Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and modules covered
Public claim only
The AI transparency policy lists the TrademarkNow features by name and function: NameCheck (name risk scoring, a phonetic engine, normaliser, goods and services similarity and translation), LogoCheck, LogoWatch and Industrial Design (neural-network embeddings for visual similarity), Watch and Search (phonetic detection, goods and services summaries and translations, and Nice Class classification) and Name Generator (generative, on enterprise OpenAI models). The same document separates Brand Protection (Corsearch Zeal) and Content Protection features, which are not TrademarkNow. The product page adds ExaMatch, Automated Watch, Expert Watch, Company Name search and Corsearch Pharma.
Ask: Which TrademarkNow modules, including Name Generator and Expert Watch, are in our order form, and which can be disabled for our account?
Deployment and hosting location
Public claim only
The service is a hosted platform reached through corsearch.com with platform logins; no on-premises or private-cloud option is published. The AI transparency policy states that 'Corsearch AI data and platform infrastructure are hosted securely in data centers located in Germany, Europe', checked 2026-09-27. No Australian, Asia-Pacific or United States region is offered on any page read.
Ask: Is any Australian or Asia-Pacific hosting region available for an Australian firm, and if not, does all processing of our queries occur in Germany?
AI functions and their classification
Public claim only
The AI transparency policy classifies each TrademarkNow feature under the EU AI Act: NameCheck, LogoCheck, LogoWatch and Industrial Design are described as analytical AI systems using neural networks and mathematical embeddings, Watch and Search as an analytical or summarisation system using large language models and natural language processing for goods and services summaries and translations, and Name Generator as a generative AI system under Article 50(2) powered by enterprise OpenAI models. Outputs listed include similarity scores, dominance analysis, threat ranking, translated goods and services text, visual similarity embeddings, Nice Class suggestions and candidate trade mark names. The product page adds that neural-network models analyse phonetics, spelling, meaning and visuals.
Ask: For each module we license, what is the output, what does the score mean, and which features are generative rather than analytical?
Jurisdiction, registers and translation
Public claim only
The product page states screening across 190 global trade mark registries; no register is itemised and no Australian register is named on the pages read. The AI transparency policy names public trade mark registry data as a training and processing source for the similarity and phonetic engines. The user agreement states Corsearch may supply an English translation of goods and services citations where an office or third party does not, identifies such text as translated, expressly disclaims the accuracy and comprehensiveness of any translation, may not translate all records, and places responsibility for verifying translations on the user.
Ask: Is the Australian trade mark register included and how current is it, and which goods and services text in an Australian search would be machine translated?
Vendor content directing how AI describes the product
Not confirmed
A deliberate check for vendor content directing how AI models, assistants or crawlers should describe the product found none, checked 2026-09-27. The site map and the five pages read surfaced no /llms.txt, /ai-info or equivalent, and the document at /legal/corsearch-ai-transparency-policy is a notice about the vendor's own use of AI rather than instructions to AI systems about how to describe the vendor.
Ask: Does Corsearch publish any page or embedded instruction addressed to AI models or crawlers about how to describe TrademarkNow?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional responsibility
Public claim only
The AI transparency policy states that in Trademark Solutions 'responsibility for legal evaluation rests with the Customer (including legal counsel and law firms advising their clients). Liability for final legal advice or consequential decisions remain strictly with the customer', and that the final decision to act on an AI output rests entirely with the user. The user agreement states that information retrieved is not to be construed as a legal opinion on whether a mark may be used or registered, and that 'Corsearch is not a law firm and does not issue legal opinion(s)'. The data protection agreement makes the customer the controller and requires it not to disclose sensitive personal data to Corsearch.
Ask: What client consent or engagement wording do you expect where our clients' brand candidates and naming criteria are entered into your platform?
