Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The home page, read 2026-09-27, publishes four components under the heading 'Secure, AI-Powered Contracting Is Here': Document Automation, Custom Workflows, Contract Repository and Security by Design. Solutions pages address Legal Teams, Sales Teams and HR Teams. No plan or tier names appear on the home page.
Ask: Which Aerofiler plan will our order form cover, and are the AI contract analysis and the 'Rapid Learning AI' extraction included in it or charged separately?
Deployment model
Public claim only
The security page (effective 20 April 2023, read 2026-09-27) says 'The Aerofiler application is hosted on Amazon Web Services (AWS)', with customer documents stored on Amazon S3 and metadata on MongoDB's Atlas service. No on-premises, private-cloud or self-hosted option appears on the pages read.
Ask: Is a single-tenant or private-cloud deployment available, and in which AWS region would our tenant, its backups and the MongoDB Atlas metadata sit?
AI features in scope
Public claim only
The home page limits its AI claim to the Contract Repository component, 'effortless filing for your contracts including AI-powered contract analysis, obligation tracking and reporting', and to a separate item, 'Rapid Learning AI - AI that accurately learns about your contracts with only a few examples'. Document Automation and Custom Workflows are described without an AI claim. The FAQ says of image PDFs, 'we can recognise text if the contract is an image PDF'.
Ask: Which fields and clauses does the AI contract analysis extract, what does 'learns about your contracts with only a few examples' mean in practice, and can the AI analysis be turned off for nominated matters?
Jurisdictions and legal content
Public claim only
Aerofiler is presented as a contract management system. The pages read claim no legal-research content, no citation to primary law and no jurisdiction-specific legal coverage. The vendor publishes an Australian terms page and an Australian Data Processing Addendum and gives a Sydney address.
Ask: Does any Aerofiler output purport to state a legal position on an Australian contract, or is it limited to extracting and reporting terms the customer's documents already contain?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A map of the site returned a complete 35-URL inventory with no /llms.txt, /ai-info, /ai or /for-ai path, and the home, security, Data Processing Addendum (AU) and subprocessor page bodies read on the same date contain no block addressed to AI models, assistants, crawlers or language models telling them how to describe the product. No llms.txt file describing products to language models was present either, and no crawler allow or disallow directive was examined because no such file appeared in the inventory.
Ask: Do you publish, or plan to publish, any page or embedded block that tells AI assistants or language models how to describe Aerofiler?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
The pages read do not address a law firm's professional obligations, client consent to send client contracts to the named United States processors, or supervision of extracted obligations. The Data Processing Addendum (AU) states that it 'is only applies to you if you are located in the European Union ("EU") or Switzerland, or your process personal data of individuals resident in the EU or Switzerland', so on its own wording an Australian customer with no EU data is not covered by it.
Ask: Which document governs our processing obligations as an Australian customer with no EU data, given that the Data Processing Addendum (AU) states it applies only to EU and Swiss customers?
Foundation-model providers
Public claim only
The vendor's subprocessor list, read 2026-09-27, names Anthropic PBC and OpenAI, LLC, each with purpose 'Infrastructure and cloud services' and entity country United States. The list does not say which product feature uses which provider, and no model name, version or endpoint region appears on the home, security or Data Processing Addendum pages read.
Ask: Which Aerofiler features send contract content to Anthropic and to OpenAI, under which commercial terms and in which region, and what notice do we get if a provider changes?
Subprocessors
Public claim only
A public subprocessor list at the URL named in the Data Processing Addendum lists thirteen entities with purpose and entity country, read 2026-09-27: Adobe, Amazon Web Services, Anthropic PBC, DocuSign, Google, Litera Corp ('Process customer documents'), Microsoft ('Australia & United States'), MongoDB, Namirial S.p.A. (Italy), Okta, OpenAI, Twilio and Zapier. The page carries no version or last-updated date.
Ask: Please date and version the subprocessor list, and state for each entity the data categories it receives and whether it is engaged for our tenant.
