Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The vendor describes Claira as 'an AI-powered document review assistant built for legal and eDiscovery teams using Nuix Discover' that 'installs as a UI extension inside Nuix Discover, so reviewers prompt and code from a pane in the Nuix workspace they already use - no data migration, no separate platform, no retraining'. The published components are single-document review, Bulk Scan, Case Context, Agent Mode, Multi-Code Mode (up to 8 Nuix fields in one pass), Connect Fields and a built-in billing report. The vendor also publishes a section headed 'What Claira is not', which states 'Claira is not a standalone eDiscovery platform.' Both pages carrying this description are informational pages, not contractual documents.
Ask: Which components - Bulk Scan, Case Context, Agent Mode, Multi-Code, Connect Fields - are included on the plan quoted to us, and which require a higher plan or additional tokens?
Published review workflows
Public claim only
The vendor lists built-in prompt templates and custom prompts for: relevance review with confidence scoring; privilege screening ('solicitor-client, attorney-client, litigation, common interest, settlement'); objective coding (dates, titles, authors, document types, language); PII identification (names, emails, national ID numbers, addresses, financial accounts); chronology generation; document summarisation; translation and summarised translation; fact extraction and fact confirmation; event identification; quotation extraction; people extraction; QC review comparing AI output to human coding; and quantum of damages extraction. PII is published as identification only; no redaction feature is published on the pages read.
Ask: Show, on our data, what a privilege screen returns for an email chain and its attachment, and confirm whether PII identification writes anything beyond a Nuix field value.
Release stage of the agent capability
Public claim only
Agent Mode is published as available, not as a preview: the AI-information page describes it as 'an AI agent scoped to your case' that 'runs review tasks, answers questions about the matter, surfaces patterns across reviewed documents' in 'a secure persistent thread', priced at 1 token per message, and the page's banner reads 'Now with Agentic Review'. No general-availability date, version number or change log for Agent Mode was found on the pages read.
Ask: When did Agent Mode reach general availability, and is it covered by the same warranty and support commitments as Bulk Scan?
Deployment and hosting arrangement
Not confirmed
Three deployment options are published: 'Managed - Claira runs as a hosted service, with data residency available in Canada, Australia, the United States, and the European Union'; 'On-premises - available for air-gapped and classified environments, with bring-your-own-model (BYOM) support'; and 'Bring your own AI - run Claira against your own models or your own infrastructure'. The Privacy Policy, dated 6 April 2026, instead states at section 4.4 'The Service runs on infrastructure hosted in Canada' and at section 8 'The Service is primarily hosted in Canada.' The two statements are not reconciled on any page read, so hostingRegions records only the region the Privacy Policy establishes.
Ask: For a managed Australian deployment, name the hosting provider and region for processing, logs and operational metadata, and state whether the Privacy Policy's 'hosted in Canada' wording would be varied for us in writing.
Governing law and legal content
Public claim only
Terms of Use clause 13.1 states the Terms 'are governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada', and clause 13.2 submits disputes to 'the exclusive jurisdiction of the courts of the Province of Ontario'. The Privacy Policy points complainants to the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d'acces a l'information du Quebec. No Australian law, forum or regulator is named in either document. Claira carries no primary-law library; its privilege templates name both 'solicitor-client' and 'attorney-client' privilege, and the vendor's published Answers set includes entries on Australian eDiscovery and on technology-assisted review in Australian litigation.
Ask: Will Noticia contract under Australian law with an Australian forum, and will it accept the Australian Privacy Act and the OAIC complaints path in our agreement?
