Product and intended use
Define the configuration, people, information and tasks being assessed.
Aurora platform versus review SKUs and services
Public claim only
This profile covers Aurora as Consilio's private-cloud legal-data platform and the Legal AI Suite (AI Investigate, AI Summarize, AI PrivGen/PrivDetect, Guided AI Review, Native AI Review). Consilio also sells managed document review, Sightline, Aurora Verity, RelativityOne hosting, Reveal Private Deployment inside Aurora, and talent/secondment (LOD). Alpha/Beta Consilio Labs features are not generally available.
Ask: Confirm the statement of work: Aurora hosting region, which AI modules are production versus Labs, which review engine (Relativity, Everlaw, Verity, Reveal RPD) and whether Consilio reviewers will see our documents.
Private data centres including Australia
Public claim only
Aurora is marketed as private-cloud infrastructure, not public multi-tenant SaaS. Technology page: data processing, hosting and production infrastructure physically located in certified data centres across North America, the UK, Australia, Europe and Asia. AI Investigate: data stored outside the public cloud in Consilio's private data centres. Chosen jurisdiction is a selling point; the contracted centre is not listed as self-serve.
Ask: Name the Australian (or other) data-centre location, operator and backups for our Aurora tenancy, and confirm generative inference stays in that centre.
Legal AI Suite and platform choice
Public claim only
Aurora unifies a matter portfolio and lets the customer choose a review platform per matter (Relativity, Everlaw and, from October 2025, Reveal Private Deployment). Legal AI Suite pages list AI Investigate (natural-language search in CoreECI), AI Summarize, AI Narratives, AI PrivDetect/PrivGen, Guided AI Review with human 'AI Guides', and several Alpha/Beta tools (Deposition Intelligence, Extract, PII, Protocol, Tariff, Subpoena). Claude MCP exposes Investigate without exporting data, per the May 2026 announcement.
Ask: Which of Investigate, Summarize, PrivGen, Guided AI Review, Claude MCP and Labs Alpha/Beta features will be enabled, and who (our lawyers versus Consilio guides) operates them?
Australian hosting available; intra-group access is global
Public claim only
Technology page names Australia among data-centre regions. Subprocessor list includes Consilio Global Australia for hosting, processing, support and document review (Sydney, Perth, Melbourne, Brisbane). The same list includes India, China (PRC-origin matters only), Hong Kong (rare, consent usually sought) and Relativity RelOne. Privacy notice: Consilio is US-headquartered and Personal Data may be transferred outside the customer's jurisdiction.
Ask: Will our matter data be stored and inferred only in Australia, and which Consilio affiliates (India, China, HK) are in-scope for support or review?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Matter data; managed review and Claude connector
Not confirmed
Consilio holds confidential matter data in private centres and may assign intra-group or third-party document-review subprocessors. Claude MCP lets an Anthropic application query live matters after user authentication. No per-client AI exclusion control was documented. Australian clients would still need to describe India/China/HK access and any RelativityOne path to their own clients.
Ask: Can we disable Claude MCP, managed review and non-AU affiliate access per matter, and what hosting/subprocessor description can we give clients?
In-house models, customer choice, Claude and RelOne
Public claim only
Aurora marketing: customers choose AI models and are not locked into a proprietary model. Guided AI Review: custom-built algorithms developed in-house, hosted on Consilio's private cloud; models can be trained for the specific case. The May 2026 Claude connector uses Anthropic's application while stating queries run against Consilio's private infrastructure. Subprocessor list also names Relativity RelOne and Wexler AI. The default generative model family for Investigate/Summarize was not named.
Ask: Which models and regions process Investigate, Summarize, PrivGen and Guided AI Review for our tenancy, and is Claude/RelOne/Wexler in or out of the Order Form?
Published intra-group list including AU, India and China
Public claim only
A public processors page lists Consilio LLC affiliates (US, UK, Australia, India, China, Hong Kong, Canada, Japan, Belgium, Germany, France, Switzerland, South Africa, Mauritius) for hosting, support and, in some cases, document review. Third-party service subprocessors named include Forensic Innovations, Linguistic Systems, Millnet, Veritone, Relativity RelOne and Wexler AI. China is footnoted as restricted to PRC-originating matters; Hong Kong as rare with usual client consent. RelativityOne subprocessors may differ. Notice/objection period is not stated.
