Choosing an eDiscovery provider is an important decision, but selecting the provider is only part of the process. Before work begins, legal teams also need to understand exactly what they are agreeing to.
An eDiscovery contract can affect far more than the initial price quote. It can determine how data is handled, how costs change as a matter evolves, what support your team receives, how new data sources are addressed, what happens when the scope changes, and how easily you can retrieve your data when the matter ends.
So, what should legal teams review in an eDiscovery contract?
At a minimum, review the scope of services, pricing structure, hosting and storage terms, data security requirements, data transfer provisions, change-order language, support and service levels, reporting expectations, AI and technology provisions, termination rights, data return requirements, and liability terms.
The key is to look beyond the headline rate and understand how the agreement will work when the matter does not go exactly as planned.
This guide walks through the most important eDiscovery terms to review before signing, along with questions to ask your provider before committing to an agreement.
Before reviewing the pricing, make sure you understand what the provider is actually agreeing to do.
eDiscovery can span identification, preservation, collection, processing, hosting, early case assessment, analytics, document review, production, and presentation. Some providers offer all of these services, while others specialize in particular stages of the discovery lifecycle.
Your eDiscovery agreement should make it clear which services are included in the engagement and which may require a separate statement of work or additional fees.
Further, it’s important to be clear about which services are offered directly by the provider as opposed to those that may be delivered by a third party or outsourced as those items may require additional scrutiny for security or workflow clarity.
Pay attention to assumptions about:
This is especially important because the scope of a matter can change quickly.
A case may begin with several custodians and a collection of email and business documents. As discovery progresses, the legal team may identify additional custodians, mobile devices, Teams messages, Slack conversations, cloud repositories, or other sources of potentially relevant information.
The contract should give you a clear understanding of what happens when that occurs.
A well-defined scope does not have to predict every detail of a future matter. It should, however, establish a reasonable framework for handling changes without creating unnecessary uncertainty or more paperwork.
One of the biggest mistakes legal teams can make when reviewing an eDiscovery vendor contract is focusing too heavily on the quoted rate.
A rate is only one piece of the pricing model.
Depending on the provider and the services involved, costs may be associated with processing, hosting, storage, users, productions, collections, data transfers, exports, project management, analytics, AI tools, or specialized services.
That means two providers with similar-looking per-GB rates could produce very different total costs depending on what is included as part of that “all-in” rate.
Start by determining exactly what the provider means by "processing" and "hosting."
Is processing priced by gigabyte? Is hosting based on the amount of data uploaded, processed, or stored? Is data expansion and deduplication taken into account? Are there minimum monthly charges? Does the hosting rate change as more storage is consumed?
These distinctions matter because data can move through several stages during a matter, and the pricing model may treat each stage differently.
Ask the provider to explain how a typical matter would be billed from collection through production, rather than relying solely on the rate sheet. Even if volumes for your specific project are as yet unknown, ask for a sample quote based on some standard assumptions (like 50 GB, 500 GB and 1 TB).
User license charges can also affect the total cost of a matter, particularly when multiple attorneys, paralegals, reviewers, experts, or other participants need access.
Similarly, production costs can vary depending on the number and type of productions, required formats, volume, or other specifications.
Data exports deserve particular attention. A legal team may eventually need to move data to another platform, another provider, internal storage, or another environment. If the eDiscovery agreement includes separate export or transfer fees, those costs should be understood before signing.
Ask what happens when the actual matter looks different from the original estimate.
What happens if the data volume is substantially higher than expected? What if the matter lasts longer than anticipated? What if the volume is lower?
Some agreements include minimum commitments, volume thresholds, overage rates, time-sensitive or time-restricted pricing provisions or other clauses that can materially affect the final bill.
Find out whether third-party technology, specialized collections, translations, forensic services, AI tools, or other services are billed separately.
The goal is not necessarily to eliminate every variable cost. It is to understand them.
The most useful eDiscovery pricing terms are the ones you can predict before the invoice arrives.
For legal teams that want to understand the broader factors that influence discovery costs, an eDiscovery cost calculator can be a useful companion when reviewing contract terms.
Data can remain in an eDiscovery environment long after the initial collection and processing are complete.
That makes hosting and storage provisions particularly important for matters that remain active for months or years.
Look at how the agreement defines the data used to calculate hosting or storage charges. Is the measurement based on raw data, processed data, hosted data, or another metric? Are database artifacts, such as the text and metadata index, included in the hosting calculation?
Also determine whether the agreement distinguishes between active hosting and archived or inactive data.
Other questions worth addressing include:
These details can have a meaningful impact on long-running matters.
An eDiscovery provider may handle highly sensitive information, including confidential business records, personally identifiable information, privileged communications, intellectual property, and other material that requires careful protection.
Your contract should establish clear expectations for how that data will be protected.
Review provisions addressing encryption, access controls, authentication, security monitoring, incident response, breach notification, employee access, subprocessors, data retention, data deletion, disaster recovery, and the geographic location of data.
It is also worth looking at the provider's security certifications and infrastructure.
