Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and components covered
Public claim only
The vendor's platform page (checked 2026-09-27) publishes four groups: pricing (a 'Pricing agent' that 'Infers scope from client instructions' and 'Costs the scope based on data', a 'Precedent bank', a 'Quote builder' and a configurable rate and taxonomy structure); matter management (real-time reporting that 'Supports 30+ KPIs', 'Predictive budget alerts', matter overviews with drill-down 'to individual time cards', and custom alarms); data enrichment (matter data enrichment, 'Task & phase enrichment', 'Data masking' and an Open API); and deployment claims including '24/7 support'. Plan tiers are not described on that page.
Ask: Which of these components are in the tier we would buy, and which are separately licensed - specifically the Pricing agent, the Precedent bank, data masking and the Open API?
Deployment and hosting
Not confirmed
The platform page lists 'Hosted in the cloud or on-prem' under the Data masking feature only, not as a statement about the platform, and the security page describes 'Our AWS-based cloud infrastructure'. Appendix I of the privacy policy states 'All Ayora processing occurs in physical data centres that are managed by AWS.' Those two statements are not reconciled: one offers an on-premises option for a component, the other places all processing in AWS-managed facilities. Only cloud delivery is recorded here.
Ask: Is an on-premises deployment available for anything other than the data-masking component, and if masking runs on our infrastructure, what leaves it and to which AWS region?
Where the AI sits
Public claim only
The platform page names the AI functions specifically: 'Predictive AI for matter run-rates' for budget alerts, 'Advanced AI enrichment' for matter data, 'Context-aware task & phase generation at time entry level' for coding, a data-masking system that 'Leverages Small Language Models', 'LLM agents for specialist business tasks', and a Pricing agent that infers and costs scope. The security page adds that the masking system is 'powered by a self-hosted Small Language Model'. No model, version or provider is named for the agents.
Ask: For each named function - run-rate prediction, enrichment, task and phase generation, masking and the pricing agent - which model runs it, where, and which are deterministic rather than model-driven?
Jurisdictions and legal content
Public claim only
The product works on the firm's own matter, time and financial data and maps to 'your own taxonomy'; no jurisdictional legal content, court scale or costs regime is claimed anywhere on the pages read. The published legal documents are written to English and UK law, and no Australian jurisdictional material appears.
Ask: Does anything in the product depend on a jurisdiction-specific code set or costs regime, and is the Australian market supported by a local entity or reseller?
Vendor content addressed to AI systems
Not confirmed
The check for content directing how AI systems should describe the product was made on 2026-09-27 and found none. Requests for /llms.txt and /ai.txt each returned HTTP 404 (the site's 404 page). /robots.txt returned HTTP 200 and contains one line only, 'Sitemap: https://www.ayora.ai/sitemap.xml', so no crawler allow or disallow directives are published either. The 57-URL site map holds no /ai-info, /ai or /for-ai page, and the platform, security, terms and privacy pages read contain no block addressed to AI models, assistants or crawlers.
Ask: Do you publish, or plan to publish, any file or page instructing AI systems how to describe ayora, and who approves its contents?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and confidentiality
Not confirmed
The product processes time-entry narratives, matter data and client instructions, which commonly identify clients and describe matters. The vendor publishes a masking layer for this: 'Our AI compliance replaces identifiers with secure placeholders while preserving semantic integrity' and, on the platform page, a system for 'anonymising time entries without losing the valuable signals' that 'Ensures ayora's LLM use is fully compliant'. Whether masking is on by default, whether it applies to client instructions and matter documents as well as time entries, and what 'fully compliant' is measured against, is not published.
Ask: Is masking applied by default to every path that reaches a language model, including client instructions and matter narratives, and can you demonstrate what a subprocessor actually receives?
Foundation-model providers and inference location
Public claim only
The published subprocessor table on the security page names Google LLC, corporate headquarters California, USA, for 'File storage and videoconferencing software, generative AI features'. That is the only provider connected to generative AI features anywhere on the pages read. No model, model version, endpoint region or contractual arrangement is named, and the masking layer is described only as a 'self-hosted Small Language Model'. No customer choice of model is offered on the pages read.
Ask: Name each model behind the pricing agent, enrichment and task and phase generation, the region each endpoint runs in, and whether Google is the provider for all of them or only some.
Subprocessors
Public claim only
The security page publishes a subprocessor table with seven entries: Amazon Web Services (data storage, USA), Google LLC (file storage and videoconferencing software, generative AI features, USA), Auth0 (access management and authentication, USA), Sentry (software monitoring, USA), Zendesk (customer support, USA), Attio (CRM, UK) and Zoho (CRM, India). The column published is 'Corporate HQ location', which is not a processing location, and no Australian location appears. An email subscription for subprocessor updates is offered. Appendix I of the privacy policy states Ayora enters data processing agreements with subprocessors and reviews them before engagement.
