Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Clio Draft is sold as an add-on, not a plan inclusion: the Australian pricing page lists it under 'Add more to your plan' as 'Add-on Advanced document automation' with 'Contact your sales representative for pricing', grouping advanced document automation, court forms and template building. Which contract applies depends on how it is bought: the APAC Terms of Service state 'For customers using Clio Draft as a standalone product, please refer to Clio Draft Terms of Use' and that 'Clio Draft functionality accessed within Clio Work or Clio Manage is governed by this Agreement.'
Ask: Are we buying Clio Draft inside Clio Manage or Clio Work under the APAC Terms of Service, or standalone under the separate Clio Draft Terms of Use, and what is the add-on price for our seat count?
What the product does and where the AI sits
Public claim only
The Clio Draft page (checked 2026-09-27) is headed 'AI legal drafting software that saves you hours' and names one specific AI function: 'AI builds your templates for you — Clio Draft's built-in AI takes your existing Word documents and turns them into reusable templates'. The deeper feature page on advanced document automation does not use the word AI in its body and describes the assembly engine as conditional logic — 'the use of "if-then" statements within document templates to dynamically adjust content based on specific inputs' — plus autofill from Clio Manage, questionnaire mapping, clause reuse and version control. The page also advertises bundled template sets, branded client questionnaires and a court-form library. 'AI-powered questionnaires' is used on the product page while only conditional logic is described.
Ask: Which steps in Clio Draft call a language model — template conversion only, or also questionnaire behaviour and document assembly — and what happens to a template if the conversion model is changed?
Deployment and processing locations
Public claim only
Cloud SaaS on au.app.clio.com. The subprocessor list (last modified 20 August 2026) names Amazon Web Services as the cloud hosting provider for Clio Draft with data locations 'United States, European Union, Canada, Australia', and lists seven AI service providers against Clio Draft with data locations that are mostly the United States and European Union. The Product Specific Terms refer to 'your selected data processing region' in the Web Search section (cl 2.4) without saying which regions can be selected or how. No on-premises or private-cloud option is published.
Ask: Can our Clio Draft tenancy be pinned to an Australian data processing region for storage, the vector database and the template-conversion model call, and will you confirm that in writing?
Jurisdiction and court forms
Public claim only
The product page advertises 'up-to-date court forms for your area' and firm-specific starter templates, and names client care letters, cost estimates, retainer agreements and contracts as document types. No Australian court or tribunal, no form list, no update process and no jurisdictional coverage statement appears on the pages read. Separately, the APAC Terms are governed by the laws of New South Wales with disputes in the courts of New South Wales in Sydney (cl 21.9) and state the Service is intended for users located in Australia (cl 21.10).
Ask: Which Australian courts and tribunals are covered by the court-form library, how quickly are forms updated after a rule change, and who is accountable if a superseded form is filed?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A 14-URL search-filtered map of clio.com/au returned no /ai-info, /llms.txt or /for-ai page, and none of the pages read for this profile — the Clio Draft page, the advanced document automation page, the Australian pricing page, the APAC Terms of Service, the Product Specific Terms, the subprocessor list or the GDPR Data Protection Addendum — carries a heading or block addressing AI models, assistants or crawlers, or instructing them how to describe the product. The map was search-filtered and does not exhaust the site.
Ask: Do you publish any page, block or file (for example /llms.txt or an AI-information page) that tells AI assistants or crawlers how to describe Clio or Clio Draft?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority, disclosure duties and professional use
Public claim only
APAC Terms: 'Themis is not a law firm and does not provide legal advice, through the Service or otherwise', and the Service 'is intended only for use by legal professionals and those working under their supervision'. Clause 14.4 makes the Subscriber solely responsible for disclosures to its end-users about 'the use of artificial intelligence or automated systems', 'the nature and limitations of AI-generated responses', data practices and 'any human oversight or review processes', and cl 14.5 requires the Subscriber to indemnify Themis for failures to make them. Clio Draft's client questionnaires collect case information directly from clients.
Ask: What notice do you recommend we give clients whose information is collected by a Draft questionnaire and whose documents are assembled with these features, and do you provide model wording?
Foundation-model providers
Public claim only
The subprocessor list (last modified 20 August 2026) names Clio Draft against seven AI service providers: Amazon Web Services (AWS Bedrock) — United States, European Union; Anthropic, Inc — United States; OpenAI, LLC — United States, European Union; Google LLC (Google Vertex AI) — United States, European Union, Canada, Australia; Microsoft Corporation (Azure Foundry) — United States, European Union; Braintrust Data, Inc for 'AI Analytics, Evaluation and Testing' — United States; and Turbopuffer, Inc as a vector database — United States, European Union, Canada, Australia. No document read says which provider performs the template-conversion function, and no customer choice of model is published.
