Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Anaqua sells AQX as its IP management platform and AQX Law Firm as the law-firm configuration of it. A firm-named customer statement on the law-firm page describes the surrounding products as separate purchases: 'The high level of integration and automation in the AQX Law Firm platform, combined with the efficiency and time-saving benefits of WiseTime and AQX Billing, were particularly important to us.' Anaqua also sells AI Docketing, Brand Protection, Timekeeping & Billing, Analytics, RightHub and AcclaimIP as their own products. Whether the AI capabilities are licensed with AQX or priced separately is not stated on the pages read.
Ask: On our order form, which AQX modules and which named AI capabilities are included, and which of AQX Billing, WiseTime, AI Docketing and Brand Protection are separately licensed?
Deployment model and hosting
Public claim only
The AQX product page (read 2026-09-27) describes 'Azure-based, single-tenant hosting for maximum isolation and resilience' and, separately, 'U.S.-only infrastructure and staffing for sensitive and export-controlled data'. A customer case study on the same page describes AQX as 'Built on Microsoft Azure'. No region list, no Australian region and no on-premises option appear on any page read; the privacy policy refers only to 'Anaqua and/or its hosting providers' without naming a region.
Ask: In which Azure regions would our AQX Law Firm tenant, its backups, its logs and its AI processing run, and is an Australian region available?
AI capabilities in scope
Public claim only
Anaqua's AI page lists named capabilities with a described function for each: automated document and email processing that extracts and validates data and triggers next steps, AI docketing, intelligent classification of patents and IP assets, AI-powered information disclosure statement management, AI document understanding producing summaries and guided analysis, automatic time capture generating billing narratives, natural-language interaction to 'ask questions, generate reports, translate content, and analyze documents', AI-assisted invention and patent drafting, brand risk detection across marketplaces, domains and social platforms, and AI-enhanced data quality. The page states 'Anaqua AI capabilities are delivered across our platforms—AQX for enterprise-scale IP management and RightHub for connected, AI-native workflows.'
Ask: Which of the ten published AI capabilities are available in AQX Law Firm today as opposed to RightHub, and which are on a roadmap?
Jurisdictions and IP office coverage
Public claim only
The AQX FAQ states 'AQX supports patents, trademarks, designs, domain names, copyrights, conflicts, and related agreements' and that it is 'designed for organizations managing increasing portfolio complexity across jurisdictions'. Connectivity to 'global patent offices' is asserted without naming any office. No jurisdiction list, no rule source for deadline calculation and no reference to any Australian IP office appear on the pages read.
Ask: Which patent and trade mark offices does AQX connect to, which jurisdictions' statutory deadline rules does it calculate, and how are Australian rules maintained and dated?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A map of 40 URLs on anaqua.com surfaced no /llms.txt, /ai-info or /for-ai page, and none of the AQX product page, the law-firm solutions page, the Anaqua AI page, the legal-terms page or the privacy policy contains a block addressed to AI models, assistants or crawlers. The AI page does carry five 'guiding principles' addressed to readers — human oversight by default, privacy and security by design, transparent and explainable outputs, domain-specific quality and accuracy, and governance and compliance — which are statements of intent with no contractual or audited backing on the pages read.
Ask: Do you publish any page or block of content directed at AI assistants, answer engines or crawlers about how Anaqua products should be described, and where is it?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Nothing on the pages read addresses client consent or notice for AI processing of a client's IP matter. The AcclaimIP Terms & Conditions, the only terms published, disclaim that anything in the software constitutes legal advice and state the customer 'hereby disclaims and waives any reliance whatsoever upon the same', but those terms govern a different product. The AQX and law-firm pages describe client and foreign-agent visibility into matter status and reporting without addressing whose consent that requires.
Ask: What notice or consent do we need from our IP clients before AQX AI processes their matters, and can AI processing be disabled for nominated clients or matters?
Foundation-model providers
Not confirmed
No model or model provider is named on the Anaqua AI page, the AQX page, the law-firm page, the legal-terms page or the privacy policy read 2026-09-27. Phase 2 searched the Anaqua AI page explicitly for OpenAI, Azure, Anthropic, Bedrock, Gemini and 'large language model' and found none. The only related fact published is that AQX is hosted on Microsoft Azure, which does not establish which model service performs inference.
