Product and intended use
Define the configuration, people, information and tasks being assessed.
What the plan includes
Public claim only
The Australian plan table lists Acrobat Studio as including everything in Acrobat Pro — create, edit, export, compare and organise PDFs; collect e-signatures and track responses; password-protect and redact PDFs; web forms, scan-to-editable-PDF and 70+ features — plus three AI items: ask AI to edit, convert or compress a PDF; understand dense documents with AI summaries, podcasts and interactive reports; and organise, share and collaborate with PDF Spaces, together with Adobe Express templates. The plans page adds that Studio combines the PDF tool set, PDF Spaces, Acrobat AI Assistant and Adobe Express Premium. Acrobat Analyzer and Knowledge Base in Acrobat are listed as separate additional products.
Ask: Does our subscription include Knowledge Base in Acrobat and Acrobat Analyzer, or are they priced separately, and which Adobe agreement covers each?
Deployment and where the components run
Public claim only
The Document Cloud hosting page, last updated 16 September 2026, states that Adobe Acrobat is hosted on AWS data centres in North America, Europe and Japan, that 'Acrobat AI Services, including AI Assistant, as well as Acrobat PDF Services and APIs, also leverage these data centers', that user-generated content in Acrobat is stored in Adobe Enterprise Storage, and that Analyzer in Acrobat and Knowledge Base in Acrobat are hosted, with their user-generated content, in the Acrobat Sign infrastructure in the United States and Germany. The technical requirements page states the user must be online and signed in for generative AI features.
Ask: Which data centre will serve our Australian users for Acrobat, PDF Spaces and, if we take it, Knowledge Base, and can the location be fixed in our order?
Documented functions and limits
Public claim only
Adobe describes a PDF Space as a workspace into which several files are brought and queried through a prebuilt or personalised assistant, with summarisation, comparison of documents and creation of new material, producing a summary, audio overview, visual report or presentation, shareable with tracking of how others engage with it. The legal use-case page adds that Knowledge Base in Acrobat finds answers across connected repositories 'with every response traceable to the specific document and source sentence', and lists comments, annotations, review activity and AI-powered redaction as the record of a review. The technical requirements page sets the operating limits: files under 100 MB and 600 pages, no password-protected files or PDF Portfolios, prompts under 500 characters, text selections under 8,000 characters on a single page, no support for images or complex vector graphics, and a fixed language list in which Generate Presentation supports fewer languages than AI Assistant Q&A, generative summary, PDF Spaces and Generate Podcast.
Ask: Which of these functions are available on the plan we would buy in Australia, and which are limited to enterprise agreements?
Legal content and jurisdiction
Not confirmed
Studio supplies no legal content library, citator or jurisdiction setting on any page read; answers are traced to the customer's own documents. Adobe's legal use-case page states that 'AI Assistant surfaces information, language patterns and document structure for a legal team's review, but it does not constitute legal advice or risk assessment. Outputs should always be reviewed by qualified legal counsel.'
Ask: Does any Studio component apply Australian legal knowledge, or is it confined to the documents we place in a PDF Space or repository?
Vendor content addressed to AI models, and marketing claims that need testing
Public claim only
Adobe publishes a file at https://www.adobe.com/llms.txt, checked 2026-09-27, addressed to large language models and listing Adobe products with one-line descriptions; it opens '# Adobe Tools > Give your team a creative edge.' Neither Acrobat Studio nor PDF Spaces appears anywhere in it: the Acrobat section lists Acrobat Pro, the online tools, Acrobat AI Assistant, Acrobat Reader, Acrobat Business, the students, non-profit and government pages and Acrobat eSign. The file contains no instruction of the form 'describe this product as X'. On the same footing, the legal use-case page's FAQ asserts that Studio 'uses encryption, granular permissions and zero-training data usage to keep all legal information protected' and that it 'helps ensure version control, audit logs, secure collaboration spaces and metadata preservation'; those are marketing statements and the encryption and audit-log limbs were not found in any binding document read.
Ask: Which statements on the legal use-case page are warranted in our agreement, and is the llms.txt file maintained — it does not mention Studio or PDF Spaces?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and confidentiality
Not confirmed
The General Terms state that the customer agrees not to collect, process or store Sensitive Personal Information using the services and software except as directly authorised by Adobe, as intended by the services, or as governed by the Product Specific Terms. Building a PDF Space or connecting a repository places client documents in Adobe's cloud and, per the sub-processor list, within reach of model providers including Microsoft, OpenAI and Google. Adobe's own suggested pilot approach on the legal page includes defining do-and-don't rules such as 'Use AI for NDAs and vendor MSAs; no AI on active litigation or investigations.'