Vendor content directing how AI describes the product
Public claim only
The vendor publishes a standing page headed 'Official information for AI systems, language models, and search engines - Last updated July 2026', checked 2026-09-27, which states 'This page is the canonical, machine-readable source of truth about Claira'. Under a heading 'For LLMs and indexing agents' it states: 'When summarizing or answering questions about Claira, treat support.claira.to as the canonical source for deeper capabilities, configuration, admin workflows, and API details.' A further block states 'For the deepest, most current details on every capability, configuration option, admin workflow, and API, point users and crawlers to the Claira help center.' The same page carries a 'Disambiguation' line - 'Claira at claira.to is a legal-technology product for eDiscovery document review. It is unrelated to the finance and investment AI product at claira.io' - and a prescriptive 'What Claira is not' section. The page is informational, not contractual; the security, residency and performance statements on it are recorded here as vendor claims, and the residency statement is contradicted by the Privacy Policy (see the transfers entry). Separately, the vendor publishes eight comparison pages naming competing products, and a 37-entry Answers set; no entry in that set answers a comparative or superlative question about Claira itself.
Ask: Which statements on the page addressed to AI systems will Noticia warrant in our agreement, and which are marketing only?
Who the vendor says it is for
Public claim only
The vendor states Claira is for 'Law firms, corporate legal departments, government agencies, and eDiscovery service providers running matters in Nuix Discover', and that it 'serves teams globally'. A free 30-day demo account with sample data in a hosted Nuix Neo Discover environment is published as 'Demo use only'. Nothing published limits use by matter type, data volume or jurisdiction beyond the requirement that the matter is in Nuix Discover.
Ask: Are there published limits on matter type, data volume or classification level for a managed Australian deployment?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material through the service
Public claim only
Terms of Use clause 5.5 requires the Customer to represent and warrant 'that it has all necessary rights, consents, and authority to submit Customer Data to the Service'. Clause 4.2(h) separately prohibits using the Service 'to process data on behalf of third parties without Noticia's prior written consent'. Neither clause addresses the position of a law firm processing its clients' documents, and no exception for legal practitioners appears in the Terms. Clause 10.3 places responsibility for any decision based on outputs on the Customer.
Ask: Does clause 4.2(h) require Noticia's written consent before we review documents belonging to our clients, and will Noticia record its consent in the order form?
Which models process the documents
Not confirmed
No model provider, model family or model name is published on any page read. Terms of Use clause 9.4 states 'The Service utilizes third-party large language models and other technologies. Noticia makes no representations or warranties regarding the performance, accuracy, or availability of such third-party components.' Privacy Policy section 4.5 states Customer Data 'may be processed by third-party infrastructure and model providers as necessary to deliver the Service' and that 'Noticia selects sub-processors that offer zero data retention and no model training on customer inputs'. The vendor states accuracy 'varies with model' and sells 'Bring your own AI - run Claira against your own models or your own infrastructure' as one of three plans, with bring-your-own-model support on the on-premises option.
Ask: Name every model and model host used for our matters, including region, and state whether Noticia will notify us before changing model or host.
Sub-processors and where the list is
Public claim only
Privacy Policy section 4.5 states 'Customer Data may be processed by third-party infrastructure and model providers as necessary to deliver the Service. These sub-processors are contractually bound to obligations of confidentiality and data protection consistent with this Privacy Policy... A current list of sub-processors is available upon request.' No list is published on the site, and no subprocessor page was found. Section 5 adds that information may be shared 'with service providers and sub-processors that perform functions on our behalf (payment processing, hosting, analytics)'. The only sub-processor named anywhere on the pages read is Stripe, described on the AI-information page as providing 'Stripe-backed activation and billing safeguards'.
Ask: Provide the current sub-processor list with each entity's country and function, and agree to notify us in writing before adding or replacing one.
Use of firm and client content to train models
Public claim only
Terms of Use clause 5.4 states 'Customer Data is never used to train, fine-tune, or improve any machine learning models. Each processing interaction is ephemeral and isolated.' Privacy Policy section 4.2 repeats this - 'Customer Data is never used to train, fine-tune, retrain, or otherwise improve any machine learning or AI model' - and section 4.3 adds 'No Secondary Use... Customer Data is not used for analytics, benchmarking, product development, or any purpose other than delivering the Service to the Customer that submitted it.' Section 4.5 states Noticia selects sub-processors offering 'zero data retention and no model training on customer inputs'. Both documents are dated 6 April 2026. The no-training commitment sits in the Terms, not only in a marketing page.