Ask: Name every model and model provider used by each AQX AI capability, the legal entity and region of the inference endpoint, and whether any model runs outside Anaqua's own tenancy.
Subprocessors
Not confirmed
No subprocessor list or register is published on anaqua.com on the pages read, and no trust centre was found. The global privacy policy refers to 'Anaqua, Inc. and its global affiliates' and to third parties who assist with developing, promoting and providing software and services, with billing and collection, and with fraud prevention, and states that personal data 'may not be used by the third parties for any other purpose'. It also refers to 'Anaqua and/or its hosting providers' without naming one.
Ask: Provide a dated subprocessor register for AQX Law Firm, naming every entity, its country of processing, what it processes and our notice and objection rights.
Training on customer content
Not confirmed
Nothing on the pages read says whether customer matter data, documents, prompts or outputs are used to train, fine-tune or evaluate any model. The AI page's 'Privacy and security by design' principle says only 'Protect sensitive IP data with access controls and safeguards across data handling and outputs'. The AcclaimIP Terms & Conditions, which do not govern AQX, assign to Anaqua all right, title and interest in the software and its updates and modifications 'whether suggested, created, made, or provided by Anaqua, Customer, or any other person', and require the customer to assign any such rights it acquires.
Ask: Does any signed document prohibit training, fine-tuning, evaluation or product improvement on our matter data, documents, prompts and outputs, by Anaqua and by any model provider?
Feedback and quality monitoring
Not confirmed
No in-product rating or feedback control for AQX AI output is described, and nothing states whether prompts, outputs or corrections are reviewed by staff or reused for quality work. The privacy policy has a section headed 'Enhancement of the Customer Experience' which concerns marketing contact and an annual user conference, not AI quality review. A published case study describes a named firm taking part in 'co-development workshops and feedback loops' with Anaqua.
Ask: Are AQX AI prompts, outputs and user corrections reviewed by Anaqua staff or a model provider for quality improvement, and can our firm opt out of that?
Retention of matter data, prompts and outputs
Public claim only
The global privacy policy (updated 18 October 2023) states Anaqua retains personal data 'only as long as necessary for Anaqua to comply with business, tax, and legal requirements'; that for customers, partners, vendors and employees the period 'is likely to be the entire time you are a Customer'; that after the relationship is terminated Anaqua will keep personal data 'for a reasonable period'; and that it 'may keep an anonymized form of your PD… for statistical purposes without time limits'. No period is given for AQX matter data, documents, AI prompts, AI outputs or backups, and 'a reasonable period' is not defined.
Ask: State in days the retention applied to our AQX matter data, documents, AI prompts and AI outputs, both during the term and after termination, and the same for backups.
Deletion and certified erasure
Not confirmed
The privacy policy lists a right to erasure for individuals 'subject to applicable law' and says Anaqua will delete information from existing files 'within a reasonable time period' when asked to stop marketing contact. Nothing on the pages read states what happens to a law firm's AQX matter data, documents or AI artefacts on termination, or whether deletion is certified. The AcclaimIP Terms & Conditions, which do not govern AQX, contain no return-or-destroy provision on termination beyond payment of outstanding amounts.
Ask: On termination, what is deleted, in what period, including AI prompts, outputs and backups, and will Anaqua certify deletion in writing?
Vendor access to customer content
Public claim only
The privacy policy states 'Our policies also limit access to PD to only those employees, contractors, agents, or representatives that require the information to perform their jobs or assist Anaqua with providing Software and Services to you.' The AQX page states 'U.S.-only infrastructure and staffing for sensitive and export-controlled data', which implies staffing elsewhere for other data without saying where. Anaqua's boilerplate states offices across the United States, Europe, Asia and Australia. No access-approval process, no logging commitment and no list of support countries appears on the pages read.
Ask: From which countries can Anaqua staff and contractors read our matter content, under what approval, and can we obtain the access log for our tenant?
