Product and intended use
Define the configuration, people, information and tasks being assessed.
How Analyzer is licensed and metered
Public claim only
The Australian product page FAQ, checked 2026-09-27 (page card date 2026-07-22), states that 'Analyzer is an enterprise capability included in Adobe Acrobat Studio. Every seat includes a credit allocation for Analyzer in Acrobat Studio usage and organisations can purchase additional shared credits to support higher volume.' Both calls to action on the page are 'Contact sales'. The Analyzer security overview dated August 2026 adds that an Adobe administrator must assign the user an Acrobat licence in the Adobe Admin Console, enable the Analyzer product toggle in the Acrobat product profile and give the user access to Acrobat Shared Credits, and that without Shared Credits access users are 'limited to read-only permission to view collections and extracted values that have been shared with them'.
Ask: For an Australian firm, how many documents or pages does a seat's credit allocation cover, what does an additional shared credit cost in Australian dollars, and what happens to a review in progress when the allocation runs out?
Where the product and its data storage run
Public claim only
The Analyzer security overview dated August 2026 states that 'The Analyzer web application, the Analyzer Generative AI Service, and corresponding data and file storage are hosted in Amazon Web Services (AWS) data centers in Virginia, USA and Frankfurt, Germany', and that 'Although Analyzer in Acrobat is built on the Acrobat Sign infrastructure, data remains separate and is not transferred or shared between the Analyzer in Acrobat and Acrobat Sign solutions.' Adobe's Document Cloud hosting page, last updated 16 September 2026, states that 'Analyzer in Acrobat and Knowledge Base in Acrobat are hosted and associated user-generated content is stored in the Acrobat Sign infrastructure in the United States and Germany.' No on-premises, private-cloud or Australian deployment is described in either document.
Ask: Which of the two data centres would hold an Australian firm's documents, can the choice be fixed in the order documents, and is an Australian region planned with a date?
Documented functions and inputs
Public claim only
The security overview describes five components: a web application for uploading and organising files, searching text, creating custom attributes, filtering, chatting with multiple documents and exporting reports; an AI Assistant conversational interface; the Analyzer Generative AI Service, which divides and indexes files and calls Azure OpenAI; Analyzer data storage holding attribute definitions, indexes and uploaded documents; and APIs. Extraction runs on 'standard attributes', predefined for contract terms, and 'custom attributes' written by the user in natural language and saved in the Analyzer database. The Australian product page states inputs are 'PDFs, Microsoft Word and Excel files and scans', that it can 'Search by meaning, not just keywords', and that every value carries 'source citations linked directly to the original document'.
Ask: What are the published limits on file size, page count, collection size and number of attributes, and which file types or document conditions are silently skipped?
Legal content and jurisdiction
Public claim only
No legal content library, citator or jurisdiction setting is described on either the Australian product page or the security overview; extraction is grounded only in the documents the customer uploads or syncs. The product page carries the footnote 'Analyzer in Acrobat Studio is a tool to support your compliance workflows; it does not constitute legal, audit or regulatory advice or certification.'
Ask: Does Analyzer apply any Australian legal or regulatory knowledge to an extraction, or is it confined entirely to the text of the documents in the collection?
Who Adobe names as the intended users
Public claim only
The Australian product page names the intended functions as 'Finance and Accounting, Procurement and Vendor Management, IT and Information Security, Sales and Revenue Operations and Compliance and Risk teams'; legal practice is not among them, although the same page names contract review, vendor agreements, statements of work, compliance documents, security questionnaires, policies and call transcripts as the document types, and 'contract review for revenue recognition' and 'vendor risk assessments' as use cases. The page states that 'Business users define and manage their own extraction projects, while IT retains administrative control, governance, security policies and enterprise integrations.'
Ask: Is Analyzer supported for use by a law firm on client matter documents, and does Adobe publish any guidance specific to legally privileged material?
Vendor content addressed to AI models, and marketing claims that need testing
Public claim only
A deliberate check for vendor content directing how AI should describe this product found none: no 'instructions for AI' block, and no /ai-info page, appears on the Australian product page or on the Adobe Trust Centre pages read on 2026-09-27. Adobe does publish a file at https://www.adobe.com/llms.txt addressed to large language models, opening '# Adobe Tools > Give your team a creative edge. Create something beautiful, boost productivity, and deliver engaging experiences with Adobe software.' It is a product directory with one-line descriptions and contains no instruction of the form 'describe this product as X'; neither Acrobat Studio nor Analyzer appears in it. Crawler allow and disallow directives, which are access control rather than narrative control, were not examined. Separately, two statements on the product page are marketing rather than contractual and are contradicted in their detail by the security overview: 'Neither your organisation's data nor documents are used to train Adobe's AI models', and 'Data remains within your organisation's tenet and is not used to train foundation models' - the second contains an apparent typographical error and is not a residency commitment, because the security overview states that content is passed to Azure OpenAI.