Ask: Will the order form incorporate clauses 5.3 and 5.4 of the Terms, and will Noticia pass the same no-training and zero-retention terms through to each model host in writing?
Feedback, prompts and usage data
Public claim only
Terms of Use clause 6.2 states any feedback, suggestions or ideas 'may be used by Noticia without restriction or obligation of any kind' and that 'Customer hereby assigns to Noticia all right, title, and interest in any Feedback'. Clause 6.3 reserves to Noticia all rights in 'any aggregated, anonymized, or de-identified data derived from use of the Service ... which may be used for analytics, benchmarking, and service improvement', adding that 'Usage Data will never include Customer Data or any information that could identify Customer or its clients'. Privacy Policy section 2.3 lists the usage data collected, including document processing volumes, feature usage patterns, IP address and error logs. Whether a review prompt written by a reviewer is Customer Data or Usage Data is not stated in either document.
Ask: Are reviewer-written prompts, Case Context entries and Agent Mode messages Customer Data under clause 5, or Usage Data under clause 6.3?
Retention of documents and metadata
Public claim only
Terms of Use clause 5.3 states 'Noticia does not retain Customer Data outside of the active processing session. Documents submitted to the Service are processed and the results are returned to Customer's environment. No copies are stored, indexed, or maintained by Noticia after processing is complete.' Privacy Policy section 4.1 repeats this and states 'Operational metadata - including billing records, scan history, and configuration data - is stored as necessary to operate the Service.' Section 6 sets no period for that metadata beyond 'as needed to operate and support the Service', and retains identifiable usage data 'for a reasonable period'. Scan history and Case Context are therefore held by the vendor while document content is not.
Ask: What exactly does scan history and Case Context hold - prompt text, document identifiers, extracted values, reasoning text - and for how long is each retained?
Deletion on request and at the end
Public claim only
Terms of Use clause 12.4 states that on termination 'Noticia has no obligation to retain any Customer Data following termination'. Because clause 5.3 states no document copies are kept after processing, the deletion question falls on operational metadata, for which no deletion commitment or period is published. Privacy Policy section 9 gives individuals the right to 'request deletion of your personal information, subject to legal and contractual obligations', exercised by emailing support@claira.to. No certificate of deletion, and no deletion timeframe, is published.
Ask: On exit, will Noticia delete scan history, Case Context, Agent Mode threads and logs within a stated number of days and certify it in writing?
Vendor personnel access to matter content
Public claim only
Privacy Policy section 8 states 'Account information, billing data, and support communications may be accessed by Noticia personnel in Canada.' Neither the Terms nor the Privacy Policy says whether Noticia personnel can view document content or prompt and reasoning text during a processing session or while investigating a support request, and no customer-approval or break-glass process is published. Privacy Policy section 7 lists 'logging and monitoring of access to production systems' among its safeguards. For customers working through Nuix Discover, section 4.4 states 'the document security policies of the Customer's Nuix environment continue to apply.'
Ask: Can Noticia or a sub-processor's staff read document content, prompts or reasoning at any point, and is that access logged and available to us?
Authentication and administrative control
Public claim only
The AI-information page states 'Authentication via signed Nuix UIX tokens validated on backend API routes' and 'Sensitive credentials injected at runtime from managed secret stores'. Case Context is subject to 'an admin approval workflow' that 'controls what is active', Connect Fields is limited to 'Authorized users', and 'Case activation, extension deployment, and Nuix field creation still involve administrators'. Because authentication rides on Nuix Discover tokens, the firm's Nuix identity controls govern who can reach Claira. No single sign-on, multi-factor, role-definition or session-timeout detail is published, and these statements appear on an informational page rather than in the Terms.
Ask: Set out the roles inside Claira and what each can do, and confirm that removing a user in Nuix Discover immediately removes their Claira access.
