---
title: "Datasite Diligence (Datasite LLC)"
url: "https://ailawframework.com/software/datasite"
type: "software_profile"
site: "AI Law Framework"
id: "datasite"
vendor: "Datasite LLC"
category: "Legal-specific"
segment: "Due diligence and data rooms"
confidence: "high"
last_reviewed: "2026-09-21"
---

# Datasite Diligence (Datasite LLC)

> M&A virtual data room with in-room AI (summarise, Q&A drafts, redaction, search). Australian Azure hosting is available; OpenAI/Blueflame inference for AU projects is in the EU. ISO 42001 claimed.

Canonical page: https://ailawframework.com/software/datasite  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Datasite Diligence VDR and native Datasite AI under Australian GTC (28 May 2026). Blueflame AI is an optional paid add-on with extra LLM providers. Outreach/Acquire/Archive need separate review if used.

## Capabilities

- Due-diligence document review
- Document summarisation
- Knowledge search
- Translation

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA, Canada |
| Australian region | Yes |
| Model providers | OpenAI, Google Cloud Platform (semantic search), Anthropic (Blueflame, optional), Amazon (Blueflame, optional) |
| Assurance | SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO/IEC 42001 |
| Training on customer content | No |
| Retention | OpenAI/Blueflame LLM layer uses zero-retention endpoints. Blueflame keeps project data until closure then deletes. DPA: deletion of Personal Data begins 30 days after project closure or termination. |
| Legal content coverage | Grounds on documents in the customer's Datasite project. Not a licensed Australian primary-law collection. |
| Pricing | Fees on the SOW. No public list prices. Blueflame is an optional paid add-on. Availability credits are the exclusive uptime remedy. |
| Australian presence | Yes. Datasite Australia Pty Ltd (support). Azure Australia East/Southeast. OpenAI and GCP for AU projects process in the EU. No named AU law-firm customers on pages reviewed. |
| Website | https://www.datasite.com/en/products/diligence |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan and contracting entity | Public claim only | Australian customers contract under Australian GTC (revision 28 May 2026) plus SOW with the Datasite entity named in the SOW. Products include Diligence (VDR), Outreach, Acquire, Archive, Apps, and optional Blueflame AI. Native Datasite AI (summarise, explain, classify, Q&A drafts, redaction, translation, semantic search) can be turned off per project on written admin request. Website terms of use are separate and do not create a contract. | Confirm the Datasite contracting entity on our SOW, which of Diligence/Blueflame/Apps are in scope, and that AI features we do not want are off. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Datasite services agreement index](https://www.datasite.com/en/legal/services-agreement); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite) |
| Hosting regions | Public claim only | Azure-hosted. Australia customer projects: Australia East (NSW) with DR Australia Southeast (Victoria). Americas: East US2. EMEA/APAC default: Germany West Central (Frankfurt) with Berlin DR. Canada East on written request. Projects may be hosted on any identified region upon request. | Name our Azure region and DR pair, and confirm they will not be moved without notice. | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Datasite Privacy Notice](https://www.datasite.com/en/legal/privacy-notice) |
| Datasite AI and Blueflame | Public claim only | Datasite AI: Q&A drafting, summarisation, redaction, semantic search, translation, document classification, folder suggestions. Blueflame (optional paid affiliate add-on): natural-language Q&A grounded in deal content. Marketing: answers scoped to deal content, cited to document/section, human review before buyer send, permission-aware, redacted content not processed. | Which AI features will be on, and is Blueflame included? | [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [Datasite Diligence product](https://www.datasite.com/en/products/diligence) |
| Australia | Public claim only | Datasite Australia Pty Ltd is a support subprocessor. Azure Australia East available. Privacy notice: Online Services servers in the US, Australia and Germany. AU GTC: NSW law and NSW courts. OpenAI/GCP/Blueflame for AU projects process in the EU, not in Australia. | Will our project be Australia East, and do we accept EU processing for OpenAI/Blueflame/semantic search? | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Datasite Privacy Notice](https://www.datasite.com/en/legal/privacy-notice); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs) |
| Pricing | Not confirmed | No public list prices. Fees on the SOW; Renewal Term Minimum may apply. Availability credits are exclusive uptime remedy. | Itemised quote for Diligence, AI modules, Blueflame, archive and support. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Datasite Diligence product](https://www.datasite.com/en/products/diligence) |
