Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and modules
Public claim only
The home page sets out four stages: 'CURATE', marked 'New', where 'Curate reads every clause and surfaces the strongest. You decide what makes the cut'; 'BUILD', setting a precedent up as a template 'with no code'; 'DRAFT', where answering questions assembles a finished document; and 'EXECUTE', described as 'Negotiate. Redline. The audit trail builds itself as you go. Then sign. All in one place.' The product navigation lists Automate, Curate, Massdraft, Headless Drafting and Integrations as separate items. Which of these are separately licensed is not published on any page read; there is no pricing page in the 134-URL site inventory taken 2026-09-27.
Ask: Which modules - Automate, Curate, Massdraft, Headless Drafting - are included in the subscription quoted to our firm, and which are priced separately?
What the platform does
Public claim only
The home page lists 'Live questionnaire drafting - Capture structured data once and watch it flow through every clause and schedule', 'Reusable drafting logic', 'AI inside your guardrails' and 'High-volume drafting & enterprise security', with no further detail on the AI behind the third item. The matter types named are share purchase agreements, disclosure letters and ancillaries, real estate, and commercial and procurement. The privacy policy states the product and services 'help users template, draft, collaborate, negotiate, e-sign and analyse contracts' and that the platform records 'history of actions that individuals take on a document (e.g. review, negotiate sign)'.
Ask: What exactly do the AI features do in the Curate and Draft stages, which of them are on by default, and can each be disabled tenant-wide?
Deployment and hosting regions
Public claim only
The security page states under 'Physical location security': 'Servers located in our clients' core business regions (UK, Europe, US and Australia)', 'AWS, OVH and Azure datacentres' and 'Physical access by Avvoka staff is restricted'. It also states 'All production databases are subject to real-time replication', a 'Hot-standby arrangement for failovers' and 'Backups encrypted using AES-256'. This is the vendor's own security page rather than a contractual document; how a customer elects a region, whether replication crosses regions, and where any AI processing occurs are not published on it or on any other page read.
Ask: Can our tenancy and its backups and replicas be pinned to an Australian region, in which Australian data centre, and does any processing - including AI processing - occur outside Australia?
Governing law and contracting entity as published
Public claim only
The privacy policy opens: 'This privacy policy (the "Policy") sets out how Avvoka Limited ("us," "our," or "we") collect and use information'. The footer on every page read states 'London: Avvoka Limited, 124 City Road, London, England, EC1V 2NX', 'Registered number: 09729807 | VAT number: GB234611139', and gives a Singapore address at 160 Robinson Road. No Australian entity, ACN, ABN or office appears on any page read, and the privacy policy's legal framework is British and European: it defines terms by reference to 'the Data Protection Act 1998 and the General Data Protection Regulation (2016/679)' and makes no reference to the Australian Privacy Principles or the Privacy Act 1988 (Cth). No governing-law clause is published, because the terms of service text did not render on the terms page.
Ask: Which entity would contract with our Australian firm, under which governing law, and is there an Australian-law order form or a Privacy Act 1988 (Cth) schedule?
Check for vendor content directing how AI describes the product
Not confirmed
A deliberate check was made on 2026-09-27 and no such content was found. A firecrawl map of avvoka.com returned 134 URLs and listed no /llms.txt, /ai-info, /ai or /for-ai page, and the home page, security page, privacy policy and terms page read in full contain no heading or block addressed to AI models, assistants or crawlers and no instruction about how the product should be described. Two distinct things are recorded separately and are not conflated with this check: the inventory does contain vendor comparison pages at /compare/avvoka-vs-netdocuments and /switch-from/ for other named tools, which compare competitors rather than direct how AI should describe Avvoka, and no ranking from them is carried into this catalogue; and crawler allow and disallow directives were not fetched, being access control rather than narrative control.
