Epiq Acquires Data Breach Response Software Provider Canopy

Epiq's Canopy Purchase Turns a Referral Partner Into an Owned AI Product — and Buyers Lose an Independent Option

Epiq, the legal technology and services provider, announced on September 25, 2026 that it has acquired Canopy, a data breach response and privacy software company it had previously partnered with rather than owned. Financial terms were not disclosed. Canopy's patented platform, which detects sensitive information and identifies impacted individuals after a breach, will be folded into Epiq AI, Epiq's agentic AI suite, and offered through Epiq Service Cloud. Former Canopy Chief Operating Officer Adi Elliott joins Epiq as Vice President of Product Management, Cyber, along with Canopy's engineering and cyber response staff. Epiq's own release states it already works with more than 87% of breach counsel and over 70% of cyber insurers, handles more than 1800 cyber incidents a year, claims up to 95% data reduction using AI, and can generate up to 2 million notifications a day.

Why buy a company Epiq was already partnering with?

Epiq is converting a long-standing referral relationship into an owned product line, folding Canopy's breach-detection software and staff directly into Epiq AI instead of routing clients to an outside vendor.

Epiq's Scott Berger, Senior Vice President of Managed Services and Cyber Solutions, called Canopy "a longstanding partner to Epiq" before the deal — language that signals this was less a bet on a stranger's technology than a decision to stop sharing margin, and data access, with a company Epiq's own clients were already using. Bringing Canopy's Auto Review agentic AI feature in-house also gives Epiq a second AI engine, alongside its own, sitting on breach data rather than a third party's.

Can you trust the numbers in Epiq's release?

Treat the 87%, 70%, 1800-incident, and 95%-reduction figures as Epiq's own marketing claims, published with no independent audit or defined methodology attached.

Neither Epiq's release nor the coverage of it explains how "87% of breach counsel" is counted, over what period the 1800 incidents ran, or what baseline the "up to 95% data reduction" is measured against. "Up to" figures describe a ceiling, not a typical result. Buyers evaluating cyber response or e-discovery vendors should always ask for the denominator behind a percentage and whether it's been checked by anyone other than the company reporting it.

What should e-discovery and cyber-response buyers ask now?

Ask whether Canopy's Auto Review AI trains on client data, whether pricing changes now that an independent alternative has disappeared, and how custody transfers across merged platforms.

Once Canopy sits inside Epiq Service Cloud, a client no longer has the option of pairing Epiq's e-discovery work with a separate breach-response vendor as a check on either one. That's the same tenancy and training question this site has raised before in coverage of AI-driven review platforms: does the vendor process sensitive, often privileged, data in a shared model, or does the client control its own instance and keys. Get that answer in writing before renewing.

Frequently asked questions

Was the purchase price disclosed?

No. Neither Epiq's announcement nor Law.com's report of it included a purchase price or other deal terms.

Does this change Epiq's core e-discovery review product?

Not directly. Canopy is being integrated into Epiq AI for cyber incident response, a distinct offering from Epiq's review tools, though the AI investment behind both overlaps.

Who moved over from Canopy?

Former Canopy COO Adi Elliott joins as Vice President, Product Management, Cyber, along with Canopy's engineering and cyber response teams.

Sources: Law.com and eDiscovery Today.