Product and intended use
Define the configuration, people, information and tasks being assessed.
Callidus rebrand and Individual versus Firm
Public claim only
Terms of 26 March 2026: StrongSuit AI, Inc., f/k/a CallidusAI, Inc. (Delaware). Individual USD 249/month; Firm is quoted. An MSA/SOW, if signed, prevails over self-serve Terms.
Ask: Is our order on the self-serve Terms or a signed MSA, and which modules are in scope?
US SaaS
Public claim only
Privacy 16 March 2026: Client Data stored on geographically redundant servers exclusively in the United States. Microsoft Azure is named for cloud hosting. No Australian region is offered.
Ask: Confirm Azure regions on our tenancy and whether any failover leaves the US.
Research, contracts, discovery
Public claim only
Home and Terms describe legal research, memo/brief drafting, contract draft/redline, proofreading, document summarisation, Word add-in, e-discovery and a facts/timeline generator in beta. Home FAQ claims 0% hallucinations of case names in the research module; that figure is marketing, not an independent audit.
Ask: Which modules are on our licence, and is the timeline generator still beta?
US case law
Public claim only
Pricing: comprehensive case database with 10M+ federal and state cases. Sample authorities on the home page are US. Australian coverage is not described.
Ask: Does the corpus include Australian authorities, or is it US-only?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client disclosure
Not confirmed
No client-consent template, privilege protocol for Australian matters, or SC Gen 23 analysis was published on pages reviewed. Terms treat StrongSuit as a confidential agent for support access under US evidence rules.
Ask: Provide a client-disclosure template and written advice on privilege and APP 8 for US processing.
OpenAI, Google, Anthropic
Public claim only
Privacy: inference via OpenAI, Google, Anthropic and others in a private-tenant environment. Terms require users to comply with those providers' API terms. Customer model choice is not described.
Ask: Name the providers, models and regions on our tenancy, and whether we can disable any of them.
Named providers, no dated list
Public claim only
Privacy names Microsoft Azure for hosting and OpenAI, Google, Anthropic for LLMs. Terms allow subcontractors. No public dated subprocessor list, locations table or objection right was found.
Ask: Provide the current list with locations, functions, notice period and flow-down of no-training/ZDR.
No training on Client Data
Public claim only
Terms 5.6: StrongSuit will not train any AI models with User Content. Privacy: does not and will not use Client Data to train, retrain or improve proprietary or third-party LLMs, including those of sub-processors; private-tenant inference so data does not enter public training datasets.
Ask: Point to the signed LLM API terms (ZDR/no-train) that apply to our plan, including Google.
Usage Data and session replay
Public claim only
Terms 5.7: Usage Data (excluding Confidential Information) may be used to develop, improve, support and operate the Services; sharing only if aggregated and anonymised. Session-replay tools may be used; user-generated text is said to be anonymised or excluded.
Ask: Can prompts or document text appear in analytics or session replay, and can we disable those tools?
No numbered live schedule
Public claim only
Privacy states processing is to provide the Services; live Client Data retention is not numbered. After termination, an administrative wind-down applies, then deletion may occur after about 90 days. User Data: 90 days after account close; billing about seven years.
Ask: State default retention for chats, uploads, embeddings, logs and backups while the subscription is live.
About 90 days after end
Public claim only
Privacy: StrongSuit may permanently delete remaining Client Data after subscription end or after an internal administrative period (e.g. 90 days), subject to legal hold. Terms: customer must export before the end of the subscription; StrongSuit may then delete with no obligation to retain.
Ask: Will you certify deletion of production, backups and provider logs within a stated period?
Support access
Public claim only
Privacy: employees do not monitor Client Data except (a) technical support requested by the customer, (b) legal/regulatory order, or (c) security/integrity investigations. Support access is framed as a confidential agent of the user.
Ask: Is support access ticket-scoped, logged and time-limited, and can we forbid it?
Shared logins prohibited
Public claim only
Terms: do not share credentials, including within the same organisation; user is responsible for all activity under the account. Firm plan markets user-access management. SSO/SCIM/MFA are not described on pages reviewed.
Ask: Is SSO/MFA/SCIM available on Firm, and can we enforce unique named users?
TLS and at-rest encryption
Public claim only
Privacy: Client Data encrypted at rest using industry-standard protocols and in transit over the public internet (TLS/SSL). Algorithms and key management (including customer-managed keys) are not specified.
Ask: Confirm algorithms, key custody and whether BYOK is offered.
SOC 2 Type II claim
Public claim only
Home page displays a SOC 2 Type II image. Pricing includes 'SOC 2 Type II' as a bullet. No report date, Type I versus II letter, or ISO 27001/42001 claim was inspectable. No DPA URL was found.
Ask: Provide the current SOC 2 Type II report under NDA and state whether ISO 27001 is in scope.
Delaware AAA Terms; no public DPA
Public claim only
Self-serve Terms: Delaware law; AAA commercial arbitration in Delaware; class-action waiver; liability cap of fees in the prior 12 months; as-is warranties; customer hold-harmless for output errors. Privacy is a processor statement for Client Data, not a signed DPA. MSA/SOW, if any, controls.
Ask: Will you sign our DPA with APP 8, 72-hour notice, audit rights and Australian law, or must we accept these Terms?
US-only storage
Public claim only
Privacy: all Client Data stored exclusively in the United States. Inference via US-headquartered LLM providers in a private tenant. No SCCs or Australian APP 8 wording was found.
Ask: List every country of storage and inference and the transfer mechanism that would bind Australian personal information.
No published SLA
Not confirmed
Privacy and Terms do not state a customer-notification period for a security incident. No 72-hour commitment was found on pages reviewed.
Ask: Commit in writing to notify us within 72 hours of a confirmed incident affecting our data.
Posted updates; continued use
Public claim only
Terms may be changed by posting; continued use is acceptance. Privacy: updates posted with a new date; email notice in some cases. No advance subprocessor-change notice was found.
Ask: Will you give 30 days' written notice of material term or subprocessor changes, with a right to terminate?
Customer must export first
Public claim only
Terms: customer is responsible for exporting User Content before the end of the subscription; StrongSuit may then delete and has no obligation to retain. Privacy: about 90-day administrative deletion. No certified-deletion form was published.
Ask: What export formats are available, and will you certify deletion of production and backups?
Word add-in; LLM APIs
Public claim only
Word add-in is in Terms and pricing. LLM traffic is routed to OpenAI, Anthropic and Google APIs. No other DMS/email connectors were named.
Ask: List every connector that can receive matter text and how we disable them.
Web search not described
Not confirmed
Pages reviewed describe retrieval-grounded legal research against a case database, not open-web search. Whether the assistant can browse the public internet was not stated.
Ask: Can the assistant perform open-web search, and can we disable it for matter work?
No agentic tool-use described
Not confirmed
Product is described as research, drafting, redline and discovery inside the platform and Word. No outbound email/send or third-party write actions were documented.
Ask: Confirm the product cannot send email, file documents or write to third-party systems without a human step.
User must verify output
Public claim only
Terms: user is solely responsible for reviewing, verifying and editing work before relying on it; output may contain errors; hold-harmless for errors or omissions. Home: lawyer in the loop. No in-product mandatory review gate was described.
Ask: Is there an in-product acknowledgement before export, or is review left to firm policy?