Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The AI Agent is a named module in the published Checkbox product menu at /solutions/ai-agent, checked 2026-09-27. No separate SKU, plan or price is published for it. The MSA frames AI as conditional: s 11.1 opens 'Where you have access to features of the Software that rely on artificial intelligence', and Scope of Use and fees are set by an Order.
Ask: Does our Order include the AI Agent module, on what Scope of Use unit is it counted, and which published MSA version applies to that Order?
Deployment and where the module runs
Public claim only
SaaS only; no on-premises or private-cloud option appears on either page read. DPA Annex III (read 2026-09-27) states 'Amazon Web Services is used to host and store the data entered into the Checkbox software' and gives a Seattle address, with no region named. The module also runs inside Slack, Microsoft Teams, Gmail and Outlook per the product page.
Ask: In which AWS region will our tenant, backups, logs and the AI Agent's index of our uploaded policies be held, and can that be contractually fixed to Australia?
What the module does
Public claim only
The product page (2026-09-27) publishes: grounding in customer material ('Ground the AI Agent in approved internal policies, playbooks, templates, and knowledge sources'); answering in existing channels ('Let your AI Agent capture and answer employee requests directly from Slack, Microsoft Teams, Gmail, and Outlook'); routing ('Identify requests that need legal judgment and route them to the right person, workflow, or team'); unprompted monitoring ('Your AI Agent watches the channels your team already uses and joins the conversation when something needs legal, even when nobody thought to raise a request'); and logging ('Track, capture, and audit every interaction'). Worked examples show an answer carrying an internal source line. This is a marketing page, not a contractual description.
Ask: Which of these behaviours are configurable per channel, and what happens when no approved internal source matches the question?
Jurisdiction and governing law
Public claim only
MSA s 1.3 and s 18.7(b): an Australian-domiciled customer contracts with Checkbox Operations Pty Ltd under New South Wales law with exclusive NSW jurisdiction. Section 19 of the MSA-adjacent documents is silent on legal content; the module's grounding material is the customer's own, and s 11.3 excludes public web data as source material for substantive outputs.
Ask: Will our Order name Checkbox Operations Pty Ltd and New South Wales law, and does the AI Agent hold any jurisdiction-specific legal content we have not supplied?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. Neither the AI Agent page nor the AI legal front door page carries a heading or block addressed to AI models, assistants, crawlers or 'LLMs', and neither contains wording instructing how the product should be described. A 40-URL search-filtered site map of checkbox.ai run the same day, searched for llms, ai-info, for-ai and 'instructions for AI assistants', returned no such path. The map was search-filtered and limit-capped, so this is 'not found' rather than proof of absence.
Ask: Does Checkbox publish, at any path or in any page markup, content addressed to AI models or assistants about how Checkbox should be described?
Vendor answering a comparative question about itself in its own FAQ
Public claim only
The standing FAQ on the AI Agent page (checked 2026-09-27) puts a comparative question about the vendor's own product and answers it: 'How does Checkbox's AI Agent compare to generic chatbots or AI tools?' — 'Checkbox's AI Agent is purpose-built for legal teams, with deep integration into legal workflows, triage, and matter management.' The same FAQ answers 'Is the AI Agent secure and compliant with data privacy standards like GDPR or SOC 2?' with 'Yes, Checkbox is built with enterprise-grade security and is fully compliant with major standards like GDPR and SOC 2.' No named competitor appears. This is marketing content in machine-readable question-and-answer form, not a contractual statement.
Ask: Which statements in the AI Agent FAQ are warranted in our Order or the MSA, and which are marketing only?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and who receives an answer
Not confirmed
The module answers employees directly in Slack, Teams, Gmail and Outlook, and the MSA places the judgement on the customer: s 11.1(d) says the customer 'must not rely solely on the AI Technology's outputs, recommendations or results when making critical decisions', and s 11.1(e) requires the customer to 'exercise judgment, due diligence and appropriate oversight'. Nothing read requires a lawyer to stand between an AI Agent answer and the employee who asked.