Access control, authentication and audit
Not confirmed
The privacy policy refers to 'firewalls and access control procedures' without detail. The AcclaimIP Terms & Conditions, which do not govern AQX, place seat security on the customer, limit administration to a single customer administrator login and prohibit seat sharing. Single sign-on, multi-factor authentication, role-based permissions for AI features and audit-log export are not described anywhere on the pages read.
Ask: Does AQX support single sign-on and enforced multi-factor authentication, can AI capabilities be restricted by role, and can we export a complete audit log of AI use?
Encryption in transit and at rest
Public claim only
The AQX product page states 'Encryption at rest and in transit protects sensitive IP at every stage'. No algorithm, protocol version, key-management arrangement or customer-managed-key option is named on that page or on any other page read, and the privacy policy refers only to 'security techniques designed to protect your information from unauthorized access, including firewalls and access control procedures'.
Ask: Specify the encryption algorithms and protocol versions used in transit and at rest, who holds and rotates the keys, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The AQX product page states 'Certified security controls validated by ISO 27001, SOC 2 Type 2, and ISO 9001' without naming the certified entity, the certificate number, the auditor, the scope or the date. The privacy policy states something narrower: 'Anaqua and/or its hosting providers are at least ISO/IEC 27001 and/or SSAE-16/SOC 2, Type 2 certified', which leaves open whether the certification is held by Anaqua or by its hosting provider. No report, certificate, penetration test summary or trust centre was found on anaqua.com. GDPR: the vendor's own page states "ction, use, and retention of personal information including the General Data Protection Regulation (GDPR), Switzerland, the UK, the California Consumer Privacy Act (CCPA), and other ap" (https://www.anaqua.com/privacy-policy/, checked 2026-10-10). ISO 27001: the vendor's own page states "ht=112&name=container.png) ### Proven compliance Certified security controls validated by ISO 27001, SOC 2 Type 2, and ISO 9001 - ![container (1)](https://www.anaqua.com/hs-fs/hu" (https://www.anaqua.com/products/aqx/, checked 2026-10-10). SOC 2: the vendor's own page states "=container.png) ### Proven compliance Certified security controls validated by ISO 27001, SOC 2 Type 2, and ISO 9001 - ![container (1)](https://www.anaqua.com/hs-fs/hubfs/con" (https://www.anaqua.com/products/aqx/, checked 2026-10-10).
Ask: Provide the current ISO 27001 certificate and SOC 2 Type II report for the legal entity that operates AQX, with the scope statement, the auditor and whether the AI capabilities are in scope.
Contract, DPA, liability and forum
Not confirmed
No AQX contract is published. The legal-terms page carries website Terms of Use governed by Delaware law with exclusive jurisdiction in Delaware courts, and the AcclaimIP Terms & Conditions governed by Massachusetts law with exclusive jurisdiction there, a jury-trial waiver, and liability capped at fees paid in the preceding twelve months with all indirect and consequential damages excluded. Those two documents name different governing laws, and neither is stated to cover AQX or AQX Law Firm. No data processing agreement is published; the privacy policy states only that 'Anaqua's Customers are the "data controller" and Anaqua is the "data processor"' and that Anaqua complies with the EU standard contractual clauses for onward transfers from the EU.
Ask: Provide the master agreement and data processing agreement that would govern AQX Law Firm for an Australian firm, naming the contracting entity, its ACN or ABN, the governing law, the forum and the liability cap.
Cross-border transfers and APP 8
Not confirmed
The privacy policy names no country of processing and addresses transfers only from the EU, stating 'Anaqua complies with the EU Standard Contractual Clauses for all onward transfers of PD from the EU' and that Anaqua may be required to disclose personal data 'in response to lawful requests by public authorities, including to meet national security or law enforcement requirements'. It lists the GDPR, Switzerland, the UK and the California Consumer Privacy Act as applicable laws and does not mention the Australian Privacy Act or Australian Privacy Principle 8. The only region named anywhere is the 'U.S.-only infrastructure and staffing' option for sensitive and export-controlled data.
Ask: For an Australian firm, list every country where our matter data would be stored, processed for inference, supported, logged and backed up, and what Australian Privacy Principle 8 mechanism you rely on.
