Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and modules covered
Public claim only
One product line, contract review for conveyancing, sold as separate NSW and VIC offerings. The features page lists data extraction and population, contract navigation, Ria Findings, Smart Prefill for NSW and for VIC, Visual Reference, Title Understanding, Property Imagery, Dealing Extraction, Preflight, Cross-Document Verification, Library, Personalised Reports, Amendment List, Report Versions, Reporting and Analytics, edge-case coverage for multi-property contracts, CRM integrations and a unified workspace. Each is tagged NSW, VIC or both; Smart Prefill for NSW, Title Understanding and Dealing Extraction are tagged NSW only.
Ask: Which features in our order form apply to Victorian files, and which of the NSW-only features have no Victorian equivalent yet?
What the software does
Public claim only
On the vendor's account, Curia reads every page of a contract and writes values into the review, including front page, special conditions, dealings and planning certificates; Ria Findings set an answer, the reasoning and a citation to page and clause; Smart Prefill organises NSW special conditions against the firm's categories with a citation on every entry, and for VIC summarises every general and special condition in plain English and maps what amends, overrides or deletes what; Title Understanding parses titles and plans from lot through to community and describes dealings in plain English; Preflight cross-checks data across the file, confirms prescribed documents are attached and flags what is missing with colour-coded priority alerts; Cross-Document Verification keeps values that should agree across a bundle in step and flags documents whose validity has lapsed; the Amendment List builds from visible recommendations; Report Versions captures each downloaded report as a fixed dated version.
Ask: Can we see Ria Findings, Smart Prefill and Preflight run on a sample of our own NSW and Victorian files, with the citations checked against the source pages?
Jurisdiction and external data sources
Public claim only
NSW and Victoria. Schedule 1 to the terms states the Software incorporates NSW Government spatial data from Spatial Services (cadastre boundaries, planning overlays, property data and satellite imagery) under Creative Commons Attribution 4.0, and Victorian Government (Vicmap/DTP) spatial data under Creative Commons Attribution 3.0 Australia with imagery credited to Esri, Maxar and Earthstar Geographics, and that inclusion is not endorsement by either government. Clause 16.2 disclaims responsibility for the accuracy, quality, integrity or reliability of third party content, and Schedule 1 subjects the accuracy, completeness and currency of third party spatial data to that clause.
Ask: How current is the government spatial and planning data behind Property Imagery and Preflight, how often is it refreshed, and what happens when a source is unavailable?
Deployment and hosting
Public claim only
Hosted software accessed at app.curia.com.au; no private cloud, on-premises or self-hosted option is published, and clause 2.2(a) prohibits attempts to access or control the server on which the Software is hosted except through the client interface. The security page states 'We utilise enterprise-grade cloud infrastructure' without naming a provider, and that 'Data is stored in Australia. Some processing may be performed by our technology suppliers outside Australia.' Privacy policy clause 11.1 names the United States as one such location. No hosting provider, region or availability zone is named.
Ask: Which cloud provider and Australian region hold our data, and which processing steps run with suppliers outside Australia?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. None of the pages read (features, security and privacy, terms version 7, privacy policy version 2.1, contact) carries a block addressed to AI models, assistants or LLMs, or a heading of the 'Instructions for AI Assistants' kind. Status checks the same day returned not found for /llms.txt, /llms-full.txt, /ai.txt and /ai-info. A robots.txt is published and reads 'User-agent: * Allow: / Allow: /_emdash/api/media/file/ Disallow: /_emdash/ Sitemap: https://www.curia.com.au/sitemap.xml': crawler access directives only, which are access control and not a direction about how the product should be described. The published site map holds 48 URLs, most of which were not read.
Ask: Do you publish, on any page or file, guidance telling AI assistants or crawlers how to describe Curia?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the software
Public claim only
Clause 21.6 makes the customer solely responsible for all Customer Material, and clause 21.7 requires the customer to ensure that Customer Material and its collection, use, processing, disclosure and dissemination via the Software does not infringe any person's intellectual property rights and complies with all applicable laws including Privacy Laws. Clause 2.3 prohibits use that breaches applicable laws. Clause 30.1 defines a Transaction Participant as a person granted access to a limited part of the Software in connection with a particular matter, including the customer's client, another party to the transaction, a representative of that party and a real estate agent, and the Authorised Purpose includes facilitating access by the customer's clients and other participants.