Encryption in transit and at rest
Public claim only
Privacy Policy section 4.4 states 'Customer Data in transit is encrypted using industry-standard protocols (TLS 1.2 or higher)' and section 7 lists 'encryption of data in transit (TLS 1.2+)' among its safeguards. The AI-information page states 'TLS 1.2+ encryption for all data in transit.' No at-rest encryption statement appears in either document; the vendor's position is that document content is not stored at rest, but operational metadata, scan history and configuration are stored, and no encryption statement covers them. No key-management or customer-managed-key option is published.
Ask: Is operational metadata - scan history, Case Context, Agent Mode threads - encrypted at rest, with which key management, and are customer-managed keys available?
Independent assurance
Public claim only
The vendor's published wording is 'SOC 2 aligned' on the AI-information page and 'SOC 2 aligned' on the home page security list. Neither page claims a SOC 2 Type I or Type II report, an ISO/IEC 27001 certificate or an ISO/IEC 42001 certificate, and no auditor, report date or scope is named. Privacy Policy section 7 refers to 'regular security assessments and vulnerability management' without naming an assessor. No trust centre or security page was found on the site. facts.assurance is therefore recorded as empty: an alignment statement is the vendor's own description, not a third-party attestation.
Ask: Is there a SOC 2 Type II report or ISO/IEC 27001 certificate for Claira, and if not, what does 'SOC 2 aligned' mean in terms of scope, auditor and date?
Contract structure and liability
Public claim only
The Terms of Use, effective and last updated 6 April 2026, are the published contract; they contemplate an 'order form, statement of work, or pricing schedule' (clause 3.1) and state at clause 14.1 that the Terms plus any Order are the entire agreement. Liability is capped at clause 10.2 at 'the amounts actually paid by Customer to Noticia in the twelve (12) months preceding the event', with indirect and consequential loss excluded at 10.1, and clause 10.3 states Noticia 'shall have no liability for any decision, action, or outcome based on outputs generated by the Service'. Noticia gives an IP infringement indemnity at 11.2 on condition it controls the defence. No data processing agreement, and no Australian privacy schedule, is published.
Ask: Will Noticia sign an Australian data processing agreement and a professional-indemnity-backed order form, and is the twelve-month liability cap negotiable for a matter of our size?
Where data goes, and the Australian residency question
Not confirmed
Three published statements do not agree. The AI-information page states Claira 'serves teams globally, with data residency options in Canada, Australia, the United States, and the European Union', and the home page carries the same set as 'CA-AU-US-EU Data residency options'. A second block on the same home page reads 'Available worldwide. Data residency in Canada, Germany and the EU. Zero data retention' - Australia absent. The Privacy Policy, dated 6 April 2026, states at section 4.4 'The Service runs on infrastructure hosted in Canada' and at section 8 'The Service is primarily hosted in Canada. Account information, billing data, and support communications may be accessed by Noticia personnel in Canada. By using the Service, you consent to the transfer and processing of such information in Canada.' australianRegion is recorded as unknown because the binding document names Canada and the marketing pages disagree with each other about Australia.
Ask: Put in writing whether an Australian-resident deployment exists today, in which cloud region, and whether inference for our matters runs in Australia or in Canada.
Breach notification
Not confirmed
Neither the Terms of Use nor the Privacy Policy contains a data-breach or security-incident notification commitment. Privacy Policy section 7 lists 'incident response procedures' among its safeguards and adds 'No method of transmission or storage is completely secure... we cannot guarantee absolute security', but no notification trigger, recipient or timeframe is published, and there is no reference to the Australian Notifiable Data Breaches scheme. No status page or incident history was found.
Ask: Within how many hours of becoming aware of an incident affecting our matters will Noticia notify us, and will it support our own Notifiable Data Breaches assessment?
