Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and scope covered
Public claim only
The Arctera Unified Platform Service Description (July 2026) states the services 'deliver a SaaS-based solution for Archiving, eDiscovery, and Surveillance via an All-In-One SKU' and lists five capabilities: Archiving, Capture, Classification, eDiscovery and Surveillance. eDiscovery is described there as optimising 'legal hold management, search, and case review'. The licence documentation page separately lists third-party notices for 'eDiscovery Platform Version 10.3', and the product datasheet is titled Arctera eDiscovery. This profile covers the eDiscovery capability; Classification and Surveillance sit in the same SKU but are not profiled here.
Ask: Is the eDiscovery we would buy the SaaS capability in the All-In-One SKU, a separately licensed eDiscovery Platform release we install, or both, and which release is current?
What the product does, and where AI sits
Public claim only
The datasheet describes collection from more than 130 content sources, real-time iterative search (search-within-search) with Boolean, proximity and wildcard operators, saved searches that automatically add newly matching items, collaborative review in which an administrator provisions each reviewer with distinct privileges, legal hold, review status, labels, categorisation and notes, audit trails of individual messages or of a whole matter, and self-service export. The eDiscovery solutions page describes coverage of 'the entire Electronic Discovery Reference Model (EDRM) workstream - from legal hold and data capture through processing, review, analysis, and production'. No generative AI, machine learning, predictive coding or auto-summarisation feature is described in the eDiscovery datasheet, the eDiscovery solutions page or the Service Description read 2026-09-27; the only AI reference in those documents is a statement in the About Arctera block that 'more than 280 AI policies help firms streamline compliance and adapt to evolving regulations', which is about the Unified Platform rather than the eDiscovery capability.
Ask: Which parts of eDiscovery use machine learning or generative AI today - for example auto-summarisation, continuous active learning or classification - and are they on by default?
Deployment model
Public claim only
The Service Description (July 2026) describes a SaaS service with a web interface service portal, company-managed infrastructure and planned and emergency maintenance windows, and states the service 'is compatible only with approved versions of on-premise mail' systems for capture. The licence documentation page also publishes third-party notices for a versioned 'eDiscovery Platform Version 10.3', which was not itself read, so whether a customer-installed deployment remains available was not established.
Ask: Is a customer-hosted or private-cloud deployment of eDiscovery still offered, and if so which version is supported and for how long?
Version and continuity from Veritas
Public claim only
The licence documentation page lists current third-party notices for 'eDiscovery Platform Version 10.3', alongside Enterprise Vault 15.2, Data Insight 5.1, Merge1 7.0.2411 and Alta Capture 1.0, checked 2026-09-27. The datasheet states Arctera was created in 2024 from Veritas Technologies and is a Cloud Software Group company. Product help for Arctera eDiscovery is also served from a Veritas support domain, which appeared in search results but was not read for this profile.
Ask: What is the supported version and end-of-support date for the release we would run, and has the product name or entity changed on the agreement since the Veritas period?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27, and the check is incomplete. A site map of arctera.com with search terms including 'ai' returned 60 URLs, all of them under /blogs (posts, author pages and topic pages), and listed no /llms.txt, /ai-info, /ai or /for-ai page. The eDiscovery datasheet, the eDiscovery solutions page, the licence documentation page and the Service Description were read and contain no heading or block addressed to AI models, assistants, LLMs or crawlers, and no instruction to describe the product in a particular way. The home page and the product pages were not read within the credit budget, so a block on those pages would not have been seen.
Ask: Do you publish any page or embedded block - for example /llms.txt, an AI-information page or structured question-and-answer data - that tells AI models or crawlers how to describe Arctera eDiscovery?
Entity and Australian contracting
Public claim only
The licence documentation page carries the copyright line 'Copyright (c) 2026. Arctera US LLC. All rights reserved.', displays the Cloud Software Group logo and links Legal and Privacy to cloud.com; End User Agreements are linked to cloud.com/legal/terms, which was not read. The Service Description refers only to 'Company' and 'Customer' and names no entity, address or governing law. No Australian entity, ABN or local contracting arrangement is named in any document read.