Ask: Which of these providers and models performs the Word-to-template conversion for an Australian tenancy, in which region, and can we exclude any named provider?
Subprocessors and notice rights
Public claim only
Clio publishes a dated subprocessor page (last modified 20 August 2026) as Exhibit C to the Terms of Service, split into infrastructure, AI service providers, feature-specific providers and payment processors, plus 21 Clio affiliates in Canada, the United States, the United Kingdom, Ireland, Australia, Spain, Colombia, Mexico, Brazil, Chile and Peru, and a separate list of vendors for Clio's own business operations. On notice, the GDPR Data Protection Addendum cl 3.2 says 'Themis shall notify Subscriber from time to time of the identity of any Subprocessors engaged' with an objection right to request the data be moved — but that addendum applies only to EEA and UK data, and no equivalent notice or objection right for Australian customers was found in the APAC Terms.
Ask: What advance notice and objection right do we have as an Australian customer before a new AI subprocessor is added for Clio Draft, given the DPA applies only to EEA and UK data?
Training and product improvement on customer content
Public claim only
APAC Terms cl 14.6: 'Themis may de-identify and aggregate the Content submitted to, and Output received from, AI Services and use the same in order to improve and ensure the quality of the AI Services. Subscriber's use of AI Services does not grant Themis the right to use any of Subscriber's Confidential Information for the purpose of training generalized LLMs.' Clause 14.3 separately bars the Subscriber from using Outputs to train any model. The Australian pricing page FAQ states 'Your firm's data stays in Clio and is never used for AI training or any other external purpose' — that FAQ addresses Clio's AI generally, is not a Clio Draft statement, and is not a contractual term. No opt-out from clause 14.6 is published.
Ask: Does clause 14.6 permit de-identified template text or assembled document text from Clio Draft to be used to improve your AI Services, can we opt out, and will you warrant that no model provider retains or trains on our content?
Evaluation, testing and quality telemetry
Public claim only
APAC Terms cl 14.6 permits de-identified, aggregated use of Content and Output to improve and ensure the quality of the AI Services. Consistent with that, the subprocessor list names Braintrust Data, Inc against Clio Draft for 'AI Analytics, Evaluation and Testing' with a United States data location. Neither document states what is sent to that evaluation pipeline, whether it is de-identified before transfer, or whether a customer can decline it.
Ask: What Clio Draft data reaches Braintrust, is it de-identified before it leaves our region, and can our tenancy be excluded from AI evaluation and testing?
Retention of content, prompts and outputs
Public claim only
APAC Terms cl 8.1 and cl 10.7: following cancellation or termination the Subscriber has 90 days to retrieve Content, after which all Content is irrevocably deleted from the Service; Escrowed Data, where an Escrow Agreement exists, remains available for six months. Nothing in the documents read states a retention period, during the subscription, for Clio Draft prompts, model outputs, uploaded source documents, questionnaire responses or the records held by the listed vector-database subprocessor.
Ask: State the retention period for Clio Draft prompts, model outputs, uploaded Word source files and vector-database entries during the subscription, and whether any listed AI provider retains them.
Deletion and erasure evidence
Public claim only
APAC Terms cl 10.7: after a period of no less than 90 days from cancellation or termination, 'all Content associated with such subscription will be irrevocably deleted from the Service'. The GDPR Data Protection Addendum cl 7.1 gives a 90-day election to have data made available for retrieval or deleted, with cl 7.2 permitting Themis and its subprocessors to retain data where law requires — but that addendum applies only to EEA and UK data. No certificate of deletion, and no deletion timetable binding the listed AI subprocessors, was found.
Ask: Will you certify deletion in writing after exit, and does the 90-day deletion reach backups, the vector database, evaluation pipelines and every AI subprocessor copy?
Vendor staff and affiliate access to content
Public claim only
APAC Terms cl 21.3: 'Only Themis, with strict business reasons, may access and transfer the Content and only to provide Subscriber with the Service. Themis will make reasonable efforts to provide notice to Subscriber prior to such access and transfer.' Clause 4.2 binds Themis and its vendors and hosting partners to hold Content in strict confidence. The subprocessor page states that Clio engages its affiliates as subprocessors and that 'These affiliates may have access to customer data in that capacity', listing 21 affiliates across eleven countries including Australia, Canada, the United States, the United Kingdom, Ireland, Spain, Colombia, Mexico, Brazil, Chile and Peru.