Training on customer content
Not confirmed
Nothing on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27 states whether customer contracts, extracted clause data or the examples used by 'Rapid Learning AI' are used to improve models, or whether Anthropic and OpenAI are contractually barred from training on content sent to them. The DPA limits processing to the customer's instructions but states that it applies only to EU and Swiss customers.
Ask: Give us a written undertaking that our contracts, extracted data and any embeddings are not used to train or improve any model, including by Anthropic and OpenAI, and name the document that carries it.
Feedback and quality monitoring
Not confirmed
No in-product rating, correction or feedback mechanism for AI output is described on the pages read, and nothing states whether corrections a customer makes to extracted terms are reused beyond that customer's tenant. The 'Rapid Learning AI' description implies customer examples train an extraction model, but the pages read do not say whether the resulting model is tenant-specific.
Ask: When we correct an extracted clause or obligation, is the learning confined to our tenant, and can you evidence that boundary?
Retention of documents, extracted data and AI requests
Not confirmed
No retention period for contracts, extracted metadata, audit logs or AI request payloads while a subscription is live was found on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27. The DPA addresses only deletion after termination.
Ask: State default and configurable retention for documents, extracted metadata, audit logs and any AI request or response payloads during the subscription.
Deletion and certified erasure
Not confirmed
Two different periods are published. The Data Processing Addendum (AU) says Aerofiler will, on termination, 'delete the Personal Data as soon as reasonably practicable and within a maximum period of 180 days unless applicable law requires or permits further storage'. The security page says that if a customer stops using Aerofiler, 'we will delete any customer data that can be tied back to that customer from our systems within 30 days'. The DPA also states it applies only to customers located in the EU or Switzerland.
Ask: Which period binds an Australian customer, 30 days or 180 days, does it cover backups and subprocessor copies, and will you certify deletion in writing?
Vendor access to customer content
Public claim only
The security page says personnel reach production resources 'through secure, encrypted connections that require multi-factor authentication', that access is granted 'on a least privilege basis to only those personnel who need it', that it is 'immediately revoked once an employee or contractor finishes working with Aerofiler', and that all personnel sign non-disclosure agreements. No customer-visible access log is offered and no country is named for support personnel.
Ask: Who can read our contracts, from which countries, under what ticketed approval, and can we receive a log of every staff access to our tenant?
Access control, authentication and audit
Public claim only
The security page describes user-definable granular permissions, two-factor authentication, forced session sign-outs, minimum password complexity, the ability to suspend users, and 'extensive logging of system activity, giving you visibility into actions taken on documents, such as who is viewing, downloading, or editing them'. Single sign-on via Okta appears on the subprocessor list as conditional on using that integration.
Ask: Is SSO with our identity provider and enforced multi-factor authentication available on our plan, and can we export the full audit log including AI analysis events?
Encryption in transit and at rest
Public claim only
The security page says documents on Amazon S3 and metadata on MongoDB Atlas are 'encrypted at rest using AES 256-bit encryption', that data in transit between application components is 'secured with TLS 1.2 encryption', and that all client connections require HTTPS. Customer-managed keys are not offered on the pages read, and no encryption statement covers data sent to the named model providers.
Ask: Confirm the encryption applied to content sent to Anthropic and OpenAI, whether TLS 1.3 is now in use, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The security page says the information security management system 'is audited and certified annually by an independent JAS-ANZ accredited body' against ISO 27001, and refers to AWS SOC 1, SOC 2 and SOC 3 accredited data centres for physical security. No certificate number, scope statement or penetration-test summary is published. The Data Processing Addendum gives EU and Swiss customers copies of independent audit reports and one written audit questionnaire a year.
Ask: Provide the current ISO 27001 certificate with its scope and certification body, the latest penetration-test summary, and confirm whether the AI analysis pipeline is inside the certified scope.
Contract, entity and governing documents
Public claim only
The Data Processing Addendum (AU), last updated 1 December 2018 and read 2026-09-27, names 'Aerofiler Pty Ltd ("Aerofiler"), which is located in Australia' and states that it 'is only applies to you if you are located in the European Union ("EU") or Switzerland'. It says it prevails over the terms of service at https://www.aerofiler.com/terms/au, which was not read within the source budget. No ACN or ABN appears on the pages read.
