Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan and contracting entity
Public claim only
Australian customers contract under Australian GTC (revision 28 May 2026) plus SOW with the Datasite entity named in the SOW. Products include Diligence (VDR), Outreach, Acquire, Archive, Apps, and optional Blueflame AI. Native Datasite AI (summarise, explain, classify, Q&A drafts, redaction, translation, semantic search) can be turned off per project on written admin request. Website terms of use are separate and do not create a contract.
Ask: Confirm the Datasite contracting entity on our SOW, which of Diligence/Blueflame/Apps are in scope, and that AI features we do not want are off.
Hosting regions
Public claim only
Azure-hosted. Australia customer projects: Australia East (NSW) with DR Australia Southeast (Victoria). Americas: East US2. EMEA/APAC default: Germany West Central (Frankfurt) with Berlin DR. Canada East on written request. Projects may be hosted on any identified region upon request.
Ask: Name our Azure region and DR pair, and confirm they will not be moved without notice.
Datasite AI and Blueflame
Public claim only
Datasite AI: Q&A drafting, summarisation, redaction, semantic search, translation, document classification, folder suggestions. Blueflame (optional paid affiliate add-on): natural-language Q&A grounded in deal content. Marketing: answers scoped to deal content, cited to document/section, human review before buyer send, permission-aware, redacted content not processed.
Ask: Which AI features will be on, and is Blueflame included?
Australia
Public claim only
Datasite Australia Pty Ltd is a support subprocessor. Azure Australia East available. Privacy notice: Online Services servers in the US, Australia and Germany. AU GTC: NSW law and NSW courts. OpenAI/GCP/Blueflame for AU projects process in the EU, not in Australia.
Ask: Will our project be Australia East, and do we accept EU processing for OpenAI/Blueflame/semantic search?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Bidders
Not confirmed
Q&A outputs never visible to buyers until approved (vendor). Guests are authorised by the client company. No AU AI-disclosure template found.
Ask: What notice do counterparties get that AI is used in the room?
Model providers
Public claim only
OpenAI (summarise/explain/classify/folders; models include gpt4.1-nano, gpt-4o-mini, o3-mini, o4-mini). Semantic search: Google Cloud Platform. Blueflame (optional): OpenAI, Anthropic and Amazon. AU/APAC/EMEA OpenAI and GCP processing in the EU; Americas in the US.
Ask: List enabled models for our project and confirm Blueflame is off if unused.
Subprocessors
Public claim only
Published list includes Datasite affiliates, Azure, OpenAI, GCP, Blueflame, Harman India, Costa Rica entity. SCCs unless adequacy. Subscribe for updates. Customers with a DPA may object within 24 days (or DPA period).
Ask: Confirm the list is current for our project and that we are subscribed to change notices.
Training
Public claim only
OpenAI/Blueflame FAQs: customer data not used to train those models; ZDR endpoints so prompts/responses not retained by the LLM provider. AU GTC: Datasite may use anonymised aggregated Services Data (Content stripped of numbers, addresses, locations and personal data) and User Data to develop and improve products during and after the Term. That is not a full no-training clause for Datasite itself.
Ask: Confirm in the SOW that deal Content is not used to train Datasite or any model except anonymised Services Data as defined, and that OpenAI ZDR remains on.
Feedback
Public claim only
Feedback is excluded from Confidential Information. DPA treats Feedback, Usage Data or User Data as Datasite-controlled for business operations where personal. Privacy notice includes quality-control and training purposes for website personal data.
Ask: Can we disable any in-product feedback that sends prompts or documents to Datasite staff?
Retention
Public claim only
OpenAI/Blueflame LLM layer: ZDR. Blueflame retains customer data for the project then deletes on closure. DPA: deletion of Personal Data begins 30 days from project closure or termination. Datasite-side AI logs not separately specified.
Ask: Retention of Q&A drafts, AI logs and Azure backups after project close?