Ask: Do you publish, or plan to publish, any page or embedded content that tells AI assistants how to describe Avvoka, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Role in respect of matter content
Public claim only
The privacy policy states that when customers use the software 'we process and store certain information on their behalf as a data processor ... In those instances, the customer as the data controller is responsible for most aspects of the processing of the information', and directs data subjects with questions to the customer. It also notes 'If you or your organisation has a contract with us, that contract may have privacy terms that also apply to the information you provide to us under that contract'. Nothing on the pages read addresses legal professional privilege, client confidentiality obligations of a law firm, or restrictions on the vendor using matter content, and the contract holding those privacy terms was not readable.
Ask: What does the customer contract say about confidentiality and privilege over matter content, and does it prohibit any use of our documents other than providing the service?
Model provider named
Not confirmed
No AI model or model provider is named on any page read. The home page refers only to 'AI inside your guardrails'; the security page and privacy policy name no AI provider and include no AI processing clause. The home page links vendor posts headed 'Legora and Avvoka integrate to deliver every first draft inside the agentic operating system for legal work', 'Avvoka and Harvey partner to bring automated drafting into agentic workflows' and 'Avvoka now connects to Claude'; those posts were not read within the credit budget for this profile, and their headlines describe integrations rather than the model behind the platform's own AI features.
Ask: Which model providers and models power the Curate and drafting AI features, in which region are those calls served, and are they listed as subprocessors?
Subprocessors
Public claim only
The terms page carries a heading 'Approved sub processors' with 'Last updated 26 February 2026' beneath it, but no list, table or link rendered in the page text read on 2026-09-27, so the approved list itself could not be read. The privacy policy describes categories rather than names: 'We share your information with other companies we use to support our Software. These companies provide services like online web chat, search technology, advertising and authentication systems', and asks users to consent 'to having your information transferred to certain Sub-processors in the United States. These sub-processors provide our customer web chat solution and our email hosting platform.' Google Analytics and HubSpot are named for website analytics.
Ask: Please provide the approved subprocessor list dated 26 February 2026, including any AI model provider, and the notice period before a subprocessor is added or replaced.
Training on customer content
Not confirmed
No statement about training, fine-tuning or model improvement on customer documents appears on any page read. The nearest published language is in the privacy policy's use list: 'Create and review data about our users and how they use our Software' and 'Test changes in our Software and develop new features and products'. Neither addresses whether contract text, templates or clause libraries are used to train or evaluate models, and no opt-out is published.
Ask: Are our templates, clause libraries or drafted documents used to train, fine-tune or evaluate any model - yours or a provider's - and will you warrant that they are not?
Prompts, edits and feedback
Not confirmed
Nothing published addresses prompts, accepted or rejected AI suggestions, or reviewer feedback. The privacy policy records that the platform captures a 'history of actions that individuals take on a document (e.g. review, negotiate sign)' and permits use of information to 'Test changes in our Software and develop new features and products', but does not say whether the choices our lawyers make when accepting or rejecting AI output are retained or reused beyond our tenancy.
Ask: When a lawyer accepts or rejects an AI suggestion in Curate or drafting, is that decision retained and reused outside our tenancy, and can it be turned off?
Retention
Public claim only
The privacy policy states: 'We keep your personal information for no longer than necessary for the purposes for which it is processed. The length of time for which we retain information depends on the purposes for which we collected and use it and/or as required to comply with applicable laws. Where there are technical limitations that prevent deletion or anonymisation, we safeguard personal data and limit active use of it.' No period is published, and nothing addresses retention of customer documents, templates, negotiation history or backups, or retention after termination; the terms of service text that might cover it did not render.
Ask: What is the retention period for our documents, templates and negotiation history during the subscription and after it ends, including in replicas and backups?
Deletion and return
Public claim only
The privacy policy gives individuals a route to close an account - 'If you wish to close your account, please go to your account settings. You may also email us at the email address listed in Section 11 to close your account' - and records that 'In certain situations, you can ask that we erase or stop using your information (and object to use of your personal data) or export your data', qualified by the statement that where 'technical limitations ... prevent deletion or anonymisation, we safeguard personal data and limit active use of it'. No deletion timeframe, no customer-level deletion process for documents and templates, and no certificate of destruction is published.
Ask: How does our firm delete a specific matter's documents and all copies, within what period is deletion completed, and what do you keep afterwards?