Ask: Which legal entity would contract with an Australian customer, under which governing law, and is there an Australian entity or reseller of record?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to archive and review staff and third-party communications
Public claim only
Service Description (July 2026), Additional Service Requirements: 'Customer shall comply with all applicable laws with respect to use of the Service(s). In certain countries it may be necessary to obtain the consent of individual personnel. Configuration and use of the Service(s) is entirely in Customer's control, therefore, Company is not liable for Customer's use of the Service(s)', nor for civil or criminal liability the customer may incur. The Compliance section makes the customer responsible for all activities that occur in user accounts and for user compliance with the agreement and the acceptable use policy.
Ask: For Australian employees and for third parties in captured communications, what consent and notification does Arctera expect us to obtain, and does Arctera act only as processor on our instructions?
Models and providers
Not confirmed
No model, model family, model provider or inference location is named in the eDiscovery datasheet, the eDiscovery solutions page, the licence documentation page or the Service Description read 2026-09-27. The only AI reference in those documents is the statement that 'more than 280 AI policies help firms streamline compliance and adapt to evolving regulations', which does not identify a model or provider. Vendor blog posts on generative AI summarisation and on machine learning in eDiscovery appear in the site map but were not read.
Ask: If any AI feature touches our data, which model and provider runs it, in which region, and can the feature be disabled for our tenant?
Third parties handling the data
Not confirmed
No subprocessor list is published. The licence documentation page publishes per-product third-party software notices (including for eDiscovery Platform Version 10.3) and a 'Third-Party Offerings' list linking to the terms of Smarsh/Telemessage, Sausalito Labs, LeapXpert and Nuclei; those are software components and separately licensed offerings across the Arctera range, not a list of parties processing customer data, and the page does not say which apply to eDiscovery. The Service Description says 'Third party notices and third party flow-downs are available at https://www.arctera.com/license-agreements' and notes that interoperability with third-party tools and APIs may cease.
Ask: Please provide the subprocessor list for the eDiscovery service, with each party's role, country and whether it processes customer content or only metadata.
Use of customer data to improve the service
Not confirmed
Neither the Service Description (July 2026) nor the datasheet says whether customer data, metadata or search behaviour is used to train models or to develop or improve the service. The End User Agreements, which may address this, are hosted at cloud.com/legal/terms and were not read, and no DPA or privacy notice specific to the service was found.
Ask: Do you use our archived content, metadata, review decisions or search logs to train models or improve the service, and is there a contractual commitment against it?
Feedback and telemetry
Not confirmed
No statement about feedback, telemetry or product usage data was found in the Service Description (July 2026), the datasheet, the eDiscovery solutions page or the licence documentation page read 2026-09-27. The Service Description does record that the service is monitored for availability, capacity and network utilisation, without saying what is collected or retained.
Ask: What telemetry does the service collect about our use, how long is it kept, and can support tickets or feedback include customer content?
Retention of archived data
Public claim only
Service Description (July 2026): 'While Customer's subscription is active, Customer Data is maintained according to the Customer-defined retention/expiry period, except where customer may opt in to WORM storage functionality with a 7-year retention period as specified at the time of order'; data is maintained for that period based on the mail date of the email and is deleted after the retention period expires. The same document states the service does not replace the customer's need to back up its own mail servers.
Ask: Can retention be set per matter or per legal hold so that data under hold survives the organisation-wide expiry rule, and is WORM storage available to us?
Deletion at the end of service
Public claim only
Service Description (July 2026): 'Customer data is deleted permanently 30 days after the end of the Service term.' Data is decommissioned on service cancellation, termination or expiration; 'Customer loses all access to the Service and its Customer Data immediately following suspension, expiration, or termination'; and 'Decommissioned Customer Data will be deleted in accordance with Company's standard deletion practices within thirty (30) days of the Data Decommissioning event and is irretrievable thereafter.' The standard deletion practices are not published and no deletion certificate is offered.
Ask: What are your standard deletion practices, do they cover backups and search indexes, and will you certify deletion after decommissioning?