Incident notification and history
Not confirmed
No incident notification commitment, period or history is published on the pages read. The privacy policy says only that Anaqua 'cannot guarantee that an unauthorized disclosure will not occur' and describes security measures 'to protect against the loss, misuse, and alteration of information'. The AcclaimIP Terms & Conditions, which do not govern AQX, contain no notification provision. Nothing addresses the Notifiable Data Breaches scheme.
Ask: What is the contractual notification period from discovery of an incident, who is notified, and have there been any material incidents affecting AQX in the last 24 months?
Change notice for models, terms and processors
Public claim only
The website Terms of Use state 'Anaqua may revise these Terms of Use at any time without notice' and that continued use binds the user to the then current version. The privacy policy states Anaqua 'may update this Privacy Policy at any time', reserves 'the right to expand our capabilities for information collection and use', and says a notice will be posted on the websites 'if any change constitutes a material change'. Nothing on the pages read gives notice or objection rights before a new model, model provider or subprocessor is introduced into an AQX AI capability.
Ask: What written notice will we receive before an AQX AI capability changes model or model provider, or a new subprocessor is added, and can we object?
Export and exit
Not confirmed
No export or exit provision for AQX is published. The AcclaimIP Terms & Conditions, which govern a different product, point the other way for that product: they prohibit automated access to the software and state 'The Data from the Software may not be directly or indirectly copied, disassembled, resold or redistributed in any manner', and reserve a right to ban users for automated access. Whether an equivalent restriction applies to extracting a firm's own matter data from AQX is not addressed anywhere on the pages read.
Ask: In what formats can we bulk-export our AQX matter records, documents, docketed deadlines and time entries, at what cost, and does any clause restrict automated extraction of our own data?
Connectors and third-party services
Not confirmed
Anaqua publishes an Application Connectors page and states AQX integrates with 'enterprise systems, research tools, and global patent offices'; that page was not read and no connector is named on the pages that were. The privacy policy states Anaqua 'is not responsible for the content or privacy policies of other non-Anaqua websites' reached through links from its software. Nothing states which connectors are on by default or what data they carry.
Ask: List every connector that would be enabled for our tenant, what each sends and receives, and confirm none feeds an AI capability unless we enable it in writing.
Open-web and external retrieval
Not confirmed
Two published capabilities involve sources outside the firm's own records: brand risk detection is described as monitoring 'marketplaces, domains and social platforms', and AQX is described as connecting to 'global patent offices' and 'research tools'. Nothing on the pages read states whether any AI capability performs a general internet search, what it sends when it does, or whether that can be switched off.
Ask: Do any AQX AI capabilities query the open internet or third-party sites, what data leaves our tenant when they do, and can each be disabled?
Automated actions and confirmation
Not confirmed
Anaqua describes AI that acts on the system of record, not only advises: automated document and email processing that extracts and validates data, matches it to cases and 'triggers next steps'; AI docketing; and AI-powered information disclosure statement management that extracts references, removes duplicates and prepares filings. Against that, the law-firm page states 'AI can suggest updates, summaries, and drafted content, but workflows are designed for review and confirmation so teams can validate before changes are applied', and the AQX page says AI is applied 'while keeping humans in the loop for oversight and decisions'. Which actions require confirmation by default, and whether confirmation can be turned off, is not stated.
Ask: Which AI actions — docketing a deadline, updating a case field, preparing an information disclosure statement — can execute without a person confirming, and can a firm administrator make confirmation mandatory?
Human review before use
Public claim only
The AI page's first guiding principle states 'AI accelerates work, but people stay in control—with review, confirmation, and clear accountability.' The AQX page states AI is applied 'while keeping humans in the loop for oversight and decisions', and the law-firm FAQ states AI is applied 'while keeping professionals firmly in control'. All three are marketing statements; no product setting that forces a named reviewer, and no contractual human-oversight obligation, was found, no AQX contract having been published.
Ask: What product setting forces a named reviewer to sign off an AI-docketed deadline or an AI-prepared filing before it takes effect, and can that setting be enforced firm-wide?
