Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plans
Public claim only
The terms state 'Awelle provides legal information and AI-assisted document generation tools' and that 'Paid plans are billed in advance on a recurring basis', with 'Credits included in a plan ... consumed as described on the pricing page' which 'unless stated otherwise, expire at the end of the billing period'. The home page offers a free trial and account creation at my.awelle.io, separate from the public website, and lists eight pathways: business owners, franchisors, franchisees, small to medium businesses, lawyers, accountants, HR and start-ups. The pricing page exists in the 44-URL site inventory taken 2026-09-27 but was not opened within the credit budget, so no tier, figure or credit rate is recorded.
Ask: Which plan and credit allowance would our firm be on, what does one credit buy, and do unused credits expire at the end of each billing period?
What the platform does
Public claim only
The home page describes three functions: 'Generate. Create a tailored first draft from the way your business works, using lawyer-authored clause libraries and decision logic'; 'Review. Upload documents to get plain-English risk flags, highlighting critical terms to consider before you sign or negotiate'; and 'Understand obligations. Research Australian legal questions in everyday language and trace answers back to useful legal sources.' A 'Regulatory Updates' panel offers 'Curated, plain-English summaries of recent regulatory changes in Australia', and on 2026-09-27 read 'No updates available' and 'Our team has not approved any regulatory updates for publication yet', with the caveat 'We make no claims of real-time comprehensive updates'. Named document types in the site inventory include employment and casual employment contracts, contractor agreements, NDAs, shareholders agreements, commercial and retail leases, franchise agreements, disclosure documents, service agreements and website terms.
Ask: For each of the three functions, what does the platform produce for a law firm user, and which document types in your library are maintained and how often?
Deployment and hosting
Not confirmed
No hosting region, data centre, cloud provider or data-residency statement appears on any page read, and there is no security page or trust centre in the 44-URL site inventory taken 2026-09-27. The privacy policy and the data processing agreement contain no location clause. The platform is a separate web application at my.awelle.io; no on-premises, private-cloud or customer-tenancy option is published.
Ask: In which country is the platform hosted, where is customer content stored, and is Australian data residency available for a law firm tenancy?
Governing law and contracting entity
Public claim only
The published legal documents do not identify the operator or the governing law. The terms, last updated 13 September 2026, state they 'govern your access to and use of the Awelle platform, website, and services (collectively, the "Services") operated by [LEGAL ENTITY NAME] ("Awelle", "we", "us")' and that 'These Terms are governed by the laws of [JURISDICTION]'; both square-bracketed placeholders appear unfilled in the page read on 2026-09-27. The privacy policy of the same date uses the same '[LEGAL ENTITY NAME]' placeholder, as does the data processing agreement, which names '[LEGAL ENTITY NAME] ("Processor")'. The terms also use the United States expression 'no attorney-client relationship is created'. The footer reads only 'Copyright 2025-2026 Awelle'; no ACN, ABN or registered address appears anywhere on the pages read.
Ask: Which legal entity operates Awelle, what is its ACN or ABN, and which jurisdiction's law governs the terms - the three published legal documents leave the operator and the governing law as unfilled placeholders?
Stated scope and disclaimers
Public claim only
The terms state 'Awelle is not a law firm, does not provide legal advice, and no attorney-client relationship is created through your use of the Services. Documents generated through the Services are templates and starting points only; you should consult a qualified legal professional before relying on them.' The home page states 'Awelle can accelerate routine work, but human judgment remains essential. You remain responsible for decisions and next steps', and answers its own question 'Does Awelle replace advice from a lawyer?' with 'No.' The home page also states the accountant pathway offers 'practice-managed and white-label pathways for accounting firms to coordinate routine legal-document work within their client relationships' and advises discussing 'the service scope and commercial terms with Awelle before offering a service to clients'.
Ask: How does the white-label accountant pathway sit with the statement that Awelle is not a law firm and gives no legal advice, and what is a firm permitted to represent to its own clients about documents produced on the platform?