Ask: What client notice or consent does Adobe consider necessary before client documents are placed in a PDF Space, and can a matter be excluded technically rather than by policy?
Foundation-model providers
Public claim only
The sub-processor list dated 28 July 2026 states that Adobe 'offers the use of the Azure OpenAI service to provide features within Adobe Apps/Services where customers decide to use such features (e.g., AI Assistant in Adobe Acrobat)', that OpenAI supports 'features in Document Cloud related to being able to query for information in documents' with a note that Adobe also accesses OpenAI models through Azure OpenAI to assist Acrobat's AI Assistant, and that Google's Gemini and Veo models support 'AI supported features in Document Cloud'. The hosting page states that for EU enterprise users 'LLM processing (currently Microsoft Azure OpenAI) will take place in the EU (currently in Sweden)'. No page read names the model behind PDF Spaces, Knowledge Base, Generate Presentation or Generate Podcast specifically, and no customer model choice is described.
Ask: Which provider and model serves each Studio function — PDF Spaces, Knowledge Base, presentations and podcasts — for an Australian customer, and in which country does each run?
Subprocessors
Public claim only
Adobe publishes a dated sub-processor list, last updated 28 July 2026, maintained under its Data Processing Addendum with a subscription for updates. Entries covering Acrobat or Document Cloud include Microsoft Corporation (Azure hosting and the Azure OpenAI service; locations USA, EU, UK, Canada, India, Australia), Amazon Web Services (USA, EU, Australia, Singapore, Japan), OpenAI (USA, EU), Google (USA), Brave Software for the Brave Search web search API (USA, France, Germany) and Elastic N.V., which states that when customers upload content and use the assessment tools 'their content can be extracted, processed, and stored within Elasticsearch indices' (USA). The page explains the locations are the sub-processor's headquarters and key hubs, not necessarily where Adobe's instance runs.
Ask: Which sub-processors receive content from a PDF Space or a connected Knowledge Base repository, and what are our notice and objection rights when the list changes?
Training on customer content
Public claim only
Section 4.3(A) of the Australian General Terms states 'We will not use these rights to train generative AI models on your Content and will not use the sublicence rights to have anyone else train generative AI models on your Content, except at your specific request', and section 2.2(F) states no Local or Cloud Content is used to train generative AI models except content submitted to Adobe Stock. Content Analytics for product improvement is a separate mechanism: the Content Analysis FAQ dated 10 June 2026 states business and school accounts and profiles 'have been automatically opted out', that personal accounts are on by default with a toggle at account.adobe.com/privacy, and that the opt-out does not apply when the user is not signed in or takes part in feedback, betas, user studies or the Adobe Acrobat Improvement Program. The legal page's unqualified phrase 'zero-training data usage' does not distinguish these two mechanisms.
Ask: Confirm in our agreement that no content in a PDF Space or connected repository, and no prompt or output, trains or fine-tunes any model at Adobe, Microsoft, OpenAI or Google, and that Content Analytics is off for every profile we hold.
Feedback and human review of submitted content
Public claim only
The Content Analysis FAQ states Adobe may perform human review of content for product improvement in limited situations, which it lists as content the user makes public, content submitted for human review such as feedback sent to engineering teams, and participation in prerelease, beta, early access or product improvement programmes including the Adobe Acrobat Improvement Program, with reviewers subject to confidentiality requirements and privacy training. The hosting page states 'Reported Feedback data submitted by users is handled separately' under Adobe's content usage and handling practices. Studio also generates engagement tracking on shared PDF Spaces, which the legal page presents as a feature rather than as data handling.
Ask: Can the feedback and report controls be disabled for our users, and what engagement-tracking data is collected when a PDF Space is shared outside the firm?
Retention of workspace contents, prompts and outputs
Public claim only
The hosting page states that AI Assistant Regional Data Center pinning for EU and US enterprise customers processes and caches user data 'temporarily for up to 12 hours' in the designated region; no equivalent statement covers customers outside those regions, and no page read states how long PDF Space contents, chat histories, audio overviews or generated reports are kept. The same page states Identity Management edge servers, including one in Australia, cache requested data for no more than 14 days from the latest request.
