---
title: "Brightflag (Shine Analytics Limited (t/a Brightflag))"
url: "https://ailawframework.com/software/brightflag"
type: "software_profile"
site: "AI Law Framework"
id: "brightflag"
vendor: "Shine Analytics Limited (t/a Brightflag)"
category: "Legal-specific"
segment: "Practice management"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# Brightflag (Shine Analytics Limited (t/a Brightflag))

> Irish enterprise legal-management platform for in-house spend, e-billing and matter data, with invoice AI and an in-app LLM assistant.

Canonical page: https://ailawframework.com/software/brightflag  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Brightflag ELM including invoice AI and Ask Brightflag. Customer MSA and trust.brightflag.com (DPA, AI subprocessors) are gated. Website terms of use are not the product contract.

## Capabilities

- Matter management
- Intake and triage
- Document summarisation
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | European Union / EEA, United States, Australia |
| Australian region | Australian region available |
| Assurance | ISO/IEC 27001:2013, SOC 1 Type 2, SOC 2 Type 2 |
| Training on customer content | Unknown |
| Retention | Security page: retention and deletion configurable to the customer. Privacy Notice (23 July 2026): active systems keep personal data only as long as needed for the purpose, longer if complaint or litigation. Trust Centre (AI subprocessors and DPA) did not scrape. |
| Integrations | SAML SSO, SCIM, OAuth API, Gmail (Brightflag Connect), finance integrations (asset guide) |
| Legal content coverage | Customer invoices, matters, vendors and spend. Ask Brightflag is described as an LLM over that system of record. No licensed Australian primary-law library. |
| Pricing | No public price list. Demo required. Website terms of use are Irish-law site terms, not a product licence. |
| Australian presence | Yes. Group includes Brightflag Pty Ltd. Security page offers AWS data centres in Ireland, the United States and Australia. Privacy notice is issued for Shine Analytics Limited, Brightflag Inc and Brightflag Pty Ltd. Checked 2026-10-10. Vendor page: “Our data is stored in secure data centers in Europe (Ireland), the United States and Australia.” (https://www.brightflag.com/security). Recorded as Australian region available. |
| Website | https://brightflag.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | Brightflag is sold as ELM covering e-billing, spend, matters and legal-service requests, plus invoice AI and Ask Brightflag. No public plan matrix. Customer MSA and Trust Center are gated. | Confirm which modules (invoice AI, Ask Brightflag, Connect, service requests) are on our order form and attach the MSA/DPA. | [Brightflag — home](https://brightflag.com/); [Brightflag AI](https://brightflag.com/brightflag-ai/); [Brightflag Trust and Security](https://brightflag.com/security/) |
| Deployment model | Public claim only | Multi-tenant AWS SaaS. Security: data centres in Ireland, the United States and Australia, chosen by customer location. Privacy: platform information can be hosted in the EEA; websites default to the EEA unless the customer elects US hosting. No on-premises option was found. Checked 2026-10-10. Vendor page: “Our data is stored in secure data centers in Europe (Ireland), the United States and Australia.” (https://www.brightflag.com/security). Recorded as Australian region available. | Will our tenant, backups, logs and Ask Brightflag indexes sit only in Australia? | [Brightflag Trust and Security](https://brightflag.com/security/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag hosting statement checked 2026-10-10](https://www.brightflag.com/security) |
| AI features in scope | Public claim only | Invoice AI reads every invoice, emails a work summary and billing-guideline hits, and allows approve-from-inbox. Ask Brightflag opens an LLM window on the current page over matters, vendors and spend, including drafting vendor emails. Navigation describes models and agents trained and tuned for legal teams. A site AI agent answers product questions. | Which of invoice AI, Ask Brightflag, email-approve and the site agent will be on for our tenant? | [Brightflag AI](https://brightflag.com/brightflag-ai/); [Brightflag — home](https://brightflag.com/) |
| Jurisdictions and legal content | Public claim only | Content is the customer's invoices, matters and vendors, not a licensed Australian case-law library. Website terms: Ireland law and Irish courts. Privacy last modified 23 July 2026 (GDPR/CCPA/CPRA/VCDPA). | Confirm which Brightflag entity and law govern our MSA, and that Ask Brightflag will not browse open-web Australian law. | [Brightflag Terms of Use](https://brightflag.com/terms-of-use/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag AI](https://brightflag.com/brightflag-ai/) |
| Licence and pricing unit | Not confirmed | No public price. Website terms of use are not a product licence. | Provide an itemised quote (users, invoice volume, AI modules, term, auto-renewal). | [Brightflag Terms of Use](https://brightflag.com/terms-of-use/) |
| Word, Outlook and matter-system integration | Public claim only | Security: SAML SSO (ADFS, Entra ID, Google, Okta, OneLogin, Ping) and SCIM; API via OAuth. Privacy: Brightflag Connect processes Gmail via Google API as a processor. Finance-integration and implementation guides exist as gated assets. No native Word drafting add-in was described. | Demonstrate SSO/SCIM, Connect Gmail scopes, and which finance systems will be on. | [Brightflag Trust and Security](https://brightflag.com/security/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Support and security contact | Public claim only | Privacy: privacy@brightflag.com; disclosures@brightflag.com for vulnerabilities. Privacy allows generative AI to respond to support, pricing, billing or licensing requests. Trust Center access is by request. No public Sev-1 times. | Provide the support SLA, whether genAI reads ticket content, and the security escalation path for an Australian tenant. | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag Trust and Security](https://brightflag.com/security/) |
