---
title: "Case360 (Case360 (no company name, ABN or ACN published on any page read))"
url: "https://ailawframework.com/software/case360"
type: "software_profile"
site: "AI Law Framework"
id: "case360"
vendor: "Case360 (no company name, ABN or ACN published on any page read)"
category: "Legal-specific"
segment: "Practice management"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# Case360 (Case360 (no company name, ABN or ACN published on any page read))

> Workplace investigation case management sold to Australian HR teams, investigation firms and employment law firms, with document summarisation, evidence-to-allegation analysis, transcription and report generation the…

Canonical page: https://ailawframework.com/software/case360  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The Case360 web app on its four published plans (Solo, Starter, Professional, Enterprise), with all AI features metered by credits. HRIS integration and SAML SSO/SCIM are Professional and Enterprise only and need separate review.

Workplace investigation case management sold to Australian HR teams, investigation firms and employment law firms, with document summarisation, evidence-to-allegation analysis, transcription and report generation the vendor labels advisory.

## Capabilities

- Matter management
- Document summarisation
- Data extraction
- Document classification
- Chronology building
- Document automation
- Correspondence and document drafting
- Transcription
- Redaction
- Practice analytics

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia |
| Australian region | Yes |
| Model providers | Google Vertex AI |
| Training on customer content | Improvement stated, training not addressed |
| Retention | Terms clause 10: on termination data is retained 30 days then permanently deleted. Privacy Policy clause 6: case data for the subscription plus 30 days after closure; audit logs 7 years; billing records 7 years. Features page: deleted records are soft-deleted to a recycle bin recoverable for 30 days. No retention period is published for backups, for AI outputs stored alongside documents, or for interview audio. |
| Integrations | SAP SuccessFactors (HRIS, Professional and Enterprise), Workday (HRIS, Professional and Enterprise), TechnologyOne (HRIS, Professional and Enterprise), Aurion (HRIS, Professional and Enterprise), SAML single sign-on (Professional and Enterprise), SCIM user provisioning (Professional and Enterprise), Stripe (billing), Resend (transactional email) |
| Legal content coverage | No legal content library, citator or legislative material is claimed. The pricing page states a generated final report contains 'per-allegation findings, Briginshaw analysis, and recommendations'; the source of that legal framing is not published. |
| Pricing | Four published plans in AUD inclusive of GST: Solo $33/mo or $390/yr (1 team member, 10 active cases, 5 GB, 100 AI credits), Starter $66/mo or $790/yr (5 members, 50 cases, 10 GB, 200 credits), Professional $249/mo or $2990/yr (25 members, 500 cases, 100 GB, 500 credits) and Enterprise on custom pricing (unlimited users and cases, 1024 GB, 1000 credits). The pricing page states every plan includes the full platform and that AI is on every plan 'metered by credits', publishing a credit price per AI action (document summary 1, interim report 5, final report from 10, Fact Find 10, Allegation Builder 10, Extract Responses 5, Cross-Evidence Analysis 10, interview transcription 3 per 15 minutes of audio). Credits reset monthly and do not roll over; purchased top-up packs do not expire; a daily per-organisation cap applies. Top-up pack prices are not published. 14-day free trial with no credit card, on the Professional plan per Terms clause 6. |
| Australian presence | Yes. No contracting entity, ABN or ACN is published on the features, pricing, Terms of Service, Privacy Policy or resources pages read on 2026-09-27; the footer reads '(c) 2026 Case360. Built for Australian workplace investigators.' and the only contacts are support@case360.com.au and privacy@case360.com.au. Terms clause 12 states the Terms are governed by the laws of New South Wales with exclusive jurisdiction in the NSW courts; clause 6 states billing is monthly in AUD inclusive of GST; clause 8 states all Customer Data is stored in Australia (Sydney region). The Privacy Policy states compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and names australia-southeast1 (Sydney), ap-southeast-2 (Sydney) and syd1 (Sydney) for the four infrastructure components and Vertex AI. No headquarters location is stated anywhere, so hqCountry is left null. Checked 2026-10-10. Vendor page: “All customer data is stored exclusively in Australia.” (https://www.case360.com.au/privacy). Recorded as hosted in Australia. |
