Product and intended use
Define the configuration, people, information and tasks being assessed.
Core SaaS vs Advanced private
Public claim only
Deployment page: Alexi Core is secure SaaS (typically 11–25 lawyers, early AI). Alexi Advanced is a fully isolated private environment (typically 25+ lawyers) with firm-owned learning. Confirm which SKU.
Ask: Which SKU (Core vs Advanced) and country edition would we buy?
SaaS or single-tenant
Public claim only
Core is multi-tenant-style SaaS; Advanced is single-tenant private environment with Azure and AWS logos on the private-environment page. Hosting country for Core is not named there. Security: encryption in transit/at rest; inference-only model usage.
Ask: For Core SaaS, which cloud region hosts storage and inference? For Advanced, is the tenant in Canada?
Litigation/knowledge
Public claim only
Purpose-built for law firms; VALS AI accuracy badge is displayed.
Ask: Which research, drafting and knowledge features are in our licence?
Canada-only use in Terms
Public claim only
Terms: 'Customer may access and use the Alexi Solution only in Canada.' Home markets North American firms. No Australian primary-law coverage is described. Governing law: Ontario and federal laws of Canada; courts in Toronto.
Ask: Is an Australian-use Order Form available, or is this product off-limits for AU seats?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Customer consents; Canada use
Public claim only
Terms: Customer warrants it has all consents for Customer Data; only Permitted Users; use only in Canada; Customer is responsible for accuracy and legality of Customer Property. Security stresses client confidentiality but does not replace those warranties.
Ask: What client disclosure do we use, and can non-Canadian users be blocked?
Azure/AWS shown; LLM unnamed
Public claim only
Private-environment page displays Azure and AWS logos. Security: tenant and model isolation; inference-only model usage; no cross-tenant access. Terms define a Baseline Model (Alexi or its licensors) and Custom GenAI Model trained or fine-tuned using Customer Data. Foundation-model brand names are not stated.
Ask: Name each model, entity, region and whether Custom GenAI fine-tuning is on by default.
Subcontracting without notice
Public claim only
Terms s 2.2: Alexi may engage third parties to provide the Solution without prior consent or prior notice to Customer. Privacy: service providers for hosting, cloud, payments, advertising; no named public register. Trust centre (DPA/audit reports) is gated and did not scrape.
Ask: Provide the dated named subprocessor register, including any LLM, and a right to object.
Improve-licence vs no-external-training
Not confirmed
Security: information does not train external systems; inference-only. Terms: Customer grants a perpetual licence to Process Customer Property to improve and enhance the Alexi Solution and other offerings; Custom GenAI Model is defined as trained or fine-tuned using Customer Data and is Alexi Property. Home: continuously learning environment. These must be distinguished in the signed DPA (PDF on the DPA URL did not extract).
Ask: Does any firm content train a shared Baseline Model, only a tenant-isolated Custom GenAI Model, or neither?
Feedback and usage metadata
Public claim only
Terms: Feedback is not confidential and Alexi may use, commercialise or disclose it worldwide without compensation. Alexi may Process Customer Property to generate Aggregated Data and metadata about how users interact with features; Aggregated Data is not Customer Data.
Ask: Can we contract out the Feedback licence and improvement use of Customer Property?
ZDR
Public claim only
Zero-data-retention policies and audit logging are claimed without numbered periods.
Ask: State platform versus model-provider retention.
30-day retrieval if requested early
Public claim only
Terms s 13(c): if Customer requests in writing at least 30 days before termination and has paid Fees, Alexi will make Customer Data available for electronic retrieval for 30 days. Alexi may retain Customer Data as required by law and in backups until deleted in the ordinary course. DPA PDF did not extract.
Ask: On exit, certified deletion of production, backups and subprocessors within 30 days — including Custom GenAI weights?
Need-to-know staff
Public claim only
Privacy: access restricted on a need-to-know basis to employees and authorised service providers. Security: inference-only; no cross-tenant access. Countries of staff access are not listed beyond privacy's US/Ireland processing note.
Ask: Who can read our matters, from which countries, and can we see access logs?
SSO, MFA, RBAC
Public claim only
Security: SSO (SAML/OIDC), MFA, role-based access. Terms: Administrator User Accounts create Staff User Accounts; sharing accounts prohibited; Alexi may suspend accounts used without authorisation.
Ask: Confirm SCIM and export of a complete agent/workflow audit log.
Encryption
Public claim only
Encryption in transit and at rest. Algorithms not named.
Ask: Name TLS/AES versions.
SOC 2
Public claim only
SOC 2 certification badge. Type I vs II and scope not stated.
Ask: Provide the current SOC 2 report and scope.
Ontario Terms; DPA PDF unread
Public claim only
Public Customer OS Terms: Ontario and federal Canadian law; exclusive courts in Toronto; liability cap equal to Fees in the prior 12 months; customer indemnity; DPA incorporated for personal information. DPA URL exists (2025 PDF) but text did not extract. Trust centre gated.
Ask: Provide the signed DPA text, any AU-use amendment, and confirm the cap applies to confidentiality breaches.
Outside Canada including US and Ireland
Public claim only
Privacy: we and our service providers may access, store and otherwise process personal information outside of Canada, including in the United States and Ireland. Terms still limit Customer use of the Solution to Canada. Core SaaS region is unnamed; Advanced is private single-tenant.
Ask: List every country for Core SaaS storage, inference, backups and support, and the APP 8 basis.
incidents
Not confirmed
Not documented on the pages reviewed in this pass.
Ask: Provide current contractual evidence for this control.
Subcontract and modify without consent
Public claim only
Terms: subcontractors without prior consent or notice; Modifications allowed if they do not materially reduce functionality; Fees may change on each anniversary with 30 days' notice. No model-change notice is specified.
Ask: What notice before a new model or processor, and can we object?
30-day export window
Public claim only
If requested in writing at least 30 days before termination and Fees are paid, Customer Data is available for electronic retrieval for 30 days. Customer is solely responsible for copying records. No certified deletion SLA. Auto-renew unless 30 days' non-renewal notice.
Ask: Will you export in a usable format and certify deletion including Custom GenAI artefacts?
DMS, identity, third-party products
Not confirmed
Optional identity/DMS integrations and Third Party Products. Terms: exchange of data with third-party products is solely between Customer and that provider; Alexi is not responsible for disclosure or deletion resulting from those products.
Ask: List every connector on our tenant and disable unused ones.
Web
Not confirmed
Not described.
Ask: Does any skill call the open web?
Agents and workflow automations
Not confirmed
Product includes Agents & Workflow Automations (checklists, transcript workflows). Confirmation gates before an agent files, emails or writes back to a DMS are not described on pages reviewed.
Ask: Which agent actions can send email or write to iManage without a second lawyer confirmation?
Independent validation required
Public claim only
Terms warranty disclaimer: Customer agrees it will independently validate, and instruct Permitted Users to independently validate, results including all GenAI Outputs before relying, and will ensure anyone they share outputs with understands the limitations.
Ask: Can we technically require every GenAI Output to be marked reviewed by a named lawyer before export?