Ask: Can we configure the AI Agent so that no answer is visible to an employee until a named lawyer has approved either the answer or the source it cites?
Foundation-model providers
Public claim only
Neither AI Agent page names a model, a provider or an inference region. The DPA Annex III (read 2026-09-27) names one AI provider for the platform: 'OpenAI, LLC', 3180 18th St, San Francisco, described as 'used to provide generative artificial intelligence services for AI-based functionality in Checkbox where the customer enables such optional features'. It does not name the AI Agent module. MSA s 11.1(b) says the technology rests on Checkbox's own models and 'artificial intelligence models provided by third-party providers ... which may change over time'.
Ask: Name the OpenAI models and endpoint regions used by the AI Agent, and confirm whether any other model provider is used for retrieval, embeddings or routing.
Sub-processors
Public claim only
DPA Annex III (read 2026-09-27) lists four, all with United States addresses: Amazon Web Services, Inc. (hosting and storage), Datadog, Inc. (application and infrastructure logs for debugging, troubleshooting, auditing, reporting and alerting), OpenAI, LLC (generative AI for optional features) and SendGrid, Inc. (workflow email, deleted automatically after delivery). The Standard Contractual Clauses in the DPA require at least 15 days' written notice of additions or replacements with an objection route, while MSA s 10.3 states that nothing in the Agreement 'grants you a right to approve, consent to or object to the appointment or replacement of any sub-processor'. MSA s 10.2 makes the DPA prevail for Personal Data.
Ask: Confirm that this dated Annex III is the list applicable to our Order, and that the DPA's 15-day notice and objection route applies to us despite MSA s 10.3.
Training on customer content
Public claim only
Two clauses say it, and one is given priority. MSA s 4.3 (read 2026-09-27) is headed 'No training of Checkbox or third-party models on your Data': Checkbox 'does not use your Data to train, fine-tune or improve any general-purpose or multi-customer machine learning or artificial intelligence model, whether Checkbox's own or a third party's', permits configuration and training of 'only your own instance or account', segregates any resulting model state to that instance, and states 'This Section 4.3 prevails over any inconsistent provision of this Agreement.' Section 11.2 repeats it for the AI Technology, and s 11.4(b) binds AI Model Providers to the same limit.
Ask: Does s 4.3 cover the AI Agent's embeddings of our uploaded policies, its routing labels and its conversation logs, and can instance-level tuning be switched off for us?
Feedback, quality monitoring and usage analytics
Public claim only
MSA s 4.4: Checkbox may create and use 'data, reports, metrics, benchmarks, insights and analytics' about use and performance as Usage Data, owns it, and must keep it aggregated and de-identified. Section 9.1 states Checkbox owns 'all Usage Data, and all workflows, templates, models, configurations, prompts, logic, tooling and methodologies' it uses or creates in providing the Services. The product page advertises measurement of 'accuracy, user satisfaction, and service reliability'; where those measurements are stored, and whether accept or reject signals stay in the tenant, is not published.
Ask: Do AI Agent accuracy and satisfaction measurements stay inside our instance under s 11.2, or are they Usage Data under s 4.4, and can we see what is collected?
Retention of conversations, prompts and indexes
Not confirmed
Two published clocks differ. MSA s 16.4(a) sets a 90-day post-termination Retention Period during which Data stays available for export. The DPA Annex I.B states that personal data is retained 'for the duration of the license agreement until 30 days following termination of the agreement, unless a written request for data to be deleted on an earlier date is made'. Both were read on 2026-09-27. Neither sets any in-life retention period for AI Agent conversations, prompts, embeddings or the audit trail.
Ask: Reconcile the 90-day MSA Retention Period with the DPA's 30-day figure for our Order, and state the default and configurable in-life retention for AI Agent conversations and embeddings.
Deletion and certified erasure
Public claim only
MSA s 16.4(b): at the end of the Retention Period Checkbox 'will delete or destroy your Data and, on written request made within the Retention Period, will provide written certification of that deletion or destruction within thirty (30) days of the request'. Section 16.4(d) preserves retention required by law, legal process or legal hold, to be deleted once that purpose ceases. Section 11.4(d) requires AI Model Providers not to retain Data except as required by law or to prevent abuse and misuse.