For example, Array's eDiscovery services are supported by a SOC 2 certified data center with 99.99% uptime and 24/7 access. But the larger contract review question is not simply whether a provider says it is secure. It is whether the security obligations and protections you need are clearly established for the engagement.
If your organization has specific vendor security requirements, make sure those requirements are addressed in the agreement or an incorporated security addendum. It may also be important to review clauses covering cyber security insurance coverage.
A provider's website may describe its security practices, but your legal and procurement teams should understand which commitments are actually contractual.
Data collection and transfer can become surprisingly complicated, particularly when a matter involves modern communication and cloud environments.
The contract should establish who is responsible for getting data into the discovery environment, what collection methods will be used, and how transfers will be handled.
Consider whether the agreement addresses:
This is also where it helps to think beyond traditional email discovery.
Modern matters may involve Teams, Slack, cloud storage, mobile devices, messaging applications, and other data sources that require different collection and processing approaches.
Your contract does not necessarily need to list every possible technology. It should provide enough flexibility and clarity to establish what happens when new sources are identified and how collections from various sources are typically priced – per hour or per source.
Few discovery matters stay exactly the same from beginning to end.
Imagine a matter starts with six custodians and approximately 500 GB of expected data. A few weeks later, the legal team identifies four additional custodians and discovers that relevant communications may also exist in a collaboration platform.
What happens next?
The answer should be reasonably clear from the eDiscovery vendor contract.
Look for language addressing change orders, additional custodians, new data sources, increased volumes, expedited services, additional productions, new users, and changes to project timelines.
Just as importantly, understand how those changes are approved and priced.
Does the provider need written authorization before beginning additional work? Can the provider proceed with work and invoice the client later? Are new services priced according to an existing rate card, or does the provider establish a new price?
A clear change-management process protects both sides. It gives the provider a mechanism to manage work outside the original scope while giving the client visibility into what that additional work will cost.
"Support is available" sounds reassuring until something goes wrong shortly before a production deadline.
Your eDiscovery agreement should provide enough detail to understand what customer service actually means.
Consider who your primary point of contact will be, when support is available, how urgent issues are escalated, and what response times apply to different types of problems.
For more complex matters, also consider the role of project management.
Will you have a dedicated project manager? What tasks does that person or team handle and which tasks are assigned to other divisions? Is project management included in the base price? Are the support resources located onshore or offshore? Who coordinates technical questions, productions, data transfers, and other matter-specific needs?
Service levels can be particularly important when deadlines are tight. A legal team should understand who owns the communication, resolution and rectification if a critical issue affects access to data, processing, review, or production.
The right questions are not simply, "Do you offer support?"
They are:
Who supports us? When can we reach them? How quickly will they respond? And what happens when an issue needs to be escalated?
Timely and detailed reporting can help legal teams make better decisions throughout a matter.
It can also help legal operations and procurement teams understand how a matter is using technology and resources.
Before signing, determine what reporting is included and how frequently it will be provided.
Depending on the engagement, useful reporting may cover data volumes, processing status, hosting usage, user activity, review progress, productions, transfers, billing, project milestones, and exceptions.
Also ask whether reports are standard or customizable, whether they are available on demand, and whether the information can be accessed in real time.
This is an area where visibility can become especially valuable as matters scale. If the legal team can clearly see what is happening with the data, it is easier to identify issues, manage budgets, and make decisions before small problems become larger ones.
AI is becoming an increasingly common part of eDiscovery workflows. That makes technology language an important part of modern contract review.
But "AI" should not be treated as a single technology or a cursory reference buried in the agreement. Instead, its use should be addressed with specificity and intent. If AI-assisted tools may be used, ask what tools are involved, what they do, how they are used, and how client data is handled.
Your review should address questions such as:
What AI tools may be used?
Understand whether AI-assisted review, predictive analytics, generative AI, automated classification, or other technologies may be used as part of the engagement.
Where does client data go?
Determine whether information is processed by the provider, a technology partner, or another third party. Understand where processing occurs and what data is transmitted.
Can client data be used to train models?
The agreement should make clear whether client data, prompts, outputs, metadata, or other matter information can be used for model training or product development.
Is AI use optional?
Find out whether AI-enabled services can be enabled or disabled based on the client's needs and requirements.
How is AI use priced?
Determine whether AI services are included in the existing pricing structure or subject to additional usage- or unit-based fees.
What controls are in place?
Ask how AI-assisted outputs are validated, documented, monitored, and incorporated into the broader discovery workflow.
These questions are particularly important because AI capabilities can change quickly. A contract that addresses technology clearly gives legal teams a stronger foundation for evaluating new tools as they become available.
For additional context, see Array's AI document review guide and, if applicable to your matter, learn more about Array Platform Intelligence.
The end of the relationship deserves just as much attention as the beginning.
Legal teams should know what happens to their data when a matter concludes, when a contract ends, or when they decide to move work to another provider.
Ask:
One useful way to evaluate these provisions is to ask:
If we needed to move this matter to another provider tomorrow, exactly what would that process look like?
If the answer is difficult to determine, the contract deserves another look.