Ask: Confirm the contracting entity and its ACN, provide the Australian terms of service and an Australian data processing agreement, and state which document prevails.
Cross-border transfers and data location
Not confirmed
The security page says 'Aerofiler uses AWS data centers located in multiple locations and we are able to work with customers who have requirements regarding where their data must be geographically located', without naming a region. The subprocessor list gives entity countries: United States for Adobe, Amazon Web Services, Anthropic PBC, DocuSign, Google, Litera, MongoDB, Okta, OpenAI, Twilio and Zapier; 'Australia & United States' for Microsoft; and Italy for Namirial. An entity's country of incorporation is not a statement about where data is stored or processed.
Ask: In writing, name the AWS region and MongoDB Atlas region for our tenant and backups, and state whether any AI analysis request leaves Australia and to which country.
Incident notification
Public claim only
The Data Processing Addendum (AU) says Aerofiler 'will notify you without undue delay of the discovery by Aerofiler of any actual Personal Data Breach', with a description of the nature of the breach, anticipated consequences and remedies; on its own wording that clause reaches EU and Swiss customers. The security page says that if Aerofiler 'learns of a security breach, we will notify affected users'. No hour count, Notifiable Data Breaches reference or incident history was found.
Ask: State the contractual notification period from discovery for an Australian customer, whether it covers subprocessor incidents, and list any material incidents in the last 24 months.
Change notice for subprocessors and models
Public claim only
The Data Processing Addendum authorises Aerofiler to engage the entities on the subprocessor list and says 'Aerofiler shall notify you of any additional sub-processors by posting them at the foregoing URL'. A customer may object in writing, and the DPA then states that if Aerofiler does not cease using the subprocessor, 'you should stop using the Services'. No notice period, dated version history or model-change notice was found.
Ask: What advance written notice will we receive before a new subprocessor or model provider is added, and what remedy do we have other than ceasing to use the service?
Export and exit
Public claim only
The home-page FAQ says 'You can export your files and data at any time in a self-serve manner'. The security page says customers 'can take a copy of their data before they go (both documents and document metadata)' and can use the integrations to back up files to their own cloud storage. No export format, completeness statement covering extracted metadata and audit logs, or deletion certificate is described on the pages read.
Ask: Demonstrate a full export, including documents, extracted metadata, workflow history and audit logs, and state the formats and any assistance cost.
Connectors and conditional processors
Public claim only
Each integration-linked processor on the subprocessor list is marked conditional: Adobe, DocuSign and Namirial S.p.A. 'if using' the matching e-signature integration, Okta 'if using Single Sign On via Okta', and Zapier 'if using integrations'. Litera Corp is listed unconditionally, with purpose 'Process customer documents'.
Ask: What does Litera Corp do with our documents, since it is listed without an 'if using' condition, and can that processing be disabled?
Open-web retrieval
Not confirmed
Nothing on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27 says whether any Aerofiler feature retrieves content from the open web, and no search or browsing control is described. The AI claims on the home page are confined to analysing the customer's own contracts.
Ask: Does any Aerofiler feature query the internet or an external data source when analysing a contract, and can that be disabled?
Automated actions and confirmation
Not confirmed
Custom Workflows are described as 'automating requests, approvals and signatures' across the contract lifecycle, which is rule-based routing rather than an AI agent acting. The pages read do not say whether an AI-extracted value can trigger a workflow step, a signature request, a renewal notice or an outbound message without a person confirming it.
Ask: Can any AI-extracted value start a workflow, send a signature request or issue a renewal notice without a person confirming it, and can that be blocked by configuration?
Human review before reliance
Not confirmed
No statement was found on the pages read that a person reviews AI-extracted clauses, obligations or generated contracts before they are relied on, and no in-product review, approval or confidence indicator for AI output is described on the home or security pages.
Ask: What in-product control forces a named reviewer to accept or reject each AI-extracted obligation before it drives a report or a reminder?