| Website | https://www.case360.com.au/features |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plans covered | Public claim only | The pricing page publishes four plans in AUD inclusive of GST: Solo $33/mo (1 team member, 10 active cases, 100 AI credits), Starter $66/mo (5 members, 50 cases, 200 credits), Professional $249/mo (25 members, 500 cases, 500 credits) and Enterprise on custom pricing (unlimited users and cases, 1000 credits), each with an annual option. The page states 'Every plan includes the full platform' and that 'AI features are available on every plan, metered by credits', with HRIS integration and SAML SSO/SCIM added only on Professional and Enterprise. Terms clause 6 states trials are 14 days on the Professional plan. | Which plan and monthly AI credit allowance is on our order, what does a top-up credit pack cost, and what is the daily per-organisation fair-use cap the pricing page refers to? | [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms) |
| What the AI features do | Public claim only | The features page describes three AI tools: Document Intelligence, which 'Summarises uploaded documents in seconds', 'Assigns a risk ranking (Low / Medium / High / Critical) to each document', 'Extracts key facts, dates, and names automatically' and 'Supports PDFs, Word docs, images, audio and video transcripts'; AI Fact Find, which takes 'your allegations, all uploaded evidence, your running sheet, and task notes' and returns a per-allegation analysis that 'Clearly marks evidence as Supporting, Disputing, Neutral, or Not yet tested' and 'Flags gaps'; and One-Click Report Generation producing interim and final reports from templates, exported to .docx. The pricing page adds a credit price per AI action and names five further actions: Allegation Builder (10 credits, 'Reads selected documents and drafts suggested formal allegations grounded in specific dated events'), Extract Responses (5), Cross-Evidence Analysis (10, 'Maps every document against every allegation to surface contradictions between sources and flag unused evidence and gaps'), Interview Transcription (3 credits per 15 minutes, 'a diarised, timestamped verbatim transcript of an audio or video interview') and Interim (5) and Final (from 10) Report generation. Both pages are marketing pages; no model, retrieval design or accuracy evidence is published. | Demonstrate each of the eight credited AI actions on our own case file, and tell us what each one reads and what it writes back to the case record. | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing) |
| Deployment and hosting | Public claim only | Terms clause 2 states Case360 is 'a cloud-based workplace investigation case management platform' provided on subscription, and clause 3 that 'Each organisation receives an isolated subdomain and data environment'. Terms clause 8 states 'We store all Customer Data in Australia (Sydney region)'. The Privacy Policy clause 4 names the providers and regions: Firestore database and GCS file storage on Google Cloud Platform 'australia-southeast1 (Sydney)', authentication on Supabase 'ap-southeast-2 (Sydney)', application hosting on Vercel 'syd1 (Sydney)', and states 'AI analysis features use Google Vertex AI in australia-southeast1 (Sydney)'. No on-premises, private-cloud or self-hosted option appears on any page read. Checked 2026-10-10. Vendor page: “All customer data is stored exclusively in Australia.” (https://www.case360.com.au/privacy). Recorded as hosted in Australia. | Confirm in writing that backups and any disaster-recovery copies also sit in australia-southeast1, and whether an isolated or single-tenant deployment is available on Enterprise. | [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Jurisdiction and legal context | Public claim only | Terms clause 12 states the Terms 'are governed by the laws of New South Wales, Australia' with exclusive jurisdiction in the NSW courts, and clause 11 preserves rights under the Australian Consumer Law. The Privacy Policy states Case360 is committed to protecting personal information 'in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)'. The product is presented for Australian workplace investigations, and the pricing page states the Final Report output includes 'per-allegation findings, Briginshaw analysis, and recommendations'. No primary-law library, citator or legislative content is claimed anywhere on the pages read. | What legal source material, if any, sits behind the Briginshaw analysis in a generated final report, and who reviewed that wording? | [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Licence, data ownership and billing | Public claim only | Terms clause 5 states 'You retain full ownership of all data you upload or create within the Service' and 'We do not claim any intellectual property rights over Customer Data', processing it 'only as necessary to provide the Service and as described in our Privacy Policy'. Clause 6 states subscriptions are billed monthly in AUD inclusive of GST, renew automatically unless cancelled, that no refunds are given for partial billing periods, and that failed payments are retried for 7 days before suspension. Clause 4 prohibits using the Service 'to store or process information that you do not have the right to use'. Clause 11 caps total liability at the fees paid in the preceding 12 months. | Does the customer own the AI-generated output (summaries, risk rankings, Fact Find analyses and drafted allegations) on the same terms as uploaded Customer Data, and is that stated anywhere? | [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms) |
