templates are loaded, and the first matter goes out. Because the tool has fields, the fields get filled. Because nobody decided what belongs in them, they get filled inconsistently.

Six months in, the symptoms are recognizable. Two matters with near-identical facts have custodian lists that differ by a factor of three, because different people scoped them and neither wrote down why. Notice templates have quietly forked into eleven variants. Acknowledgement rates sit at seventy percent and nobody owns chasing the rest. Holds from closed matters are still open because release was never assigned to anyone.

None of that is a software defect, and no configuration change fixes it. The tool did what it was told. What was missing was the decision layer, and buying a platform is the most common way of postponing the realization that you never built one. A tool imposed on an undefined process does not organize the process; it produces a very well-documented record of an inconsistent one.

When software plus your own process is genuinely the right answer

It often is. If the following describes you, buy the platform, skip the service, and spend the difference elsewhere.

• Matter volume is steady and moderate. Predictable flow means the same people handle holds often enough to stay fluent, and rarely enough that it fits alongside their other work.
• The data landscape is stable and small. One email tenant, one collaboration suite, a known set of file repositories, no recent acquisitions, no significant shadow IT. Scoping is close to a lookup.
• You have an experienced litigation-support function. Someone whose job includes discovery, who has run holds before, and who has authority to require things of IT.
• Legal and IT already work together. Preservation depends on this more than on any other single factor. If the escalation path to an Exchange or Workspace administrator is a name rather than a ticket queue, you are ahead of most organizations.
• The process is written down. Documented triggers, a scoping method, standard notice language, a refresh cadence, a release procedure.

Organizations that fit that profile do not need a managed service. They need the administrative burden lifted, which is precisely what the software sells. Buying more than that is buying reassurance.

When a managed service earns its cost

The economics change when the constraint stops being administrative effort and starts being judgment applied under time pressure.

• Volume is spiky. Four matters a year, then twenty-six after a product recall. Staffing to the peak is wasteful; staffing to the average means the peak is handled badly, and the peak is when scrutiny arrives.
• Data crosses borders. Preservation touching EU or UK personal data brings privacy obligations that run against your discovery obligations. That conflict is resolved by analysis, not by a workflow.
• Novel or ephemeral sources. Disappearing messages, personal devices under a bring-your-own-device policy, collaboration platforms with short default retention, and whatever your business adopted last quarter without telling Legal.
• There is no dedicated litigation-support function. If holds are a fraction of someone's role and that someone is also handling contracts and compliance, the platform adds a system to administer rather than removing work.
• Sanctions risk is live. An existing spoliation allegation, a preservation failure in a prior matter, a regulator's attention. At that point the process itself is evidence, and independent execution is worth more than a licence.
• The environment is mid-change. Migrations, tenant consolidation, and post-acquisition integration all break preservation assumptions quietly, and the breakage surfaces months later.

What a court actually examines

This is where the defensibility argument gets misused in sales conversations, in both directions. Rule 37(e) applies when ESI that should have been preserved is lost because a party failed to take reasonable steps to preserve it and it cannot be restored or replaced. Reasonable steps is the operative phrase, and it describes conduct.

No court has ever asked what a party's hold platform was called. What gets examined is when the duty was recognized, how the custodian list was built and by whom, what the notice said, whether it reached the systems that held the data as well as the people, whether auto-deletion was actually suspended, whether the hold was refreshed as the case changed, and what happened when a custodian did not respond. A platform generates evidence about some of those. It answers none of them.

Which cuts both ways. A well-run manual process with contemporaneous documentation can be entirely defensible. A platform administered inconsistently produces a detailed, timestamped record of a process that was not reasonable — and hands it to your adversary in an exportable format.

Legal hold evaluation criteria that matter more than the feature grid

Vendors compete on feature counts because features are comparable in a table. The criteria that predict whether a deployment works are mostly not on the grid.

1. Does it integrate with your identity source? If the custodian list is not populated from your directory, it is maintained by hand, and it will be wrong within a quarter. Ask specifically about how departures propagate.
2. Does it reach the systems, or only the people? Direct in-place preservation in your email and collaboration platforms is a different capability from sending notices. Many tools do the second and describe it as the first.
3. How much administration does it need per matter? Ask for an honest hours estimate per matter and multiply by your annual volume. This is the number that decides total cost.
4. What does the audit export look like? Ask to see a real one, redacted. It is the artefact that matters when the process is challenged, and it is rarely in the demo.
5. Can it defend an inconsistent history? If you migrate mid-matter, what happens to holds issued under the old process? Every deployment faces this and few evaluations ask.
6. Who administers it when the person who configured it leaves? Institutional knowledge concentrated in one administrator is a common and unpriced risk.

The cost nobody budgets

The licence is the visible number and typically not the largest one. Implementation and directory integration are usually quoted. What is usually not quoted, and what dominates the total, is administrative time: scoping each matter, drafting and adapting notices, chasing acknowledgements the automation did not resolve, refreshing holds, coordinating with IT on system-level preservation, and releasing at close.

Estimate it directly. Take your annual matter count, estimate hours of legal and litigation-support time per matter across the hold lifecycle, and cost it at a loaded rate. In most organizations that figure exceeds the licence, sometimes substantially. It is also the figure a managed service replaces, which is what makes the comparison meaningful rather than a licence-versus-fee argument.

Questions that reveal a legal hold vendor's assumed process

Every platform is built around an implied operating model. The useful diagnostic questions are the ones that surface it, so you can check whether that model matches how your organization actually works.

1. Show me how a matter is scoped in your system. Where does the custodian list come from before it reaches this screen?
2. A custodian has not acknowledged after three reminders. What does the product do, and what does a person still have to do?
3. How does the tool preserve data for a custodian who left the company last month?
4. Which systems can you place under in-place preservation directly, and which do you only send notices about?
5. What happens to a hold when scope changes mid-matter? Is that a new hold, an amendment, or a manual re-issue?
6. Walk me through what your audit report shows about a hold that was scoped incorrectly and later corrected.
7. What does your average customer do that we would have to change to use this well?

The last one is the most revealing, and the answer tells you whether the product assumes a discovery function you do not have.

The decision, stated plainly

If your process is defined and your team is experienced, buy software; the tool removes administrative burden from people who already know what they are doing, and that is a good trade. If the honest answer is that your hold process lives in a handful of people's judgment and has never been written down, a platform will document that condition rather than fix it. Define the process first, whether you do that internally or with help, then choose a tool to run it.

Most organizations end up somewhere between: software for the administrative machinery, outside support for scoping in the hard matters and for periodic review of whether the process still fits the data landscape. That is usually the right shape, and it is a smaller commitment than either vendor category tends to propose. The starting point is the same in every version: a documented hold process that names the trigger, the decision-maker, the scope method, and the release. Whether it runs on a platform or a well-maintained spreadsheet is the second question.