Ask: Will the deletion certificate cover the AWS, Datadog, SendGrid and OpenAI copies of AI Agent conversations, and what is the process for deleting a single conversation in life?
Vendor access to conversations and content
Public claim only
MSA s 4.2 grants Checkbox a licence over customer Data that expressly includes access '(c) for diagnostic, troubleshooting and support purposes in relation to the Services' and '(d) to configure, tune, test and train your instance of the Software and your account, including any AI Technology made available to you'. DPA Annex III records that Datadog processes application and infrastructure logs for debugging, troubleshooting, auditing, reporting and alerting. Neither document read states which countries staff access from, nor whether the customer can see an access log.
Ask: Who can read our AI Agent conversations and uploaded policies, from which countries, under what approval, and will you give us those access logs?
Access control, SSO and audit trail
Not confirmed
Neither AI Agent page, nor the MSA, nor the DPA read on 2026-09-27 names single sign-on, SCIM provisioning or multi-factor authentication. DPA Annex II lists 'Measures for user identification and authorisation' and 'Measures for ensuring events logging' as categories without detail. The product page advertises an audit of every interaction but does not describe export or retention of that audit trail. The /security-and-trust and /certifications pages were not read within budget.
Ask: Confirm SSO and SCIM support, and whether the AI Agent's retrieval respects per-user permissions on uploaded policies so a user cannot be answered from a document they may not read.
Encryption in transit and at rest
Public claim only
DPA Annex II (read 2026-09-27) lists 'Measures for encrypting personal data at rest and in transit', 'Measures for the protection of data during transmission' and 'Measures for the protection of data during storage', and names a Cryptographic Standard among the governing policies. No algorithm, key length or customer-managed key option is published.
Ask: Provide the Cryptographic Standard, and state whether customer-managed keys are available and what encryption applies on the path to the model provider.
Independent security assurance
Public claim only
DPA Annex II (read 2026-09-27) states that Checkbox 'conducts regular third-party audits of such policies and controls including penetration tests, SOC 2 Type II audits, and ISO certifications (ISO/IEC 27001:2022, ISO/EIE 27017:2015, ISO/IEC 27018:2019)'. MSA s 10.4 makes the current report or attestation available on written request once in any 12-month period or after an incident. No report was inspected, and the /certifications page was not read within budget. The product FAQ separately asserts compliance with GDPR and SOC 2, which is marketing text rather than an attestation.
Ask: Provide the current SOC 2 Type II report and ISO 27001:2022 certificate with their scope statements, and confirm the AI Agent module and its model path are inside that scope.
Contracting entity, liability and document set
Not confirmed
Three Checkbox entities appear across two binding documents read on 2026-09-27. MSA s 1.3 names Checkbox Operations Pty Ltd for Australian-domiciled customers and Checkbox Software, Inc. for all others. The DPA names 'Checkbox Technology Pty Ltd' as Data Importer at the same Haymarket address and states that it forms part of 'the Checkbox Customer Agreement, available at https://www.checkbox.ai/legal/customer-agreement', a different document and URL from the MSA. The page footer reads 'Checkbox Software, Inc., 2026 All Rights Reserved'. No ACN or ABN is published in either document. MSA s 13.4 caps each party's aggregate liability at fees paid in the preceding 12 months, rising for intellectual property, data protection and indemnity claims to the greater of three times that amount or US$1,000,000, and s 13.5 states that no liability is uncapped.
Ask: Which entity will sign our Order and which entity is our data processor, and are the MSA and the 'Customer Agreement' referred to in the DPA the same document?
Cross-border transfers and APP 8
Public claim only
The DPA read on 2026-09-27 is built on the EU Standard Contractual Clauses, controller to processor, with the Irish Data Protection Commission named as competent supervisory authority. All four Annex III sub-processors carry United States addresses. Neither the MSA nor the DPA names a storage region, an inference region or an Australian data location, and the privacy policy was not read within this wave's budget.