Ask: Which of the data-handling statements on the Analyzer product page are warranted in our agreement, and is the llms.txt file maintained - it does not mention Analyzer or Acrobat Studio at all?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and confidentiality
Not confirmed
Uploading or syncing a collection places client documents in AWS data centres in Virginia and Frankfurt and passes relevant content sections to Azure OpenAI, so a firm needs authority for an offshore disclosure before the first extraction. Section 2.4 of the Australian General Terms states the customer agrees not to collect, process or store Sensitive Personal Information using the services except as directly authorised by Adobe, as intended by the services, or as governed by the Product Specific Terms, and not to make such information available to Adobe or its third-party providers; the defined term covers financial information, health information, biometric data and children's personal information, which are ordinary contents of a litigation or family-law file.
Ask: Given section 2.4, does Adobe authorise the processing of financial and health information in Analyzer collections, and in what document is that authorisation given?
Foundation-model provider for this product
Public claim only
The Analyzer security overview dated August 2026 names the provider for this product: 'The Analyzer Generative AI Service currently leverages Azure OpenAI and enhances it with Adobe proprietary technology', and lists the data passed to Azure OpenAI as customer queries, prompts and relevant sections of content extracted from user-uploaded files. It states that 'Adobe has disabled logging in Azure OpenAI, helping ensure that Microsoft does not collect, review, or store any data sent for processing to Azure OpenAI', and that Adobe uses Microsoft Azure AI Content Safety configured to 'Medium' blocking on both input and output. No model name or version is published, the word 'currently' is used, and no customer model choice is described.
Ask: Which Azure OpenAI model and version serves Analyzer for an Australian customer, what notice would we get before it changes, and can we pin or refuse a version?
Subprocessors reached by an extraction
Public claim only
For Analyzer specifically the security overview names Microsoft twice - Azure OpenAI for extraction and generation, and Azure AI Content Safety for content filtering - and Amazon Web Services as the host of the web application, the service and the data storage. Adobe's sub-processor list, last updated 28 July 2026, is maintained under its data-protection terms with a subscription for updates, and states that Microsoft Azure 'provides cloud hosting services for Adobe Cloud Services (Experience Cloud, Creative Cloud, and Document Cloud)' and that 'Adobe also offers the use of the Azure OpenAI service to provide features within Adobe Apps/Services'; that list is written at Document Cloud level and does not name Analyzer, and it explains that the locations it gives are sub-processor headquarters and key hubs rather than the location of Adobe's instance.
Ask: Provide the sub-processor list scoped to Analyzer, including every party that can touch a synced SharePoint document, and our notice and objection rights when it changes.
Training on customer content
Public claim only
Section 4.3(A) of the Australian General Terms states 'We will not use these rights to train generative AI models on your Content and will not use the sublicence rights to have anyone else train generative AI models on your Content, except at your specific request', and section 2.2(F) states Adobe will not use Local or Cloud Content to train generative AI models except content submitted to the Adobe Stock marketplace. The Analyzer security overview adds that 'Adobe does not use any customer data to train or fine-tune Azure OpenAI models.' A separate mechanism, Content Analytics, is not model training: the Content Analysis FAQ dated 10 June 2026 states business and school accounts and profiles 'have been automatically opted out', with exceptions where the user is not signed in or takes part in feedback, betas, user studies or an improvement programme.
Ask: Confirm in our agreement that no document, attribute definition, prompt or extracted value in Analyzer trains or fine-tunes any model at Adobe or Microsoft, and that Content Analytics is off for every profile we hold.
Feedback and human review of submitted content
Public claim only
Section 2.2(G) of the Australian General Terms states that for Cloud Content human review may occur in limited circumstances, listed as when the customer asks, when the content is made publicly available, when it is flagged or reported as illegal or abusive, and when the customer opts in to a prerelease, beta or product improvement programme, and that Local Content is 'never' reviewed. The Document Cloud hosting page states that 'Reported Feedback data submitted by users is handled separately' under Adobe's content usage and handling practices. Neither document describes a feedback or thumbs control inside Analyzer, or whether such a control can be disabled for a tenancy.
Ask: Does Analyzer have a feedback or report control, what content does it send to Adobe, and can it be disabled for all of our users?
Retention of documents, chats and extracted values
Public claim only
The Analyzer security overview states that all chat interactions 'are recorded in the user's history and retained in Analyzer data storage until the relevant document or collection of documents is deleted', and that Analyzer 'stores user-uploaded documents, and the extracted standard and custom attribute values from these files in Analyzer data storage until the user deletes the file(s)'. Where documents are synced from SharePoint, 'Analyzer in Acrobat mirrors the retention policy of the SharePoint folder(s)'. There is therefore no maximum retention period: material stays until a user acts, and no backup retention interval is published.
