Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Checked 2026-09-27. The product is the casechat.au web application, whose home page is the AI chat itself and whose first navigation item is 'Try AI'. One prompt is available without an account, after which the interface states 'You've used your free AI prompt! Log in or sign up to continue with CaseChat AI and unlock unlimited access.' No plan names, tiers or module list are published; /pricing returns HTTP 404.
Ask: Which named plan or tier would our firm be contracting for, and what does a registered account include compared with a paid subscription?
Deployment model
Public claim only
Checked 2026-09-27. Access is through the hosted web application at casechat.au with account registration at /register and login at /login. The Privacy Policy states 'Website data is hosted at third party cloud hosting providers' without naming a provider or a country. No on-premises, private-cloud or self-hosted option is published anywhere on the site.
Ask: Is a private-tenancy, single-tenant or on-premises deployment available, and if not, which cloud provider and which region hosts the tenancy our firm would use?
AI features in scope
Public claim only
Checked 2026-09-27. The interface publishes: jurisdiction filters (Commonwealth, NSW, Vic, Qld, WA, SA, Tas, ACT, NT); date-range filters including 'Since Federation (1901)' and 'Since Australia Act (1986)'; a prompt-rewriting control ('Original Prompt' / 'Optimized Prompt' / 'Re-optimize'); two answer modes labelled 'Explain' and 'Answer'; document upload with a 'Document context active' state and the invitation 'Drop in a contract or memo and ask anything about it'; suggested follow-ups; a 'Was this helpful?' control; and source panels headed 'MOST RELEVANT PASSAGE' with 'Read full text' and 'Access Full Text' links. Progress strings shown while a query runs are 'Searching Australian cases and statutes', 'Analysing precedents and principles', 'Linking to legal citations' and 'Preparing authoritative case law references'; the answer is headed 'Generated Analysis'. The word 'authoritative' is the vendor's interface wording and is recorded here as a quotation, not adopted.
Ask: Which of these controls are available to a paid account, and what does the 'Optimized Prompt' control change about the text that is sent for generation?
Jurisdictions and legal content
Public claim only
Checked 2026-09-27. The site navigation publishes Australian cases by jurisdiction (Commonwealth, NSW, Vic, Qld, WA, SA, Tas, ACT, NT) plus United Kingdom and New Zealand cases, and Australian and United Kingdom legislation. The sitemap index lists 39 files, including au-cases-1 to au-cases-14, uk-cases-1, nz-cases-1 to nz-cases-2, au-legislation-1 to au-legislation-3 and uk-legislation-1, together with ai-cases-1 to ai-cases-14 and au-ai-legislation-1 to au-ai-legislation-3 holding per-item '?tab=summary' URLs. Two files were counted: au-cases-1.xml and au-legislation-1.xml each hold 47,000 <loc> entries; the remaining files were not counted, so no corpus total is asserted. The home page subhead is 'AGLC ready Commonwealth and State laws backing every AI answer.'
Ask: Which court and tribunal series, and which legislation series, are included for each jurisdiction, from which source, and how often is each refreshed?
Intended users and stated limits on use
Public claim only
Checked 2026-09-27. Terms of Service clause 1 states the product 'provides artificial intelligence (AI)-powered legal research tools designed to assist Australian barristers, solicitors, and law students' and that responses are 'made available for research, study, reporting of judicial proceedings, and to support the provision of professional legal advice'. Clause 2 limits eligibility to individuals 'engaged in or studying Australian law' who are at least 18. Clause 1 also states 'CaseChat is not a law firm and does not provide legal advice' and makes 'no representations or warranties as to the accuracy or effectiveness of AI-generated responses'. Output carries the on-screen line 'General information only — not a substitute for advice from a qualified lawyer.'
Ask: Does the licence permit use by a firm as an organisation, including accounts held in the firm's name, or is it limited to individual practitioners?
