---
title: "Aerofiler (Aerofiler Pty Ltd)"
url: "https://ailawframework.com/software/aerofiler"
type: "software_profile"
site: "AI Law Framework"
id: "aerofiler"
vendor: "Aerofiler Pty Ltd"
category: "Legal-specific"
segment: "Contract review and CLM"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Aerofiler (Aerofiler Pty Ltd)

> Contract management system used by legal, sales and HR teams for contract generation, approval workflows and a repository with extraction of contract terms and obligations.

Canonical page: https://ailawframework.com/software/aerofiler  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Covers the Aerofiler contract management system as described on the vendor's home, security, Data Processing Addendum (AU) and subprocessor pages. Plan tiers, the AU terms of service and the Legal Teams solution page need separate review.

## Capabilities

- Document automation
- Data extraction
- Compliance monitoring

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Model providers | Anthropic PBC, OpenAI, LLC |
| Assurance | ISO 27001 |
| Training on customer content | Unknown |
| Retention | No retention period for contracts, extracted metadata or AI request logs while a subscription is live was found on the pages read. On exit, two different periods are published: the Data Processing Addendum (AU) says personal data is deleted 'within a maximum period of 180 days' after termination, and the security page says customer data is deleted 'within 30 days'. The DPA states on its face that it applies only to customers located in the EU or Switzerland. |
| Integrations | Salesforce, DocuSign, Adobe Sign, Namirial eSignAnyWhere, Microsoft Teams, Slack, Google Drive, Microsoft Office, Okta (single sign-on), Zapier, API |
| Pricing | No price, unit or currency was read. publicPricing is recorded as false only because this review read no published price: the vendor publishes a pricing page at https://www.aerofiler.com/pricing which was not read within the source budget. The home page says 'Pricing and functionality that scales with your business, no matter the size'. |
| Australian presence | Yes. The Data Processing Addendum (AU), read 2026-09-27, names the contracting entity as 'Aerofiler Pty Ltd ("Aerofiler"), which is located in Australia'. The footer of every page read gives 3 Spring Street, Sydney NSW 2000, Australia. No ACN or ABN appears on the home, security, DPA or subprocessor pages read, and the Australian terms of service at https://www.aerofiler.com/terms/au were not read within the source budget. |
| Website | https://www.aerofiler.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | The home page, read 2026-09-27, publishes four components under the heading 'Secure, AI-Powered Contracting Is Here': Document Automation, Custom Workflows, Contract Repository and Security by Design. Solutions pages address Legal Teams, Sales Teams and HR Teams. No plan or tier names appear on the home page. | Which Aerofiler plan will our order form cover, and are the AI contract analysis and the 'Rapid Learning AI' extraction included in it or charged separately? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Deployment model | Public claim only | The security page (effective 20 April 2023, read 2026-09-27) says 'The Aerofiler application is hosted on Amazon Web Services (AWS)', with customer documents stored on Amazon S3 and metadata on MongoDB's Atlas service. No on-premises, private-cloud or self-hosted option appears on the pages read. | Is a single-tenant or private-cloud deployment available, and in which AWS region would our tenant, its backups and the MongoDB Atlas metadata sit? | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| AI features in scope | Public claim only | The home page limits its AI claim to the Contract Repository component, 'effortless filing for your contracts including AI-powered contract analysis, obligation tracking and reporting', and to a separate item, 'Rapid Learning AI - AI that accurately learns about your contracts with only a few examples'. Document Automation and Custom Workflows are described without an AI claim. The FAQ says of image PDFs, 'we can recognise text if the contract is an image PDF'. | Which fields and clauses does the AI contract analysis extract, what does 'learns about your contracts with only a few examples' mean in practice, and can the AI analysis be turned off for nominated matters? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Jurisdictions and legal content | Public claim only | Aerofiler is presented as a contract management system. The pages read claim no legal-research content, no citation to primary law and no jurisdiction-specific legal coverage. The vendor publishes an Australian terms page and an Australian Data Processing Addendum and gives a Sydney address. | Does any Aerofiler output purport to state a legal position on an Australian contract, or is it limited to extracting and reporting terms the customer's documents already contain? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/); [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au) |
| Licence and pricing unit | Not confirmed | No price, licence unit, term or auto-renewal statement was read. The vendor publishes a pricing page at https://www.aerofiler.com/pricing, which was not read within this review's source budget, and Australian terms of service at https://www.aerofiler.com/terms/au, also not read. The home page says 'Pricing and functionality that scales with your business, no matter the size'. | Provide an itemised Australian quote: licence unit, minimum term, auto-renewal, and any cap or metering on AI analysis requests or document volume. | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Integrations and API | Public claim only | The home page names Salesforce, eSignAnyWhere, Adobe Sign, DocuSign, Microsoft Teams, Slack and Google Drive, and says 'we also offer an API'. The subprocessor list read 2026-09-27 ties named processors to those integrations, including Adobe, DocuSign and Namirial S.p.A. for e-signature, Okta for single sign-on, Zapier for external applications, and Microsoft for 'Microsoft Office integration'. | Which integrations will be enabled for our tenant, and what contract content does each one send outside Aerofiler? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/); [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) |