Ask: Is there any tenancy-level retention or auto-deletion policy for Analyzer collections and chat history, and how long do deleted items persist in backups?
Deletion of documents and metadata
Public claim only
The security overview states that 'All documents along with their corresponding metadata are deleted after the user deletes them from the Analyzer web application.' The Australian General Terms provide that at the end of the licence term Adobe will use commercially reasonable efforts to allow the customer to transition content out, that the transition must be completed within thirty days of termination or expiry, and that at the end of that period Adobe reserves the right to delete the content. No certified deletion, no deletion timeline for backups and no administrator bulk-deletion process is described for Analyzer.
Ask: On exit, will Adobe delete every Analyzer collection, index, chat history and extracted value on request and certify that deletion in writing, and within what period?
Adobe and provider access to collection content
Public claim only
The security overview states that Adobe has disabled logging in Azure OpenAI 'helping ensure that Microsoft does not collect, review, or store any data sent for processing to Azure OpenAI', and that uploaded documents 'are visible to the user unless the user chooses to share collections of documents along with extracted values with other authorized users within the same admin organization'. Section 2.2 of the Australian General Terms states that 'A person may review your content on our servers in limited circumstances, such as upon your request, when you choose to let us use your content to improve our products or when your content is flagged or reported as illegal.' No break-glass or support-access process for Analyzer data storage is published, and no customer-inspectable access log is described.
Ask: Which Adobe teams can read documents in Analyzer data storage, from which countries, under what approval, and can we obtain a log of any such access?
Administrative control, entitlement and sharing
Public claim only
The security overview states that access requires an Adobe administrator to assign an Acrobat licence in the Adobe Admin Console, enable the Analyzer toggle in the Acrobat product profile and grant Acrobat Shared Credits; users are authenticated by Adobe Identity Management Services; and without Shared Credits a user has read-only access to collections shared with them. Sharing is described at collection level through a 'Share' button, to 'other authorized users within the same admin organization'. Whether a collection can be restricted to a named group, and whether a customer-accessible audit log of Analyzer activity exists, is not stated in any document read.
Ask: Can access to a collection be limited to a named group rather than the whole organisation, and is there a customer-accessible audit log of who queried or exported which collection?
Encryption
Public claim only
The Analyzer security overview states that 'All data is encrypted in transit over HTTPS using TLS 1.2 or greater' and that 'Data stored by Analyzer in Acrobat is encrypted at rest using AES 256-bit encryption', and adds that Analyzer 'encrypts user-uploaded documents on a per-document basis'. No key-management detail and no customer-managed or customer-held key option is described.
Ask: Who holds and rotates the keys for Analyzer data storage, and is a customer-managed key option available for an Australian enterprise agreement?
Independent security assurance
Not confirmed
No certification naming Analyzer was found. The Analyzer security overview refers questions to the Adobe Trust Center without naming a certification or audit scope, and the Australian Trust Centre page read on 2026-09-27 states that Adobe undergoes independent audits and links a compliance attestation list without naming any certification on the page itself. The attestation list itself was not retrieved within the evidence budget, so whether Analyzer sits inside any audited boundary is unverified.
Ask: Is Analyzer in Acrobat named in a current SOC 2 or ISO 27001 report, and if not, on what date do you expect it to be added and under whose control framework does it run today?
Contracting entity, liability and forum
Public claim only
The Australian General Terms state that for customers residing outside North America and Japan the relationship is with Adobe Systems Software Ireland Limited under the laws of Ireland, and that 'For customers in Australia, Adobe Systems Software Ireland Limited is acting as an authorised agent of Adobe Systems Pty Ltd. and is entering into this contract in its capacity as agent for Adobe Systems Pty Ltd.' No ACN or ABN is published in the terms. Total liability is limited to the greater of US$100 or the amount paid in the three months preceding the event; the services are supplied 'AS-IS' to the maximum extent permitted by law; consumer rights under the Competition and Consumer Act 2010 (Cth) are preserved, with liability for a statutory guarantee limited at Adobe's election to re-supply or its cost. Section 2.3(B) provides that Data Protection Terms apply to personal data collected from individuals outside the EEA and the UK; those terms and any enterprise agreement were not read.
Ask: Confirm the Australian contracting entity and its ACN for an Acrobat Studio enterprise agreement covering Analyzer, provide the Data Protection Terms and the Product Specific Terms that will apply, and state any negotiated liability cap.