| Permissions and SSO | Public claim only | AI respects provisioned access and skips redacted content. Customer must independently review outputs. SSO/MFA not detailed on the pages reviewed (ask). | Demonstrate Entra SSO, guest offboarding, and that a bidder cannot query documents they cannot open. | [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite) |
| Support locations | Public claim only | Support affiliates: US, UK, France, Germany, Australia, Singapore, Japan. Application support: Costa Rica (including manual document processing) and Harman India. No public Sev SLA found. | Will Costa Rica/India application support see our documents, and what are Sev-1 times? | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors) |
| Citations and ISO 42001 | Public claim only | Vendor: every AI response linked to document and section; first VDR with ISO/IEC 42001. No independent hallucination study published. Customer must verify all outputs (AU GTC hosting terms). | Show citation accuracy on our sample files and the ISO 42001 certificate scope. | [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Task fit | Not confirmed | Fit for in-room DD Q&A, summarisation, redaction and translation with human approval before buyer send. Not a licensed case-law citator. Prepare/Sandbox restrictions apply before go-live. | Is buyer-side AI off, and must every Q&A draft be approved? | [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Bidders | Not confirmed | Q&A outputs never visible to buyers until approved (vendor). Guests are authorised by the client company. No AU AI-disclosure template found. | What notice do counterparties get that AI is used in the room? | [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Model providers | Public claim only | OpenAI (summarise/explain/classify/folders; models include gpt4.1-nano, gpt-4o-mini, o3-mini, o4-mini). Semantic search: Google Cloud Platform. Blueflame (optional): OpenAI, Anthropic and Amazon. AU/APAC/EMEA OpenAI and GCP processing in the EU; Americas in the US. | List enabled models for our project and confirm Blueflame is off if unused. | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs) |
| Subprocessors | Public claim only | Published list includes Datasite affiliates, Azure, OpenAI, GCP, Blueflame, Harman India, Costa Rica entity. SCCs unless adequacy. Subscribe for updates. Customers with a DPA may object within 24 days (or DPA period). | Confirm the list is current for our project and that we are subscribed to change notices. | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors) |
| Training | Public claim only | OpenAI/Blueflame FAQs: customer data not used to train those models; ZDR endpoints so prompts/responses not retained by the LLM provider. AU GTC: Datasite may use anonymised aggregated Services Data (Content stripped of numbers, addresses, locations and personal data) and User Data to develop and improve products during and after the Term. That is not a full no-training clause for Datasite itself. | Confirm in the SOW that deal Content is not used to train Datasite or any model except anonymised Services Data as defined, and that OpenAI ZDR remains on. | [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Feedback | Public claim only | Feedback is excluded from Confidential Information. DPA treats Feedback, Usage Data or User Data as Datasite-controlled for business operations where personal. Privacy notice includes quality-control and training purposes for website personal data. | Can we disable any in-product feedback that sends prompts or documents to Datasite staff? | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Datasite Privacy Notice](https://www.datasite.com/en/legal/privacy-notice) |
| Retention | Public claim only | OpenAI/Blueflame LLM layer: ZDR. Blueflame retains customer data for the project then deletes on closure. DPA: deletion of Personal Data begins 30 days from project closure or termination. Datasite-side AI logs not separately specified. | Retention of Q&A drafts, AI logs and Azure backups after project close? | [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Deletion | Public claim only | On termination, Content destroyed or returned per SOW; certificate on request. USB return option in DPA TOMs. Deletion begins 30 days after closure. Default (non-payment) may remove preservation obligation. | Certified deletion of Content, AI indexes and Blueflame stores, including backups, without a fee dispute. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Vendor staff | Public claim only | Support in multiple countries including Costa Rica (manual document processing) and India (application support). Personnel sign NDAs; activity logged (TOMs). Blueflame US operational access for EU-stored data 'for operational and compliance reasons'. | When can Datasite, Costa Rica, India or Blueflame staff read our documents, and is that logged to us? | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Access control | Public claim only | Project administrators; Datasite may remove a user at the employer's request. AI permission-aware. SSO not documented on reviewed pages. | SSO-only, MFA, and a failed permission test for AI. | [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Encryption | Public claim only | OpenAI/Blueflame path: TLS 1.2+ in transit, AES-256 at rest, logically separated. Azure platform encryption for the VDR (TOMs). Customer-managed keys not mentioned. | Encryption of the Azure fileroom, AI indexes and backups in Australia East? | [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs); [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Assurance | Public claim only | AU GTC DPA TOMs: ISO 27001, 27701, 27017, 27018; SOC 2 Type II since 2007 (ISO 27701 since 2023). Marketing: ISO/IEC 42001 for AI. Reports not inspected. | Provide current SOC 2 Type II, ISO 27001/27701/42001 certificates scoped to Diligence AI and Blueflame. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite) |