Deletion
Public claim only
On termination, Content destroyed or returned per SOW; certificate on request. USB return option in DPA TOMs. Deletion begins 30 days after closure. Default (non-payment) may remove preservation obligation.
Ask: Certified deletion of Content, AI indexes and Blueflame stores, including backups, without a fee dispute.
Vendor staff
Public claim only
Support in multiple countries including Costa Rica (manual document processing) and India (application support). Personnel sign NDAs; activity logged (TOMs). Blueflame US operational access for EU-stored data 'for operational and compliance reasons'.
Ask: When can Datasite, Costa Rica, India or Blueflame staff read our documents, and is that logged to us?
Access control
Public claim only
Project administrators; Datasite may remove a user at the employer's request. AI permission-aware. SSO not documented on reviewed pages.
Ask: SSO-only, MFA, and a failed permission test for AI.
Encryption
Public claim only
OpenAI/Blueflame path: TLS 1.2+ in transit, AES-256 at rest, logically separated. Azure platform encryption for the VDR (TOMs). Customer-managed keys not mentioned.
Ask: Encryption of the Azure fileroom, AI indexes and backups in Australia East?
Assurance
Public claim only
AU GTC DPA TOMs: ISO 27001, 27701, 27017, 27018; SOC 2 Type II since 2007 (ISO 27701 since 2023). Marketing: ISO/IEC 42001 for AI. Reports not inspected.
Ask: Provide current SOC 2 Type II, ISO 27001/27701/42001 certificates scoped to Diligence AI and Blueflame.
Contract
Public claim only
AU GTC 28 May 2026, NSW law and courts. Content is Confidential Information (Feedback and Services Data excluded). Liability cap: fees in prior 12 months on the SOW; USD 500,000 (or AU equivalent) for confidentiality/data sections 5(a) and 5(d); carve-outs for fees, IP, customer warranties, export, fraud, wilful misconduct. Customer must verify AI outputs. DPA incorporated.
Ask: Execute AU GTC+DPA, confirm the USD 500,000 confidentiality cap, and that Diligence AI is in scope.
Transfers
Public claim only
AU storage on Azure Australia East is available. OpenAI, GCP semantic search and Blueflame for AU projects process in the EU. Support in US, Costa Rica, India and others. SCCs on the subprocessor page.
Ask: APP 8 map for Azure AU storage versus EU OpenAI/Blueflame inference versus support access.
Incidents
Public claim only
DPA 6.4: notify Personal Data Breach affecting Customer Personal Data without undue delay. No 48-hour clock. Vulnerability disclosure policy exists (not fully reviewed).
Ask: Contract a 72-hour maximum notice with NDB-usable content.
Changes
Public claim only
Website Terms of Use and Privacy Notice may change. Subprocessor subscribe/24-day objection. AI features off on written request. Trial services withdrawable.
Ask: Notice before default model (e.g. gpt4.1-nano) or Blueflame providers change?
Exit
Public claim only
Destroy or return Content; certificate on request; encrypted USB option. Deletion begins 30 days after close. Archive is a separate product.
Ask: Fee-free export of documents, Q&A, audit logs and AI artifacts, then certified deletion.
Connectors
Public claim only
Apps and Non-Datasite Applications at customer's risk. Blueflame is an optional affiliate add-on.
Ask: List enabled Apps/Blueflame; unused off.
Web search
Public claim only
Marketing: not trained on external internet data and cannot access information beyond the data room. Confirm as a hard control.
Ask: Can any AI feature call the open web?
Q&A send and redaction
Not confirmed
Human-in-the-loop: responses require deal-team review before going to buyers (vendor). Automated redaction exists. AI can be disabled per project in writing.
Ask: Must every AI draft be approved before a bidder sees it, and who can enable Blueflame?
Oversight
Public claim only
AU GTC: Customer independently reviews and verifies all outputs. Activity logged and reportable (TOMs).
Ask: Exportable audit of who ran which AI feature, for 12 months?