Check for vendor content directing how AI describes the product
Public claim only
A deliberate check was made on 2026-09-27 and no content directing AI models, assistants or LLMs how to describe the product was found. /llms.txt, /ai-info, /ai, /for-ai and /about all return HTTP 404; a firecrawl map of the site returned 60 URLs, all case pages; the sitemap index's main.xml lists only /, /cases, /legislation, /blog, /login, /register and jurisdiction filter URLs; and the scraped home page contains no 'Instructions for AI Assistants' heading or equivalent block. robots.txt exists and contains crawler access-control directives only, with no AI- or LLM-specific user-agent group: it disallows ia_archiver entirely, and for 'User-agent: *' disallows /admin/, /cdn-cgi/, /export/Kase/, /export/Legislation/, /_debugbar/*, /filament/*, /dashboard and similar paths, together with approximately 70 individually named /cases/ judgment URLs. The blog at /blog returns HTTP 200 and was not read.
Ask: Does the vendor publish, anywhere outside the pages checked, guidance to AI models or crawlers on how the product should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the tool
Public claim only
Checked 2026-09-27. Terms of Service clause 4 defines 'Client Data' as 'any documents, text, queries, or other content you upload or input into CaseChat' and states 'You are responsible for ensuring that you have the right to upload and use any Client Data, including content containing personal, sensitive, or confidential information.' Clause 5 prohibits use of the product to 'breach professional confidentiality obligations or court orders'. The obligation therefore sits entirely with the user; the Terms give no assurance about how Client Data is handled after upload.
Ask: What happens to an uploaded document after the conversation ends: is it retained, indexed, or available to the vendor's personnel, and can our firm obtain that in writing?
Model and model provider
Not confirmed
Checked 2026-09-27. No model, model family or model provider is named on the home page, in the Terms of Service, in the Privacy Policy or in the site's published navigation. The Terms refer only to the vendor's own 'software, design, algorithms, models, and branding' in the intellectual-property clause. No subprocessor list is published, so the provider performing generation is not established.
Ask: Which model and which model provider generate the 'Generated Analysis' output, and will we be notified in writing before that provider changes?
Subprocessors and where they sit
Not confirmed
Checked 2026-09-27. No subprocessor list is published and no page at a /subprocessors or trust-centre path was found. The Privacy Policy states only 'Website data is hosted at third party cloud hosting providers. All third parties are contractually required to maintain confidentiality and data security.' No provider is named and no country is given. The Terms of Service do not name any third party.
Ask: Provide the full subprocessor list for the product, including the hosting provider, the inference provider and their processing locations, with a commitment to notify us of changes.
Training on customer content
Not confirmed
Checked 2026-09-27. Neither the Terms of Service nor the Privacy Policy states whether prompts, uploaded documents or outputs are used to train or improve any model. The Privacy Policy lists 'Improving our services and user experience' among the purposes for which personal information is used, and does not say whether Client Data as defined in Terms clause 4 falls within that purpose. The only training statement found runs the other way: Terms clause 5 prohibits the user from using the product to 'develop or train competing AI systems'.
Ask: Will the vendor warrant in our agreement that prompts, uploaded documents and outputs are not used to train or fine-tune any model, including by any downstream provider?
Feedback and thumbs-up data
Not confirmed
Checked 2026-09-27. The interface publishes a 'Was this helpful?' control that returns 'Thanks for the feedback'. Neither the Terms of Service nor the Privacy Policy says what is captured when that control is used, whether the prompt and output are stored with the rating, how long the record is kept, or whether it is used for model improvement.
Ask: When a user presses 'Was this helpful?', is the prompt, the uploaded document and the generated answer stored with the rating, and who can read it?
Retention periods
Public claim only
Checked 2026-09-27. The Privacy Policy states 'Personal information is retained only as long as necessary to provide CaseChat's services or comply with legal obligations', with no period given. It also states that unsolicited personal information the vendor is not permitted to retain 'will be securely destroyed or de-identified as soon as practicable'. Neither document states any retention period for Client Data as defined in Terms clause 4, for conversation histories or for uploaded documents.
Ask: State the retention period for conversation history and for uploaded documents, and whether a shorter or zero-retention setting is available to our firm.
Deletion on request and on exit
Not confirmed
Checked 2026-09-27. Neither the Terms of Service nor the Privacy Policy sets out a deletion right, a deletion process, a deletion timeframe, or what is deleted when an account is closed. The Privacy Policy contains no access-and-correction section and names no privacy contact other than the general support address support@casechat.au. Terms clause 12 allows the vendor to suspend or terminate access but says nothing about deleting the user's data on termination.
