Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plans covered
Public claim only
The pricing page (dated 2026-09-04 on the page) publishes three plans priced per user per month - Launch $105, Scale $130 and Optimize $160 - with a currency selector offering AUD, USD, EUR and GBP. The AI layer, published as DazychainAI, appears on every plan: the comparison table lists 'Matter/project summary', 'Contract/document summary', 'Contract/document Q&A' and 'Contract/document playbook comparison' under a DazychainAI heading with no tier exclusions. The Launch plan states AI access is subject to 'usage caps apply'; Scale and Optimize state 'Unlimited AI access'. Document automation, workflow automation, advanced intake routing and API access are Optimize only. Implementation configuration is $5,000 as an option on Scale and included as a line item on Optimize.
Ask: What are the AI usage caps on the Launch plan, in what unit are they counted, and in which currency are the $105, $130 and $160 figures on the pricing page quoted?
What DazychainAI does, and a difference between the page text and the vendor's own FAQ
Not confirmed
The vendor's own FAQ on the AI page, dated 2026-08-13 on the page, bounds present capability: 'DazychainAI helps your legal team work smarter. Today, it can generate document summaries, answer questions about documents, and provide matter summaries, making it faster and easier to find key information and insights.' The body copy of the same page describes more: 'DazychainAI manages contract analysis and comparison through a detailed document review and comparison to a corporate contract playbook. Using a generative AI tool for lawyers, DazychainAI compares an external contract with the playbook to determine areas of non-compliance or non-conformance, listing the areas requiring attention and assisting document drafting'; self-service generation where an intake form feeds 'a pre-approved template, instantly generating a tailored document'; automated matter creation from client intake forms that 'create matters automatically, assign them to the correct lawyer, and fill in the matter details'; and 'By automating drafting, legal research, generating accurate matter summaries, and streamlining collaboration'. The pricing comparison table lists playbook comparison as a DazychainAI item on all three plans, so it is published as a current feature; legal research appears only in the body copy and is not in the FAQ's list of what the tool 'can do today'.
Ask: Does DazychainAI perform legal research today, as the page body says, or only document summaries, document Q&A, matter summaries and playbook comparison, as the FAQ and the pricing table say?
Deployment and hosting
Public claim only
The security page (dated 2026-09-07) states 'Dazychain uses cloud services to host our databases and application servers Application data is hosted in Amazon data centres in Australia and the USA, while the database is hosted by cloud provider Object Rocket, also in Australia and the USA', that documents are 'stored in the Amazon S3 file system in Amazon data centers in Australia and the USA', and that the application stack 'runs on AWS, fully utilising the multi-availability zones for High Availability and redundancy' behind Elastic Load Balancers. The AI FAQ states 'DazychainAI runs on AWS Bedrock infrastructure in Australia or United States of America depending on your location.' Sign-in is at app.dazychain.com. No single-tenant, private-cloud or on-premises option appears on the pages read, and no page states how a customer is assigned to the Australian rather than the United States deployment. Checked 2026-10-10. Vendor page: “- Dazychain uses cloud services to host our databases and application servers Application data is hosted in Amazon data centres in Australia and the USA, while the database is hosted by cloud provider Object Rocket, also in Australia and the USA.” (https://www.dazychain.com/features/security/). Recorded as Australian region available. Checked 2026-10-10. Vendor page: “- A key feature of Dazychain’s legal document management is that documents are encrypted in transit and at rest, and stored in the Amazon S3 file system in Amazon data centers in Australia and the USA” (https://www.dazychain.com/features/security/). Recorded as Australian region available.
Ask: For an Australian customer, are the application, the Object Rocket database, S3 documents, backups and Bedrock inference all in Australian regions, and what determines that assignment?
Jurisdiction and legal context
Public claim only
The Privacy Policy states 'Dazychain is bound by the Privacy Principles set out in the Privacy Act 1988' and that 'Dazychain stores its data on servers located in Australia. We will not disclose your personal information outside of Australia without your consent.' The security page states 'We comply with the Privacy Act 1988 (Privacy Act) and related Australian privacy and data laws' and 'Dazychain is also GDPR compliant.' No governing-law or jurisdiction clause was found: no terms of service, subscription agreement or licence document appears on the site or in the mapped URL set. The pricing page offers AUD, USD, EUR and GBP.
