Product and intended use
Define the configuration, people, information and tasks being assessed.
What this profile covers
Not confirmed
The vendor publishes one platform, headed on the home page 'The all-in-one platform for Legal Project Management', with a single features list covering upfront planning, ongoing budget control, advanced data reporting, competitive tendering, and confidentiality and data protection. No plan, edition, tier or module list is published on the pages read, so what any one subscription includes is not established. A pricing page exists in the site navigation at https://allyone.com.au/pricing; it was not read because the firecrawl operation budget for this product was exhausted.
Ask: Is AllyOne sold as one platform or in editions, and are competitive tendering and the AI invoice reading included in every subscription or licensed separately?
Published functions
Public claim only
The Overview & Features page states the platform sets up a project 'with tasks that are necessary, likely, and possible for achieving your legal outcome' and bases the budget 'only on what's necessary'; provides 'Capped project budgets divided into necessary likely and possible streams of work – only necessary work is approved for payment'; offers 'Project templates'; lets a buyer 'Manage and approve law firm change requests'; performs 'Automatic invoice reading for invoices within approved budget'; produces 'Single-click reports for cash flow forecasts, timelines, budget changes, savings and more' and 'Fully customisable reports'; invites 'law firms to bid for work with defined tasks and outcomes' with 'Like-for-like quote comparison' and 'Customisable tender requirements'; and states 'AllyOne automatically updates your project spend, so you get real-time budget updates'.
Ask: Which of those functions use a model and which are deterministic rules — specifically, is task scoping, budget forecasting or like-for-like quote comparison model-driven, or is the AI limited to invoice reading?
Release stage and product history
Not confirmed
No version, release note, changelog or roadmap is published on the pages read. The Overview & Features page states the budgeting methodology behind the product has been in use 'since 2008', which is a statement about the methodology and not about the software. The home page carries four unattributed or role-attributed testimonials and the Overview & Features page one attributed to a general counsel at an organisation named as CCI. No launch date for the platform itself is published.
Ask: When was the current AllyOne platform first released, how many organisations use it today, and what is the release and change history of the AI invoice reading?
How it is delivered and where it runs
Public claim only
The home page states 'We offer flexible hosting options - on AWS, your preferred cloud provider, or on-premise to suit your infrastructure and security needs.' That is the only deployment statement found, and it names Amazon Web Services without a region, account model, or any detail of what a customer-hosted or on-premises deployment includes. The Security page adds 'Automated back-ups' with no location, frequency or retention. No page read states which region the vendor's own hosted service runs in, and no data-residency statement appears anywhere, so no Australian residency is recorded.
Ask: For the vendor-hosted option, which AWS region holds our data and our backups, and is an Australian region the default or available on request?
Australian standing and applicable law
Public claim only
The Privacy Policy dated 5 September 2023 states "In this Privacy Policy, 'us' 'we' or 'our' means AllyOne Pty Ltd ABN 41 657 206 874 (AllyOne)", and directs access, correction and complaint requests to the Chief Executive Officer at the vendor's Canberra office, naming the Office of the Australian Information Commissioner at www.oaic.gov.au as the external complaint route. The published address on every page read is Suite 3, Ground Floor, 65 Canberra Ave, Griffith ACT 2603 Australia, with telephone (02) 5104 3170. The policy is therefore written to the Australian Privacy Act. No ACN is published on any page read, and no governing-law or forum clause was found anywhere because no terms of service are published.
Ask: Confirm the contracting entity and its ACN, and provide the governing law and forum in your subscription agreement.
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page, file or block telling AI models, assistants or crawlers how to describe the product. A 26-URL map of allyone.com.au returned no /llms.txt, /ai-info, /ai or /for-ai URL, and none of the home page, the Overview & Features page, the Security page or the Privacy Policy contains a block addressed to AI models or crawlers, nor any machine-readable question-and-answer content in which the vendor answers a comparative or superlative question about itself. One limitation is material and is stated rather than glossed over: the site publishes a frequently-asked-questions page at https://allyone.com.au/faqs which was not read because the firecrawl operation budget for this product was exhausted, and that is the page on which such content would most likely sit.