Ask: For each subprocessor, in which country is our data actually processed and stored, and which of them can receive time-entry or matter content before masking?
Training on customer content
Public claim only
The security page states, under a 'No AI model training' heading: 'Ayora does not use customer data to train foundational AI models.' The statement is limited to foundational models and says nothing about training or tuning Ayora's own models, including the self-hosted small language model used for masking. No training prohibition appears in the published website terms or privacy policy, and no platform agreement or DPA is published, so the statement has no contractual backing in the documents available.
Ask: Will you warrant in our agreement that neither Ayora nor any provider trains, fine-tunes or evaluates any model on our time entries, matter data, prompts or outputs, including your own small language models?
Feedback, corrections and quality monitoring
Not confirmed
Nothing on the pages read says what happens to corrections a firm makes to generated task and phase codes, to quotes or to enrichment tags, or whether in-product feedback is used to improve the system. The privacy policy addresses website and account personal data and does not deal with product telemetry.
Ask: Are corrections to coded time entries, edited quotes or agent feedback used to improve your models or benchmarks, and can that be disabled for our tenancy?
Retention of prompts, enriched data and logs
Public claim only
The privacy policy states 'We will delete your personal data within 30 days of your request', keeps personal data 'only as long as necessary', and says specific retention periods can be obtained on request. Appendix I adds a shared-responsibility model in which the customer 'unilaterally determine[s] what data you route through our services'. No retention period is published for enriched matter data, time-entry narratives, prompts, masked or unmasked payloads, agent outputs or access logs.
Ask: State the default and configurable retention for enriched matter data, time-entry narratives, prompts and responses at each subprocessor, agent outputs and access logs.
Deletion and certified erasure
Public claim only
The privacy policy states personal data will be deleted within 30 days of a request and that 'All personal data is deleted from the platform following service termination'. It also states 'Personal data is incidental to Ayora's services' and that most porting use cases do not apply. No certified-erasure commitment, no timeframe for deleting non-personal matter and financial data, and no statement about deletion at subprocessors appears.
Ask: On termination, what is deleted from the platform, from backups and from each subprocessor, within what period, and will you certify that deletion in writing?
Vendor access to customer content
Public claim only
The security page states all staff pass background checks, sign NDAs and use device-managed, antivirus-protected equipment. Appendix I of the privacy policy states customer agreements contain confidentiality obligations and that Ayora 'monitors access to applications, tools, and resources that process or store Customer data', with security logs reviewed by the security and engineering teams. Neither says whether Ayora personnel can read a firm's time-entry or matter content, under what approval, from which countries, or whether the firm can see those events.
Ask: Can your staff or contractors read our unmasked time entries and matter data, under what ticketed approval, from which countries, and can we receive a log of that access?
Access control, SSO and audit
Public claim only
The security page states enterprise single sign-on, multi-factor authentication and password enforcement are offered, and that the product provides 'granular permissions, access logs, and event tracking'. Appendix I of the privacy policy repeats multi-factor authentication and single sign-on and describes 'a sophisticated in-app permissioning system' limiting user access to selected data and environments. No SCIM provisioning, session policy or exportable audit format is described.
Ask: Which identity providers are supported for SSO, is multi-factor authentication enforceable firm-wide, and can the in-app access log be exported to our SIEM?
Encryption and key management
Public claim only
Appendix I of the privacy policy states encryption at rest 'is automated using AWS's transparent disk encryption, which uses industry standard AES-256 encryption', that 'All keys are fully managed by AWS', and that traffic in transit is encrypted with TLS 1.2. The security page states 'TLS 1.2+ for connections and AES-256 encryption for all stored data via AWS-managed services'. Customer-managed keys are not offered on the pages read.
Ask: Is a customer-managed key option available, and is data encrypted in transit to and from each subprocessor, including the generative AI path?
Independent security assurance
Public claim only
The security page states 'We are UKAS-accredited to ISO 27001:2022' and reports '3 years of ISO27001 audits' by UKAS-accredited auditors, '80+ Security controls', grey-box penetration testing by CREST-certified specialists, GDPR compliance with ICO registration ZB406049 and a data protection officer. Appendix I of the privacy policy adds an annual internal audit, an external ISO 27001 audit and a third-party grey-box penetration test. No certificate, audit report, statement of applicability, penetration-test summary or SOC 2 report is published, and no SOC 2 is claimed.