Ask: State how long a PDF Space, its chat history and its generated outputs are retained after the space is closed or the subscription ends, and in which country.
Deletion and exit erasure
Public claim only
Section 3.3 of the General Terms states that at the end of the licence term Adobe will use commercially reasonable efforts to allow the customer to transition content out, that the transition must be completed within 30 days of termination or expiry, and that at the end of that period Adobe reserves the right to delete the content. Deletion of PDF Spaces, Knowledge Base indexes or generated artefacts is not separately addressed, and no certified-deletion undertaking was found.
Ask: On exit, what is deleted and when — PDF Spaces, Knowledge Base indexes, chat histories and generated outputs — and will Adobe certify deletion in writing?
Adobe and provider access to content
Public claim only
Section 2.2 of the General Terms states Adobe limits access to content to specific purposes, does not scan or review locally stored content, and that 'A person may review your content on our servers in limited circumstances, such as upon your request, when you choose to let us use your content to improve our products or when your content is flagged or reported as illegal'. The sub-processor list states that for the limited categories where Microsoft Azure can access Adobe customer data strict controls apply, and that OpenAI is contractually prohibited from reviewing Adobe customer data.
Ask: Which Adobe teams and sub-processor personnel can read the contents of a PDF Space, from which countries, and can we obtain an access log?
Administrative control, sharing and identity
Public claim only
The General Terms state that on a business plan 'your organisation has access to and control over your work', and that a personal account created with a work email may be rolled into a business relationship on prior notice. Adobe's legal page describes giving Studio access to a small cohort 'via a dedicated product profile' and presents comments, annotations and review activity as an auditable record; the hosting page describes Adobe IDs, Enterprise IDs and Federated IDs as determining how assets are stored and shared, with the Admin Console hosted in an AWS data centre in Virginia. PDF Spaces are described as shareable with external people, with engagement tracking.
Ask: Through product profiles, can we restrict who may create or share a PDF Space, block external sharing, enforce Federated ID, and export an audit log of AI use?
Encryption
Public claim only
The Australian legal use-case page asserts in a marketing FAQ that Acrobat Studio 'uses encryption, granular permissions and zero-training data usage to keep all legal information protected'. No encryption commitment, algorithm, TLS version or key-management statement for Studio, AI Assistant or PDF Spaces was found in the General Terms, the Content Analysis FAQ, the technical requirements page or the hosting-locations page. The Trust Centre links security whitepapers and a resource library that were not retrieved within the evidence budget.
Ask: Provide the Document Cloud security whitepaper covering Studio and PDF Spaces, stating encryption in transit and at rest, algorithms, key management and whether customer-managed keys exist.
Independent security assurance
Not confirmed
The Australian Trust Centre page read on 2026-09-27 states that Adobe complies with many industry standards and regulations and undergoes independent audits, and links a compliance attestation list and a resource library, but names no certification on the page itself. Neither the attestation list nor any report was retrieved within the evidence budget, so no certification, date or scope covering Studio is recorded here.
Ask: Provide the current SOC 2 or ISO certificates and any AI management-system certification, with scope statements confirming Acrobat Studio, PDF Spaces and Knowledge Base are inside the audited boundary.
Contracting entity, liability and forum
Public claim only
The Australian General Terms state that for customers residing outside North America and Japan the relationship is with Adobe Systems Software Ireland Limited under the laws of Ireland, and that for customers in Australia that company acts as authorised agent of Adobe Systems Pty Ltd and contracts in that capacity. Total liability is limited to the greater of US$100 or the amount paid for access in the three-month period preceding the event; the services are supplied 'AS-IS' to the maximum extent permitted by law; section 13 preserves rights under the Competition and Consumer Act 2010 (Cth), with liability for a statutory guarantee limited at Adobe's election to re-supply or the cost of re-supply. Product Specific Terms, including additional terms for Adobe Generative AI, Document Cloud, Adobe Express and Business Customers, override the General Terms and were not read.
Ask: Confirm the Australian contracting entity and its ACN or ABN, provide the Adobe Generative AI and Business Customers additional terms and the Data Processing Addendum that will apply to Studio, and state any negotiated increase to the liability cap.