Ask: Do you publish any page, file or metadata addressed to AI assistants, answer engines or crawlers setting out how AllyOne should be described, and does your FAQ page answer any question comparing AllyOne with other products?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and the buyer-to-firm boundary
Not confirmed
The platform holds a legal buyer's matter scopes, capped budgets, tender documents, law firm proposals and law firm invoices, and law firms are invited into it to bid and to submit change requests. The home page heading over the testimonials is 'Trusted by leading general counsel' and two of the four testimonials are attributed to a 'Government Client'. The only access statements published are 'Multi-Factor Authentication', 'Role-Based Access Control and Granular Permissions allow you to tailor access levels to specific team members' and integration with existing authentication systems. Nothing read states what a bidding firm can see of another firm's proposal or of the buyer's internal budget, or what a government buyer would need to satisfy its own hosting and assessment requirements.
Ask: In a competitive tender, exactly what can each bidding firm see of the buyer's budget and of other bids, and what certification do you hold for Australian government workloads?
Foundation-model providers
Not confirmed
No model, model family, version, platform or supplier is named anywhere on the pages read. The vendor's AI statements are three short phrases: 'Process and validate invoices using AI' and 'Allocate resources (people + AI) intelligently' on the home page, and 'Automatic invoice reading for invoices within approved budget' on the Overview & Features page. Neither the Security page nor the Privacy Policy mentions artificial intelligence, a model, or any third-party processing service.
Ask: Name the model and provider behind the invoice reading, the legal entity supplying it, the region in which inference runs, and whether invoice content leaves your tenancy to reach it.
Subprocessors
Not confirmed
No subprocessor list, register or processing schedule is published. The Privacy Policy states 'We hold personal information in hard copy or electronic f ormat, in storage facilities that we operate ourselves or that are operated by trusted third parties', naming none, and lists recipients including 'third party suppliers and service providers (including providers for the operation of our websites and/or our business or in connection with providing our products and services to you)', 'professional advisers, dealers and agents' and 'payment systems operators'. The only third party named anywhere is Amazon Web Services, on the home page as one of several hosting options.
Ask: Provide a dated subprocessor register for AllyOne naming every entity including the invoice-reading model provider, each one's country of processing, and our notice and objection rights.
Training on customer content
Not confirmed
Nothing on the pages read states whether a customer's matter scopes, budgets, tender responses, invoices or reports are used to train, tune or evaluate any model. The Privacy Policy does state two adjacent things about secondary use of data: that personal information is used 'to operate, protect, improve and optimise our website and services, business and our users' experience, such as to perform analytics, conduct research and for advertising and marketing', and that 'We may also disclose de-identified information to a trusted third party who also holds other information about you. This third party may combine that information in order to enable it and us to develop anonymised consumer insights'. Neither clause names AI training and neither is limited to a customer's own tenancy.
Ask: Does any signed document prohibit training, tuning or evaluation on our invoices, budgets and tender responses, and does the de-identified-disclosure clause in your privacy policy apply to platform data as well as website data?
Use of feedback and corrections
Not confirmed
Nothing published says what happens when a user corrects an invoice reading or a budget match, whether the correction is retained, or whether it is reused beyond the customer's own data. The Privacy Policy's only related statement is that personal information collected includes 'information you provide to us through customer surveys' and that data may be used to 'improve and optimise our website and services'.
Ask: When our team corrects a misread invoice line, is that correction retained, and is it used to improve the model for other customers?
Retention
Public claim only
The Privacy Policy states 'We aim to keep your personal information for as long as we need it – for example for business or legal reasons. When we no longer need it, we take reasonable steps to destroy or de-identify your personal information', and separately 'We store personal information for as long as it is needed fro the purpose for which it was collected or as required by law' (the typographical error is in the original). No period is stated, and nothing sets a retention period for platform content: matter scopes, budgets, tender documents, invoices, invoice images or generated reports.
Ask: How long do you retain our project, budget, tender and invoice data and the invoice images after a project closes and after the subscription ends, and can we set that period?
Deletion on request and on exit
Public claim only
The Privacy Policy provides individual access and correction rights on written request to the Chief Executive Officer, notes an administration fee may be charged for access, and undertakes to acknowledge a complaint within 10 working days and to aim to determine resolution steps within 30 working days. It commits to taking 'reasonable steps to destroy or de-identify' personal information when no longer needed. Those are rights over personal information held by AllyOne. No deletion commitment, timetable or certificate is published for a customer's platform data on termination.