Ask: Which affiliates and staff locations can read our matter content and Draft templates, is each access ticketed and logged, and can we require Australian-only support access?
Access control, single sign-on and audit
Public claim only
APAC Terms cl 5.1 puts secure authentication and password management on Themis and cl 5.2 to 5.3 put credential protection on the Subscriber. The Australian pricing comparison table lists 'SAML-based single sign-on (SSO)' as not available on EasyStart or Core and available on Signature and Elite. Clause 5.8 states that the Subscriber is solely responsible for the access restrictions it sets and that 'Any elements of the Service provided by Themis that restrict a User's access to Content are provided AS IS and may contain bugs, errors or other defects'. No audit-log export for AI use is described.
Ask: On the plan we are buying, is SAML SSO with enforced MFA available, can Clio Draft be limited to named users, and can we export an audit log of template conversions and document generations?
Encryption in transit and at rest
Public claim only
APAC Terms cl 21.3 states 'The Content is stored securely and encrypted'; cl 5.1(b) requires passwords to be transmitted in an encrypted format; cl 5.4(a) to (c) commit Themis and its hosting partners to information security best practices for transmitting and storing Content and to host facilities meeting industry standards. The Australian pricing FAQ adds that data is 'encrypted in transit and at rest' with backups multiple times a day to mirrored facilities. No algorithm, TLS version or key-management detail is published, and customer-managed keys are not offered in any document read.
Ask: Name the encryption algorithms, TLS versions and key-management arrangements protecting Clio Draft content, including data in transit to each AI provider, and state whether customer-managed keys are available.
Independent security assurance
Public claim only
APAC Terms cl 5.4(d): within 30 days of a request Themis will provide 'a (SOC2 or SOC3) audit report or industry standard successor report or a comparable description of its security measures in respect of the data center facilities used to host the Service and the Content', but 'In order to obtain such a report, Subscriber must enter into an agreement with the third party provider of the report'. The Australian pricing FAQ states Clio 'is SOC 2 Type II certified and meets GDPR requirements' and that independent third parties audit its security and privacy regularly. No ISO 27001, ISO/IEC 42001 or IRAP assessment was found on the pages read, and no scope statement covering Clio Draft or its AI providers was published.
Ask: Provide the current SOC 2 Type II report and confirm whether its scope covers Clio Draft, the template-conversion model call and the listed AI subprocessors.
Contract set, entity, liability and forum
Public claim only
For Clio Draft used inside Clio Work or Clio Manage the contract is the APAC Terms of Service with Themis Solutions (Australia) Pty Ltd, incorporating the Australian Privacy Policy, Exhibit A (Service Level Commitments), Exhibit B (GDPR Data Protection Addendum), Exhibit C (Authorized Subprocessors) and the Product Specific Terms (cl 16). Governing law is New South Wales with disputes in the courts of New South Wales in Sydney (cl 21.9). Liability is excluded to the maximum extent permitted by law except for fraud, negligence or wilful misconduct, and where liability can be limited it is limited to re-supply of the services or the cost of re-supply (cl 11.1). Themis may amend the Agreement on notice by email or other reasonable means (cl 21.7). A separate Clio Draft Terms of Use applies to standalone purchases and was not read.
Ask: Confirm the contracting entity and its ACN, whether we sign the APAC Terms or the standalone Clio Draft Terms of Use, and whether the clause 11.1 re-supply limit can be replaced with a monetary cap.
Cross-border transfers and the Privacy Act
Public claim only
APAC Terms cl 5.7: 'Themis will comply with the Privacy Act 1988 (Cth) in relation to personal information that it collects, uses and stores in Australia, and discloses to and from Australia', with transfer detail left to the Australian Privacy Policy (not read in this pass). The subprocessor list shows most AI service providers for Clio Draft processing in the United States and European Union. Product Specific Terms cl 2.4 states that subprocessors used to provide Web Search 'may process data in a location other than your jurisdiction or your selected data processing region' and that the Subscriber is solely responsible for deciding whether that is acceptable. The GDPR Data Protection Addendum and its Standard Contractual Clauses cover only EEA and UK data.
Ask: List every country in which Clio Draft content, prompts, outputs and embeddings are stored or processed for an Australian tenancy, and state what Australian Privacy Principle 8 mechanism you rely on for each.
Security incident notification
Public claim only
APAC Terms cl 5.5: Themis will report any event it reasonably believes represents unauthorised access to, disclosure of, use of, or damage to Content 'within 72 hours after learning of the Security Breach', with details except those that would prejudice other customers' security; cl 5.6 commits Themis to cooperate on cause, affected Content, prevention of recurrence, related litigation and mitigation. The GDPR Data Protection Addendum cl 4.3 repeats a 72-hour notification for EEA and UK data. No express commitment to assist with an Australian notifiable data breach assessment, and no incident history, was found.