| Integrations and identity | Public claim only | The features page states HRIS integration is a 'Pro & Enterprise' capability covering 'SAP SuccessFactors, Workday, TechnologyOne and Aurion (more on request)', that it 'Pulls name, contact, department, position, business unit, branch, location, start date and manager', that each case 'keeps the reporting line as at intake' as a point-in-time snapshot, and that it 'Connects directly to your own HR tenant, so employee data never leaves your region'. The same tiers add 'SAML single sign-on (SSO) + SCIM'. The Privacy Policy names Stripe for billing and Resend for transactional email. No API, Microsoft 365, SharePoint or Outlook integration appears on any page read, although the vendor's own buyer guide lists Microsoft 365 integration and export capability among the things to look for. | Is there a documented API, and does the HRIS connector write anything back to our HR system or read only? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy); [Case360 - Workplace Investigation Software: What HR Teams Actually Need (vendor guide, dated 15 June 2025)](https://www.case360.com.au/resources/workplace-investigation-software-australia) |
| Support and service levels | Public claim only | Terms clause 7 states 'We target 99.5% monthly uptime', that scheduled maintenance is communicated at least 24 hours in advance, and that the vendor is 'not liable for downtime caused by third-party infrastructure providers or events outside our reasonable control'. The pricing page lists 'Priority support + SLA' only on the Enterprise plan. The only support channel published is the email address support@case360.com.au. No status page, support hours or response targets appear on any page read. | What are the support hours, response targets and escalation path on our plan, and is the 99.5% uptime target backed by a service credit? | [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms) |
| Check for vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. A filtered site map returned 12 URLs and none is an /llms.txt, /ai-info, /ai or /for-ai path. The five pages read in full - features, pricing, Terms of Service, Privacy Policy and the resources guide 'Workplace Investigation Software: What HR Teams Actually Need' - contain no block addressed to AI models, assistants, crawlers or 'LLMs', and no 'Instructions for AI Assistants' heading. The resources guide is a buyer's checklist: it names no competitor product and answers no comparative or superlative question about Case360, so no vendor self-ranking was found either. A filtered map is not a complete crawl, so this records an absence across the URL set and pages read rather than proof that no such file exists. | Do you publish any page, file or metadata that tells AI assistants or crawlers how to describe Case360, and do you maintain an llms.txt or equivalent? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy); [Case360 - Workplace Investigation Software: What HR Teams Actually Need (vendor guide, dated 15 June 2025)](https://www.case360.com.au/resources/workplace-investigation-software-australia) |
| Authority to put case and third-party data into the tool | Public claim only | The Terms place the authority burden on the customer: clause 1 requires whoever accepts to have authority to bind the organisation, and clause 4 prohibits using the Service 'to store or process information that you do not have the right to use' or to 'Attempt to access another organisation's data'. Clause 3 states each organisation receives an isolated subdomain and data environment and makes the customer responsible for credential security. The Privacy Policy clause 2 records that the case data collected includes 'names, contact details, and information about individuals involved in workplace investigations entered by you or your team' - that is, personal information about complainants, subjects and witnesses who are not the contracting party. Nothing in the Terms or Privacy Policy addresses the customer's notification or consent obligations to those individuals. | What do you expect a customer to have told a complainant, subject or witness before their statement is uploaded and run through AI Fact Find, and is that expectation written down anywhere? | [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Model and model provider | Public claim only | The Privacy Policy clause 4 states 'AI analysis features use Google Vertex AI in australia-southeast1 (Sydney)' and that 'Document content processed for AI analysis is not retained by Google beyond the scope of the individual API call'. No model family, model name or version is published, and the features page names no provider at all, stating only that 'All AI runs in Australia (Sydney), so case data never leaves the country'. Whether the same model serves all eight credited AI actions, including interview transcription, is not published. | Which Vertex AI models serve each AI action including transcription, are any of them preview models, and will we be told in advance if a model is changed? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Subprocessors | Public claim only | The Privacy Policy publishes the provider set rather than a standing subprocessor page: clause 4 names Google Cloud Platform (Firestore and GCS, australia-southeast1), Supabase (ap-southeast-2), Vercel (syd1) and Google Vertex AI (australia-southeast1); clause 5 states disclosure may be made to 'Our infrastructure providers (Google Cloud, Supabase, Vercel, Stripe, Resend) solely to deliver the service'. No region is published for Stripe or Resend. There is no subprocessor change-notification commitment; the only change commitment is 30 days' notice of material changes to the policy itself (clause 11). | In which country do Stripe and Resend process our data, and will you notify us before adding or replacing any of the six named providers? | [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Use of customer content for training | Public claim only | The Privacy Policy clause 4 states 'Document content processed for AI analysis is not retained by Google beyond the scope of the individual API call'. Clause 3 lists the uses of collected information, the first being 'To provide and improve the Case360 platform', and clause 2 records that usage data is collected 'for security and product improvement purposes'. Neither the Privacy Policy nor the Terms says whether Case360 itself uses customer case content, AI prompts or AI outputs to train, tune or evaluate models. Terms clause 5 limits processing to what is 'necessary to provide the Service and as described in our Privacy Policy'. | Will you warrant that Case360 does not use our case documents, AI prompts or AI outputs to train, fine-tune or evaluate any model, and does 'improve the platform' extend to that? | [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Use of feedback, corrections and ratings | Not confirmed | Nothing on the five pages read describes a feedback, rating or correction mechanism on AI output, or what happens to a correction. The features page states summaries 'are stored alongside the document for your whole team' and the pricing page states Extract Responses 'Never overwrites; you review and edit inline', but neither says whether an edit, an acceptance or a rejection of AI output is captured as a signal or used beyond the tenancy. | When an investigator edits or rejects an AI summary, a risk ranking or a drafted allegation, is that recorded as a signal, and is it used outside our tenancy? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing) |
| Retention | Public claim only | Terms clause 10 states 'Upon termination, your data is retained for 30 days then permanently deleted'. Privacy Policy clause 6 states case data is retained for the duration of the subscription and for 30 days after account closure, then permanently deleted, that 'Audit logs are retained for 7 years in compliance with Australian Privacy Principles', and that billing records are retained for 7 years 'as required by Australian tax law'. The features page states deleted records are soft-deleted to a recycle bin and recoverable for 30 days before permanent removal. No retention period is published for backups, for AI outputs stored alongside documents, or for interview audio. | How long are backups kept, and are AI summaries, Fact Find analyses and interview audio deleted on the same 30-day clock as the case record? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Deletion and destruction | Public claim only | Terms clause 10 and Privacy Policy clause 6 both state that data is permanently deleted 30 days after termination or account closure. Privacy Policy clause 8 gives individuals a right to 'Request deletion of your personal information (subject to legal retention requirements)'. The features page states deleted records sit in a 30-day recycle bin. The 7-year audit log retention in clause 6 is not reconciled with the deletion right, and the features page states that summaries are stored alongside the document and that every PII reveal is written to the audit log, so AI output and reveal events persist in records with a longer stated retention. | If an individual exercises the APP deletion right, what happens to the 7-year audit log entries and to the AI summaries stored alongside their documents, and will you certify destruction? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Vendor personnel access to customer data | Not confirmed | Nothing on the five pages read states whether Case360 personnel can read customer case data, under what conditions, whether such access is logged, or whether the customer is notified. Privacy Policy clause 7 lists 'multi-tenant data isolation, role-based access controls, and short-lived signed URLs for file access (15-minute expiry)', and the features page states field-level masking is 'Enforced server-side, and every reveal is audited', but both describe controls over customer users rather than vendor staff. No background-check, confidentiality-undertaking or break-glass statement appears. | Under what circumstances can Case360 staff or contractors open a case file, is that access written to the same audit log the customer can download, and are staff background-checked? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Access control and authentication | Public claim only | The features page states three roles - 'Admin, Lead Investigator, Investigator' - 'with granular permissions', field-level masking of 'names, contact details, dates of birth and more' with 'Role-based access or reveal-on-demand: you choose per organisation' and every reveal written to the audit log, and 'SAML single sign-on with your identity provider and automated user provisioning' which the pricing page confines to Professional and Enterprise. Privacy Policy clause 7 adds short-lived signed URLs with a 15-minute expiry for file access. Multi-factor authentication is not mentioned on any page read, and no page states whether the three roles can be restricted from invoking AI features. | Is multi-factor authentication available on the Solo and Starter plans where SAML SSO is not included, and can a role be prevented from running Fact Find or Cross-Evidence Analysis? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Encryption | Public claim only | Terms clause 8 states 'We implement industry-standard security measures including encryption in transit and at rest, access controls, and regular security reviews'. Privacy Policy clause 7 is more specific: 'TLS encryption in transit, AES-256 encryption at rest, multi-tenant data isolation, role-based access controls, and short-lived signed URLs for file access (15-minute expiry)'. The features page states files are 'stored in encrypted cloud storage on Australian shores' with 'Time-limited signed URLs, no permanent public links'. No statement addresses key management, customer-managed keys, or whether the chain-of-custody hash is separately protected. | Who holds and rotates the encryption keys, are customer-managed keys available on Enterprise, and what algorithm produces the chain-of-custody hash? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Independent assurance and certification | Not confirmed | No certification or independent assessment is claimed anywhere on the five pages read. There is no SOC 2, ISO 27001, ISO/IEC 42001 or IRAP claim, no trust centre, no penetration-test statement and no certificate. Terms clause 8 refers only to 'regular security reviews'; the features page has a 'Security & Compliance' section but it is part of the marketing features page and cites no external assessment. The features page states Australian data residency 'Meets government and enterprise data sovereignty requirements' without naming a framework or assessor. | Has any independent assessor reviewed Case360, and can you provide a SOC 2 report, an ISO 27001 certificate or a recent penetration-test summary, plus the basis for the statement that residency 'meets government and enterprise data sovereignty requirements'? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms) |
| Contracting and documents | Public claim only | The only contractual document published is a Terms of Service last updated 13 April 2026, accepted by creating an account (clause 1), with 14 clauses, NSW governing law and liability capped at 12 months' fees. There is no master services agreement, no order form, no data processing agreement, no acceptable-use schedule and no AI-specific addendum on the site or in the mapped URL set. No company name, ABN or ACN appears on any page read: the footer reads '(c) 2026 Case360. Built for Australian workplace investigators.' and the only contacts published are support@case360.com.au and privacy@case360.com.au. | Which legal entity contracts with us, what is its ABN or ACN, and can Enterprise be bought on a negotiated agreement with a data processing agreement rather than the click-through Terms? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Cross-border transfers | Public claim only | Terms clause 8 states 'We store all Customer Data in Australia (Sydney region)'. Privacy Policy clause 4 states 'All customer data is stored exclusively in Australia' and names an Australian region for each component, including 'AI analysis features use Google Vertex AI in australia-southeast1 (Sydney)'. The features page states 'All AI runs in Australia (Sydney), so case data never leaves the country'. Clause 5 permits disclosure to the six named infrastructure providers and to 'Successors in the event of a business transfer'; no region is published for Stripe or Resend, and nothing addresses whether support or administration is performed from outside Australia. | Do Stripe and Resend process any personal information outside Australia, and is all support, administration and engineering access to our tenancy performed from within Australia? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Incident and breach notification | Not confirmed | No incident-response or breach-notification commitment appears on any of the five pages read. The Terms are silent on security incidents. The Privacy Policy refers to a right to 'Make a complaint to the Office of the Australian Information Commissioner (OAIC)' but sets out no notification process, window or channel for a data breach, and does not mention the Notifiable Data Breaches scheme. There is no status page and no security contact other than the general support and privacy addresses. | What is your contractual notification window and channel for a suspected eligible data breach affecting our case data, who notifies affected complainants, subjects and witnesses, and who bears that cost? | [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Change notice | Public claim only | Terms clause 13 states 'We may update these Terms from time to time. We will notify you of material changes via email at least 30 days before they take effect', and Privacy Policy clause 11 gives the same 30-day commitment for material policy changes. Neither document extends that notice to changes in the product: nothing addresses notice before a change to the AI credit costs published on the pricing page, to the credit allowance on a plan, to the Vertex AI model behind a feature, or to the risk-ranking scale and evidence labels that appear in case records. | Does the 30-day notice cover a change to AI credit prices, to a plan's credit allowance, and to the model or provider behind an AI feature? | [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Exit and data portability | Not confirmed | Terms clause 10 lets the customer cancel from the Billing page effective at the end of the billing period, after which data is retained 30 days then permanently deleted. The only export mechanisms published are report export to .docx (features and pricing pages) and a 'Downloadable audit log for legal proceedings' (features page). No bulk export of the case record, documents, version history, chain-of-custody hashes or AI outputs is described, and no API is published. The vendor's own buyer guide raises the point, stating 'Avoid software that locks your investigation data in a proprietary format with no export path' and listing export to PDF or CSV among the capabilities to look for. | What bulk export exists for the complete case record - documents, every version, chain-of-custody hashes, audit log and AI outputs - in what format, and can it be obtained inside the 30-day post-termination window? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms); [Case360 - Workplace Investigation Software: What HR Teams Actually Need (vendor guide, dated 15 June 2025)](https://www.case360.com.au/resources/workplace-investigation-software-australia) |
| Connectors and data flows out of the platform | Public claim only | The published connectors are the HRIS integrations on Professional and Enterprise (SAP SuccessFactors, Workday, TechnologyOne, Aurion, 'more on request'), SAML SSO with SCIM on the same tiers, Stripe for billing and Resend for transactional email. The features page also describes 'External Requests': a witness or subject receives 'a secure, token-based link' and can respond and upload documents with 'No account needed', and document access uses 'Time-limited download links'. No API, webhook, Microsoft 365 or cloud-storage connector appears on any page read. | Where does an external request link send data, how long is the token valid, and can an uploaded response be processed by AI before an investigator has seen it? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| Retrieval outside the tenancy | Not confirmed | Nothing on the five pages read states whether any AI feature retrieves information from outside the case file. The AI tools are described as operating on material inside the case - uploaded evidence, the running sheet, task notes and allegations - and the features page states 'All AI runs in Australia (Sydney), so case data never leaves the country', but no page says whether a request reaches any endpoint other than Vertex AI, or whether the Briginshaw analysis in a generated final report draws on any external source. | Does any AI feature call an endpoint other than Vertex AI in australia-southeast1, for example for web retrieval, case-law lookup or transcription, and can that be disabled? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) |
| What the AI can change in the case record | Public claim only | The vendor describes the AI as invoked by the user and constrained in what it writes. The features page states of AI Fact Find that 'Output is advisory only, clearly labelled, and your findings remain yours'. The pricing page repeats this per action: Fact Find is 'Advisory only. Does not alter your case'; Allegation Builder is 'Advisory only. You review and accept each one'; Extract Responses 'appends what they said about each recorded event to that event's response field, routed by their role. Never overwrites; you review and edit inline'. Document Intelligence assigns a risk ranking to each document and stores the summary alongside it. Escalation rules are described as rules that flag overdue tasks and stalled cases, not as AI. | Which AI actions write to the case record without a user accepting each change - Extract Responses appends and Document Intelligence stores a risk ranking - and can that be turned off per role or case type? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing) |