Ask: When we grant a purchaser, a vendor's representative or an agent Transaction Participant access, what can each see, and what consent do we need to record for that disclosure?
Models and model providers
Not confirmed
No model, model provider or model version is named on any page read. The security page states 'We use AI services under terms that prohibit our providers from using your data to train their models', without naming the providers or the contractual instrument. Clause 16.2 of the terms refers generally to third party content including open source software. Privacy policy clause 11.1 states some processing may be performed by technology suppliers outside Australia, including in the United States, without naming them.
Ask: Which model providers and models process our contracts, in which country does inference run for an Australian customer, and where is the provider no-training obligation recorded?
Subprocessors
Public claim only
No subprocessor list is published and no page of that kind appears in the published site map. Privacy policy clause 12.1 names one third party by name, Xero, for bookkeeping and accounting, with a link to its privacy policy. Clause 13.2 lists categories rather than names: affiliates; third parties including business partners, suppliers and subcontractors; disclosure required by law; an actual or potential buyer in a merger or acquisition; and others with consent. Terms clause 1.4 permits Curia to engage a third party service provider to assist in delivery, installation, customisation or support, and clause 28.3(b) permits disclosure of confidential information to permitted sub-contractors. The AI and cloud suppliers are unnamed.
Ask: Will you provide a named subprocessor list with processing locations, covering the AI, cloud, email and analytics suppliers, and give notice before it changes?
Use of uploaded contracts to train models
Public claim only
Two separate statements apply. The security page states 'We use AI services under terms that prohibit our providers from using your data to train their models', which addresses third-party providers. The terms address Curia's own use: clause 21.1(c) licenses Customer Material for 'internal training, including training of our AI models', and clause 21.8(a) permits uploaded contracts, documents and files to be used for monitoring compliance and system performance, internal analytics and quality assurance, 'training, development and improvement of AI models and features within the Software only', supporting research and development, and deriving aggregated and deidentified insights, statistics and analytics that may be used, published and disclosed to third parties in industry reports, benchmarks and public publications. Clause 21.8(b) permits disaggregation across different model training exercises, 21.8(d) and (e) state uploaded information will not be shared with third parties or commercialised, 21.8(f) sets the deidentification standard for published insights, and 21.8(c) states the rights continue after the account is terminated. No opt-out is published.
Ask: Can our files be excluded from clause 21.8 model training and from the aggregated insights published under 21.8(a)(v), and what happens to material already in a training dataset if we exit?
Use of feedback, corrections and usage data
Public claim only
Terms clause 21.8(a) covers monitoring compliance and system performance, internal analytics and quality assurance, and supporting research and development, alongside model training. Privacy policy clause 5.1(g) includes 'feedback and reviews' within Profile Data and clause 5.1(h) collects Usage Data about how the customer uses the Software and services. Nothing published distinguishes feedback a user submits deliberately from the edits a reviewer makes to a prefilled entry, a finding or a report.
Ask: Are the corrections our reviewers make to prefilled entries and Ria Findings captured as training or quality-assurance signal, and can that be turned off for our workspace?
Retention
Public claim only
Privacy policy clause 8.1 ties retention of personal data to an ongoing business need, including legal, tax or accounting requirements, and clause 8.2 retains it while the relationship continues and for a period afterwards, then deletes or anonymises it; no period is stated. Terms clause 13.6(b) deletes access and data stored in the Software 90 days after account cancellation, and clause 13.6(c) carves out system backups containing customer data, application and security logs, uploaded contracts incorporated into training datasets, and derived models. Clause 13.6(e) allows free trial accounts to be deleted immediately after the trial subject to the same carve-outs. Backup and log retention periods are not published.
Ask: What are the actual retention periods for uploaded contracts, reports, application and security logs, and backups, and can we set a shorter retention at workspace level?
Deletion and the training carve-out
Public claim only
Terms clause 13.6 states that on cancellation by either party the customer must request which data it requires, that Curia will provide a copy in PDF or CSV form, and that access and data stored in the Software will be deleted 90 days after cancellation. Clause 13.6(c) expressly retains, notwithstanding that deletion: system backups containing customer data for operational and disaster recovery; application and security logs that may contain references to account activity; uploaded contracts that have been incorporated into training datasets or used in developing or improving the AI models and features; and derived models and algorithms trained using those uploaded contracts, which are stated to be general to the Software and not specific to the account. Clause 13.6(d) disclaims liability for loss of data following cancellation.
