Legal-specific · Intake and client service · Medium confidence
Checkbox Operations Pty Ltd · Checkbox legal front-door SaaS (intake, matters, workflows, First Pass AI). Australian customers contract with Checkbox Operations Pty Ltd under the public MSA. US entity is separate.
Australian-origin in-house legal intake and workflow platform, now selling globally, with optional OpenAI features and a First Pass review agent.
Opens a private software assessment of Checkbox for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | Unknown |
| Australian region | On request |
| Model providers | OpenAI |
| Assurance | SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 |
| Training on customer content | No |
| Retention summary | MSA: 90 days after termination for customer export, then deletion; written certification within 30 days if requested during the Retention Period. DPA Annex: personal data retained for the licence term until 30 days after termination unless earlier deletion is requested. AI Model Providers must not retain except as required by law or abuse-prevention. |
| Integrations | Ironclad (partnership), SendGrid (workflow email) |
| Pricing summary | Fees on an Order. No public list price. No termination for convenience. Material MSA changes apply only at the next renewal after 30 days' notice. |
| Legal content coverage | Customer requests, matters, contracts and invoices captured in workflows. First Pass is a context-aware review agent. No licensed Australian primary-law library. |
| Australian presence | Yes — AU customers contract with Checkbox Operations Pty Ltd, 5/24 Campbell Street, Haymarket NSW 2000; NSW law and courts. Privacy: primarily stored in the data-centre region the customer requests. Home page shows Telstra and Xero logos. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Public MSA plus Order. AI Technology is optional and customer-enabled. First Pass (16 September 2026) is a review agent for requests, contracts and invoices. Historic customer-agreement versions are archived on /legal/.
Ask: Confirm our Order includes First Pass/AI, which MSA version applies, and whether any older customer agreement still governs.
Public claim only
SaaS hosted on Amazon Web Services (DPA Annex III). Privacy: primarily stored in the region the customer requests, with possible onward disclosure to other locations. No on-premises option was found.
Ask: Will our tenant, backups, logs and First Pass indexes sit only in an Australian AWS region?
Public claim only
Intake FAQ: OpenAI LLMs for optional AI features. First Pass reviews contracts, invoices and incoming requests, files to open matters and routes by plain-language guidelines. Workflow automation and self-service tools exist without AI.
Ask: Which AI/First Pass features will be enabled, and can we keep OpenAI off for nominated workflows?
Public claim only
Content is the customer's requests and documents, not a licensed case-law library. AU domicile: Checkbox Operations Pty Ltd, NSW law and exclusive NSW courts (MSA 1.3 and 18.7(b)).
Ask: Confirm NSW law on our Order, and that First Pass will not browse open-web Australian law.
Record the practical work needed to introduce and maintain the software.
Public claim only
Scope of Use on the Order. No termination for convenience. Material MSA changes take effect only at the next renewal after ≥30 days' notice. List price unpublished. External Users may be charged extra.
Ask: Provide an itemised quote (seats, External Users, AI/First Pass, term, auto-renewal) and confirm no-for-convenience termination.
Public claim only
Ironclad partnership for CLM hand-off is marketed. SendGrid sends workflow emails (DPA). No native Microsoft Word add-in was described on the pages read. Customer may grant External Users limited access.
Ask: Demonstrate Ironclad (or other) connectors and whether Word/Outlook capture is in scope.
Public claim only
MSA: Checkbox may access Your Environment as necessary to fulfil the Order; customer must notify incidents. DPO privacy@checkbox.ai. Assurance materials (SOC/pen-test) once per 12 months or after an incident. No public Sev-1 times.
Ask: Provide the support SLA for our tenant and the security escalation path.
Compare complete work at the required quality, including checking and correction.
Not confirmed
First Pass launch copy is qualitative. No independent accuracy study was found.
Ask: Share any evaluation of First Pass on Australian contracts and invoices, including incorrect-routing rates.
Public claim only
First Pass is designed to resolve routine work before it reaches a lawyer. Intake FAQ says documents remain isolated. Time saved after lawyer checking is not independently measured.
Ask: On our guidelines, show a request First Pass closes without a lawyer, one it escalates, and typical Legal review time.
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
The product is a front door for the business. External Users may interact as end users; Checkbox disclaims warranty to them. First Pass may resolve work before a lawyer sees it — that is the customer's authority decision.
Ask: What disclosure do External Users see, and can we require every First Pass output to stay internal until Legal accepts it?
Public claim only
DPA Annex III: OpenAI, LLC provides generative AI where the customer enables optional features. Intake FAQ names OpenAI large language models and a zero-retention policy. MSA s 11: Data sent only as required, not used to train the provider, not retained except law/abuse. Model version and region are unnamed.
Ask: Name each OpenAI model, endpoint region and ZDR contract, and the notice period before a model is swapped.
Public claim only
DPA Annex III: AWS (hosting), Datadog (logs), OpenAI (optional AI), SendGrid (workflow email; deleted after delivery). SCC text: 15 days' written notice of sub-processor changes with objection rights.