Ask: For an Australian Order, list every country in which AI Agent conversations are stored, inferred on, logged and supported from, and state which transfer mechanism applies under APP 8.
Incident notification and history
Public claim only
The DPA's Standard Contractual Clauses require the data importer, on a personal data breach concerning data it processes, to 'notify the data exporter without undue delay' and to take measures to address and mitigate it. No fixed notification period in hours appears. MSA s 10.4 allows an assurance request following a security incident affecting the customer's Data. No incident history is published on the pages read.
Ask: State the notification period in hours from discovery, your Notifiable Data Breaches and OAIC process, and any material incident in the last 24 months affecting the AI Agent.
Change notice for terms, models and sub-processors
Public claim only
MSA s A.4: material modifications require at least 30 days' notice, do not apply to the then-current Licence Term, and take effect at the next renewal; Checkbox also undertakes not to modify the liability caps (s 13.4), the retention and export commitments (s 16.4) or the confidentiality obligations during a live Order. Section 11.5 gives notice of a materially adverse AI model change but states it 'does not confer any right to approve, consent to, object to or reject any change'. Section 11.6 lets the customer stop using the AI Technology with a pro-rata refund if a model provider's policy change stops Checkbox meeting s 11.4. Sub-processor changes carry 15 days' notice under the DPA.
Ask: What notice will we receive before the model behind the AI Agent changes, and can we suspend the module rather than accept the change?
Export and exit
Public claim only
MSA s 16.4(a): Data remains available for export 'through the Software or in a commonly used, machine-readable format' for 90 days after termination or expiry. Section 16.4(c) makes extended retention and any assisted export, extraction or migration chargeable at Checkbox's then-current rates. Section 16 carries a heading 'No termination for convenience', so exit is at the end of the Licence Term or for cause under s 16.1.
Ask: What exactly is in the 90-day export for the AI Agent — conversations, cited sources, routing decisions and the audit trail — and in what format?
Connectors and third-party tools
Not confirmed
The module's published connectors are Slack, Microsoft Teams, Gmail and Outlook. MSA s 6.3 treats anything the customer chooses to use alongside the Software as a Third Party Input at the customer's risk, and s 11.1 frames AI features as ones the customer may have access to. DPA Annex III shows OpenAI applies 'where the customer enables such optional features' and SendGrid where workflows send email. Which of these is on is the customer's configuration decision.
Ask: List every connector that will be enabled for our tenant, the data each receives, and whether the AI Agent can be enabled on some channels only.
Open-web retrieval
Public claim only
MSA s 11.3 (read 2026-09-27): 'Checkbox does not use publicly scraped or public web data as source material for the AI Technology's substantive outputs. The source material for outputs generated for you is your Data, together with any materials you or your Authorised Users provide or designate for that purpose, and the underlying general capabilities of the AI Model Providers' models.' The product FAQ matches this: 'It relies on your internal sources and rules, not external data.'
Ask: Confirm s 11.3 covers the AI Agent, and that no browsing or external retrieval tool can be enabled for it on our tenant.
Agent actions and confirmation gates
Not confirmed
The product page describes the agent acting without being asked: it 'watches the channels your team already uses and joins the conversation when something needs legal, even when nobody thought to raise a request', captures intent and context, creates and populates matters, files work to the matter it belongs to, assigns by customer-defined rules, and escalates. Nothing in the MSA or on either page read requires a human confirmation before the agent posts into a channel, opens a matter or assigns work.
Ask: Which AI Agent actions can post to a channel, create a matter or assign work without a second confirmation, and can each be put behind approval?
Human review before an answer is used
Not confirmed
MSA s 11.1(d) and (e) require the customer not to rely solely on outputs and to exercise judgement and oversight, and s 11.1(f) releases Checkbox from liability where the customer does not. The product FAQ positions the module on 'questions your lawyers already know the answers to'. Nothing read obliges a lawyer to review an AI Agent answer before an employee receives it; that gate is the customer's to build.
Ask: Can a lawyer approval step be made mandatory per topic before an answer is delivered, and is the approval recorded in the audit trail?