Ask: Provide the ISO 27001:2022 certificate and statement of applicability, the latest penetration-test summary, and confirm whether the platform and the masking component are both in scope.
Contract, entity, liability and forum
Public claim only
The only published terms are terms of use for the website, effective 25 January 2024, operated by 'Ayora Technologies Limited', 'registered in England and Wales under company number 14284631', with liability provisions framed on English law and the site 'made available free of charge'. No platform subscription agreement, order form, data processing agreement or standard contractual clauses are published. The registered office differs between documents: the footer gives 10 York Road, London SE1 7ND, and the terms and privacy policy give Spaces Cannon Street, 60 Cannon St, London EC4N 6NP.
Ask: Which entity would contract with an Australian firm, under which governing law and forum, and will you provide the subscription agreement and a data processing agreement with Australian Privacy Principles obligations?
Cross-border transfers and data residency
Not confirmed
The security page states 'We support full data localisation, ensuring sensitive data stays within customer-chosen jurisdictions', but names no region, and the platform page names none either. Appendix I of the privacy policy states all processing occurs in AWS-managed data centres without naming a region. Every published subprocessor has a corporate headquarters outside Australia (United States, United Kingdom, India). The privacy policy is framed on UK law and contains no Australian Privacy Principle 8 disclosure statement.
Ask: Can our tenancy, including the generative AI path and support access, be confined to an Australian region, and which specific AWS regions are available?
Incident notification and history
Not confirmed
Appendix I of the privacy policy lists 'recording and reporting personal data breaches' among accountability measures. No notification period, no notification recipient, no reference to the Notifiable Data Breaches scheme or the OAIC, and no incident history appears on any page read. The published website terms contain no notification clause.
Ask: State the contractual notification period from discovery, what we receive, and whether you will support our own Notifiable Data Breaches assessment as an Australian customer.
Change notice for terms, models and processors
Public claim only
The published website terms state 'We may revise these terms of use at any time by amending this page' and that revisions are binding. The privacy policy states 'We reserve the right to change this privacy policy at any point in time' with notice by email or a website notice. For subprocessors the vendor offers an email subscription to 'Get notified of updates to our subprocessors'. No notice period or objection right is published for a change of model, provider or hosting region.
Ask: What written notice will we get before a new subprocessor, model or region is used, and can we object to a change without terminating?
Export and exit
Public claim only
The privacy policy states all personal data is deleted from the platform following service termination and that Ayora 'will respond to all requests for data porting', while noting that 'Personal data is incidental to Ayora's services' and that most porting use cases do not apply. No export format, timeframe or cost is published for enriched matter data, coded time entries, quotes or precedent records, and the Open API is offered as a product feature rather than an exit right.
Ask: On exit, in what format and over what period can we extract enriched matter data, coded time entries, quotes and precedent records, and is the Open API available during a transition?
Connectors and data ingestion
Public claim only
The platform page claims '1,000+ app integrations' with no application named, states that data sources are connected 'within days using our secure transfer mechanisms', and offers an Open API described as a 'Secure Rest API' with 'Human-in-the-loop flows'. Appendix I of the privacy policy places responsibility for what enters the platform on the customer: 'You unilaterally determine what data you route through our services.'
Ask: List the connectors you would use for our systems, the authentication method, the fields ingested, and which of them send content to a subprocessor before masking.
Open-web retrieval
Not confirmed
Nothing on the pages read says the platform retrieves from the open web. The inputs described are the firm's own matter, time and financial data, client instructions supplied to the pricing agent, and the firm's rate structures and taxonomies. No web-retrieval feature or toggle is published.
Ask: Does the pricing agent or any other agent fetch anything from the internet at run time, and if so what, and can it be disabled?
Agent actions and confirmation
Public claim only
The Pricing agent is published as inferring scope from client instructions, costing that scope from data and offering 'Human-like interaction'; predictive budget alerts and custom alarms are generated automatically with configurable triggers at matter and client level; the Quote builder supports precedent matter cloning and collaboration. Nothing published states which agent outputs can be issued to a client, written back to another system or sent as an alert without a person approving them first.
Ask: Which agent or alert actions can complete without a person confirming, who receives an alert by default, and can a quote leave the firm without approval?
Human review before use
Public claim only
'Human-in-the-loop flows' appears once, as a bullet under the Open API, and the task and phase enrichment is described as a 'human-like approach'. No human-review control is published for the codes applied to time entries, for the pricing agent's costed scope or for a generated quote, and there is no human-oversight clause in the published terms.
Ask: Which settings force a named reviewer before coded time entries affect a bill or a report, and before a costed scope or quote is used with a client?
