eDiscovery and Litigation Data Management Software: Controlling Hosted Volume Before the Monthly Bill Decides Your Case Budget

Why the hosting invoice arrives before anyone knows the case

A matter lands on a Friday. Twelve custodians, five years, Microsoft 365 plus Slack plus two phones. Legal hold notices go out from a template in Outlook, tracked in a spreadsheet with a column for acknowledged. Collection is scoped by a vendor who quotes on estimated volume. Processing produces 4.1 terabytes, which becomes 2.8 after deduplication, which becomes a hosted set because everything gets promoted to review while the team works out what matters.

Six weeks later the first hosting invoice arrives and the litigation partner discovers that the case budget he agreed with the client assumed a fraction of that volume. Nobody made a bad decision. It is just that the decision that determined the cost, what to promote into hosted review, was made by default under time pressure by people who had no cost visibility at the moment they made it.

Meanwhile two custodians never acknowledged the hold, one left the company in month two and their mailbox followed the standard retention policy, and there is now a preservation question that will be raised by the other side. Across litigation support projects we have delivered, this shape repeats: cost decided by inertia rather than judgement, preservation tracked in a spreadsheet, and a production process where the defensibility rests on one person remembering what they did.

Problem 1: legal hold is a preservation obligation being run as an email merge

A hold is not a notice. It is an ongoing obligation with custodians who join and leave, systems whose retention policies must be suspended, reminders that must be issued and evidenced, questionnaires that establish where each custodian's data actually lives, and a release at the end that is as important as the issue.

Spreadsheet tracked holds fail in predictable ways. A custodian who never acknowledged and was never chased. An automatic deletion policy that kept running on a mailbox because nobody told IT. A departing employee whose device was wiped by standard offboarding. Under Rule 37(e) the consequences of losing electronically stored information that should have been preserved can be serious, and the first question is always what steps you took.

What a custom build does: holds are objects with a scope, custodians drawn from your HR (Human Resources) directory so leavers are detected automatically, acknowledgement tracking with escalation, scheduled reminders that are evidenced, and integration with the systems that hold data so preservation is applied and verified rather than requested. Custodian questionnaires capture where the data is, including personal devices and the chat tools that never appear on the IT asset list. When the matter closes, release is a recorded action, because holds left running forever are their own cost.

Problem 2: modern data does not look like email and processing tools were built for email

The hard part of a 2020s collection is not the PST. It is Slack and Teams, where a conversation has no natural document boundary and has to be exported into something reviewable, and where a message references a document by link rather than attachment. Those linked documents, sometimes called modern or cloud attachments, are the version at the time of collection and not necessarily the version the recipient saw, and reconstructing families around them is genuinely difficult work.

Nuix has a serious processing engine and handles difficult formats better than most. Relativity has the deepest ecosystem for what happens after processing. Neither removes the judgement about how a chat channel becomes a reviewable unit, how far a linked document trail is followed, and what you tell the other side about it at the meet and confer.

What a custom build does: an orchestration and chain of custody layer over your collection tools rather than a replacement for them. Every collection records the source system, the method, the date range, the custodian, the operator and hashes for what was acquired, producing an evidence log that survives challenge. Chat conversations are converted to review units by a documented rule you can defend, typically a channel and day boundary with participants preserved. Linked documents are resolved where the tenancy allows and logged where they cannot be, because a documented gap is defensible and a silent one is not.

Problem 3: everything is promoted to hosting because nothing tells you not to

Per gigabyte hosted per month is the pricing model that dominates this market, and it means volume decisions are budget decisions. Yet the promotion decision usually happens before anybody has done any assessment, because the fastest route to reviewing anything is to host everything.

Culling is not new. Date filtering, custodian scoping, domain analysis, deduplication across custodians, email threading to suppress inclusive duplicates, and de-NISTing to remove system files can remove a large share of a corpus before review. The reason it does not happen consistently is that the tooling to make those decisions often sits on the other side of the hosting decision.

What a custom build does: an assessment layer that sits before hosting. Load metadata and extracted text into your own infrastructure, run search term reports, thread analysis, domain and date distributions, and show the litigation team the cost of each promotion decision in currency, not gigabytes, at the moment they make it. In our experience this is where a custom build pays for itself, because a partner looking at a screen that says promoting this custodian set adds a monthly figure to the matter will scope differently from one who is told the total afterwards.