| Published quality evidence | Not confirmed | Invoice AI is described as patented. Forrester TEI assets are gated. No independent accuracy study of Ask Brightflag or invoice classification was inspected. | Share any evaluation of invoice-guideline detection and Ask Brightflag answer accuracy on our billing guidelines. | [Brightflag AI](https://brightflag.com/brightflag-ai/) |
| Task fit and verification | Public claim only | Invoice AI is bounded to invoices and guidelines with an email summary a reviewer can approve or open. Ask Brightflag is unbounded chat over the ELM record. Time saved after checking is not independently measured on the pages read. | On our guidelines, show a true-positive violation, a miss, and how long a reviewer spends on an AI-summarised invoice. | [Brightflag AI](https://brightflag.com/brightflag-ai/) |
| Client authority and professional use | Not confirmed | Invoice reviewers may be finance or legal ops, not only lawyers. Ask Brightflag can draft vendor emails. Enabling Connect on Gmail and approve-from-inbox is the customer's authority decision. Website terms do not address professional use. | Who may approve invoices from email, and can we restrict Ask Brightflag so it cannot draft outbound vendor mail? | [Brightflag AI](https://brightflag.com/brightflag-ai/); [Brightflag Terms of Use](https://brightflag.com/terms-of-use/) |
| Foundation-model providers | Not confirmed | Ask Brightflag is described as an LLM. Privacy says customer data may be processed by AI subprocessors listed in the DPA and at trust.brightflag.com, which did not scrape. No named OpenAI, Azure or Anthropic entity appears on the public AI or security pages. | Name each model, legal entity, region and contract used for invoice AI and Ask Brightflag, and the notice period before a model is swapped. | [Brightflag AI](https://brightflag.com/brightflag-ai/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Subprocessors | Not confirmed | Privacy 1.7: all subprocessors, including AI subprocessors, are listed in the DPA and published at trust.brightflag.com. That Trust Center URL failed to scrape (likely gated). AWS is named as the host on the security page. | Provide the current dated subprocessor register, including AI processors, with entity, country, purpose and objection rights. | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag Trust and Security](https://brightflag.com/security/) |
| Training on customer content | Not confirmed | Navigation markets 'models and agents trained and tuned for legal teams' without saying on whose data. Privacy uses analytics on how customers use the Services to make them more intuitive. No clause prohibiting foundation-model training was found in the public Privacy Notice or website terms. | Does the signed DPA/MSA prohibit training of Brightflag or third-party models on invoices, prompts, outputs and embeddings? | [Brightflag — home](https://brightflag.com/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag Terms of Use](https://brightflag.com/terms-of-use/) |
| Feedback and quality monitoring | Public claim only | Privacy: generative AI may be used for support and to analyse crash information; usage analytics to study how customers use the Services. Whether invoice accept/reject labels train a shared model is not stated. | Do invoice-review decisions and Ask Brightflag feedback stay in our tenant only? | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Retention of prompts, outputs and matter indexes | Public claim only | Security: retention and deletion configurable. Privacy: keep personal data in active systems only as long as needed. No numbered default for Ask Brightflag chats or invoice-AI logs. | State default and configurable retention for invoices, Ask Brightflag chats, embeddings and AI-subprocessor logs on an Australian tenant. | [Brightflag Trust and Security](https://brightflag.com/security/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Deletion and certified erasure | Public claim only | Security: records not retained longer than needed; dSAR support. Privacy: right to erasure with legal exceptions; Brightflag may delete collected information per retention policies. No certified-deletion SLA covering AWS or AI subprocessors was found in public terms. | On exit, what is deleted (invoices, chats, embeddings, subprocessors), in what period, and will you certify deletion in writing? | [Brightflag Trust and Security](https://brightflag.com/security/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Vendor and verifier access to content | Public claim only | Privacy: access only to employees and consultants with a need for a lawful purpose; staff are trained. Support may use generative AI. Trust Center is staff-gated. | Who can read our invoices and Ask Brightflag chats, from which countries, under what approval, and can we see those access logs? | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Access control, SSO and audit | Public claim only | Security: SAML SSO and SCIM; roles and permissions; every action captured for audit. Approve-from-inbox is an access-control choice. | Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete Ask Brightflag and invoice-approval audit log. | [Brightflag Trust and Security](https://brightflag.com/security/); [Brightflag AI](https://brightflag.com/brightflag-ai/) |
