---
title: "Checkbox (Checkbox Operations Pty Ltd)"
url: "https://ailawframework.com/software/checkbox"
type: "software_profile"
site: "AI Law Framework"
id: "checkbox"
vendor: "Checkbox Operations Pty Ltd"
category: "Legal-specific"
segment: "Intake and client service"
confidence: "medium"
last_reviewed: "2026-09-21"
---

# Checkbox (Checkbox Operations Pty Ltd)

> Australian-origin in-house legal intake and workflow platform, now selling globally, with optional OpenAI features and a First Pass review agent.

Canonical page: https://ailawframework.com/software/checkbox  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Checkbox legal front-door SaaS (intake, matters, workflows, First Pass AI). Australian customers contract with Checkbox Operations Pty Ltd under the public MSA. US entity is separate.

## Capabilities

- Intake and triage
- Matter management
- Document automation
- Contract review and redlining
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Unknown |
| Australian region | On request |
| Model providers | OpenAI |
| Assurance | SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 |
| Training on customer content | No |
| Retention | MSA: 90 days after termination for customer export, then deletion; written certification within 30 days if requested during the Retention Period. DPA Annex: personal data retained for the licence term until 30 days after termination unless earlier deletion is requested. AI Model Providers must not retain except as required by law or abuse-prevention. |
| Integrations | Ironclad (partnership), SendGrid (workflow email) |
| Legal content coverage | Customer requests, matters, contracts and invoices captured in workflows. First Pass is a context-aware review agent. No licensed Australian primary-law library. |
| Pricing | Fees on an Order. No public list price. No termination for convenience. Material MSA changes apply only at the next renewal after 30 days' notice. |
| Australian presence | Yes. AU customers contract with Checkbox Operations Pty Ltd, 5/24 Campbell Street, Haymarket NSW 2000; NSW law and courts. Privacy: primarily stored in the data-centre region the customer requests. Home page shows Telstra and Xero logos. |
| Website | https://www.checkbox.ai/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | Public MSA plus Order. AI Technology is optional and customer-enabled. First Pass (16 September 2026) is a review agent for requests, contracts and invoices. Historic customer-agreement versions are archived on /legal/. | Confirm our Order includes First Pass/AI, which MSA version applies, and whether any older customer agreement still governs. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand); [Checkbox — AI legal intake and triage](https://www.checkbox.ai/solutions/ai-legal-intake-and-triage) |
| Deployment model | Public claim only | SaaS hosted on Amazon Web Services (DPA Annex III). Privacy: primarily stored in the region the customer requests, with possible onward disclosure to other locations. No on-premises option was found. | Will our tenant, backups, logs and First Pass indexes sit only in an Australian AWS region? | [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum); [Checkbox Privacy Policy](https://www.checkbox.ai/legal/privacy-policy) |
| AI features in scope | Public claim only | Intake FAQ: OpenAI LLMs for optional AI features. First Pass reviews contracts, invoices and incoming requests, files to open matters and routes by plain-language guidelines. Workflow automation and self-service tools exist without AI. | Which AI/First Pass features will be enabled, and can we keep OpenAI off for nominated workflows? | [Checkbox — AI legal intake and triage](https://www.checkbox.ai/solutions/ai-legal-intake-and-triage); [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand) |
| Jurisdictions and legal content | Public claim only | Content is the customer's requests and documents, not a licensed case-law library. AU domicile: Checkbox Operations Pty Ltd, NSW law and exclusive NSW courts (MSA 1.3 and 18.7(b)). | Confirm NSW law on our Order, and that First Pass will not browse open-web Australian law. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement) |
| Licence and pricing unit | Public claim only | Scope of Use on the Order. No termination for convenience. Material MSA changes take effect only at the next renewal after ≥30 days' notice. List price unpublished. External Users may be charged extra. | Provide an itemised quote (seats, External Users, AI/First Pass, term, auto-renewal) and confirm no-for-convenience termination. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement) |
| Word, Outlook and matter-system integration | Public claim only | Ironclad partnership for CLM hand-off is marketed. SendGrid sends workflow emails (DPA). No native Microsoft Word add-in was described on the pages read. Customer may grant External Users limited access. | Demonstrate Ironclad (or other) connectors and whether Word/Outlook capture is in scope. | [Checkbox — home](https://www.checkbox.ai/); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Support and security contact | Public claim only | MSA: Checkbox may access Your Environment as necessary to fulfil the Order; customer must notify incidents. DPO privacy@checkbox.ai. Assurance materials (SOC/pen-test) once per 12 months or after an incident. No public Sev-1 times. | Provide the support SLA for our tenant and the security escalation path. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Published quality evidence | Not confirmed | First Pass launch copy is qualitative. No independent accuracy study was found. | Share any evaluation of First Pass on Australian contracts and invoices, including incorrect-routing rates. | [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand) |