Ask: On termination, what is deleted, on what timetable, and will you certify deletion of our invoice images, tender documents and backups?
Vendor staff access
Not confirmed
Nothing published states which AllyOne staff or contractors can read a customer's budgets, tender responses or invoices, from which countries, or under what approval, and no customer-visible access log is described. The Privacy Policy states AllyOne uses 'a combination of technical solutions, security controls and internal processes to help us protect your personal information and our network from unauthorised access and disclosure' and that information may be held in facilities 'operated by trusted third parties'. The Security page describes customer-side controls only.
Ask: Which of your staff can access our tenancy and from which countries, is access logged and visible to us, and is any support or development work performed offshore?
Authentication and permissions
Public claim only
The Security page states 'AllyOne uses Multi-Factor Authentication for all logins. Organisations can also integrate AllyOne with their existing authentication systems' and 'Role-Based Access Control and Granular Permissions allow you to tailor access levels to specific team members, ensuring users only see what they need to.' The Overview & Features page repeats 'Multi-factor authentication' and 'Role-based access control'. The named authentication standard, whether single sign-on is SAML or OIDC, whether SCIM provisioning exists, and whether an administrator audit log is available and exportable are not published.
Ask: Which single sign-on standards do you support, is SCIM provisioning available, and can firm administrators export an audit log of who viewed a budget, a bid or an invoice?
Encryption in transit and at rest
Public claim only
The Security page states 'All data, both in transit and at rest, is encrypted using industry best-practice methods.' No algorithm, protocol version, key-management arrangement or customer-managed-key option is named, and the statement appears on a marketing page with no contractual backing found. The Privacy Policy is weaker and names different measures: 'we use multi factor authentication, sessions, automated backups, access tokens. However, we cannot guarantee the security of your personal information.'
Ask: Specify the encryption algorithms and protocol versions in transit and at rest, who holds and rotates the keys, and whether customer-managed keys are available.
Independent security assurance
Public claim only
Two statements are published and they differ in wording. The Security page states 'AllyOne has ISO/IEC 27001 certification – an internationally recognised standard for managing information security and protecting data from threats' and 'AllyOne follows a proactive vulnerability management process –continuously monitoring, assessing, prioritising, and remediating security risks.' The Overview & Features page states 'ISO27001:2022 accredited', and the home page states 'We are ISO 27001 certified' and 'Our platform is tested by independent security consultants to ensure your data is secure.' No certificate number, certified legal entity, scope statement, certification body, issue date or expiry is published, no penetration-test summary or report is offered, and no SOC 2 or IRAP assessment is claimed anywhere. ISO 27001: the vendor's own page states "a8d6d765/94a6cf84-2018-492f-a56a-158f5208ddd8/Security.png) ### Highest data security standards - ISO 27001 certified We are ISO 27001 certified - ensuring your data is" (https://allyone.com.au/, checked 2026-10-10). Unverified, not applied (2026-10-10): security claim GDPR (https://allyone.io/). not the vendor's domain.
Ask: Provide the ISO/IEC 27001 certificate for AllyOne Pty Ltd with its certification body, certificate number, scope statement and expiry date, and the date and scope of your most recent penetration test.
Contract, DPA, liability and forum
Not confirmed
No subscription agreement, data processing agreement, liability cap, indemnity or forum clause is published anywhere on the site, and a 26-URL map of allyone.com.au surfaced no terms page. The Privacy Policy is the only published legal document; it names AllyOne Pty Ltd ABN 41 657 206 874 as the entity and contains no contractual provisions. The contracting entity is therefore known, and every commercial and data-processing term is not.
Ask: Provide your subscription agreement and data processing agreement, including the liability cap, the indemnities, the governing law and whether AllyOne Pty Ltd is the contracting party.
Cross-border transfers and APP 8
Not confirmed
The Privacy Policy contains no statement about overseas disclosure and names no country in which personal information is or may be held; it lists recipient categories without location, and does not mention Australian Privacy Principle 8 or any transfer mechanism. The only geography published anywhere is the vendor's Canberra address and the reference to hosting 'on AWS, your preferred cloud provider, or on-premise', which names no region. No country of processing is therefore established for any deployment option.