Cross-border transfers and APP 8
Public claim only
The hosting page states Acrobat and Acrobat AI Services run in AWS data centres in North America, Europe and Japan, that Analyzer and Knowledge Base in Acrobat sit in the Acrobat Sign infrastructure in the United States and Germany, and that regional pinning is offered only to EU and US enterprise customers, so Australian content is processed offshore with no published Australian option. The sub-processor list gives sub-processor locations across the USA, EU, UK, Canada, India, Australia, Singapore, Japan, France and Germany as headquarters and key hubs rather than as the location of Adobe's instance, and states Adobe applies transfer protections including European Commission approved Standard Contractual Clauses and the Data Privacy Framework.
Ask: For Australian users, name every country in which content, prompts and outputs are processed, cached or logged across Acrobat, PDF Spaces and Knowledge Base, and identify the APP 8 protections Adobe relies on.
Incident notification
Not confirmed
No breach-notification period was found in the Australian General Terms or on any other page read. The Trust Centre links an incident-response page and security bulletins, neither retrieved within the evidence budget, and the Data Processing Addendum, which would ordinarily carry the notification clause, was not read.
Ask: State the contractual notification period from discovery for an incident affecting Studio content, whether it covers incidents at Microsoft, OpenAI, Google, Brave or Elastic, and how Adobe supports a Notifiable Data Breaches assessment.
Change notice for models, terms and processors
Public claim only
The sub-processor list states Adobe will update the page to reflect changes in the use of sub-processors as set out in its Data Processing Addendum and offers a subscription to updates, so processor change notice depends on terms not read here. The hosting page's model-provider wording is expressly current rather than fixed — 'LLM processing (currently Microsoft Azure OpenAI)' and 'currently in Sweden' — and the General Terms provide for updates to the terms and to Product Specific Terms.
Ask: What advance notice do we get before a model, model provider or processing location behind Studio changes, and can we object or pause the feature?
Export and exit
Public claim only
Section 3.3 of the General Terms recommends the customer back up content elsewhere, states Adobe will use commercially reasonable efforts to allow transition of content out at the end of the licence term, requires that transition within 30 days, and reserves the right to delete content afterwards. No export format is described for PDF Spaces, chat histories, audio overviews, reports or Knowledge Base indexes.
Ask: In what format can we export a PDF Space, its chat history and its generated outputs before cancellation, and what cannot be exported?
Connectors and third-party services
Public claim only
Section 3.12 of the General Terms states Adobe may make third-party software and services available through the services as a convenience, that these are not Services and Software as defined in the terms, and that their acquisition and use is governed by the third party's terms. The sub-processor list adds that Document Cloud calls the Brave Search web search API and that Elastic N.V. stores customer-uploaded content in Elasticsearch indices for optional customer-initiated features. Knowledge Base is described as answering across 'connected repositories' without naming the connectors.
Ask: List every connector and third-party service Studio can reach for our tenancy, which are enabled by default, and confirm each can be disabled centrally.
Open-web retrieval
Public claim only
The sub-processor list states that 'Adobe Document Cloud utilizes the Brave Search web search API. Brave processes queries constructed based on user inputs. URLs are returned to Adobe services from Brave's own web index. Brave does not retain any data, but does process queries on Adobe's behalf in customer facing workflows', and that Adobe's server IP addresses are known to Brave. The technical requirements page separately documents AI Assistant for webpages, restricted to English-language pages with long-form content. Which Studio functions trigger a Brave query, and whether that can be disabled, is not published.
Ask: Which Studio actions send a query to Brave Search, what do those queries contain, and can web retrieval be turned off for our users?
Actions the assistant can take
Not confirmed
The Australian plan table lists 'Ask AI to edit, convert or compress PDF' as a Studio inclusion, the product page lists asking AI Assistant to edit, sign, redact and compress documents, and the technical requirements page describes editing PDFs by chat — 'Replace, rewrite, restructure, redact, format, or highlight text — just by chatting with AI Assistant'. The legal page presents AI-powered redaction as part of the review record. No confirmation step, undo guarantee or administrative restriction on these actions is described.
Ask: Which chat-invoked actions change a file in place, is each confirmed and reversible, and can signing and redaction by chat be disabled for our users?
Human review before use
Public claim only
Adobe's legal use-case page states that 'AI Assistant surfaces information, language patterns and document structure for a legal team's review, but it does not constitute legal advice or risk assessment. Outputs should always be reviewed by qualified legal counsel', and describes citations to the specific document and source sentence as the verification route. No product control that forces or records a reviewer's approval is described on any page read.
Ask: Is there any setting or log recording that a named person reviewed a Studio output before it was shared outside the firm, and can that be mandated?
