Legal-specific · Practice management · Medium confidence
Shine Analytics Limited (t/a Brightflag) · Brightflag ELM including invoice AI and Ask Brightflag. Customer MSA and trust.brightflag.com (DPA, AI subprocessors) are gated. Website terms of use are not the product contract.
Irish enterprise legal-management platform for in-house spend, e-billing and matter data, with invoice AI and an in-app LLM assistant.
Opens a private software assessment of Brightflag for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | European Union / EEA, United States, AustraliaHosting regions source, checked 2026-10-10 (opens in a new tab) |
| Australian region | Australian region available |
| Assurance | ISO/IEC 27001:2013, SOC 1 Type 2, SOC 2 Type 2 |
| Training on customer content | Unknown |
| Retention summary | Security page: retention and deletion configurable to the customer. Privacy Notice (23 July 2026): active systems keep personal data only as long as needed for the purpose, longer if complaint or litigation. Trust Centre (AI subprocessors and DPA) did not scrape. |
| Integrations | SAML SSO, SCIM, OAuth API, Gmail (Brightflag Connect), finance integrations (asset guide) |
| Pricing summary | No public price list. Demo required. Website terms of use are Irish-law site terms, not a product licence. |
| Legal content coverage | Customer invoices, matters, vendors and spend. Ask Brightflag is described as an LLM over that system of record. No licensed Australian primary-law library. |
| Australian presence | Yes — Group includes Brightflag Pty Ltd. Security page offers AWS data centres in Ireland, the United States and Australia. Privacy notice is issued for Shine Analytics Limited, Brightflag Inc and Brightflag Pty Ltd. Checked 2026-10-10. Vendor page: “Our data is stored in secure data centers in Europe (Ireland), the United States and Australia.” (https://www.brightflag.com/security). Recorded as Australian region available. |
A later research check disagrees with a value already on this profile. The published value is unchanged.
Define the configuration, people, information and tasks being assessed.
Public claim only
Brightflag is sold as ELM covering e-billing, spend, matters and legal-service requests, plus invoice AI and Ask Brightflag. No public plan matrix. Customer MSA and Trust Center are gated.
Ask: Confirm which modules (invoice AI, Ask Brightflag, Connect, service requests) are on our order form and attach the MSA/DPA.
Public claim only
Multi-tenant AWS SaaS. Security: data centres in Ireland, the United States and Australia, chosen by customer location. Privacy: platform information can be hosted in the EEA; websites default to the EEA unless the customer elects US hosting. No on-premises option was found. Checked 2026-10-10. Vendor page: “Our data is stored in secure data centers in Europe (Ireland), the United States and Australia.” (https://www.brightflag.com/security). Recorded as Australian region available.
Ask: Will our tenant, backups, logs and Ask Brightflag indexes sit only in Australia?
Public claim only
Invoice AI reads every invoice, emails a work summary and billing-guideline hits, and allows approve-from-inbox. Ask Brightflag opens an LLM window on the current page over matters, vendors and spend, including drafting vendor emails. Navigation describes models and agents trained and tuned for legal teams. A site AI agent answers product questions.
Ask: Which of invoice AI, Ask Brightflag, email-approve and the site agent will be on for our tenant?
Public claim only
Content is the customer's invoices, matters and vendors, not a licensed Australian case-law library. Website terms: Ireland law and Irish courts. Privacy last modified 23 July 2026 (GDPR/CCPA/CPRA/VCDPA).
Ask: Confirm which Brightflag entity and law govern our MSA, and that Ask Brightflag will not browse open-web Australian law.
Record the practical work needed to introduce and maintain the software.
Not confirmed
No public price. Website terms of use are not a product licence.
Ask: Provide an itemised quote (users, invoice volume, AI modules, term, auto-renewal).
Public claim only
Security: SAML SSO (ADFS, Entra ID, Google, Okta, OneLogin, Ping) and SCIM; API via OAuth. Privacy: Brightflag Connect processes Gmail via Google API as a processor. Finance-integration and implementation guides exist as gated assets. No native Word drafting add-in was described.
Ask: Demonstrate SSO/SCIM, Connect Gmail scopes, and which finance systems will be on.
Public claim only
Privacy: privacy@brightflag.com; disclosures@brightflag.com for vulnerabilities. Privacy allows generative AI to respond to support, pricing, billing or licensing requests. Trust Center access is by request. No public Sev-1 times.
Ask: Provide the support SLA, whether genAI reads ticket content, and the security escalation path for an Australian tenant.
Compare complete work at the required quality, including checking and correction.
Not confirmed
Invoice AI is described as patented. Forrester TEI assets are gated. No independent accuracy study of Ask Brightflag or invoice classification was inspected.
Ask: Share any evaluation of invoice-guideline detection and Ask Brightflag answer accuracy on our billing guidelines.
Public claim only
Invoice AI is bounded to invoices and guidelines with an email summary a reviewer can approve or open. Ask Brightflag is unbounded chat over the ELM record. Time saved after checking is not independently measured on the pages read.
Ask: On our guidelines, show a true-positive violation, a miss, and how long a reviewer spends on an AI-summarised invoice.
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Invoice reviewers may be finance or legal ops, not only lawyers. Ask Brightflag can draft vendor emails. Enabling Connect on Gmail and approve-from-inbox is the customer's authority decision. Website terms do not address professional use.
Ask: Who may approve invoices from email, and can we restrict Ask Brightflag so it cannot draft outbound vendor mail?
Not confirmed
Ask Brightflag is described as an LLM. Privacy says customer data may be processed by AI subprocessors listed in the DPA and at trust.brightflag.com, which did not scrape. No named OpenAI, Azure or Anthropic entity appears on the public AI or security pages.