| Support and security contact | Not confirmed | The security page publishes a security contact, 'security [at] aerofiler.com', and an info address appears in the footer. No support hours, severity matrix, response target or service-level commitment was found on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27. | What support hours and severity response targets apply to an Australian customer, and who is the named escalation contact for an AI-related defect? | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Published quality evidence | Not confirmed | No accuracy figure, benchmark, error rate or evaluation method for the AI contract analysis or the 'Rapid Learning AI' extraction was found on the pages read. The home page links a customer case study PDF for one named organisation, which was not read within the source budget. | Provide measured precision and recall for clause and obligation extraction on Australian commercial contracts, including on image PDFs, and say how it was measured. | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Task fit and verification effort | Public claim only | The vendor describes the extraction model as learning 'about your contracts with only a few examples' and says image PDFs are handled by text recognition. Neither statement quantifies accuracy, and the pages read do not say what a person must check before an extracted obligation or renewal date is relied on. | On a sample of our own contracts, how many extracted obligations and dates require correction, and how long does a reviewer spend per contract? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Check for vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. A map of the site returned a complete 35-URL inventory with no /llms.txt, /ai-info, /ai or /for-ai path, and the home, security, Data Processing Addendum (AU) and subprocessor page bodies read on the same date contain no block addressed to AI models, assistants, crawlers or language models telling them how to describe the product. No llms.txt file describing products to language models was present either, and no crawler allow or disallow directive was examined because no such file appeared in the inventory. | Do you publish, or plan to publish, any page or embedded block that tells AI assistants or language models how to describe Aerofiler? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Client authority and professional use | Not confirmed | The pages read do not address a law firm's professional obligations, client consent to send client contracts to the named United States processors, or supervision of extracted obligations. The Data Processing Addendum (AU) states that it 'is only applies to you if you are located in the European Union ("EU") or Switzerland, or your process personal data of individuals resident in the EU or Switzerland', so on its own wording an Australian customer with no EU data is not covered by it. | Which document governs our processing obligations as an Australian customer with no EU data, given that the Data Processing Addendum (AU) states it applies only to EU and Swiss customers? | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au) |
| Foundation-model providers | Public claim only | The vendor's subprocessor list, read 2026-09-27, names Anthropic PBC and OpenAI, LLC, each with purpose 'Infrastructure and cloud services' and entity country United States. The list does not say which product feature uses which provider, and no model name, version or endpoint region appears on the home, security or Data Processing Addendum pages read. | Which Aerofiler features send contract content to Anthropic and to OpenAI, under which commercial terms and in which region, and what notice do we get if a provider changes? | [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) |
| Subprocessors | Public claim only | A public subprocessor list at the URL named in the Data Processing Addendum lists thirteen entities with purpose and entity country, read 2026-09-27: Adobe, Amazon Web Services, Anthropic PBC, DocuSign, Google, Litera Corp ('Process customer documents'), Microsoft ('Australia & United States'), MongoDB, Namirial S.p.A. (Italy), Okta, OpenAI, Twilio and Zapier. The page carries no version or last-updated date. | Please date and version the subprocessor list, and state for each entity the data categories it receives and whether it is engaged for our tenant. | [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors); [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au) |
| Training on customer content | Not confirmed | Nothing on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27 states whether customer contracts, extracted clause data or the examples used by 'Rapid Learning AI' are used to improve models, or whether Anthropic and OpenAI are contractually barred from training on content sent to them. The DPA limits processing to the customer's instructions but states that it applies only to EU and Swiss customers. | Give us a written undertaking that our contracts, extracted data and any embeddings are not used to train or improve any model, including by Anthropic and OpenAI, and name the document that carries it. | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Feedback and quality monitoring | Not confirmed | No in-product rating, correction or feedback mechanism for AI output is described on the pages read, and nothing states whether corrections a customer makes to extracted terms are reused beyond that customer's tenant. The 'Rapid Learning AI' description implies customer examples train an extraction model, but the pages read do not say whether the resulting model is tenant-specific. | When we correct an extracted clause or obligation, is the learning confined to our tenant, and can you evidence that boundary? