Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan and modules
Public claim only
Contracting entity is Ansarada Pty Limited (ACN 131 899 397). Terms updated 17 June 2026 plus Order Form and an incorporated DPA. Products: Deals (VDR/transaction lifecycle), Procure (infrastructure procurement), Vault/Always archive, and Ansarada Intelligence (Ask AiDA, AI-Sort, AI-Translate, AI-Redact, AI-Predict). Ask AiDA is on paid plans; a free room exists without the full Intelligence suite. Vault/Always may have separate terms.
Ask: Confirm the Order Form modules (Deals vs Procure vs Vault/Always), whether Ask AiDA and other Intelligence features are enabled, and whether we are on the 17 June 2026 Legal Terms or a negotiated form.
Deployment and hosting
Public claim only
SaaS multi-tenant VDR. GDPR page: hosted on AWS; multi-tenant with data segregation; 99.98% availability claimed. Customers select a server location at signup. Subprocessor list: AWS regions include Sydney; also Montreal, Frankfurt, Jakarta, Dublin, Oslo, Singapore, Cape Town, London, California. Microsoft Azure (Zurich, Johannesburg, Dubai) and Oracle Cloud (Jeddah) are additional hosting options. DPA: Personal Data is stored in the customer-designated region; Ansarada may transfer it outside that region in performance of the Services but says it continues to be stored in the designated region.
Ask: Name the hosting provider and region on our Order Form (Sydney AWS vs Azure/Oracle), and confirm backups stay in that region.
AiDA and Intelligence features
Public claim only
Ask AiDA is a RAG assistant inside the room: semantic search, sourced answers, Q&A similar-question drafting (≥80% similarity), summaries of PDFs up to 200 pages/50 MB. Admins control who can use AiDA; it follows room permissions. Other Intelligence: AI-Sort, AI-Translate, AI-Redact, AI-Predict (bidder engagement, not the same as AiDA). Remote document self-destruct and watermarking on the VDR.
Ask: Which Intelligence features will be on for our rooms, and is Ask AiDA limited to Data Room Administrators?
Australia
Public claim only
Australian company (Sydney HQ, founded 2005). AWS Sydney is a listed hosting location. Terms: NSW law and NSW courts for customers in Australia, Asia Pacific or Japan. Privacy Act 1988 (Cth) and Australian Privacy Principles are referenced. Offices include Sydney plus London, Amsterdam, Johannesburg, Ho Chi Minh City, Chicago and Berlin.
Ask: Will our rooms be hosted in AWS Sydney, and will support from Vietnam/US/UK still access room content?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Bidders and guests
Not confirmed
The product is a deal VDR used by bidders and advisors, not a consumer chatbot. Guests with AiDA access receive answers only from documents they may view (vendor claim). Customer warrants it has notices/consents for sharing content with Guest Users. No Australian client-disclosure template for AI use was found.
Ask: Will bidder-side AiDA be off by default, and what notice do we give counterparties that AI search is running in the room?
Model provider
Not confirmed
Ask AiDA is described as LLM + RAG. The published subprocessor list names AWS, Azure and Oracle for hosting, and Ansarada affiliates for support — it does not name OpenAI, Anthropic or another foundation-model vendor. 'No documents transmitted externally' (article) is a vendor claim that needs reconciling with the unnamed LLM path.
Ask: Name every model provider, endpoint region and whether inference stays in our chosen AWS/Azure/Oracle region.
Subprocessors
Public claim only
Published list: AWS (Sydney and other regions), Microsoft Azure (Zurich, Johannesburg, Dubai), Oracle Cloud (Jeddah), Ansarada UK Ltd, Ansarada US Inc., Ansarada Vietnam Limited. 60 days' notice of new subprocessors via site update; objection on data-protection grounds; exclusive remedy is terminating the Order Form. DPA requires flow-down no less protective than the Addendum.
Ask: Confirm this list is complete for AiDA inference (not only hosting), and that we will receive the 60-day notice.
Training on room content
Public claim only
Ask AiDA article and product page: room content is not used to train AI models / not used to train general AI models. That is marketing, not a clause in the 17 June 2026 Legal Terms extract. DPA treats Feedback and Usage Data as Ansarada-controlled for Business Operations. Privacy policy 'training' language concerns website personal data and support messages, not a room-content training prohibition.
Ask: Put a no-training clause in the Order Form covering prompts, documents, embeddings, Q&A drafts and logs, including any model provider.
Feedback and usage data
Public claim only
Feedback is excluded from Confidential Information. DPA 2.4: Feedback and Usage Data, if personal, are processed by Ansarada as independent controller for Business Operations. Scope of 'Usage Data' for AiDA sessions is not defined on the AiDA pages.
Ask: Is AiDA session content excluded from Feedback/Usage Data, and can we disable any improvement channel?
Retention of AiDA sessions and rooms
Public claim only
Ask AiDA article: conversations cleared at end of session and never archived. Room/document retention follows the deal room and Vault/Always products. DPA: return or destroy Personal Data on written request unless law requires longer. Archived backups need not be immediately erased.