Cross-border transfers and Australian Privacy Principle 8
Public claim only
The Analyzer security overview states that the application, service and storage sit in AWS data centres in Virginia, USA and Frankfurt, Germany, and that for the model 'Adobe restricts processing of Analyzer in Acrobat data to the customer's provisioned data sovereignty zone (either North America or EU)' - there is no Australian zone, so an Australian firm's documents are processed offshore. Section 2.5 of the Australian General Terms states 'We process and store information in the U.S. and other countries. By using our Services and Software, you authorise Adobe to transfer your personal information across national borders and to other countries where Adobe and its partners operate.' Adobe's sub-processor list states that it applies transfer protections including European Commission approved Standard Contractual Clauses and the Data Privacy Framework.
Ask: Name every country in which an Australian customer's documents, prompts and extracted values are processed, cached or logged, and identify the Australian Privacy Principle 8 protections Adobe relies on for each.
Incident notification
Not confirmed
No breach-notification period was found for Analyzer. The Australian General Terms contain no notification clause, the Analyzer security overview contains no incident section, and the Data Protection Terms at adobe.com/go/dpt-ww, which would ordinarily carry the notification obligation, were not read within the evidence budget.
Ask: State the contractual notification period from discovery for an incident affecting Analyzer data storage, whether it covers incidents at Microsoft or AWS, and what Adobe provides to support a Notifiable Data Breaches assessment.
Change notice for models, terms and processors
Public claim only
The security overview's model wording is expressly current rather than fixed - 'The Analyzer Generative AI Service currently leverages Azure OpenAI' - and the document itself is dated August 2026 with no version history or change log. The sub-processor list states that Adobe will update the page to reflect changes in the use of sub-processors as set out in its data-protection terms and offers a subscription to updates, and the Australian General Terms provide for updates to the terms and to Product Specific Terms.
Ask: What advance notice do we get before the model, the model provider, the sovereignty zone or the hosting region behind Analyzer changes, and can we pause the feature instead of accepting the change?
Export and exit
Public claim only
The security overview states that extracted attribute values can be exported to a CSV file and that documents can be deleted by the user; it describes no export for custom attribute definitions, which it says are stored in the Analyzer database, and none for chat history. The Australian General Terms recommend the customer keep its own backup, require any transition of content out to be completed within thirty days of termination or expiry, and reserve Adobe's right to delete content after that period.
Ask: In what format can we export custom attribute definitions, collections and chat history on exit, what cannot be exported, and does the thirty-day transition period apply to an enterprise agreement?
Connectors and third-party services
Public claim only
Two connection points are published: a Microsoft SharePoint folder sync configured in the web application's 'Integrations' tab, and REST APIs used both to ingest documents in bulk and to push extracted data into ERP, CRM, CLM and ECM systems. Section 3.12 of the Australian General Terms states that third-party software and services made available through the services are not Services and Software as defined in the terms and that their use is governed by the third party's terms. Whether the SharePoint connector can be restricted to named sites, and whether API access can be limited per product profile, is not published.
Ask: Can the SharePoint connector be scoped to named sites and libraries, which credentials does it hold, and can API access be restricted or revoked per user?
Open-web retrieval
Public claim only
Neither of the two data flows in the Analyzer security overview - attribute extraction and AI Assistant query - contains a web-retrieval step; both draw only on Analyzer data storage and Azure OpenAI. Adobe's sub-processor list states at Document Cloud level that 'Adobe Document Cloud utilizes the Brave Search web search API' and that Brave 'does not retain any data, but does process queries on Adobe's behalf in customer facing workflows'. Whether any Analyzer action can trigger a Brave query is not stated in either document.
Ask: Can any Analyzer function send a query to Brave Search or any other web service, and if so, can open-web retrieval be turned off for our tenancy?
Actions the product can take
Public claim only
In both documented data flows Analyzer reads documents and writes extracted values, responses and chat history into its own storage; no flow describes editing, redacting or signing a source document. Outbound action is by integration: the product page states extracted data can be pushed 'through REST APIs into ERP, CRM, CLM or ECM systems of record'. No confirmation step, approval gate or administrative restriction on an outbound push is described.
Ask: Does a push into a downstream system require a human confirmation, what credentials and write scopes does it use, and is each push logged?
Human review before use
Public claim only
The Australian product page states that teams can 'set criteria once and verify every finding before they act', that the product 'is designed for reviewable output, not blind automation', and that its purpose 'is not to replace judgement', and it carries the footnote that the product 'does not constitute legal, audit or regulatory advice or certification'. Those are statements of design intent on a marketing page: neither that page nor the security overview describes any product control that requires a reviewer to sign off an extracted value, or any record that one did.
Ask: Is there a review or approval state on an extracted value, and can Analyzer record which person verified which value before it was exported or pushed downstream?