| Human review and the limits placed on the AI | Public claim only | The features page states 'Case360's AI reads documents, identifies relevant facts, and organises evidence against each allegation. It never draws conclusions, assigns blame, or makes findings. Every analysis is clearly labelled advisory. The investigator reviews, interprets, and decides.' The page heading is 'AI that helps investigators find the facts. Not make the decisions.' and the AI features section is headed 'Intelligent analysis. Human judgment.' These statements appear only on the marketing features page and on the pricing page; the Terms of Service and Privacy Policy do not mention AI, advisory labelling or findings at all. | Is the statement that the AI 'never draws conclusions, assigns blame, or makes findings' warranted in our agreement, or is it a product description you can change without the 30-day notice in clause 13? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms) |
| Published evidence of quality | Not confirmed | No accuracy figure, evaluation, benchmark, error rate, sample output or independent review is published on any of the five pages read. The risk-ranking scale (Low / Medium / High / Critical) and the evidence labels (Supporting, Disputing, Neutral, Not yet tested) are published as outputs without any statement of how a label is derived or validated, and the Fact Find screenshot caption refers to 'confidence levels' that no text explains. The vendor's own buyer guide raises the question, stating that 'The key question is whether the AI is configured to understand Australian employment law context' without answering it for Case360. | What evaluation has been run on Fact Find's evidence labels and the document risk ranking, on what data, and what is the observed rate of mislabelled evidence? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing); [Case360 - Workplace Investigation Software: What HR Teams Actually Need (vendor guide, dated 15 June 2025)](https://www.case360.com.au/resources/workplace-investigation-software-australia) |
| Tasks the vendor says it is for | Public claim only | The features page names three buyer groups and the tasks for each: HR professionals managing a complaint through 'interviews, evidence, confidentiality, and board updates'; workplace investigation firms running concurrent matters where 'AI Fact Find maps evidence to allegations'; and employment law firms who 'advise on whether investigations were procedurally sound, or to conduct them yourself', for whom the page states 'Allegations module maps directly to legal elements' and 'AI analysis clearly labelled advisory, which maintains your professional independence'. The pricing page states a final report contains 'per-allegation findings, Briginshaw analysis, and recommendations'. | For an employment law firm, what does 'maps directly to legal elements' mean in practice, and does the generated final report apply the Briginshaw standard or merely use the term? | [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features); [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing) |

## Notes

Five vendor pages were read on 2026-09-27: features, pricing, Terms of Service (13 April 2026), Privacy Policy (13 April 2026) and one resources guide. What could not be verified: the contracting entity, ABN or ACN (none is published anywhere on the site, and there is no About page in the mapped URL set); any independent assurance (no SOC 2, ISO 27001 or IRAP claim exists, and there is no trust centre); vendor personnel access to case data; breach notification; feedback handling; whether any AI feature reaches an endpoint other than Vertex AI; backup retention and location; and the region in which Stripe and Resend process data. There is no data processing agreement and no negotiated agreement published - the only contract is a click-through Terms of Service. Two things recorded here are not on the features page and were found only on the pricing page: interview transcription as a paid AI action, and Allegation Builder and Cross-Evidence Analysis as separate AI actions; the capability list reflects the pricing page. The 'segment' value is the closest available: the controlled SEGMENT list has no workplace-investigations value, and the CAPABILITY list has no value for mapping a corpus of evidence to a set of allegations and reporting gaps, which is what AI Fact Find and Cross-Evidence Analysis do; document-classification is used as the closest defensible value and the gap is reported to the Maestro. The pricing model is recorded as per_seat because the plans step up with team-member count, but the published structure is a tiered plan plus metered AI credits, which no PRICING_MODEL value expresses.

## Sources

- [Case360 - Product Features (AI Features, Security & Compliance sections)](https://www.case360.com.au/features) (checked 2026-09-27)
- [Case360 - Pricing (four plans and the published AI credit schedule)](https://www.case360.com.au/pricing) (checked 2026-09-27)
- [Case360 - Terms of Service (last updated 13 April 2026)](https://www.case360.com.au/terms) (checked 2026-09-27)
- [Case360 - Privacy Policy (last updated 13 April 2026, includes data residency and infrastructure providers)](https://www.case360.com.au/privacy) (checked 2026-09-27)
- [Case360 - Workplace Investigation Software: What HR Teams Actually Need (vendor guide, dated 15 June 2025)](https://www.case360.com.au/resources/workplace-investigation-software-australia) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.