Model providers and inference
Public claim only
The AI transparency policy states Corsearch uses 'secure commercial enterprise instances from third-party providers, including OpenAI, Google Gemini and Amazon AI' and maintains enterprise data processing agreements with them 'to ensure that inputs, prompts and queries are never used to train public or third-party underlying models'. For TrademarkNow specifically, Name Generator is described as powered by enterprise OpenAI models, while NameCheck, LogoCheck, LogoWatch and Industrial Design are described as the vendor's own neural-network and narrow-AI engines. Corsearch states it acts as an AI provider where it builds, trains or fine-tunes proprietary models and as an AI deployer where it integrates third-party models, depending on the feature. The list is stated as non-exhaustive ('including') and no model version or inference region is given for the third-party providers.
Ask: For each TrademarkNow module, name the model and provider, the region the endpoint runs in, and the enterprise agreement relied on.
Subprocessors
Public claim only
Data protection agreement clause 7 gives Corsearch a general written authorisation to engage subprocessors, points to a current list at corsearch.com/privacy/subprocessors, imposes obligations on subprocessors no less protective than the DPA, keeps Corsearch liable for them, and requires at least 30 days' written notice of additions or replacements, with a subscription mechanism for updates. Clause 7.5 allows objection where a subprocessor objectively causes or is likely to cause a risk to security or to the customer's compliance, and clause 7.6 gives each party a right to terminate the affected services if an objection raised within 10 days cannot be resolved. The subprocessor list itself was not fetched within the operation budget for this profile, so its contents are unverified.
Ask: Provide the current dated subprocessor list for TrademarkNow, including the AI infrastructure providers and the hosting operator, with each one's country and function.
Training on customer content
Public claim only
The AI transparency policy states that public marketplace and web data and public trade mark registry data are used to train the vendor's classification, similarity and phonetic models, and that for 'Customer Inputs & Moderation Guides' (customer-provided logos, brand keywords, relevance prompts, search criteria and moderation guides) 'Customer inputs are used for limited, targeted model refinement' with content and guidelines from one customer never used to generate content for another. Two carve-outs are stated as no training: information entered into Name Generator 'is never used to train generative AI models', and user personal data is not used to train any model. The document does not say whether a TrademarkNow search query or seed mark counts as a customer input available for that limited model refinement.
Ask: Are our TrademarkNow search queries, seed marks and uploaded logos used for model refinement, and will you contract to exclude them?
Feedback and quality monitoring
Public claim only
The AI transparency policy gives users a right to report inaccurate, biased or improper AI-generated content through support channels, and states that Corsearch conducts regular quality assurance using proprietary benchmarks measuring precision, recall and stability. It does not say whether reported corrections feed back into model refinement. The data protection agreement treats user data (login credentials, user names and account telemetry) as data Corsearch processes as an independent controller for its own purposes, including providing and securing the services.
Ask: Where do our reported corrections go, and are they used to refine models that serve other customers?
Retention
Public claim only
Data protection agreement Schedule A gives the retention period for Customer Personal Data as the duration of the agreement, with Corsearch platform retention periods under the agreement applying where available, and clause 9.1 permits retention for up to 30 days after expiry or termination. Schedule A describes the categories of data subjects as sellers and advertisers of potential counterfeits and potential infringers of the customer's intellectual property rights, which is brand-protection framing rather than trade mark search framing, and no separate schedule for TrademarkNow was found. No published retention period covers search queries, watch alerts, generated names or reports.
Ask: State the retention period that applies to TrademarkNow search queries, watch alerts, generated candidate names and delivered reports, and whether Schedule A is replaced for trade mark services.
Deletion and return
Public claim only
Data protection agreement clause 9.1 requires prompt deletion of Customer Personal Data after the 30-day post-termination window unless retention is required by data protection law, expressly excluding copies of personal data processed on behalf of another Corsearch customer or by a subprocessor. Clause 9.2 requires return of all existing copies where the customer gives at least 30 days' prior written notice. No certificate of destruction is promised and nothing addresses deletion of data that is not personal data, such as search histories and reports.
Ask: Will you certify deletion in writing, and does deletion extend to search histories, reports and any copies held by the AI infrastructure providers?