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Retention of documents, extracted data and AI requests | Not confirmed | No retention period for contracts, extracted metadata, audit logs or AI request payloads while a subscription is live was found on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27. The DPA addresses only deletion after termination. | State default and configurable retention for documents, extracted metadata, audit logs and any AI request or response payloads during the subscription. | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Deletion and certified erasure | Not confirmed | Two different periods are published. The Data Processing Addendum (AU) says Aerofiler will, on termination, 'delete the Personal Data as soon as reasonably practicable and within a maximum period of 180 days unless applicable law requires or permits further storage'. The security page says that if a customer stops using Aerofiler, 'we will delete any customer data that can be tied back to that customer from our systems within 30 days'. The DPA also states it applies only to customers located in the EU or Switzerland. | Which period binds an Australian customer, 30 days or 180 days, does it cover backups and subprocessor copies, and will you certify deletion in writing? | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Vendor access to customer content | Public claim only | The security page says personnel reach production resources 'through secure, encrypted connections that require multi-factor authentication', that access is granted 'on a least privilege basis to only those personnel who need it', that it is 'immediately revoked once an employee or contractor finishes working with Aerofiler', and that all personnel sign non-disclosure agreements. No customer-visible access log is offered and no country is named for support personnel. | Who can read our contracts, from which countries, under what ticketed approval, and can we receive a log of every staff access to our tenant? | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Access control, authentication and audit | Public claim only | The security page describes user-definable granular permissions, two-factor authentication, forced session sign-outs, minimum password complexity, the ability to suspend users, and 'extensive logging of system activity, giving you visibility into actions taken on documents, such as who is viewing, downloading, or editing them'. Single sign-on via Okta appears on the subprocessor list as conditional on using that integration. | Is SSO with our identity provider and enforced multi-factor authentication available on our plan, and can we export the full audit log including AI analysis events? | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security); [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) |
| Encryption in transit and at rest | Public claim only | The security page says documents on Amazon S3 and metadata on MongoDB Atlas are 'encrypted at rest using AES 256-bit encryption', that data in transit between application components is 'secured with TLS 1.2 encryption', and that all client connections require HTTPS. Customer-managed keys are not offered on the pages read, and no encryption statement covers data sent to the named model providers. | Confirm the encryption applied to content sent to Anthropic and OpenAI, whether TLS 1.3 is now in use, and whether customer-managed keys are available. | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Independent security assurance | Public claim only | The security page says the information security management system 'is audited and certified annually by an independent JAS-ANZ accredited body' against ISO 27001, and refers to AWS SOC 1, SOC 2 and SOC 3 accredited data centres for physical security. No certificate number, scope statement or penetration-test summary is published. The Data Processing Addendum gives EU and Swiss customers copies of independent audit reports and one written audit questionnaire a year. | Provide the current ISO 27001 certificate with its scope and certification body, the latest penetration-test summary, and confirm whether the AI analysis pipeline is inside the certified scope. | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security); [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au) |
| Contract, entity and governing documents | Public claim only | The Data Processing Addendum (AU), last updated 1 December 2018 and read 2026-09-27, names 'Aerofiler Pty Ltd ("Aerofiler"), which is located in Australia' and states that it 'is only applies to you if you are located in the European Union ("EU") or Switzerland'. It says it prevails over the terms of service at https://www.aerofiler.com/terms/au, which was not read within the source budget. No ACN or ABN appears on the pages read. | Confirm the contracting entity and its ACN, provide the Australian terms of service and an Australian data processing agreement, and state which document prevails. | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au) |
| Cross-border transfers and data location | Not confirmed | The security page says 'Aerofiler uses AWS data centers located in multiple locations and we are able to work with customers who have requirements regarding where their data must be geographically located', without naming a region. The subprocessor list gives entity countries: United States for Adobe, Amazon Web Services, Anthropic PBC, DocuSign, Google, Litera, MongoDB, Okta, OpenAI, Twilio and Zapier; 'Australia & United States' for Microsoft; and Italy for Namirial. An entity's country of incorporation is not a statement about where data is stored or processed. | In writing, name the AWS region and MongoDB Atlas region for our tenant and backups, and state whether any AI analysis request leaves Australia and to which country. | [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security); [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) |