Check for vendor content directing how AI describes the product
Not confirmed
A deliberate check was made on 2026-09-27 and no such content was found. A firecrawl map of awelle.io returned 44 URLs and listed no /llms.txt, /ai-info, /ai or /for-ai page, and the home page, /our-difference, the terms, the privacy policy and the data processing agreement read in full contain no heading or block addressed to AI models, assistants or crawlers and no instruction about how the product should be described. Two distinct things are recorded separately and are not conflated with this check: /our-difference carries a 'How we compare' table characterising five named categories of competitor, which is a vendor comparison rather than content directing how AI should describe Awelle, and no ranking from it is carried into this catalogue; and crawler allow and disallow directives were not fetched, being access control rather than narrative control.
Ask: Do you publish, or plan to publish, any page or embedded content that tells AI assistants how to describe Awelle, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority over uploaded client material
Public claim only
The terms place responsibility for uploaded content on the customer - 'You are responsible for the legality and accuracy of Customer Content' - and the data processing agreement casts the customer as Controller and the operator as Processor, obliged to 'Process personal data only on documented instructions from the Controller'. Neither document addresses legal professional privilege, a law firm's confidentiality obligations, or the accountant and franchisor pathways in which one business uploads another party's documents. The data processing agreement does not identify what personal data is processed, for what duration or for which purposes, and has no annex.
Ask: Where are the documented instructions, categories of personal data and duration of processing recorded for our engagement, and how is privileged material treated if a law firm uploads it?
Model provider named
Not confirmed
No AI model or model provider is named on any page read. The terms describe 'AI-assisted document generation tools'. The /our-difference page states 'AI does not write our clauses from scratch. Instead, it acts as an intelligent orchestrator - selecting, customising, and assembling the right pre-vetted clauses for your specific matter', and the same page contrasts the product with 'AI-generated drafting from a general model'. Neither the privacy policy nor the data processing agreement mentions an AI provider, an AI processing clause or an AI subprocessor.
Ask: Which model provider and models does the platform call for generation, review and research, in which country are those calls processed, and is the provider named in your data processing agreement?
Subprocessors
Not confirmed
No subprocessor list is published and none appears in the 44-URL site inventory. The data processing agreement's processor obligations do not include a sub-processing clause, an authorisation mechanism or a commitment to notify the customer before a subprocessor is added or changed. The privacy policy names one category only: 'Payment data: billing details processed by our payment providers; Awelle does not store full card numbers.'
Ask: Will you publish a dated subprocessor list covering hosting, the AI model provider and payment processing, and commit to notice before adding one?
Training on customer content
Not confirmed
Nothing published states whether customer documents, uploads or queries are used to train, fine-tune or evaluate any model. The privacy policy's use list is generic - 'Provide, maintain, and improve the Services', 'Process transactions and manage subscriptions', 'Communicate with you about the Services, security, and support', 'Comply with legal obligations and enforce our Terms'. The terms grant only 'a limited licence to host and process Customer Content solely to provide the Services', which by its words does not extend to training, but no page states the position either way and no opt-out is published.
Ask: Are uploaded documents, generated drafts or research queries used to train, fine-tune or evaluate any model, either yours or a provider's, and will you say so in the terms?
Prompts, edits and feedback
Not confirmed
Nothing published addresses prompts, edits, accepted or rejected suggestions, or feedback captured through the platform. The privacy policy records collection of 'Usage data: log data, device information, and interactions with the Services' and its use to 'Provide, maintain, and improve the Services', without saying whether the content of an interaction is retained or reused. The site footer links a 'Report a Problem' page, which was not opened within the credit budget.
Ask: Are the edits a user makes to a generated draft, and the queries typed into the research function, retained and used beyond delivering that user's own output?
Retention
Public claim only
No retention period is published. The privacy policy of 13 September 2026 has no retention clause: it covers collection, use, rights, security and contact only. The data processing agreement commits the processor to 'Delete or return personal data at the end of the engagement, at the Controller's choice', which addresses the end of the engagement but sets no period during it and no timeframe for completing deletion. Nothing addresses retention of generated documents, uploaded documents, research history or backups.
Ask: How long are uploaded documents, generated documents and research history kept while our subscription runs, and what is the deletion timeframe including backups?