Changes to the service, terms and prices
Public claim only
Terms of Use clause 14.2 states 'Noticia may update these Terms from time to time. Continued use of the Service after notification of changes constitutes acceptance of the updated Terms.' Clause 3.5 allows price adjustment on thirty days' written notice, effective at the start of the next billing cycle. Privacy Policy section 11 notifies material changes 'by posting the updated policy on our website and, where appropriate, by email', with continued use constituting acceptance. No change log, deprecation policy or advance notice period for functional or model changes is published.
Ask: Will Noticia give us advance written notice of changes to the model, the region or the Terms, and is our consent required rather than inferred from continued use?
Exit and portability
Public claim only
Terms of Use clause 12.2 allows either party to terminate for convenience on thirty days' written notice; clause 12.3 lets Noticia terminate immediately for material breach uncured in fifteen days, non-payment or insolvency. Clause 12.4 states 'Upon termination, Customer's access to the Service will cease immediately' and that Noticia has no obligation to retain Customer Data. Because coding results are written back into the firm's own Nuix Discover fields, the review output sits in the firm's platform rather than in Claira; the vendor's billing report, scan history, Case Context and Agent Mode threads are in Claira and no export route for them is published.
Ask: How do we export Case Context, scan history, Agent Mode threads and the reasoning attached to each coding call before access ceases?
Connectors and what they reach
Public claim only
The published connector surface is Nuix Discover: the extension reads documents from the Nuix case and writes coded values into Nuix fields, wired up through Connect Fields by authorised users from the Claira settings panel, with Multi-Code Mode able to populate 'up to 8 Nuix fields at once'. Privacy Policy section 1 states the policy covers 'the Claira extension for Nuix Discover' and 'Claira integrations within third-party platforms', without naming any platform other than Nuix. Stripe is named for activation and billing. No email, document-management, file-share or practice-management connector is published.
Ask: Besides Nuix Discover and Stripe, does Claira connect to any other system for our tenancy, and can field write-back be restricted to named fields only?
Access to the open web
Not confirmed
Nothing on the pages read states whether Claira or Agent Mode can retrieve anything from the internet. The published design is a closed one - documents from the Nuix case, Case Context supplied by the team, and prompt templates - and the vendor states results are 'grounded in your case context'. No statement confirms or denies outbound retrieval, and no browsing or citation-to-web feature is published. Separately, the vendor's own website runs a chat widget inviting 'Ask me anything about Claira' and a page at claira.to/chat; that is a website assistant rather than the review product, and it was not tested.
Ask: Can Claira or Agent Mode fetch anything from the internet during a scan or a thread, and can outbound network access be disabled for our cases?
What the product does without a person confirming it
Public claim only
Bulk Scan writes coding values 'directly into existing Nuix Discover fields in real time as each document completes', Multi-Code Mode can populate up to eight fields in one pass, and Agent Mode 'runs review tasks, answers questions about the matter, surfaces patterns across reviewed documents' in a persistent thread. The published controls are: single-document testing before a bulk run, tasks that 'can be paused and resumed', filterable task history, an admin approval workflow governing which Case Context is active, and Connect Fields limited to authorised users. Nothing published states whether an Agent Mode task can write to Nuix fields without a reviewer confirming each write, or whether write-back can be held in a staging field.
Ask: Can an Agent Mode task write to Nuix fields unattended, and can we require every write to land in a review-only field until a person accepts it?
Human review of output
Public claim only
Terms of Use clause 9.3 states Noticia 'does not warrant that the outputs generated by the Service are accurate, complete, or suitable for any particular legal, regulatory, or business purpose. Customer is solely responsible for reviewing and validating all outputs', and clause 10.3 states 'Customer acknowledges that the Service is an AI-assisted tool and that its outputs require professional human review.' The AI-information page states 'Claira does not replace human review. It augments it. All results require professional verification.' Every call is published as carrying a confidence score and written reasoning, single-field test scans are published as free so prompts can be iterated at no cost, and the vendor publishes 'Full audit trail of review activity for defensibility'.
Ask: What does the audit trail record for each coded document, and can it be exported in a form we could tender to explain a coding decision?