Vendor personnel access
Public claim only
The security page states 'Physical access by Avvoka staff is restricted' and that the vendor adheres 'to secure development principles'. Nothing published addresses logical access by vendor personnel to customer documents or templates, whether such access requires customer approval, whether it is logged, or where the personnel are located. The privacy policy states only that service providers 'are bound by confidentiality undertakings with us'.
Ask: Under what circumstances can Avvoka staff or support personnel open our documents and templates, is that access logged and visible to us, and from which countries can they do so?
Authentication and account control
Public claim only
The security page states '2FA can be enforced company-wide', 'SSO-only enforcement rules available', 'Automatic SSO user revocation for leavers', and for passwords: 'Minimum strength rules adhered to', 'Passwords filtered from logs and one-way encrypted using BCrypt' and 'Password rotation rules can be defined'. These are described as available controls on the vendor's security page rather than contractual commitments, and no role or permission model, matter-level access restriction, session timeout or administrator audit log is published on any page read.
Ask: Which roles and permissions control who in our firm can open a given template or document, and is there an administrator audit log we can export?
Encryption
Public claim only
The security page states 'Your connection to Avvoka (including API access) is secure and encrypted using HTTPS', and 'Your documents are also stored and encrypted at rest using AES - 256 bit encryption. Each one is encrypted with a unique initialisation vector. As an additional safeguard, each key is encrypted with a regularly rotated master key.' Backups are 'encrypted using AES-256'. Key custody, whether customer-managed keys are available, and the rotation period for the master key are not published.
Ask: Who holds and rotates the master key, how often, and are customer-managed or customer-held keys available for an Australian tenancy?
Independent assurance
Public claim only
The security page states Avvoka is 'ISO27001 certified', 'Continuously certified since October 2017' and 'Subject to annual external audits', with an ISMS policy published as a linked PDF. It also states 'Each year, the application is subject to black-box penetration testing. Only CREST-approved providers are appointed. Copies of our latest scorecard are made available to clients on request.' The certificate itself, its scope and statement of applicability, and the certification body are not published, and no SOC 2 report, ISO/IEC 42001 certification or IRAP assessment appears on any page read.
Ask: Please provide the ISO 27001 certificate with its scope and statement of applicability, confirm whether the AI features are inside that scope, and provide the most recent penetration-test scorecard.
Contract documents
Not confirmed
The terms page at /terms-conditions rendered as a hub only. Under 'Current terms of service' it showed a heading 'Approved sub processors' dated 'Last updated 26 February 2026' and links to two PDFs - a 'Data Handling policy' marked 'Last updated 17 January 2022' and a 'Service Level' document marked 'Last updated 4 November 2021' - plus links to 'Historic Terms of Service' and 'Transaction-Specific Terms'. The terms of service text itself did not appear in the page read on 2026-09-27, and no master services agreement, data processing agreement or Australian order form is published. The linked PDFs and the two further terms pages were not opened within the credit budget.
Ask: Please provide the current terms of service, the data processing agreement and the service level document that would apply to our firm, and confirm the contracting entity.
Cross-border transfers
Public claim only
The privacy policy asks users to consent 'to having your information transferred to certain Sub-processors in the United States', and for those established in Switzerland or the EEA undertakes to 'procure that the relevant Sub-Processor established outside of the EEA is an entity that maintains Privacy Shield certifications under the EU-US Privacy Shield Framework Principles' and, if applicable, that 'the EU Commission's standard contractual clauses as set out by Commission Decision of 5 February 2010 with later amendments (Model Clauses) are entered into'. The named mechanisms are the EU-US Privacy Shield and the 2010 standard contractual clauses. Nothing addresses Australian Privacy Principle 8, an Australian customer's position, or transfers out of an Australian region.
Ask: For an Australian tenancy, which countries receive our content and under what transfer mechanism, given the policy cites Privacy Shield and the 2010 model clauses?
Breach notification
Not confirmed
No data breach notification commitment, timeframe or notification contact appears on any page read. The security page publishes a vulnerability disclosure route - 'Share the details of any suspected vulnerabilities with Avvoka's Security Team by contacting us at security@avvoka.com' - and asks reporters not to 'publicly disclose these details without express written consent from Avvoka'. The privacy policy has no incident clause. A service level document is linked from the terms page but was not opened within the credit budget, and no status page appears in the site inventory.