| Task fit and verification | Public claim only | First Pass is designed to resolve routine work before it reaches a lawyer. Intake FAQ says documents remain isolated. Time saved after lawyer checking is not independently measured. | On our guidelines, show a request First Pass closes without a lawyer, one it escalates, and typical Legal review time. | [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand); [Checkbox — AI legal intake and triage](https://www.checkbox.ai/solutions/ai-legal-intake-and-triage) |
| Client authority and professional use | Not confirmed | The product is a front door for the business. External Users may interact as end users; Checkbox disclaims warranty to them. First Pass may resolve work before a lawyer sees it — that is the customer's authority decision. | What disclosure do External Users see, and can we require every First Pass output to stay internal until Legal accepts it? | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand) |
| Foundation-model providers | Public claim only | DPA Annex III: OpenAI, LLC provides generative AI where the customer enables optional features. Intake FAQ names OpenAI large language models and a zero-retention policy. MSA s 11: Data sent only as required, not used to train the provider, not retained except law/abuse. Model version and region are unnamed. | Name each OpenAI model, endpoint region and ZDR contract, and the notice period before a model is swapped. | [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum); [Checkbox — AI legal intake and triage](https://www.checkbox.ai/solutions/ai-legal-intake-and-triage); [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement) |
| Subprocessors | Public claim only | DPA Annex III: AWS (hosting), Datadog (logs), OpenAI (optional AI), SendGrid (workflow email; deleted after delivery). SCC text: 15 days' written notice of sub-processor changes with objection rights. | Confirm this dated list applies to us, that OpenAI is optional, and our objection path. | [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Training on customer content | Public claim only | MSA s 4.3 and 11.2: Checkbox does not use customer Data to train, fine-tune or improve any general-purpose or multi-customer model (Checkbox or third-party). It may configure/tune only the customer's own instance; that state is segregated. Intake FAQ repeats never-train and OpenAI zero retention. s 4.3 prevails over inconsistent terms. | Confirm First Pass is covered by s 4.3/11, including embeddings and routing labels. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox — AI legal intake and triage](https://www.checkbox.ai/solutions/ai-legal-intake-and-triage) |
| Feedback and quality monitoring | Public claim only | Instance-only tuning is allowed. Whether First Pass accept/reject labels stay in the tenant follows s 11.2. Datadog collects logs for debugging and alerting. | Do First Pass labels stay in our instance only, and can we disable instance-level tuning? | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Retention of prompts, outputs and matter indexes | Public claim only | MSA: 90-day post-termination export window. DPA Annex: retain for the licence then 30 days unless earlier deletion. Those two clocks differ. OpenAI: no retention except law/abuse, then delete after that purpose. | State default and configurable retention for requests, First Pass prompts, embeddings and OpenAI logs on our region, and reconcile the 90-day vs 30-day figures. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Deletion and certified erasure | Public claim only | After the 90-day Retention Period, Checkbox deletes or destroys Data and, on written request made within that period, certifies within 30 days. DPA/SCCs also offer certified deletion. OpenAI exception for law/abuse. | On exit, confirm certified deletion of AWS, Datadog, SendGrid and OpenAI copies, and which clock (30 vs 90 days) applies. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Vendor and verifier access to content | Public claim only | MSA: limited licence includes diagnostic, troubleshooting and support access, and access to Your Environment as necessary. Datadog processes logs. Staff access is implied by support, not ticket-logged on the public page. | Who can read our requests and First Pass chats, from which countries, under what approval, and can we see those access logs? | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Access control, SSO and audit | Not confirmed | SSO/SCIM and MFA were not described on the security-and-trust page read. External Users are an access-control choice. Datadog logs application behaviour. | Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete First Pass audit log. | [Checkbox Security and Trust](https://www.checkbox.ai/security-and-trust) |