Deletion and return
Public claim only
The data processing agreement states the processor will 'Delete or return personal data at the end of the engagement, at the Controller's choice'. The privacy policy states that 'Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data', exercised by contacting a support email address. No self-service deletion, no deletion timeframe, no backup cycle and no certificate of destruction is published, and neither document states what the operator retains after deletion.
Ask: How does our firm trigger deletion or return, in what format is data returned, within how many days is deletion completed, and what is retained afterwards?
Personnel access to customer content
Public claim only
Two published statements bear on this. The data processing agreement commits the processor to 'Ensure persons authorised to process the data are bound by confidentiality'. Separately, the /our-difference page states under 'Mandatory Lawyer Review': 'Nothing leaves the platform unverified. Every document assembled by Awelle is reviewed by a qualified lawyer to ensure precision, context, and legal soundness before delivery.' On that description a person outside the customer's organisation reads the customer's document as a designed step. Who those reviewers are, whether they are employees or contractors, where they are located, and whether a customer can decline the review are not published, and the privacy policy does not mention the review at all.
Ask: Who performs the mandatory lawyer review, are they employees or contractors, in which country, what do they see, and can a law firm customer opt out of having an external reviewer read its documents?
Authentication and account control
Public claim only
The privacy policy states 'We apply technical and organisational measures appropriate to the risk, including encryption in transit and access controls', and the terms require that 'You must provide accurate information when creating an account and keep your credentials secure. You are responsible for all activity under your account.' No multi-factor authentication, single sign-on, role or permission model, session control or administrator capability is published on any page read.
Ask: Is multi-factor authentication or single sign-on available, and what roles control which users in our organisation can see a given document?
Encryption
Public claim only
The privacy policy's security paragraph is the only published statement: 'We apply technical and organisational measures appropriate to the risk, including encryption in transit and access controls.' Encryption at rest is not mentioned on any page read, and nothing is published about key management, custody or rotation.
Ask: Is customer content encrypted at rest as well as in transit, with which algorithm, and who holds and rotates the keys?
Independent assurance
Not confirmed
No information-security certification, audit report or penetration-test statement appears anywhere on the site. The 44-URL site inventory taken 2026-09-27 contains no security page and no trust centre, and the terms, privacy policy and data processing agreement read in full make no reference to SOC 2, ISO 27001, ISO/IEC 42001, IRAP or independent testing. The credentials the vendor does publish are professional and promotional: a memberships strip carrying the Law Institute of Victoria and Law Society of New South Wales marks, and an 'Australian AI Awards 2026' finalist badge captioned 'AI Innovator - Legal Services Provider'.
Ask: Is there any independent security assurance over the platform - a SOC 2 report, ISO 27001 certificate, IRAP assessment or penetration-test summary - and if not, is one planned?
Contract documents
Public claim only
Three legal documents are published and were read in full: terms and conditions and a privacy policy, each 'Last updated: 13 September 2026', and a data processing agreement carrying a reviewer byline dated 18 September 2026. An acceptable use policy and a cookie policy are also linked. Each of the three names the operating party as '[LEGAL ENTITY NAME]', an unfilled placeholder, and the terms leave governing law as '[JURISDICTION]'. Liability is capped: 'Awelle's aggregate liability arising out of or relating to the Services is limited to the amounts you paid to Awelle in the twelve months preceding the claim', with the Services provided "'as is' without warranties of any kind". No order form, master services agreement or service level document is published.
Ask: Can you issue terms and a data processing agreement naming the contracting entity, its ACN or ABN and Australian governing law, and is a service level commitment available?
Cross-border transfers
Not confirmed
No page read addresses cross-border disclosure. The data processing agreement has no transfers clause, standard contractual clauses or overseas-recipient provision; the privacy policy names no country, hosting location or overseas recipient and does not address Australian Privacy Principle 8. The privacy policy does refer to lodging 'a complaint with your supervisory authority', language drawn from European data protection rather than the Privacy Act 1988 (Cth).
Ask: Which countries does our content reach - including for AI processing and for the lawyer review step - and under what APP 8 arrangement?