Problem 4: privilege logging and production are where sanctions actually come from

Production has a form specified by agreement or order: image format with load files, native production for spreadsheets, a Bates numbering scheme that must not collide across volumes, redactions burned correctly, confidentiality designations applied under the protective order, and a privilege log that describes withheld documents sufficiently under Rule 26(b)(5) without waiving the privilege it protects.

Mistakes here are expensive and public. A redaction applied as a black box over selectable text. A privileged document produced because a family member was tagged and the parent was not. A production volume that overlaps a previous Bates range.

What a custom build does: production as a validated pipeline rather than a manual export. Pre production checks run automatically for text under redactions, family completeness, privilege coding consistency across families, Bates continuity and load file integrity, and the volume cannot be released until they pass. Privilege log entries are generated from coding fields with the description reviewed by a human, which is far faster than writing them from scratch and far safer than exporting whatever was typed in a comment box. Every production is reproducible, so when the other side queries volume three you can rebuild exactly what was sent.

Problem 5: nobody can model matter cost, so cost recovery is a guess

Firms pass eDiscovery cost to clients, and clients increasingly challenge it. The inputs are hosting by gigabyte by month, processing by volume, collection by custodian, review hours by reviewer level, and vendor pass through. Most firms compute this after the fact from invoices.

What a custom build does: a live matter cost model that accrues as the case runs and forecasts to completion under scenarios, so the answer to what happens if we add four custodians is a number in the meeting rather than a call to the vendor. Client billing draws from the same data with the pass through markup applied per your engagement terms. Corporate legal departments use the same model in reverse, to hold their firms to an agreed protocol and to compare cost per gigabyte across providers, which is the sort of comparison that changes panel decisions.

What this costs and how long it takes

Across the 2,000-plus projects Digital Heroes has delivered, here is the honest shape. A first release covering legal hold and custodian management, collection orchestration with chain of custody, pre hosting assessment and culling, and the matter cost model runs $120,000 to $250,000 and ships in 16 to 22 weeks. Extending into full review with coding panels, redaction, privilege logging and validated production runs $400,000 to $900,000 over 10 to 18 months.

We will be blunt about the boundary. Rebuilding what Relativity, Everlaw and DISCO do, including their analytics, their scale and their years of hardening, is a multi year programme well beyond those numbers and is almost never the right decision. The exception is a jurisdiction or a client requirement that forbids the data leaving your infrastructure, where hosting somewhere acceptable stops being optional.

What drives cost up in this category specifically: the number of source systems, because Microsoft 365, Google Workspace, Slack, Teams and mobile forensic tools are five separate integrations with five different export shapes. Volume, since infrastructure for terabyte scale text processing is a real engineering problem rather than a configuration. Multi jurisdiction data handling, particularly where personal data cannot be exported for review. And any requirement to run analytics or assisted review yourself, which is a specialist workstream.

What keeps cost down: building the hold, collection and assessment layer first and continuing to host review with your existing platform, which is what we recommend to most firms.

Build versus buy, and when buying is the right call

Buy your review platform. Relativity is the most extensible option with the deepest ecosystem, Everlaw and DISCO offer simpler commercial models and strong usability, and Nuix is the right answer if difficult processing is your bottleneck. For a firm handling ordinary matter volumes, that stack plus disciplined process beats any build.

Build the surrounding layer when two or more of these are true. Your legal hold tracking is a spreadsheet and you have had a preservation question raised against you. You cannot tell a client the cost consequence of a scoping decision at the moment the decision is made. You handle matters where data cannot leave a jurisdiction or must stay on your own infrastructure. Your collections span several systems and your chain of custody evidence is assembled from emails after the fact. Or you are a corporate department managing several outside firms and need one cost and protocol model across all of them, which no single firm's platform will give you.

How to choose a developer for litigation data software

Ask them what a family is and what happens when a parent email is privileged and an attachment is not. If that question needs explaining, they will build you a document management system with a legal skin and you will find out at your first production.

Ask how they would handle a Slack channel with 40,000 messages and links to cloud documents. The answer should include a documented rule for review units, resolution of linked documents where the tenancy permits, and logging where it does not. Anyone who says they will export it to PDF has not done this.

Ask what pre production validation they will build. Text under redaction, family completeness, privilege consistency across families, Bates continuity and load file integrity should be automatic gates, not a checklist someone runs. This is the difference between a defensible process and a diligent person.

Ask who owns the code, where data is hosted and how it is encrypted, in writing, before kickoff. You should own the repository and the infrastructure accounts. At Digital Heroes the client owns the code from the first commit, and for litigation data we would expect a security review and a documented deletion process at matter close, because holding client data after the obligation ends is a liability rather than a service.