Ask: Which of our uploaded contracts would be retained under clause 13.6(c)(iii) after we exit, how would we be told which they are, and can that carve-out be removed from our agreement?
Vendor personnel access to contracts
Public claim only
Nothing published on the pages read commits Curia to a support-access control, an access log, customer notification or a least-privilege rule for staff opening a customer's contracts. The closest published statements are terms clause 28.3(b), permitting disclosure of confidential information to a party's directors, agents, professional advisors, employees, contractors and permitted sub-contractors solely for exercising rights or performing obligations under the agreement, and clause 21.1(a) and (b), licensing Customer Material for providing the Software and support. The security page states firms maintain complete control over user access and permissions, which addresses customer users rather than vendor staff.
Ask: Which Curia roles can open a customer contract or report, is that access logged and available to us, and does support access require our approval?
Authentication and permissions
Public claim only
The security page states single sign-on integration with Microsoft and Google accounts, that firms maintain complete control over user access and permissions, and that the unified workspace provides visibility. Terms clause 5.1 states that on the commencement date a username and temporary password are delivered to the notified email address. Clause 30.1 separates a User, being a person the customer authorises including its personnel and contractors, from a Transaction Participant, who is granted access to a limited part of the Software for a particular matter. No statement was found on multi-factor authentication where single sign-on is not used, role definitions, session control or IP restriction.
Ask: Is multi-factor authentication enforced for accounts that do not use Microsoft or Google single sign-on, and what exactly can a Transaction Participant see?
Encryption
Public claim only
The security page states 'Data is encrypted both during transmission and storage' and that enterprise-grade cloud infrastructure is used. Privacy policy clause 11.2 states all reasonably necessary steps are taken to secure information from misuse, interference, loss and unauthorised access, modification or disclosure, while noting transmission over the internet is not completely secure. No algorithm, key management arrangement or customer-managed key option is published.
Ask: What encryption standards and key management apply in transit and at rest, and who can access the keys?
Independent assurance
Not confirmed
No certification, audit report, penetration test or external assessment is claimed on the security and privacy page, in terms version 7, or in privacy policy version 2.1, and no trust centre or compliance page appears in the published site map of 48 URLs. The page states 'Industry-standard security practices' without naming a standard or an assessor. A status page at status.curia.com.au is published but was not read. This absence is the finding.
Ask: Do you hold SOC 2, ISO 27001 or ISO/IEC 42001, or a recent independent penetration test, and will you provide the report and assessor name under NDA?
Contractual documents
Public claim only
Terms and conditions version 7, dated 8 September 2026, form a binding contract with Curia Pty Ltd ACN 673 867 733 and are incorporated into an Order Form on acceptance (clause 1.1). A published change history of previous and upcoming changes is linked from the terms. Clause 16.1 makes the Software available 'as is' with no representation, warranty or guarantee, subject to the Australian Consumer Law in clause 24. Clause 29 applies the laws of New South Wales, and clause 26.2 refers unresolved disputes to the NSW courts or to Resolution Institute arbitration in Sydney at Curia's election. Privacy policy version 2.1 of 27 August 2026 applies to personal information. No data processing agreement, security schedule or subprocessor addendum is published.
Ask: Will you enter a data processing agreement and security schedule, and will the order form vary clauses 21.1 and 21.8 and the clause 13.6(c) retention carve-outs?
Cross-border processing
Public claim only
Privacy policy clause 11.1 states 'We store data in Australia. Some processing may be performed by our technology suppliers outside Australia, including in the United States. Where this occurs, those suppliers are engaged under contractual terms that restrict their use of the data to providing services to us.' Clause 14.1, headed International Data Transfers, cross-refers to clause 11.1 and adds nothing further. The security page repeats the same two sentences. Terms clause 21.4 states the rights Curia obtains may be exercised in all Australian states and territories and worldwide. The suppliers, the processing steps performed overseas and the contractual mechanism are not identified.
Ask: Which processing steps run outside Australia, with which suppliers and in which countries, and can our workspace be configured so that no contract content leaves Australia?
Incident handling and notification
Public claim only
Privacy policy clause 11.4 states that on becoming aware of unauthorised access to, or unauthorised disclosure or loss of, information held, Curia will assess the incident promptly and take reasonable steps to contain it and limit resulting harm. Clause 11.5 states that where an incident is likely to result in serious harm to an individual, Curia 'will notify the affected customer without undue delay and provide the information reasonably necessary for that customer to meet its own notification obligations'. Terms clause 18.4 requires the customer to inform Curia immediately of any breach of the Software system or security it becomes aware of, with details sufficient to recreate or remedy it. No fixed notification period, contact protocol or post-incident report commitment is published.