Vendor access to content
Public claim only
Data protection agreement clause 4.1 requires all persons who process Customer Personal Data to be under confidentiality obligations at least as protective as the DPA, to have sufficient skills and training on commercially reasonable endeavours, and to comply with data protection laws. Access is also operational: the product page describes Expert Watch as combining AI-driven monitoring with expert review workflows, and the AI transparency policy states that in Brand Protection and Content Protection 'Corsearch analysts and customer users provide essential human oversight before taking enforcement actions'. The technical and organisational measures document that clause 4.2 relies on was not read, so no staff-access control detail is verified, and no country is published for support staff.
Ask: Which Corsearch personnel can see our searches and watch portfolios, in which countries, and is that access logged and available to us?
Access control and authentication
Not confirmed
The user agreement describes registration for a username and password and platform logins, and prohibits circumvention of authentication, bulk database downloading and automated query generation. Single sign-on, multi-factor authentication, role separation and administrator audit logs are not described on any page read; data protection agreement clause 4.2 points to a technical and organisational measures document at corsearch.com/privacy/technical-and-organisational-measures, which was not fetched within the operation budget.
Ask: Does the platform support SSO and enforced multi-factor authentication, and can an administrator export a per-user access and search log?
Encryption and technical measures
Public claim only
Data protection agreement clause 4.2 obliges Corsearch to implement and maintain appropriate technical and organisational measures 'as detailed here', linking to corsearch.com/privacy/technical-and-organisational-measures, and permits updates provided they do not materially decrease the overall level of security. That document was not fetched within the operation budget, so no algorithm, transport version or key-management arrangement is verified. The AI transparency policy points to ISO 27001:2022 certification without naming any specific control.
Ask: Provide the technical and organisational measures schedule, including encryption in transit and at rest and key management, and confirm it is contractually binding on us.
Independent security assurance
Public claim only
The AI transparency policy states that Corsearch platforms maintain technical safeguards 'demonstrated by our ISO 27001:2022 security certification'; no certificate, scope or statement of applicability was read. Data protection agreement clause 10 gives the customer, or a third-party auditor bound by confidentiality, an audit right exercised by requiring completion of the customer's security assessment questionnaire and, to the extent applicable and available, requesting copies of certifications and audit reports issued by independent third parties where controls have not materially changed. No SOC 2 report, penetration test or AI management system certification is claimed.
Ask: Provide the ISO/IEC 27001:2022 certificate and scope naming TrademarkNow, plus any SOC 2 report and the most recent penetration-test summary.
Contract, entity, liability and forum
Public claim only
The data protection agreement names Corsearch B.V., registered in the Netherlands with KVK 54875625 at Naritaweg 116, 1043 CA Amsterdam, and forms part of a Corsearch Master Services Agreement or other written agreement. The user agreement governs site and service use unless a separate contract is in place, limits any liability related to the content and preparation of a trade mark search report, and of an international search report with opinion, to a refund of the fees paid, and disclaims accuracy, non-infringement, comprehensiveness, currency and suitability of purpose for retrieved information. Neither document read states a governing law or forum, no Australian contracting entity appears, and the data protection agreement does not list Australian privacy law among the Data Protection Laws it covers.
Ask: Which entity would contract with an Australian firm, under which governing law and forum, and will the agreement cover the Privacy Act 1988 (Cth) and Australian Privacy Principle 8?
Cross-border transfers
Public claim only
The AI transparency policy states platform infrastructure is hosted in data centres in Germany. Data protection agreement clause 8 permits transfers of Customer Personal Data to affiliates and subprocessors outside the EEA where carried out in accordance with data protection laws, and requires the relevant standard contractual clauses, published at corsearch.com/privacy/sccs and incorporated into the DPA, for transfers to a third country. The framework is built around export from the EEA, the United Kingdom and Switzerland; Australia is not addressed, and no country list is published for the AI infrastructure providers.
Ask: List every country in which our queries, watch data and AI inference are processed, and how transfers out of Australia would be handled under Australian Privacy Principle 8.
Incident notification
Public claim only
Data protection agreement clause 4.3 requires Corsearch to notify the customer of a data breach without undue delay and in any event within 72 hours of becoming aware, with specified content including the nature of the breach, categories and approximate numbers affected, likely consequences and remediation, and to cooperate with the customer's own obligations. Clause 4.3.5 states that, except where required by data protection law, Corsearch will not notify any third party including a supervisory authority or data subject, and clause 4.4 requires the customer to coordinate in good faith on public statements that refer to Corsearch, its employees, a subprocessor or the services. The definition of data breach covers breaches suffered by Corsearch or any subprocessor but excludes breaches caused by the customer or a user. No incident history is published.