Vendor access to customer systems and data
Not confirmed
Service Description (July 2026), Direct Migrator ingestion: 'Company requires independent remote access to the Enterprise Vault and extraction environment such as via VPN or Citrix to the migration and SQL servers', and all ingestion work 'is done remotely'. Nothing in the documents read states whether company personnel can read archived content or matters in steady-state operation, under what approval, or with what logging. Metadata such as indexing, database information and log files is encrypted with a separate company-managed key.
Ask: Outside a migration, which of your personnel can access our archive or a matter, is each access approved and logged for us to see, and can access be restricted to named regions?
Authentication, reviewer privileges and audit
Public claim only
Service Description (July 2026): customers access 'a web interface Service portal by using a secure password protected login', must configure features through that portal or default settings apply, and in some cases no service is provided until a setting is chosen; 'Configuration and use of the Service(s) are entirely in Customer's control'. The datasheet states an administrator provisions each reviewer with distinct privileges within a case - reviewing messages, viewing logs and reports, creating exports, managing other reviewers and editing - and that reporting allows audit trails of individual messages or of a whole matter. No multi-factor authentication or single sign-on commitment appears in the documents read.
Ask: Is multi-factor authentication enforced and is single sign-on with our identity provider supported, and can the matter audit trail be exported for a court?
Encryption and key control
Public claim only
Service Description (July 2026): 'By default, Company automatically generates and stores a unique encryption key for each customer at the time of provisioning to protect Customer Data.' A customer may instead supply its own key, in which case it must give the company access to that key during provisioning (the service cannot be provided without such access) and is solely responsible for storing and backing it up, because all customer data will be lost and irretrievable if the key is lost; the customer may revoke access at any time but remains responsible for the pre-committed term and fees absent a material breach. Metadata such as indexing, database information and log files is independently encrypted with a separate company-managed key. The datasheet adds that exports can be named and password-protected.
Ask: If we bring our own key, what exactly remains encrypted under your key, and what happens to search indexes and metadata if we revoke access?
Certifications and independent assurance
Not confirmed
No ISO 27001, SOC 2, ISO/IEC 42001 or IRAP claim appears in the Arctera eDiscovery datasheet, the eDiscovery solutions page, the licence documentation page or the Service Description of July 2026, read 2026-09-27. No security page or trust centre was found: a site map of arctera.com returned 60 URLs, all blog content. The vendor publishes an explainer page about FedRAMP compliance, which appeared in search results and was not read; an explainer is not an authorisation for this product.
Ask: Which certifications or attestations cover the eDiscovery service, what is their scope, and can you provide the current reports under a confidentiality undertaking?
Contract documents
Public claim only
The licence documentation page publishes the contractual stack for the service: End User Agreements (linked to cloud.com/legal/terms, not read), the Arctera Unified Platform Service Description, a Technical Support Policy, and per-product third-party notices. The Service Description (July 2026) sets commercial terms including the All-In-One SKU, a Minimum Commit that cannot be reduced during a pre-committed subscription term, quantities fixed in a Services Instrument, quote or purchase order, and a 30-day window to reject migrated data as the sole and exclusive remedy for rejected migrated data. No liability cap, indemnity or governing law was read.
Ask: Which agreement version applies to us, what is the liability cap for loss of archived data relied on in litigation, and will you sign an Australian addendum?
Where data is held
Not confirmed
No hosting region, data centre location, residency option or cross-border transfer mechanism appears in the Service Description of July 2026, the datasheet, the eDiscovery solutions page or the licence documentation page read 2026-09-27. The Service Description refers to infrastructure only in general terms, for example performing planned maintenance at low-activity times 'in the time zone in which the affected Infrastructure is located'. The product supports exporting data to a customer-designated Microsoft Azure Blob Storage location, whose region the customer chooses.
Ask: In which country would our archive, its search indexes and its backups be held, is an Australian region available, and where does support access originate?