Ask: Name each model, legal entity, region and contract used for invoice AI and Ask Brightflag, and the notice period before a model is swapped.
Not confirmed
Privacy 1.7: all subprocessors, including AI subprocessors, are listed in the DPA and published at trust.brightflag.com. That Trust Center URL failed to scrape (likely gated). AWS is named as the host on the security page.
Ask: Provide the current dated subprocessor register, including AI processors, with entity, country, purpose and objection rights.
Not confirmed
Navigation markets 'models and agents trained and tuned for legal teams' without saying on whose data. Privacy uses analytics on how customers use the Services to make them more intuitive. No clause prohibiting foundation-model training was found in the public Privacy Notice or website terms.
Ask: Does the signed DPA/MSA prohibit training of Brightflag or third-party models on invoices, prompts, outputs and embeddings?
Public claim only
Privacy: generative AI may be used for support and to analyse crash information; usage analytics to study how customers use the Services. Whether invoice accept/reject labels train a shared model is not stated.
Ask: Do invoice-review decisions and Ask Brightflag feedback stay in our tenant only?
Public claim only
Security: retention and deletion configurable. Privacy: keep personal data in active systems only as long as needed. No numbered default for Ask Brightflag chats or invoice-AI logs.
Ask: State default and configurable retention for invoices, Ask Brightflag chats, embeddings and AI-subprocessor logs on an Australian tenant.
Public claim only
Security: records not retained longer than needed; dSAR support. Privacy: right to erasure with legal exceptions; Brightflag may delete collected information per retention policies. No certified-deletion SLA covering AWS or AI subprocessors was found in public terms.
Ask: On exit, what is deleted (invoices, chats, embeddings, subprocessors), in what period, and will you certify deletion in writing?
Public claim only
Privacy: access only to employees and consultants with a need for a lawful purpose; staff are trained. Support may use generative AI. Trust Center is staff-gated.
Ask: Who can read our invoices and Ask Brightflag chats, from which countries, under what approval, and can we see those access logs?
Public claim only
Security: SAML SSO and SCIM; roles and permissions; every action captured for audit. Approve-from-inbox is an access-control choice.
Ask: Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete Ask Brightflag and invoice-approval audit log.
Public claim only
Security: AES-256 at rest with AWS KMS; HTTPS with minimum TLS 1.2 in transit. Customer-managed keys were not offered on the page read.
Ask: Confirm encryption of Ask Brightflag indexes and the path to any AI subprocessor, and whether customer-managed keys are available for Australia.
Public claim only
ISO/IEC 27001:2013 (older edition than 2022), SOC 1 Type 2 and SOC 2 Type 2 across all five Trust Categories, CREST penetration testing. Reports live in a gated Trust Center and were not inspected.
Ask: Provide the current ISO 27001 (state the edition) and SOC 2 Type 2 reports covering Ask Brightflag and invoice AI, with scope and exceptions.
Not confirmed
Public website terms (Ireland law) govern the marketing site. Privacy says processor activity is under a DPA with the customer. That DPA and the product MSA are not published. Group entities: Shine Analytics Limited, Brightflag Inc, Brightflag Pty Ltd.
Ask: Provide the current MSA/DPA for an Australian tenant, with liability, training and AI-subprocessor terms.
Public claim only
Security offers Ireland, US and Australia data centres. Privacy: EEA hosting option; websites in the EEA unless US elected; CRM and conferencing in the US with SCCs (not DPF). AI subprocessors are not listed on the public page. Marketing and support tools may keep contact data in the US.
Ask: For invoice AI and Ask Brightflag on an Australian tenant, list every country for storage, inference, backups and support.
Not confirmed
No contractual 72-hour clause in website terms. Vulnerability reports to disclosures@brightflag.com. Incident history not published. DPA (gated) may contain the SLA.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months.
Public claim only
Privacy: material privacy changes notified by email or in-product; continued use is acceptance; unacceptable changes require the customer to stop using the Services. Website terms likewise. Subprocessor change notice lives in the gated DPA.
Ask: What written notice will we get before a new AI model or subprocessor is added, and can we object?
Not confirmed
Privacy includes a portability right for certain personal data. Export formats for invoices, matters and Ask Brightflag history, and certified deletion of AI subprocessors, are not in public terms.
Ask: What export we receive for invoices, matters and Ask Brightflag history, and will you certify deletion within 30 days including AI subprocessors?
Not confirmed
Gmail Connect and finance integrations are optional. Enabling them is the customer's choice. Privacy: Google API Limited Use for Connect. Website terms disclaim third-party sites.
Ask: List every connector that will be on for our tenant and the data each receives.
Not confirmed
Ask Brightflag is described as using Brightflag as the system of record. The site AI agent answers product questions. No open-web toggle was found.
Ask: Does Ask Brightflag browse the open web, and can we disable any such retrieval?
Not confirmed
Invoice AI can email a summary and let a reviewer approve from the inbox in a single click. Ask Brightflag can craft vendor emails. Workflow rules are customer-configured. Those are action gates the firm must set.
Ask: Can we disable approve-from-inbox and block Ask Brightflag from sending or drafting vendor email without a second Legal confirmation?
Public claim only
Invoice AI is framed as assisting a reviewer who can open the invoice. Approve-from-inbox still requires a human click, but not necessarily a lawyer. Ask Brightflag chat does not require a lawyer to approve an answer before it is shown.
Ask: Can we require every invoice AI recommendation and Ask Brightflag answer to be approved by a named lawyer before it is acted on?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI practice management tools Australia