Data portability gives legal teams flexibility. It can also become important when a matter changes hands, an organization consolidates vendors, or a case continues longer than expected.
Liability provisions can have significant consequences if something goes wrong.
Legal teams should know what happens to their data when a matter concludes, when a contract ends, or when they decide to move work to another provider.
Review the overall liability cap and determine whether it applies equally to every type of claim. Some agreements include different treatment for areas such as confidentiality, data security, intellectual property, or indemnification.
Also consider:
There is no universal liability provision that is right for every organization or matter. The appropriate terms depend on the services involved, the sensitivity of the data, the potential risks, and the organization's risk tolerance.
Legal and procurement stakeholders should evaluate these provisions accordingly rather than treating them as boilerplate.
The agreement should clearly establish who owns client data and what rights the provider has to access, process, retain, or otherwise use it.
This becomes particularly important when advanced analytics or AI tools are involved.
Review language covering:
If the agreement gives the provider broad rights to use data for analytics, benchmarking, product development, or other purposes, make sure the legal and privacy teams understand what those rights mean.
When technology is evolving rapidly, precise language can help avoid ambiguity later.
No single provision automatically makes an eDiscovery agreement unacceptable. However, certain terms should prompt additional questions before you sign.
A rate that does not tell the whole pricing story
A low per-GB rate may not mean much if users, productions, exports, transfers, project management, or other services are charged separately or if the rate “expires” after a certain amount of time.
Undefined "additional services"
If the agreement gives the provider broad discretion to charge for additional services without clearly explaining the approval process, ask for more detail.
Unclear data export costs
Your organization should know what it will cost to retrieve its own data and how long the process will take.
Broad pricing-change rights
Be cautious about provisions that allow rates to change without clear limitations, notice requirements, or protections for active matters.
Vague AI language
If the contract permits AI use but does not clearly address data handling, third-party providers, model training, or pricing, ask for clarification.
No meaningful service levels
General promises of support may not be enough for matters with strict discovery or production deadlines.
Open-ended scope-change costs
A contract should provide a reasonable way to identify, approve, and price work that falls outside the original scope.
Difficult termination or data return
Pay attention to long notice periods, substantial termination fees, restrictive export provisions, or unclear deletion timelines.
One-sided liability provisions
Liability caps and exclusions deserve careful review when the potential impact of a security incident, data loss, or significant service failure could be substantial.
Before finalizing an eDiscovery vendor contract, bring the provider into a direct conversation about the terms that matter most.
Here are ten questions that can help:
If the answer to one of these questions differs from the language in the contract, resolve the discrepancy before signing.
Contract review is not about predicting every possible problem.
It is about making sure your team understands what happens when the matter changes.
Discovery can expand unexpectedly. New custodians can emerge. Data sources can multiply. Production deadlines can move. Review strategies can evolve. Technology can change. A matter that was expected to last three months can remain active for years.
Your eDiscovery agreement should provide enough clarity and flexibility to handle those realities.
That means looking beyond the initial price and evaluating the entire relationship: scope, pricing, security, data handling, support, reporting, technology, AI, liability, termination, and data portability.
The right provider should also be willing to have those conversations before the agreement is signed.
What should legal teams review in an eDiscovery contract?
Legal teams should review the scope of services, pricing structure, processing and hosting charges, storage, data transfer, security requirements, support, service levels, reporting, scope-change procedures, AI and technology provisions, data ownership, termination, data return, liability, and indemnification.
The most important considerations will vary depending on the organization's requirements and the nature of the matter.
What are the most important eDiscovery pricing terms?
Pay close attention to how processing, hosting, storage, users, productions, collections, transfers, exports, project management, AI tools, minimums, overages, and price increases are calculated.
The goal is to understand the total pricing model rather than focusing on one headline rate.
What should an eDiscovery vendor contract say about AI?
If AI tools may be used, the agreement should provide clarity around what tools are involved, how client data is processed, whether third parties are involved, whether information can be used for model training, what controls apply, and whether AI services carry additional fees.
Can an eDiscovery provider change pricing after signing?
That depends on the terms of the agreement. Review provisions governing annual increases, pricing changes, new services, volume changes, and active matters. Any mechanism for changing pricing should be clearly understood before signing.
What happens to data when an eDiscovery matter ends?
The contract should establish how and when data is returned, the format in which it can be exported, any applicable transfer or export fees, how long the provider retains the information, and when the remaining data is deleted.
When should legal teams review an eDiscovery agreement?
Ideally, contract review should begin during the vendor-selection process, before the matter is fully underway. Early review gives legal, procurement, and operations teams time to address pricing assumptions, security requirements, service expectations, and other important terms before they become operational issues.
An eDiscovery contract should do more than establish a price. It should give your legal team a clear understanding of what the provider will deliver, what you will pay, how your data will be protected, and what happens when the matter changes.
If you're evaluating an eDiscovery vendor contract or preparing for an upcoming matter, Array can help you think through the technology, workflows, pricing considerations, and operational requirements that may affect your discovery strategy.
Talk with Array before your next eDiscovery matter.