| Incident notification | Public claim only | The Data Processing Addendum (AU) says Aerofiler 'will notify you without undue delay of the discovery by Aerofiler of any actual Personal Data Breach', with a description of the nature of the breach, anticipated consequences and remedies; on its own wording that clause reaches EU and Swiss customers. The security page says that if Aerofiler 'learns of a security breach, we will notify affected users'. No hour count, Notifiable Data Breaches reference or incident history was found. | State the contractual notification period from discovery for an Australian customer, whether it covers subprocessor incidents, and list any material incidents in the last 24 months. | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Change notice for subprocessors and models | Public claim only | The Data Processing Addendum authorises Aerofiler to engage the entities on the subprocessor list and says 'Aerofiler shall notify you of any additional sub-processors by posting them at the foregoing URL'. A customer may object in writing, and the DPA then states that if Aerofiler does not cease using the subprocessor, 'you should stop using the Services'. No notice period, dated version history or model-change notice was found. | What advance written notice will we receive before a new subprocessor or model provider is added, and what remedy do we have other than ceasing to use the service? | [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au); [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) |
| Export and exit | Public claim only | The home-page FAQ says 'You can export your files and data at any time in a self-serve manner'. The security page says customers 'can take a copy of their data before they go (both documents and document metadata)' and can use the integrations to back up files to their own cloud storage. No export format, completeness statement covering extracted metadata and audit logs, or deletion certificate is described on the pages read. | Demonstrate a full export, including documents, extracted metadata, workflow history and audit logs, and state the formats and any assistance cost. | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Connectors and conditional processors | Public claim only | Each integration-linked processor on the subprocessor list is marked conditional: Adobe, DocuSign and Namirial S.p.A. 'if using' the matching e-signature integration, Okta 'if using Single Sign On via Okta', and Zapier 'if using integrations'. Litera Corp is listed unconditionally, with purpose 'Process customer documents'. | What does Litera Corp do with our documents, since it is listed without an 'if using' condition, and can that processing be disabled? | [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) |
| Open-web retrieval | Not confirmed | Nothing on the home, security, Data Processing Addendum (AU) or subprocessor pages read on 2026-09-27 says whether any Aerofiler feature retrieves content from the open web, and no search or browsing control is described. The AI claims on the home page are confined to analysing the customer's own contracts. | Does any Aerofiler feature query the internet or an external data source when analysing a contract, and can that be disabled? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |
| Automated actions and confirmation | Not confirmed | Custom Workflows are described as 'automating requests, approvals and signatures' across the contract lifecycle, which is rule-based routing rather than an AI agent acting. The pages read do not say whether an AI-extracted value can trigger a workflow step, a signature request, a renewal notice or an outbound message without a person confirming it. | Can any AI-extracted value start a workflow, send a signature request or issue a renewal notice without a person confirming it, and can that be blocked by configuration? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) |
| Human review before reliance | Not confirmed | No statement was found on the pages read that a person reviews AI-extracted clauses, obligations or generated contracts before they are relied on, and no in-product review, approval or confidence indicator for AI output is described on the home or security pages. | What in-product control forces a named reviewer to accept or reject each AI-extracted obligation before it drives a report or a reminder? | [Aerofiler - contract management system (home page)](https://www.aerofiler.com/); [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) |

## Notes

Four vendor pages were read within a five-operation source budget: home, security, Data Processing Addendum (AU) and subprocessor list. Not read, and therefore not recorded: the Australian terms of service (/terms/au), the privacy policy, the pricing page and the Legal Teams solution page. Unverified: training on customer content, in-life retention, hosting region and whether an Australian region exists, feedback use, open-web retrieval, human review of AI output, and ownership. Two capability values considered in stage 1 were dropped for want of vendor wording: document-classification (the vendor claims 'effortless filing' and duplicate detection, not classification) and knowledge-search (no search feature is claimed on the pages read). The Data Processing Addendum (AU) states it applies only to customers located in the EU or Switzerland, which leaves an Australian customer's processing terms unestablished.

## Sources

- [Aerofiler - contract management system (home page)](https://www.aerofiler.com/) (checked 2026-09-27)
- [Aerofiler - Security (effective 20 April 2023)](https://www.aerofiler.com/security) (checked 2026-09-27)
- [Aerofiler - Data Processing Addendum (AU), last updated 1 December 2018](https://www.aerofiler.com/legal/dpa-au) (checked 2026-09-27)
- [Aerofiler - Subprocessor List](https://aerofiler.com/legal/subprocessors) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.