Ask: Which law governs the subscription agreement, in which forum are disputes heard, and which entity contracts with an Australian customer?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A filtered site map returned 60 URLs and none is an /llms.txt, /ai-info, /ai or /for-ai path. The four pages read in full - the DazychainAI page including its FAQ, the security page, the Privacy Policy and the pricing page - contain no block addressed to AI models, assistants, crawlers or 'LLMs', and no 'Instructions for AI Assistants' heading. A filtered map is not a complete crawl, so this records an absence across the URL set and the pages read rather than proof that no such file exists.
Ask: Do you publish any page, file or metadata that tells AI assistants or crawlers how to describe Dazychain, and do you maintain an llms.txt or equivalent?
Vendor's own comparative and superlative statements about its product
Public claim only
The DazychainAI page carries superlative and comparative statements the vendor makes about its own product, checked 2026-09-27. It states: 'The ability to search, analyse, and generate summaries with precision makes DazychainAI one of the most practical and effective legal AI tools available to corporate lawyers today'; 'corporate legal functions are equipped with the best legal AI tools to stay responsive and future-ready'; and 'DazychainAI is a breakthrough in legal AI software'. These appear in the page body rather than in the FAQ question-and-answer block, and no criterion, comparison set or evidence is published with them. This catalogue records no ranking of its own; the statements are recorded because they are the vendor's published material and a firm weighing the vendor's other public statements should know they are there.
Ask: On what criteria and against which products were the comparative statements on the DazychainAI page made, and can you point to the evidence behind them?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put privileged and confidential matter data into the tool
Public claim only
The DazychainAI FAQ answers 'Does AI access privileged/ confidential matters?' with: 'No. DazychainAI only accesses data when a user actively engages an AI function, such as clicking a button. Your privileged or confidential matters remain secure until AI assistance is explicitly requested.' A second answer states 'DazychainAI works only within the matter or document it's engaged on it doesn't access data outside that context.' A third, to 'Can we turn AI off or restrict it by role/matter type?', states 'Yes. AI can be completely turned off for your account, giving you full control over when and how AI features are used.' All three are FAQ entries on a marketing page; no agreement or policy document was found that carries them.
Ask: Are the FAQ statements - AI invoked only on explicit user action, scoped to the engaged matter, and able to be turned off account-wide - warranted in our agreement?
Model and model provider
Public claim only
The AI page states 'All our AI tools run on Amazon Bedrock. Bedrock keeps your sensitive client data safe. It doesn't store your inputs or outputs, share them with third parties, or use them for training like some existing systems. Each model runs in a dedicated AWS account for added protection.' The FAQ adds 'DazychainAI runs on AWS Bedrock infrastructure in Australia or United States of America depending on your location.' No model family, model name or version is published, and no page states which model serves summarisation, Q&A or playbook comparison. The statements about what Bedrock does are the vendor's characterisation of a third-party service, not a Dazychain commitment.
Ask: Which Bedrock model families and versions serve document summaries, document Q&A, matter summaries and playbook comparison, are they provisioned in an Australian region for us, and will we be notified before a model changes?
Subprocessors
Not confirmed
No subprocessor list is published. The security page names the parties involved in delivering the service: AWS (application stack, S3 document storage, Bedrock, Elastic Load Balancers, Shield, Inspector, CloudFront, GuardDuty and the AWS Web Application Firewall), 'cloud provider Object Rocket' for the database, an unnamed 'third-party virus scanner' for S3 scanning, and an unnamed 'third party, external agency' that manages annual penetration tests. The same page also states 'We don't share data with third parties. Users may choose to share information with external lawyers if they wish', and the Privacy Policy states 'We will not disclose your personal information to third parties except to persons with whom you carry on, or might wish to carry on, business using our services, where you consent, where you would reasonably expect the information to be disclosed or where we are legally required to disclose such information.' The no-third-party-sharing statements sit alongside a named set of providers that host, store and process the data.
Ask: Provide a current subprocessor list naming every provider, its role and its region, including the database host, the virus scanner and the Bedrock region, and tell us how a change is notified.
Use of customer content for training
Public claim only
Two FAQ answers address this. 'What data does DazychainAI use? Is our data used to train models?' is answered 'DazychainAI uses only the data within the specific document or matter you are working on, combined with AWS Bedrock's AI services. Your data is not used to train external models, ensuring your information remains private and secure.' 'Where does AI run (region), and how is data protected?' states 'your information is never used to train external AI model'. The AI page also states of Bedrock that 'It doesn't store your inputs or outputs, share them with third parties, or use them for training'. Both FAQ statements are limited to external models; nothing published states whether Dazychain itself may use customer matter content, prompts or AI output to train, tune or evaluate any model of its own, and no agreement was found that carries either statement.