Ask: Confirm the 72-hour clock applies to our agreement, how it works alongside Australian notifiable data breach obligations, and whether there have been material incidents in the last 24 months.
Change notice for models, processors and terms
Public claim only
The AI transparency policy states that Corsearch uses various AI models and providers and that 'If a change to an AI tool materially decreases privacy, security, functionality, or performance, Corsearch provides 30 days' advance notice to impacted customers. Routine updates do not require prior notice', and that the notice itself may be updated by updating the page. Data protection agreement clause 7.4 gives at least 30 days' written notice of subprocessor additions or replacements, and clause 8.2 reserves the right to change the published standard contractual clauses where legally required. The user agreement states Corsearch may change it at any time without prior written notice, with posting treated as written notice and continued use treated as acceptance.
Ask: Who decides whether a model change materially decreases performance, and can we require notice of every model or provider change affecting our searches?
Export and exit
Public claim only
Data protection agreement clause 9.2 requires return of all existing copies of Customer Personal Data on at least 30 days' prior written notice, and clause 9.1 sets a 30-day post-termination retention window before deletion. Against that, the user agreement prohibits downloading substantial portions of the databases and restricts reproduction, dissemination and resale of retrieved data, so what a firm may retain after exit depends on those restrictions rather than on an export right. No export format, migration assistance or archive access period is published.
Ask: On exit, in what format are our searches, watch portfolios and reports returned, and what may we keep and continue to use under the reproduction restrictions?
Connectors and third-party data sources
Public claim only
The user agreement describes investigative tools that retrieve additional information on referenced records through third-party providers, naming data from the USPTO, internet search engines and Secretary of State offices, disclaiming accuracy and comprehensiveness, and stating that where a user reaches a third-party public website through those tools the user must accept that site's own access agreement and is wholly responsible for compliance. The AI transparency policy names OpenAI, Google Gemini and Amazon AI as AI infrastructure and model providers under enterprise data processing agreements. No customer-facing connector or integration is published.
Ask: Which third-party sources do the investigative tools call for an Australian search, and what of our query is sent to each?
Open-web retrieval
Public claim only
For TrademarkNow the processing sources listed in the AI transparency policy are public trade mark registry data and customer inputs; scraped marketplace and web data is listed against Brand Protection and Content Protection rather than Trademark Solutions. The user agreement, however, states that investigative tools retrieve data from third-party providers including internet search engines and Secretary of State offices, and the product page offers Company Name search for common-law searching and competitive landscaping, which is retrieval beyond the registers.
Ask: Does any TrademarkNow feature query the open web or a search engine at run time, and can that be disabled for our account?
Automated actions and autonomy
Public claim only
The AI transparency policy states 'Our systems avoid fully autonomous decision making, and we encourage customers to involve human oversight. The final decision to act upon an AI output rests entirely with the user', with analyst and customer oversight before enforcement action in Brand Protection and Content Protection. For Trademark Solutions the described behaviour is scoring, ranking, alerting and suggestion rather than action: Automated Watch surfaces matches for review and Name Generator produces candidate names. No filing, correspondence or enforcement step is described as taken automatically for TrademarkNow.
Ask: Can any watch or screening configuration send output to a third party, or initiate any step, without one of our users approving it?
Human review of AI outputs
Public claim only
The AI transparency policy gives users a 'Right to Human Review': to request that risk scores or programmatic classifications with material impact be reviewed by a human team member, and a right to transparency about how a tool calculates scores or generates outputs. It also records that outputs are guidance only, are not formal legal clearance, and that in Trademark Solutions responsibility for legal evaluation rests with the customer. Expert Watch is described on the product page as combining AI-driven monitoring with expert review workflows; no in-product control requiring a named reviewer before an output is used is described.
Ask: How is the right to human review exercised in practice, within what time, and does it cover NameCheck similarity scores and Nice Class suggestions?