Ask: What notification period applies in hours, who is contacted, and will you commit to a written post-incident report where our client data is involved?
Changes to the software and the terms
Public claim only
Terms clause 10.1 states Curia may add, modify, redesign or discontinue any feature, functionality or tool within the Software at its own discretion and without notice, but will notify the customer by email where it makes a material adverse change in the core functionality; clause 13.1(d) then gives a termination right following that notification. Clause 31(c) requires at least 30 days prior notice of a Material Variation, defined as a variation reducing the customer's rights, increasing its obligations or increasing the fees. A change history of previous and upcoming terms changes is published, and the privacy policy is versioned (2.1, 27 August 2026) with clause 1.2 cross-referring to clause 29.5 of the terms where a change varies the agreement.
Ask: Will a change to the extraction logic, Ria Findings or the traffic-light style risk ratings be notified as a material change to core functionality under clause 10.1?
Exit and data export
Public claim only
Terms clause 13.2 lets either party terminate at any time without reason on 30 days written notice. Clause 13.6(a) states that on cancellation the customer must request which data stored on the account it requires and Curia will provide a copy of the requested data in PDF or CSV form; clause 13.6(b) deletes access and stored data 90 days after cancellation, subject to the clause 13.6(c) carve-outs, and clause 13.6(d) disclaims liability for loss of data following cancellation. Report Versions are described on the features page as fixed dated versions that can be re-downloaded. No API export, bulk download or migration assistance is published, and no request window is stated.
Ask: By when must we make the clause 13.6(a) request, what does 'requested data' cover, and can we get the underlying structured review data rather than PDF or CSV renderings?
Integrations and data flows
Public claim only
The features page describes CRM integrations that connect Curia to a practice management system so contacts and matters sync automatically and each review is findable by purchaser, address and matter details, without naming a system; a dedicated CRM integrations page exists in the published site map but was not read. Single sign-on with Microsoft and Google accounts is stated on the security page. Schedule 1 to the terms names government spatial data sources and third-party imagery. Terms clause 8.2 makes the customer responsible for data entered into any record management system or Third Party Software that interfaces with the Software and states that 'the Software does not perform any verification procedure in relation to information from Third Party Software'.
Ask: Which practice management systems are supported, what fields sync in each direction, and does a sync push any contract content out of Curia?
Retrieval of external or web content
Not confirmed
Nothing on the pages read states that the software queries public web sources. The external data described is government spatial and planning data and satellite imagery under Schedule 1, used for Property Imagery and title and planning work rather than open web retrieval, and the features page describes Property Imagery as generated automatically 'from government backed data'. Whether any feature performs a live web or third-party lookup during a review is unstated.
Ask: Does any feature query a public web source or a third-party search service during a review, and if so which, and where does that request go?
Automated actions and their boundaries
Public claim only
The features page describes the software as prefilling and proposing while the practitioner decides: Smart Prefill prefills the review and 'You add, edit or reorder anything that doesn't fit'; the VIC equivalent states 'You keep the call on every clause'; the Amendment List puts every visible recommendation on and leaves hidden ones off; Personalised Reports have Curia handle structure and standing content while the practitioner adds the comments and risk ratings. Preflight runs automatically when a contract lands and raises colour-coded priority alerts. Nothing published describes the software sending a report or amendment list to a client, a vendor's solicitor or an agent without a user step, and the terms set no boundary on automated action.
Ask: Can any report, amendment list or notification leave the system without a user pressing send, and which user roles can release a report to a purchaser or the other side?
Human review of output
Public claim only
Terms clause 16.1 makes the Software available 'as is' with no representation, warranty or guarantee, subject to the Australian Consumer Law. Clause 8.2 makes the customer responsible for the accuracy and currency of its information and data and states that the Software does not perform any verification procedure in relation to information from Third Party Software or other software used by the customer, and clause 16.2 disclaims responsibility for the accuracy, quality, integrity or reliability of third party content. The features page states Ria Findings give an answer, the reasoning and a citation to page and clause, and that the practitioner keeps the call on every clause. No in-product requirement for a reviewer to sign off before a report is released is published.
Ask: What record does the system keep that a practitioner checked each prefilled entry, finding and citation before a report went out, and is that record exportable for our file?