Ask: Will you commit to assisting an OAIC notifiable data breach assessment within the 72-hour window, and does clause 5.5 cover incidents at the AI subprocessors listed for Clio Draft?
Change notice for terms, processors and features
Public claim only
APAC Terms cl 21.7: for material changes Themis 'will notify Subscribers, by email, or by other reasonable means of these changes prior to their enactment', and continued use after reasonable notice is acceptance; no minimum notice period is stated. Clause 18 allows Themis to 'replace, disable or restrict access to any Third Party Service or cancel related integrations at any time, without notice'. Subprocessor changes are notified 'from time to time' under the GDPR addendum cl 3.2, which does not apply to Australian data. Nothing published commits Themis to notice before the model behind an AI function changes.
Ask: What minimum written notice will we receive before a change to the AI Services terms, the model provider for template conversion, or the subprocessor list affecting Clio Draft?
Export and exit
Public claim only
APAC Terms cl 8.1 and cl 10.7: on cancellation or termination Content is made available to the Administrator or a designated Authorized User and the Subscriber has 90 days to retrieve it, after which it is irrevocably deleted. The Australian pricing FAQ says a firm can export its data 'such as contacts, matters, and financial records—in open, nonproprietary formats at any time while your account is active, or within 90 days of cancellation'; that list does not mention templates, conditional logic or questionnaires. Cancellation inside a term accelerates the remaining balance (cl 10.3).
Ask: In what format do Clio Draft templates, their conditional logic, clause libraries and questionnaires export, and are they usable outside Clio after exit?
Connectors and third-party services
Public claim only
APAC Terms cl 18: Third Party Services accessed through the Service 'are not "Services" under this Agreement and are not subject to any terms related to the Service, including related warranties, indemnities, service commitments or other obligations', are governed by the third party's own terms, and Themis 'will have no liability to Subscriber in connection with any Third Party Service' and may replace, disable or restrict them at any time without notice. Clause 3 of the terms also governs API access, which Themis may modify or discontinue with or without notice.
Ask: Which third-party services or integrations will be enabled for our Clio Draft use, what data does each receive, and will they stay off until we authorise them?
Open-web retrieval
Public claim only
The Product Specific Terms describe a Web Search feature of the AI Services that 'enhances your experience by directly querying publicly available websites to supplement responses drawn from Materials'. It 'can be disabled at the account level by the Administrator via account settings' and, if active, by the user at the individual conversation level (cl 2.2); it 'is performed through one or more of Themis' subprocessors (currently, OpenAI)' (cl 2.3); its subprocessors 'may process data in a location other than your jurisdiction or your selected data processing region' (cl 2.4); and results generated using it are labelled as distinct from results drawn from Materials (cl 2.5). The Drafting Features section does not say whether Web Search operates within Clio Draft.
Ask: Does Web Search operate anywhere in Clio Draft — including template conversion or questionnaire behaviour — and can it be disabled account-wide before we go live?
Agentic actions and confirmation
Public claim only
Product Specific Terms cl 5.3 states that Drafting Features include '(c) generative drafting of documents from scratch using an AI Service; and (d) agentic features that read, analyze, draft, or edit documents and may reference, incorporate, or be informed by Materials'. Clause 5.4: 'Agentic features take actions based on information and materials provided and Subscriber's instructions. Outputs from agentic features are AI-generated and may contain errors, inaccuracies, or be speculative, and Themis does not guarantee the accuracy of any actions or outputs by Drafting Features.' Section 5 applies to Drafting Features offered through Clio Work and Clio Manage; no confirmation step, action log or administrator boundary is described in the documents read.
Ask: Which agentic Drafting Features can edit or create a document without a confirmation step, are they off by default, and is every action logged and reversible?
Human review before output is used
Public claim only
APAC Terms cl 14.2: 'Themis does not review Output for accuracy or completeness, and Subscriber acknowledges that Output may be incomplete or inaccurate ... Subscriber agrees: (a) to only use the AI Services and Output with human oversight, and (b) that Subscriber is responsible for reviewing the Output, including ... for accuracy, completeness, appropriateness for Subscriber's use case, to ensure Subscriber's compliance with legal, regulatory, and professional organization requirements'. Outputs 'are not intended to constitute legal or other professional advice of any kind'. The obligation is contractual; no product control that enforces a reviewer is described.
Ask: Which product controls, if any, force a named reviewer to approve an AI-converted template or an assembled document before it is sent to a client or filed?