| Encryption in transit and at rest | Public claim only | Security: AES-256 at rest with AWS KMS; HTTPS with minimum TLS 1.2 in transit. Customer-managed keys were not offered on the page read. | Confirm encryption of Ask Brightflag indexes and the path to any AI subprocessor, and whether customer-managed keys are available for Australia. | [Brightflag Trust and Security](https://brightflag.com/security/) |
| Independent security assurance | Public claim only | ISO/IEC 27001:2013 (older edition than 2022), SOC 1 Type 2 and SOC 2 Type 2 across all five Trust Categories, CREST penetration testing. Reports live in a gated Trust Center and were not inspected. | Provide the current ISO 27001 (state the edition) and SOC 2 Type 2 reports covering Ask Brightflag and invoice AI, with scope and exceptions. | [Brightflag Trust and Security](https://brightflag.com/security/) |
| Contract, DPA, liability and forum | Not confirmed | Public website terms (Ireland law) govern the marketing site. Privacy says processor activity is under a DPA with the customer. That DPA and the product MSA are not published. Group entities: Shine Analytics Limited, Brightflag Inc, Brightflag Pty Ltd. | Provide the current MSA/DPA for an Australian tenant, with liability, training and AI-subprocessor terms. | [Brightflag Terms of Use](https://brightflag.com/terms-of-use/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Cross-border transfers and APP 8 | Public claim only | Security offers Ireland, US and Australia data centres. Privacy: EEA hosting option; websites in the EEA unless US elected; CRM and conferencing in the US with SCCs (not DPF). AI subprocessors are not listed on the public page. Marketing and support tools may keep contact data in the US. | For invoice AI and Ask Brightflag on an Australian tenant, list every country for storage, inference, backups and support. | [Brightflag Trust and Security](https://brightflag.com/security/); [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Incident notification and history | Not confirmed | No contractual 72-hour clause in website terms. Vulnerability reports to disclosures@brightflag.com. Incident history not published. DPA (gated) may contain the SLA. | State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months. | [Brightflag Terms of Use](https://brightflag.com/terms-of-use/); [Brightflag Trust and Security](https://brightflag.com/security/) |
| Change notice for models, terms and processors | Public claim only | Privacy: material privacy changes notified by email or in-product; continued use is acceptance; unacceptable changes require the customer to stop using the Services. Website terms likewise. Subprocessor change notice lives in the gated DPA. | What written notice will we get before a new AI model or subprocessor is added, and can we object? | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag Terms of Use](https://brightflag.com/terms-of-use/) |
| Export and exit | Not confirmed | Privacy includes a portability right for certain personal data. Export formats for invoices, matters and Ask Brightflag history, and certified deletion of AI subprocessors, are not in public terms. | What export we receive for invoices, matters and Ask Brightflag history, and will you certify deletion within 30 days including AI subprocessors? | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) |
| Connectors and third-party AI tools | Not confirmed | Gmail Connect and finance integrations are optional. Enabling them is the customer's choice. Privacy: Google API Limited Use for Connect. Website terms disclaim third-party sites. | List every connector that will be on for our tenant and the data each receives. | [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy); [Brightflag Terms of Use](https://brightflag.com/terms-of-use/) |
| Open-web search | Not confirmed | Ask Brightflag is described as using Brightflag as the system of record. The site AI agent answers product questions. No open-web toggle was found. | Does Ask Brightflag browse the open web, and can we disable any such retrieval? | [Brightflag AI](https://brightflag.com/brightflag-ai/) |
| Agent actions and confirmation | Not confirmed | Invoice AI can email a summary and let a reviewer approve from the inbox in a single click. Ask Brightflag can craft vendor emails. Workflow rules are customer-configured. Those are action gates the firm must set. | Can we disable approve-from-inbox and block Ask Brightflag from sending or drafting vendor email without a second Legal confirmation? | [Brightflag AI](https://brightflag.com/brightflag-ai/) |
| Human review before use | Public claim only | Invoice AI is framed as assisting a reviewer who can open the invoice. Approve-from-inbox still requires a human click, but not necessarily a lawyer. Ask Brightflag chat does not require a lawyer to approve an answer before it is shown. | Can we require every invoice AI recommendation and Ask Brightflag answer to be approved by a named lawyer before it is acted on? | [Brightflag AI](https://brightflag.com/brightflag-ai/) |

## Notes

trust.brightflag.com (DPA and AI subprocessors) failed to scrape — gated. Models unnamed. ISO 27001 still cited as 2013. No public product MSA. Navigation 'models trained and tuned for legal teams' is not a customer-content training statement.

## Sources

- [Brightflag — home](https://brightflag.com/) (checked 2026-09-21)
- [Brightflag Trust and Security](https://brightflag.com/security/) (checked 2026-09-21)
- [Brightflag Terms of Use](https://brightflag.com/terms-of-use/) (checked 2026-09-21)
- [Brightflag AI](https://brightflag.com/brightflag-ai/) (checked 2026-09-21)
- [Brightflag Privacy Notice](https://app.brightflag.com/privacy-policy) (checked 2026-09-21)
- [Brightflag hosting statement checked 2026-10-10](https://www.brightflag.com/security) (checked 2026-10-10)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.