| Encryption in transit and at rest | Public claim only | DPA Annex lists measures for encrypting personal data at rest and in transit. Algorithms and customer-managed keys were not named. | Confirm algorithms for First Pass indexes and the OpenAI path, and whether customer-managed keys are available in our region. | [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Independent security assurance | Public claim only | Security page: SOC 2 Type II attested; ISO/IEC 27001:2022 certified; ISO 27017 and 27018 compliant. DPA repeats those audits plus penetration tests. Reports available on request under the MSA; not inspected. | Provide the current SOC 2 Type II and ISO 27001:2022 reports covering First Pass, with scope and exceptions. | [Checkbox Security and Trust](https://www.checkbox.ai/security-and-trust); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Contract, DPA, liability and forum | Public claim only | Public MSA (AU: NSW law) plus incorporated DPA. Liability cap = fees in prior 12 months; data-protection/IP/indemnity cap = greater of 3× that or US$1,000,000; no unlimited liability. ACL guarantees preserved for the AU entity. Customer must not use outputs to train non-Checkbox models (s 2.2(g)). | Confirm this MSA/DPA is on our Order and whether First Pass has any extra AI schedule. | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Cross-border transfers and APP 8 | Public claim only | Privacy: primary region as requested, with possible disclosure to other locations. DPA Annex III entities are US-registered (AWS, Datadog, OpenAI, SendGrid). OpenAI inference region is unnamed. SCCs are in the DPA. | For First Pass on our region, list every country for storage, OpenAI inference, backups, Datadog and support. | [Checkbox Privacy Policy](https://www.checkbox.ai/legal/privacy-policy); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Incident notification and history | Public claim only | DPA/SCCs: notify the exporter without undue delay after becoming aware of a personal data breach. No fixed 72-hour clock in the extract. Incident history was not published. | State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months. | [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Change notice for models, terms and processors | Public claim only | Material MSA changes: ≥30 days' notice, apply only at next renewal. Sub-processors: 15 days' written notice with objection (DPA). No model-version freeze. | What written notice will we get before a new OpenAI model is added, and can we object without waiting for renewal? | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Export and exit | Public claim only | 90-day Retention Period for self-service or commonly used machine-readable export; then deletion; certification within 30 days if requested in time. Assisted export is chargeable. No termination for convenience, so exit is at licence end or for cause. | What export we receive for workflows, requests and First Pass history, and will you certify deletion including OpenAI within 30 days? | [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement) |
| Connectors and third-party AI tools | Not confirmed | OpenAI is optional. SendGrid is used when workflows send email. Ironclad is a marketed partnership. Enabling them is the customer's choice. | List every connector that will be on for our tenant and the data each receives. | [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum); [Checkbox — home](https://www.checkbox.ai/) |
| Open-web search | Not confirmed | First Pass is described as context-aware over legal requests, contracts and invoices in Checkbox. No open-web browsing toggle was found. | Does First Pass browse the open web, and can we disable any such retrieval? | [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand) |
| Agent actions and confirmation | Not confirmed | First Pass can file requests to existing matters, assign owners and resolve routine work before a lawyer sees it. Workflows can send SendGrid email. Those gates are customer-configured. | Which First Pass or workflow actions can send email, file a matter or close a request without a second Legal confirmation? | [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand); [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) |
| Human review before use | Not confirmed | Launch copy says much of the work is resolved before it needs a lawyer. The MSA does not require a lawyer to approve an AI output before an External User or business requester sees it. | Can we require every First Pass answer or contract comment to be approved by a named lawyer before it is visible to the business? | [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand); [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement) |

## Notes

Strong public MSA/DPA. OpenAI region unnamed. 90-day MSA vs 30-day DPA retention clocks differ. SSO/MFA not on the security page read. First Pass may close work before a lawyer sees it. AWS region is customer-requested, not evidenced as default AU.

## Sources

- [Checkbox — home](https://www.checkbox.ai/) (checked 2026-09-21)
- [Checkbox Security and Trust](https://www.checkbox.ai/security-and-trust) (checked 2026-09-21)
- [Checkbox Master Services Agreement](https://www.checkbox.ai/legal/master-services-agreement) (checked 2026-09-21)
- [Checkbox Data Processing Addendum](https://www.checkbox.ai/legal/data-processing-addendum) (checked 2026-09-21)
- [Checkbox — AI legal intake and triage](https://www.checkbox.ai/solutions/ai-legal-intake-and-triage) (checked 2026-09-21)
- [Checkbox unveils First Pass](https://www.checkbox.ai/news/checkbox-unveils-first-pass-and-new-brand) (checked 2026-09-21)
- [Checkbox Privacy Policy](https://www.checkbox.ai/legal/privacy-policy) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.