Ask: On written request, and on account closure, what is deleted, from which systems including backups, within what period, and will the vendor certify it?
Human access to customer content
Not confirmed
Checked 2026-09-27. Neither document states whether the vendor's personnel, contractors or any third party can read prompts, uploaded documents or generated answers, whether such access is logged, or whether it requires the user's approval. The Privacy Policy states that third parties with access to personal information 'are contractually required to maintain confidentiality and data security' but does not describe access by the vendor's own personnel.
Ask: Can the vendor's personnel or contractors read our prompts and uploaded documents, under what approval, and is that access logged and available to us?
Access control and authentication
Public claim only
Checked 2026-09-27. Terms of Service clause 11 lists 'secure authentication processes' and 'access controls' among the safeguards, and clause 3 places responsibility for credential confidentiality and for all activity under the account on the user. The Privacy Policy lists 'Secure authentication procedures' and 'Access controls and logging'. Neither document mentions single sign-on, multi-factor authentication, role-based permissions, firm-level administration or session controls, and the site publishes no administrator documentation.
Ask: Is single sign-on and enforced multi-factor authentication available, and can a firm administrator see and revoke user accounts and sessions?
Encryption in transit and at rest
Public claim only
Checked 2026-09-27. Terms of Service clause 11 states the vendor implements 'reasonable, industry-standard safeguards', listing 'encryption in transit and at rest', 'secure authentication processes', 'access controls' and 'regular security assessments', and adds 'no system is completely secure, and you acknowledge that risks remain.' The Privacy Policy lists 'Data encryption', 'SSL Certification', 'Intrusion monitoring' and 'Regular security tests'. No cipher, key-management arrangement or customer-managed-key option is described.
Ask: Confirm the encryption standard and key management for data at rest, and whether customer-managed keys are available.
Independent assurance and certification
Not confirmed
Checked 2026-09-27. No certification, audit report or assurance standard is named anywhere on the site: there is no security page, no trust centre and no compliance page, and neither the Terms of Service nor the Privacy Policy names SOC 2, ISO/IEC 27001, ISO/IEC 42001, IRAP or any other scheme. The Terms refer only to 'regular security assessments' and the Privacy Policy to 'Regular security tests', in each case without naming an assessor, a scope or a report.
Ask: Has any independent security assessment or certification been completed, and can the report or a letter of attestation be provided under non-disclosure?
Contracting party and contract terms
Public claim only
Checked 2026-09-27. The Terms of Service are a click-through agreement accepted by creating an account or using the product, and they name the counterparty only as 'CaseChat ("CaseChat", "we", "us", or "our")'. No company name, ACN, ABN, registered office or street address appears in the Terms, the Privacy Policy or on the home page, and /about returns HTTP 404; the only contact given is support@casechat.au. Clause 17 states the Terms 'are governed by the laws of Victoria, Australia' with 'the exclusive jurisdiction of the courts of Victoria'. Clause 14 limits total liability to 'the amount you paid to use CaseChat in the 12 months prior to the claim (if any)', and clause 15 requires the user to indemnify the vendor. No enterprise agreement, order form or data processing agreement is published.
Ask: Which legal entity, with which ACN or ABN and registered office, would contract with our firm, and will that entity sign an order form and a data processing agreement?
Overseas transfer and processing location
Not confirmed
Checked 2026-09-27. The Privacy Policy states 'Website data is hosted at third party cloud hosting providers' without naming a provider or a country, and contains no overseas-disclosure section of the kind Australian Privacy Principle 8 addresses. The Terms of Service do not state where data is processed. The .au domain and the choice of Victorian law in Terms clause 17 are not statements about where data is hosted, and no inference is drawn from them. Whether generation runs in Australia is therefore not established.
Ask: In which country is the tenancy hosted, in which country does model inference run, and will the vendor commit contractually to keeping both in Australia?
Incident and breach notification
Not confirmed
Checked 2026-09-27. Neither document contains a commitment by the vendor to notify users of a data breach, a notification timeframe, or a reference to the Notifiable Data Breaches scheme. The obligation runs the other way: Terms clause 3 requires the user to 'promptly notify us of any unauthorised access or suspected breach'. The Privacy Policy lists 'Intrusion monitoring' among its safeguards but describes no notification process.