Ask: For the vendor-hosted option, list every country in which our data is stored, processed, backed up and supported, and state your APP 8 position for any offshore disclosure.
Incident notification and history
Not confirmed
No incident notification commitment, period, contact or history is published on the pages read, and the Notifiable Data Breaches scheme is not mentioned. The Privacy Policy's related statements are that AllyOne takes 'reasonable steps to protect your personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure' and that 'we cannot guarantee the security of your personal information'. The Security page describes a vulnerability management process but names no disclosure channel, bug bounty or customer notification undertaking.
Ask: What is your contractual notification period from discovery of an incident, who do you notify, and have you had any notifiable data breach in the last 24 months?
Change notice
Public claim only
The Privacy Policy states 'We may change our Privacy Policy from time to time by publishing changes to it on our website. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy', which places the burden of noticing a change on the reader and commits to no notification. No product change, release-note or deprecation notice commitment is published, and there is no changelog on the pages read, so nothing obliges the vendor to tell a customer before the invoice-reading behaviour or the budget logic changes.
Ask: Will you give advance written notice before changing the invoice-reading model or the automated approval logic, and where are release notes published?
Export and exit
Not confirmed
Nothing published describes exporting a customer's projects, budgets, tender records, invoices or reports out of AllyOne, in what format, at what cost, or how long data remains available after termination. The nearest published function is reporting rather than extraction: 'Single-click reports for cash flow forecasts, timelines, budget changes, savings and more' and 'Fully customisable reports'. The Privacy Policy addresses individual access to personal information, not bulk customer data, and notes an administration fee may apply to an access request.
Ask: In what formats can we bulk-export our projects, budgets, tender records, invoice data and invoice images on exit, at what cost, and for how long is the data available after termination?
Connectors and data reach
Public claim only
The only connector statements published are 'API integrations' in the Overview & Features list and, on the Security page, that organisations 'can also integrate AllyOne with their existing authentication systems'. Neither names a system or a protocol. Data enters the platform from two directions on the vendor's own description — the buyer sets up projects and budgets, and law firms are invited in to bid, raise change requests and submit invoices that the platform reads — but no mechanism for invoice delivery, such as email ingestion, upload or an e-billing standard, is published.
Ask: How do law firm invoices physically reach AllyOne, is any e-billing standard such as LEDES supported, and what does your API expose?
Retrieval beyond the customer's own data
Not confirmed
The published functions operate on the customer's own projects, budgets, tenders and invoices, and on its own history: 'Interrogate data from past projects so you can confidently forecast future legal spend and assess the value of a fee proposal.' No page read states that any component queries the open web or any external data set, and none states positively that it cannot. Benchmarking is described on the home page as 'Deliver world-class analytics and benchmark your results' without saying whether the comparison uses only the customer's own past projects or a pooled data set across customers.
Ask: Does benchmarking compare our results only against our own past projects, or against a pooled data set drawn from other customers, and does any component query external sources?
Autonomy and action control
Not confirmed
The published design automates an approval. The Overview & Features page states 'Save hours of time-consuming invoice reconciliation with automated invoicing approval. Invoices only get approved if they're linked to your agreed budget', the features list states 'Automatic invoice reading for invoices within approved budget' and 'only necessary work is approved for payment', and the home page states 'AllyOne automatically updates your project spend'. So an invoice inside the agreed budget can be approved by the system on the vendor's own description, while change requests outside the budget are routed to a person: 'Manage and approve law firm change requests'. Nothing read states whether the automatic approval can be turned off, whether a value threshold applies, or whether approval triggers payment.
Ask: Can an invoice be approved and passed for payment without a named human approval, is there a configurable value threshold, and is every automated approval recorded against a named user?
Human review of AI output
Not confirmed
The only human step described in the invoice path is for exceptions: change requests are managed and approved by the buyer, while invoices within the approved budget are read and approved automatically. No page read states that a person must review what the invoice reading extracted before approval, whether a confidence threshold routes an item to a person, or how a misread line is detected. For tendering the buyer compares 'like-for-like' proposals, which is described as a human decision supported by the platform.
Ask: Is there a confidence threshold that sends a read invoice to a person, and how would we detect an invoice line the system misread and approved?