Breach notification
Public claim only
The data processing agreement commits the processor to 'Notify the Controller without undue delay after becoming aware of a personal data breach'. No hour figure, notification contact, escalation path or content requirement is published, and there is no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). The privacy policy has no incident clause and there is no status page in the site inventory.
Ask: Within how many hours will you notify us of a breach, who is the named contact, what will the first notification contain, and how do you handle eligible data breach assessments under the Notifiable Data Breaches scheme?
Change notice
Public claim only
The terms state 'We may update these Terms from time to time; material changes will be notified through the Services or by email, and continued use constitutes acceptance.' The privacy policy carries a 'Last updated' date but no change clause, version number or archive of superseded versions, and no page publishes a changelog. Nothing addresses notice when the clause library, the model or the AI features change, which for a platform assembling documents from a maintained clause library is a separate question from a change to the terms.
Ask: What notice will we get when the clause library, the model or the AI behaviour changes, and do you keep dated versions of the terms, privacy policy and data processing agreement?
Exit and portability
Public claim only
The terms confirm 'You retain ownership of documents and information you upload or generate' and the data processing agreement allows deletion or return at the customer's choice at the end of the engagement. Against that, 'Fees are non-refundable except where required by law' and plan credits 'expire at the end of the billing period'. No export format, bulk download, API or notice period is published, and nothing states how long access to generated documents continues after a subscription ends.
Ask: How do we export every generated and uploaded document in bulk and in what format, how long does access continue after cancellation, and what notice would we get if the service closed?
Integrations and connections
Not confirmed
No integrations page appears in the 44-URL site inventory taken 2026-09-27 and no integration, connector or API is named on any page read. The platform is a separate web application at my.awelle.io reached by sign-in; nothing is published about connecting it to a practice management system, a document management system or email.
Ask: Does the platform integrate with a document or practice management system, and is there an API - and if so what data does it exchange?
Open-web access
Public claim only
Two vendor statements are relevant and neither answers the question. The home page states the research function lets a user 'Research Australian legal questions in everyday language and trace answers back to useful legal sources', and that workflows are 'grounded in Australian legal context, with useful sources visible where available'. The /our-difference page states the clause library is 'Not scraped from the open web'. That statement is about how the library was built; whether the research or review functions query the open web at the time a question is answered, and against which corpus of Australian legislation and case law, is not published.
Ask: When the research function answers a question, what does it search - a fixed internal corpus, a licensed legal database, or the open web - and how current is that source?
What the AI does without approval
Public claim only
The /our-difference page states 'AI does not write our clauses from scratch. Instead, it acts as an intelligent orchestrator - selecting, customising, and assembling the right pre-vetted clauses for your specific matter.' On the pages read the platform produces drafts, risk flags and research answers for a user to act on; no agentic action is described - nothing is published about the platform sending, filing, signing or emailing anything, or acting on a schedule. Because no action surface is published, no approval gate or configuration setting is published either.
Ask: Does the platform take any action beyond producing a draft, a flag or an answer for the user - sending, filing, signing or notifying - and if not, is that on the roadmap?
Human review of output
Not confirmed
Two of the vendor's own pages sit in tension. The /our-difference page states under 'Mandatory Lawyer Review': 'Nothing leaves the platform unverified. Every document assembled by Awelle is reviewed by a qualified lawyer to ensure precision, context, and legal soundness before delivery.' The terms of 13 September 2026 state that 'Awelle is not a law firm, does not provide legal advice, and no attorney-client relationship is created through your use of the Services. Documents generated through the Services are templates and starting points only; you should consult a qualified legal professional before relying on them.' The first describes review by a qualified lawyer as a step in every delivery; the second disclaims legal advice, treats output as a starting point and directs the user to their own lawyer. Neither page states how the review is recorded, how long it takes, or whether it applies on a free trial and self-service sign-up.
Ask: Is every document reviewed by a qualified lawyer before delivery on every plan including the free trial, how is that review evidenced, and how does it sit with the terms stating that no legal advice is given and that output is a starting point only?