Ask: Within how many hours of becoming aware will you notify our firm of a breach affecting our data, who is the named contact, and does the service level document contain that commitment?
Change notice
Public claim only
The privacy policy states: 'We may amend this Policy to reflect changes in the law, our Software, our data collection use and practices, or advances in technology. Our use of the information we collect is subject to the Policy in effect at the time such information is used. Depending on the type of change, we may notify you of the change by posting on this page or by email.' The terms page links a 'Historic Terms of Service' page, so superseded terms are archived, but that page was not opened within the credit budget. The privacy policy read on 2026-09-27 carries no version number or effective date, and nothing published addresses notice before an AI feature or model changes.
Ask: What notice does our firm get before a change to the terms, the privacy policy, or the models and AI features in the platform?
Exit and portability
Not confirmed
Nothing on the pages read addresses export of templates, clause logic, documents or negotiation history, or the return of data on termination. The privacy policy mentions only that an individual 'can ask that we ... export your data' as a data-subject right. The site publishes inbound migration pages under /switch-from for other automation tools, and a blog inventory that includes posts on migration and on dependency on an automation platform, but no outbound export specification; those posts were not read within the credit budget.
Ask: In what format can we export our templates, drafting logic, completed documents and negotiation history, and what is returned or deleted on termination?
Integrations and connections
Public claim only
The product navigation lists 'Integrations' at /features-extend and 'Headless Drafting', and the site inventory includes walkthroughs for a Word plug-in. The home page links vendor posts headed 'Legora and Avvoka integrate to deliver every first draft inside the agentic operating system for legal work', 'Avvoka and Harvey partner to bring automated drafting into agentic workflows', 'Avvoka now connects to Claude' and 'Draft from your own templates inside Microsoft 365 Copilot'. Those headlines are the vendor's own publications on its own site, but the posts and the integrations page were not opened within the credit budget, so what data each connection exchanges, and in which direction, is not recorded here.
Ask: For each connector - Word add-in, Microsoft 365 Copilot, Legora, Harvey, Claude and the drafting API - what data leaves our tenancy, to which provider, and can each connector be disabled?
Open-web access
Not confirmed
Nothing on the pages read states whether any AI feature queries the open web. The security page addresses inbound testing - the 'Pipeline continuously tested for attacks such as CSRF, XSS, SQLI and many more' - but not outbound access. The platform as described works from the firm's own precedents and questionnaire answers, and the Curate stage is described as reading the firm's past deals, but no statement addresses retrieval from external sources at draft time.
Ask: Do any AI features in the platform make outbound calls to the open web or to an external source at draft time, and can that be blocked for our tenancy?
What the AI does without approval
Public claim only
The only published description of control over AI action is on the home page, for the Curate stage: 'Curate reads every clause and surfaces the strongest. You decide what makes the cut, then walk away with a clean, reusable standard.' The same page describes the Execute stage as 'Negotiate. Redline. The audit trail builds itself as you go. Then sign.' Nothing published sets out which steps the platform takes without a person approving them, whether any AI feature can alter a template or clause library directly, or what the connectors named on the home page are permitted to do inside the tenancy.
Ask: Which actions can an AI feature or a connected assistant take in our tenancy without a person approving them - in particular editing a template, changing clause logic, sending a document for signature - and how is each gated?
Human review of output
Public claim only
The home page frames the person as deciding at the Curate stage - 'You decide what makes the cut' - and the vendor publishes a 'Legal advice disclaimer' and a 'Signing disclaimer' in the footer of every page read, described on the security page as covering 'the relationship between us and our users' and 'Our disclosure on e-signature'. Neither disclaimer was opened within the credit budget. No published document states what checking the vendor expects before a generated or AI-assisted document is relied on or executed.
Ask: What do the legal advice disclaimer and signing disclaimer say about reliance on generated documents, and what review does the vendor assume before a document assembled on the platform is signed?