Ask: Confirm the processors in scope for our AU-hosted Aurora matter, 30-day notice/objection, and whether RelOne or Wexler will touch our data.
Case-specific custom models; general training not stated
Not confirmed
Guided AI Review is marketed as using custom models trained for the specific case or investigation, hosted on Consilio's private cloud. No contractual clause stating that matter data is never used to train Consilio or third-party foundation models was found. The website privacy notice lists 'improve our Products and Services' among purposes for Personal Data, which is not the same as a Hosted Data training warranty.
Ask: Confirm in the MSA/DPA that prompts, documents, embeddings and logs are not used to train Consilio or third-party foundation models, and that case-specific models cannot leak across customers.
AI Guides and product improvement
Not confirmed
Guided AI Review uses Consilio consultants to iterate prompts and validate outputs. Privacy notice includes quality assurance and product improvement as purposes for Personal Data. No description of in-product thumbs-up/down for generative answers, or a contractual bar on using those signals to train models, was found.
Ask: Do AI Guide prompt iterations or any in-product feedback leave our tenancy, and is that use off unless we consent in writing?
Unpublished retention policy
Not confirmed
Privacy notice: Personal Data is processed as reasonably necessary for contractual or legal obligations and legitimate interests, under a 'Data Retention and Disposal Policy' available on request to privacy@consilio.com. Daily incremental and weekly full backups of critical data are described. No numbered live-matter schedule for Hosted Data, prompts or generative outputs is published.
Ask: Provide the numbered retention schedule for our Aurora projects, prompts, outputs, logs and backups, including after we close a matter.
No public deletion period or certificate
Not confirmed
No public MSA, DPA or product terms stating a post-termination export window, deletion period or certificate were found. Privacy notice refers generally to a disposal policy. Backup policy implies copies exist beyond live systems.
Ask: On matter close or contract end, what is deleted from Aurora, backups, RelOne/Wexler/Claude paths, within how many days, with what certificate?
Follow-the-sun affiliates and AI Guides
Public claim only
Intra-group subprocessors in India, Australia, China, Hong Kong and elsewhere provide technical support, follow-the-sun support and document review. Guided AI Review is staffed by Consilio consultants who prompt and validate models. Privacy: employees and contractors complete background screening; client data is treated as confidential. Compelled-disclosure notice to the customer is not in the public privacy notice.
Ask: Is support and AI Guide access per-ticket with our approval, logged to us, limited to named countries, and will you notify us of legal process seeking matter content?
SSO not documented on pages reviewed
Not confirmed
Claude connector: users authenticate with a Consilio ID. Privacy lists identification and authentication as processing purposes. SAML/OIDC SSO, MFA enforcement, SCIM and matter ethical walls were not specified on the Aurora or technology pages reviewed.
Ask: Do you support SAML/OIDC SSO-only, MFA enforcement, SCIM and matter-level ethical walls, including for Claude MCP users?
Network controls claimed; algorithms not named
Public claim only
Privacy notice: networks use a DMZ, multiple firewalls, intrusion detection/prevention, antivirus and strict access control; devices and data are stored securely. Technology page claims certified data centres. TLS version, AES-256 (or equivalent) at rest, and customer-managed keys were not stated.
Ask: Confirm TLS 1.2+ and AES-256 (or equivalent) in transit and at rest, including backups and any RelOne/Claude path, and whether CMK is available.
ISO 27001/27701, SOC 2 Type II, HITRUST, Cyber Essentials Plus
Public claim only
Technology page and privacy notice: Consilio is certified to ISO/IEC 27001:2022 and HITRUST CSF; collocated data centres are certified to ISO 27001 or SOC 2 Type 2; SOC 2 Type 2 attestation; ISO 27701; UK locations Cyber Essentials Plus; ITAR; GDPR and CCPA. Reports were not downloaded. Technology page still lists EU-US and Swiss-US Privacy Shield, which the privacy notice replaces with Data Privacy Framework language.
Ask: Provide current SOC 2 Type II, ISO 27001/27701 and HITRUST reports covering our AU data centre and Aurora generative features, including period and entities in scope.