Ask: Will the vendor commit in writing to notify our firm of any breach affecting our data within a stated number of hours, with a named contact?
Notice of change to the product and to the terms
Public claim only
Checked 2026-09-27. Terms of Service clause 16 states 'We may update these Terms from time to time. Updated versions will be posted on our website with a revised "Last Updated" date' and that continued use 'constitutes acceptance of any updated Terms'. Neither the Terms page nor the Privacy Policy page displayed any version number, effective date or 'Last Updated' date when read on 2026-09-27. Clause 7 allows the vendor to 'modify or improve features', perform maintenance affecting availability, or 'discontinue the service or any part of it with reasonable notice', and says advance notice of scheduled downtime is given 'where practicable'. The Privacy Policy states no change process of its own.
Ask: How will our firm be notified of a change to the Terms, to the Privacy Policy or to the underlying model, given no effective date is currently shown on either document?
Exit, export and continuity
Not confirmed
Checked 2026-09-27. No export, download or data-portability function is published, and no continuity or transition provision appears in the Terms of Service. Terms clause 5 lists 'take content from CaseChat' among prohibited uses, and clause 9 prohibits copying, reproducing, modifying or distributing any part of the platform except as permitted by law. Clause 12 allows the vendor to suspend or terminate access for breach, risk, legal requirement or non-payment, and clause 7 allows it to 'discontinue the service or any part of it with reasonable notice'. What a firm may retain of its own conversation history or uploaded documents on exit is therefore something the firm must settle before use.
Ask: On exit, in what format can our firm export its conversation history and its uploaded documents, and does clause 5 prevent us retaining our own outputs?
Connectors to firm systems
Not confirmed
Checked 2026-09-27. No integration, connector, plug-in, add-in or application programming interface is published. The only route by which firm material enters the product is manual upload in the chat interface, described on the home page as 'Drop in a contract or memo and ask anything about it' with a 'Document context active' state and a 'Remove context' control. No document-management, practice-management or email integration is named.
Ask: Is any connector or API available to a document-management or practice-management system, and if so what does it read and write?
Retrieval scope and outbound web access
Public claim only
Checked 2026-09-27. The interface describes retrieval over the product's own corpora: the progress strings are 'Searching Australian cases and statutes' and 'Preparing authoritative case law references', and answers carry a 'MOST RELEVANT PASSAGE' panel with 'Read full text' and 'Access Full Text' links back into the site's case and legislation pages. No statement about searching the open web is published, and neither the Terms of Service nor the Privacy Policy addresses outbound requests to third-party sites during a query.
Ask: Does a query ever reach the open internet or any source outside the product's own case and legislation corpora, and can that be disabled?
Actions the tool can take
Not confirmed
Checked 2026-09-27. Nothing published describes the product taking an action outside the chat: no agent, no workflow execution, no writing to an external system, no sending of email and no scheduling. The published controls all sit inside the conversation, being filters, the 'Optimized Prompt' rewrite, the 'Explain' and 'Answer' modes, document context and follow-up suggestions. The absence of a published description is recorded here; it is not a statement that no such capability exists.
Ask: Can the product take any action outside the chat window, such as writing to a connected system or sending a message, and can that be switched off at firm level?
Human review of output
Public claim only
Checked 2026-09-27. Terms of Service clause 1 states users are 'strongly encouraged to independently verify all outputs, including citations and underlying legal materials, against authoritative sources such as Commonwealth and State courts and government publications' and that 'you are solely responsible for verifying all information'. Clause 6 records that outputs 'may be inaccurate, incomplete, or outdated', that the product 'does not provide legal advice', that the user 'must independently review and verify all generated content', and that the vendor 'is not responsible for any decisions made in reliance on such content'. Generated output carries the line 'General information only — not a substitute for advice from a qualified lawyer.' No supervision workflow, reviewer sign-off or audit record of review is published.
Ask: Does the product keep any record of which outputs a user reviewed or relied on that our firm could produce if a court asked how an output was checked?