| Contract | Public claim only | AU GTC 28 May 2026, NSW law and courts. Content is Confidential Information (Feedback and Services Data excluded). Liability cap: fees in prior 12 months on the SOW; USD 500,000 (or AU equivalent) for confidentiality/data sections 5(a) and 5(d); carve-outs for fees, IP, customer warranties, export, fraud, wilful misconduct. Customer must verify AI outputs. DPA incorporated. | Execute AU GTC+DPA, confirm the USD 500,000 confidentiality cap, and that Diligence AI is in scope. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Datasite services agreement index](https://www.datasite.com/en/legal/services-agreement) |
| Transfers | Public claim only | AU storage on Azure Australia East is available. OpenAI, GCP semantic search and Blueflame for AU projects process in the EU. Support in US, Costa Rica, India and others. SCCs on the subprocessor page. | APP 8 map for Azure AU storage versus EU OpenAI/Blueflame inference versus support access. | [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Datasite Privacy Notice](https://www.datasite.com/en/legal/privacy-notice); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs) |
| Incidents | Public claim only | DPA 6.4: notify Personal Data Breach affecting Customer Personal Data without undue delay. No 48-hour clock. Vulnerability disclosure policy exists (not fully reviewed). | Contract a 72-hour maximum notice with NDB-usable content. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Changes | Public claim only | Website Terms of Use and Privacy Notice may change. Subprocessor subscribe/24-day objection. AI features off on written request. Trial services withdrawable. | Notice before default model (e.g. gpt4.1-nano) or Blueflame providers change? | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs) |
| Exit | Public claim only | Destroy or return Content; certificate on request; encrypted USB option. Deletion begins 30 days after close. Archive is a separate product. | Fee-free export of documents, Q&A, audit logs and AI artifacts, then certified deletion. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) |
| Connectors | Public claim only | Apps and Non-Datasite Applications at customer's risk. Blueflame is an optional affiliate add-on. | List enabled Apps/Blueflame; unused off. | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors); [Datasite Diligence product](https://www.datasite.com/en/products/diligence) |
| Web search | Public claim only | Marketing: not trained on external internet data and cannot access information beyond the data room. Confirm as a hard control. | Can any AI feature call the open web? | [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite) |
| Q&A send and redaction | Not confirmed | Human-in-the-loop: responses require deal-team review before going to buyers (vendor). Automated redaction exists. AI can be disabled per project in writing. | Must every AI draft be approved before a bidder sees it, and who can enable Blueflame? | [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite); [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs) |
| Oversight | Public claim only | AU GTC: Customer independently reviews and verifies all outputs. Activity logged and reportable (TOMs). | Exportable audit of who ran which AI feature, for 12 months? | [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf); [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite) |

## Notes

SOC/ISO reports not inspected. SSO not on reviewed pages. Services Data (anonymised aggregated Content) may be used to improve products. Costa Rica manual document processing is a human-access path.

## Sources

- [Australian General Terms and Conditions (28 May 2026)](https://media.datasite.com/9ff7009f-768a-4596-9fa3-b1e800ca2435/terms-conditions-australia-english-original-file.pdf) (checked 2026-09-21)
- [Datasite Privacy Notice](https://www.datasite.com/en/legal/privacy-notice) (checked 2026-09-21)
- [Datasite Sub-Processors list](https://www.datasite.com/en/legal/sub-processors) (checked 2026-09-21)
- [Data privacy, security and compliance FAQs](https://www.datasite.com/en/legal/data-privacy-security-and-compliance-faqs) (checked 2026-09-21)
- [AI at Datasite](https://www.datasite.com/en/resources/ai-at-datasite) (checked 2026-09-21)
- [Datasite Diligence product](https://www.datasite.com/en/products/diligence) (checked 2026-09-21)
- [Datasite services agreement index](https://www.datasite.com/en/legal/services-agreement) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.