No public MSA, DPA or liability cap
Not confirmed
No public master terms, DPA or liability cap were found. Privacy notice can be updated from time to time without notice; continued use is treated as agreement. Security contact infosec.clientrequests@consilio.com is given for RelativityOne questions. Engagements appear to be statement-of-work / MSA based.
Ask: Will our MSA include a DPA with APP flow-down, output ownership, a meaningful cap for confidentiality/data breach, and Australian or NSW law/forum?
US HQ, DPF/SCCs, Privacy Shield leftover, India and China affiliates
Not confirmed
Privacy notice: US headquarters; Personal Data may be stored outside the customer's jurisdiction; EU transfers via adequacy, SCCs, intra-group agreements or GDPR Article 49 derogations; UK SCCs; EU-US and Swiss-US Data Privacy Framework principles. Technology page still claims Privacy Shield, which is no longer a valid EU transfer tool. Intra-group processors include India (hosting, support, AI consulting, document review) and China (PRC-origin matters). Australia is a listed hosting region.
Ask: Name every country of storage, inference and support access for our tenancy, and confirm Privacy Shield is not relied on for our DPA.
Incident policy claimed; no public hours
Not confirmed
Privacy notice: an incident management policy requires proactive measures to prevent and report security incidents and mitigate their effects. No numbered customer-notification period or NDB cooperation clause is published. infosec.clientrequests@consilio.com is a security contact for RelativityOne queries.
Ask: Within how many hours of discovering a suspected incident affecting our Hosted Data will you notify us, and will you support an NDB assessment?
Privacy notice changeable without notice; Labs pipeline
Public claim only
Privacy notice may be updated from time to time without notice; continued interaction constitutes agreement. Consilio Labs runs Alpha and Beta programmes before production. Claude MCP and Reveal Private Deployment are recent additions. Subprocessor change notice is not stated on the processors page.
Ask: Will our MSA freeze terms during the term, and notify us before adding LLM providers, MCP, RelOne/Wexler or changing hosting/inference regions?
Export and deletion not in public terms
Not confirmed
Aurora marketing emphasises freedom from platform lock-in and reuse of work product across matters. No public export format, post-termination window or certified deletion clause was found. RelativityOne or Reveal RPD exit would follow those vendors' terms as well.
Ask: How do we export natives, work product, productions, custom models and audit logs on exit, in what format, and when are remaining copies deleted?
Review platforms and Claude MCP
Not confirmed
Aurora connects matters to Relativity, Everlaw, Verity and Reveal Private Deployment. The Claude connector (MCP) authenticates with a Consilio ID and queries live repositories from Anthropic's application, with Consilio stating data is not moved, duplicated or exported. Each is a disclosure path.
Ask: What does the Claude MCP send to Anthropic, which review-platform connectors are on by default, and how do we disable them without a ticket?
Investigation over the hosted matter corpus
Public claim only
AI Investigate is described as natural-language questions across documents and metadata in the customer's active Consilio matters, running against the full matter repository in private infrastructure. Open-web search as an Aurora feature was not found. Claude's own web tools, if enabled in the user's Anthropic account, would sit outside Consilio's control.
Ask: Confirm Aurora Investigate/Summarize do not call the open web on our matters, and how Claude is blocked from web search using our record.
Expert-guided AI; MCP actions in Claude
Not confirmed
Guided AI Review is framed as human oversight at every step, with Consilio AI Guides iterating prompts. The Claude connector currently exposes Investigate; additional project and workflow tools are expected to follow. Guardrails, a kill-switch and which actions Claude may take on a Consilio matter were not in a public contract.
Ask: Which MCP tools can write, export or launch workflows versus read-only Investigate, and how do we freeze Claude and Labs agents immediately?
Citations and AI Guides; not a public contractual duty
Public claim only
Legal AI Suite marketing: transparency via audit trails, source citations and expert validation. Summaries are described as source-backed. Guided AI Review uses consultants for quality control. No public terms clause requiring a qualified legal professional to approve outputs before use was found.
Ask: Can we require named sign-off before a privilege log, summary or coding decision leaves Aurora, with an export of who verified which items?