Security incident notification
Not confirmed
The Service Description (July 2026) places the reporting duty on the customer: 'If Customer becomes aware of any actual or potential security vulnerability or incident, Customer must immediately report it to Company.' It contains no commitment by the company to notify the customer of a security incident, and no timeframe. The End User Agreements at cloud.com were not read, and no security or incident-response page was found on the site.
Ask: What is your contractual commitment to notify us of a security incident affecting our archive, within what time, and what evidence will you give us for a Notifiable Data Breaches assessment?
Changes, maintenance and notice
Public claim only
Service Description (July 2026): for Planned Maintenance the company 'will use commercially reasonable efforts to give Customer seven (7) calendar days' notification, via email, or SMS or phone as requested', carried out at low-activity times in the time zone of the affected infrastructure and on part of the network only; for Emergency Maintenance it will 'endeavor to inform the affected parties in advance ... no less than one (1) hour prior'. Service may be diverted to infrastructure not under maintenance. No commitment to notify customers before a change to features, data sources or any AI behaviour was found.
Ask: Will you notify us before a change to search behaviour, classification rules or any AI feature, and is there a release note channel we can rely on for a defensibility record?
Getting data out at the end
Public claim only
Service Description (July 2026): 'Data Export/Extraction is provided solely as a Customer self-service capability, and is only available during an active Service term', the company may limit extraction requests that degrade the service for other customers or where fees are outstanding, and 'Customer's access to the Service in all capacities including extractions ends with the Service expiration, suspension or termination'. Before the end of the term the customer must elect in writing either deletion under the Data Decommissioning section or a contracted renewal for Data Extraction at then-current pricing; if it needs a copy of its data it 'must request a quote for such Customer Data prior to the Data Decommissioning event'. Export formats named in the datasheet are EML, PST and JSON, with or without EDRM XML.
Ask: What does a full export of our archive and matter work product cost and how long does it take at our volume, and can we run it before we give notice?
Content sources and destinations
Public claim only
The datasheet states collection from 'more than 130 sources including relevant emails, videos, and data from native external data sources and collaboration tools such as Microsoft Teams, OneDrive, SharePoint, Salesforce, Slack, Zoom, and Copilot', a one-stop capture of the Microsoft 365 ecosystem, targeted collection connectors including Exchange, Microsoft Teams, OneDrive for Business and Enterprise Vault, and export directly to a designated Microsoft Azure Blob Storage location. The Service Description adds that the service is compatible only with approved versions of on-premises mail systems and that continued interoperability with third-party tools and APIs is not guaranteed if the third party stops offering it.
Ask: Which of the 130 sources are in our SKU, which require an additional licence, and which Australian-hosted systems have you connected before?
External lookups
Not confirmed
Nothing in the documents read on 2026-09-27 indicates that the product performs web searches or sends content to an external service other than the customer's own designated export destination. The described workflow is search over the customer's archive and collected sources, with self-service export. No statement rules such a call out either.
Ask: Does any component make outbound calls to a service outside our tenant with document content or metadata, including for classification or summarisation?
Automated behaviour and configuration defaults
Not confirmed
The datasheet states that 'Once a search is saved, Arctera eDiscovery adds any new relevant information to the results automatically', and that archiving can preserve content types by policy and prevent accidental deletion. The Service Description states that features must be configured through the service portal or 'default settings will apply', that in some cases no service is provided until a setting is chosen, and that 'Configuration and use of the Service(s) are entirely in Customer's control'. The defaults are not published.
Ask: What are the default settings for capture, retention, classification and saved-search behaviour on a new tenant, and which of them change what is collected without a further instruction from us?
Machine-generated output and its review
Not confirmed
The documents read describe a human review workflow - reviewers with distinct privileges applying review status, labels, categories and notes, with audit trails - and do not describe any machine-generated output for a reviewer to check, so no vendor statement about reviewing AI output could be recorded. The datasheet notes that conversion and compression functionality and search completeness carry caveats only in general terms, and that search results depend on the criteria specified and the information available.
Ask: If predictive coding, continuous active learning or auto-summarisation is available, what is published about its measured recall, and what audit record shows a human decision over a machine suggestion?