Ask: Confirm session non-retention in the contract, backup lag, and Vault archive period after the deal closes.
Deletion and return
Public claim only
On written request, content is destroyed or returned for an additional fee; invoices must be paid first. Backups may persist under confidentiality until destruction. DPA: certify deletion on request. Remote self-destruct is a VDR feature for distributed copies.
Ask: Matter-level deletion of AiDA indexes/embeddings, backup purge time, and a deletion certificate without a return fee dispute.
Vendor staff access
Public claim only
Support affiliates in UK, US and Vietnam are subprocessors with access to Your Content. DPA: employees under confidentiality. Ask AiDA article does not describe a customer-visible access log for Ansarada staff.
Ask: When can Ansarada or Vietnam application-support staff read our room or AiDA prompts, and is that access logged to us?
SSO, MFA and room permissions
Public claim only
SSO and MFA supported. Granular room permissions, watermarking, expiry. Admins control AiDA access. Users must accept AUP. Ansarada may remove a user at the employer's request.
Ask: Enable SSO-only and MFA, and show guest disable within the hour plus an AiDA permission-wall test.
Encryption
Public claim only
DPA Appendix 2: AES-256 at rest, TLS 1.2 in transit. GDPR page: 256-bit at rest, HTTPS/SSL upload, file-level encryption with IRM (track, expire, prevent printing).
Ask: Confirm encryption of AiDA embeddings/indexes and backups in our region.
Assurance
Public claim only
ISO/IEC 27001:2022 (article 13 Jan 2026); ISO 27001 since 2009 (GDPR page). Ask AiDA article also claims SOC 2 Type II for Ansarada. AWS's own SOC/ISO are listed separately and are not Ansarada's report. Reports were not inspected.
Ask: Provide current ISO 27001:2022 certificate and SOC 2 Type II report scoped to Deals and AiDA, with exceptions.
Contract, DPA, liability and forum
Public claim only
NSW law/courts for AU/APAC/Japan customers. Your Content is Confidential Information (Feedback excluded). DPA incorporated; Privacy Act 1988 referenced. Liability cap: fees in prior 12 months on the Order Form; 2x for breach of confidentiality/data-protection sections 6(a) and 6(d); carve-outs for fees, IP ownership, customer warranties, fraud, wilful misconduct. ACL rights preserved to the extent they cannot be excluded.
Ask: Execute the published DPA, confirm 2x cap covers confidentiality/privacy/security, and that AiDA is in scope.
Cross-border transfers
Public claim only
Customer picks storage region (Sydney available). DPA allows processing outside that region while storage remains. SCCs/IDTA for EEA/UK. Support in Vietnam, US and UK. Azure/Oracle regions are outside Australia even if we pick Sydney AWS for storage — confirm AiDA does not silently use another cloud.
Ask: Feature-by-feature map for storage, AiDA inference, backups and support access, for an APP 8 assessment.
Breach notification
Public claim only
DPA 6.4: notify a Personal Data Breach affecting Customer's Personal Data without undue delay (no 48- or 72-hour clock). GDPR page: documented escalation/reporting processes aligned with ISO 27001. No public incident register inspected.
Ask: Will you contract a maximum 72-hour (preferably 48-hour) notice with NDB-usable content?
Unilateral changes
Public claim only
AUP and Privacy Policy may be amended. Subprocessor changes: 60-day site update. Scheduled maintenance ≤12 hours/month with ≥24 hours' notice; updates must not materially diminish functionality. Trial services can be withdrawn. CPI-style fee language in Terms.
Ask: What notice before AiDA model or permission behaviour changes, and is auto-renewal off unless we confirm?
Exit, export and archive
Public claim only
Return of content on written request for an additional fee after invoices paid; or destroy. Vault/Always are separate archive products. No escrow found.
Ask: Provide a fee-free export of room documents, Q&A, audit logs and AiDA artifacts in open formats, then certified deletion.
Connectors
Public claim only
VDR is the system of record. Partner Marketplace and Non-Ansarada Applications exist; customer bears privacy/security risk. Intelligence features are in-platform.
Ask: List every marketplace/integration that will be on, and confirm unused stay off.
Web search
Public claim only
Ask AiDA article: does not operate on public internet data; exclusively room content. Confirm this is a hard control, not a prompt instruction.
Ask: Can AiDA call the open web or a general LLM corpus, and how do we prove it is off?
Q&A drafts and redaction
Not confirmed
AiDA can draft Q&A answers for human approval and Intelligence includes AI-Redact. Remote self-destruct can expire distributed copies. No documented kill-switch for in-flight AiDA jobs was found.
Ask: Must every AiDA Q&A draft be approved before the bidder sees it, and can we disable AI-Redact/Translate if unused?
Oversight
Public claim only
Q&A: human reviews and approves suggested answers. Audit trails on the VDR. AiDA sessions reportedly not archived, which limits later supervision unless the room audit log captures queries.
Ask: Are AiDA queries logged in the room audit trail exportable to us for 12 months?