Ask: Confirm this dated list applies to us, that OpenAI is optional, and our objection path.
Public claim only
MSA s 4.3 and 11.2: Checkbox does not use customer Data to train, fine-tune or improve any general-purpose or multi-customer model (Checkbox or third-party). It may configure/tune only the customer's own instance; that state is segregated. Intake FAQ repeats never-train and OpenAI zero retention. s 4.3 prevails over inconsistent terms.
Ask: Confirm First Pass is covered by s 4.3/11, including embeddings and routing labels.
Public claim only
Instance-only tuning is allowed. Whether First Pass accept/reject labels stay in the tenant follows s 11.2. Datadog collects logs for debugging and alerting.
Ask: Do First Pass labels stay in our instance only, and can we disable instance-level tuning?
Public claim only
MSA: 90-day post-termination export window. DPA Annex: retain for the licence then 30 days unless earlier deletion. Those two clocks differ. OpenAI: no retention except law/abuse, then delete after that purpose.
Ask: State default and configurable retention for requests, First Pass prompts, embeddings and OpenAI logs on our region, and reconcile the 90-day vs 30-day figures.
Public claim only
After the 90-day Retention Period, Checkbox deletes or destroys Data and, on written request made within that period, certifies within 30 days. DPA/SCCs also offer certified deletion. OpenAI exception for law/abuse.
Ask: On exit, confirm certified deletion of AWS, Datadog, SendGrid and OpenAI copies, and which clock (30 vs 90 days) applies.
Public claim only
MSA: limited licence includes diagnostic, troubleshooting and support access, and access to Your Environment as necessary. Datadog processes logs. Staff access is implied by support, not ticket-logged on the public page.
Ask: Who can read our requests and First Pass chats, from which countries, under what approval, and can we see those access logs?
Not confirmed
SSO/SCIM and MFA were not described on the security-and-trust page read. External Users are an access-control choice. Datadog logs application behaviour.
Ask: Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete First Pass audit log.
Public claim only
DPA Annex lists measures for encrypting personal data at rest and in transit. Algorithms and customer-managed keys were not named.
Ask: Confirm algorithms for First Pass indexes and the OpenAI path, and whether customer-managed keys are available in our region.
Public claim only
Security page: SOC 2 Type II attested; ISO/IEC 27001:2022 certified; ISO 27017 and 27018 compliant. DPA repeats those audits plus penetration tests. Reports available on request under the MSA; not inspected.
Ask: Provide the current SOC 2 Type II and ISO 27001:2022 reports covering First Pass, with scope and exceptions.
Public claim only
Public MSA (AU: NSW law) plus incorporated DPA. Liability cap = fees in prior 12 months; data-protection/IP/indemnity cap = greater of 3× that or US$1,000,000; no unlimited liability. ACL guarantees preserved for the AU entity. Customer must not use outputs to train non-Checkbox models (s 2.2(g)).
Ask: Confirm this MSA/DPA is on our Order and whether First Pass has any extra AI schedule.
Public claim only
Privacy: primary region as requested, with possible disclosure to other locations. DPA Annex III entities are US-registered (AWS, Datadog, OpenAI, SendGrid). OpenAI inference region is unnamed. SCCs are in the DPA.
Ask: For First Pass on our region, list every country for storage, OpenAI inference, backups, Datadog and support.
Public claim only
DPA/SCCs: notify the exporter without undue delay after becoming aware of a personal data breach. No fixed 72-hour clock in the extract. Incident history was not published.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months.
Public claim only
Material MSA changes: ≥30 days' notice, apply only at next renewal. Sub-processors: 15 days' written notice with objection (DPA). No model-version freeze.
Ask: What written notice will we get before a new OpenAI model is added, and can we object without waiting for renewal?
Public claim only
90-day Retention Period for self-service or commonly used machine-readable export; then deletion; certification within 30 days if requested in time. Assisted export is chargeable. No termination for convenience, so exit is at licence end or for cause.
Ask: What export we receive for workflows, requests and First Pass history, and will you certify deletion including OpenAI within 30 days?
Not confirmed
OpenAI is optional. SendGrid is used when workflows send email. Ironclad is a marketed partnership. Enabling them is the customer's choice.
Ask: List every connector that will be on for our tenant and the data each receives.
Not confirmed
First Pass is described as context-aware over legal requests, contracts and invoices in Checkbox. No open-web browsing toggle was found.
Ask: Does First Pass browse the open web, and can we disable any such retrieval?
Not confirmed
First Pass can file requests to existing matters, assign owners and resolve routine work before a lawyer sees it. Workflows can send SendGrid email. Those gates are customer-configured.
Ask: Which First Pass or workflow actions can send email, file a matter or close a request without a second Legal confirmation?
Not confirmed
Launch copy says much of the work is resolved before it needs a lawyer. The MSA does not require a lawyer to approve an AI output before an External User or business requester sees it.
Ask: Can we require every First Pass answer or contract comment to be approved by a named lawyer before it is visible to the business?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI intake and client service tools Australia