Ask: Will you warrant that Dazychain, as distinct from external model providers, does not use our matter content, prompts or AI output to train, fine-tune or evaluate any model?
Use of feedback and corrections
Not confirmed
Nothing on the four pages read describes a feedback or rating mechanism on AI output or what happens to a correction. The FAQ states 'Users can easily validate and edit extractions directly within the platform, ensuring that all data is correct before it is finalized or shared', but does not say whether the edit is captured as a signal, retained, or used beyond the tenancy.
Ask: When a user corrects an AI extraction or summary, is the correction retained as training or evaluation data, and does it stay inside our tenancy?
Retention
Public claim only
The security page states 'Upon account termination, we retain customer data for the period requested by the customer, usually one month. After that time period, it is deleted. Alternative arrangements can be made on an ad hoc basis if requested by the customer.' It also states 'We retain encrypted data backups' and that 'The cloud providers hosting our databases and file systems make regular nightly backups', without a backup retention period. The Privacy Policy sets no retention period for personal information. No retention period is published for AI prompts or AI outputs.
Ask: What is the contractual retention period for backups and for AI prompts and outputs, and is the 'usually one month' post-termination period a term of the agreement?
Deletion and destruction
Public claim only
The security page states that after the post-termination retention period 'it is deleted'. The Privacy Policy gives a right to access and correct personal information, subject to exceptions, states a request may need to be in writing and that 'We may charge you a reasonable administration fee for granting access to your personal information'; it does not describe a deletion-on-request process for personal information held in a customer's tenancy. Nothing published addresses deletion of a single matter, its documents or its AI outputs, deletion from backups, or written certification of destruction.
Ask: Can we require deletion of a nominated matter with its documents, AI prompts and AI outputs, including from backups, within a stated period and with written confirmation?
Vendor personnel access to customer data
Public claim only
The security page publishes personnel controls: 'All staff undertake police checks before they join the organization and again once every two years. Confidentiality agreements are signed by all employees, third parties and contractors', with an Information Security Management System briefing at orientation, documented acceptance of policies and annual training. It also states 'All our employees and data processors, who have access to and are associated with the processing of personal information, are required to respect the confidentiality of your personal information and comply with this policy' (Privacy Policy). Neither page states whether staff can open customer matters or documents, under what conditions, or whether such access is logged and visible to the customer. The security page states every access to Dazychain and any modification 'are meticulously logged and preserved', without saying whether vendor-staff access appears in the customer-visible audit trail.
Ask: Under what circumstances can Dazychain or Yarris personnel open our matters or documents, does that access appear in the audit trail we can see, and can we require notice?
Access control, authentication and AI restriction
Public claim only
The pricing table lists role-based access and audit trails on all three plans, and SSO covering 'Entra, Okta, SCIM, ADFS'. The security page states 'Segregation of the data is fully supported, tenant aware and no user company can securely access another's information unless permission has been provided, such as in the case of collaboration'. Multi-factor authentication is not mentioned on any page read. The FAQ question 'Can we turn AI off or restrict it by role/matter type?' is answered only as to turning AI off: 'Yes. AI can be completely turned off for your account' - the answer does not address restriction by role or by matter type, so on the material read AI control is account-wide.
Ask: Can DazychainAI be restricted by user role or by matter type rather than only switched off for the whole account, and is MFA enforced where SSO is not used?
Encryption
Public claim only
The security page states 'Our MongoDB cross-platform document-oriented database program is fortified with AES-256 encryption at rest, encompassing all documents and critical information. We retain encrypted data backups', and 'We employ HTTPS in conjunction with the TLS 1.3 protocol to secure data in transit'. It adds that documents 'are encrypted in transit and at rest, and stored in the Amazon S3 file system' and that 'The database is encrypted at rest and all communications between the application and the database are encrypted via SSL'. No statement addresses key management, key rotation or customer-managed keys.
Ask: Who holds and rotates the encryption keys for the database and for S3, and are customer-managed keys available?
Independent assurance and certification
Public claim only
The security page states 'Our ISO 27001:2013 controls and wider Information Security Management System (ISMS) is internally and externally audited annually' and 'SOC 2 internal and external audits are undertaken annually and we produce SOC 2 reports demonstrating our strong security and data protection practices.' The edition named for the standard is the 2013 edition. It also states penetration testing is 'conducted internally prior to each release' and that 'Penetration tests are performed annually and managed by a third party, external agency', with weekly-to-daily internal validation not described. No certificate number, certification body, scope statement, SOC 2 type or report period is published, and no certificate or report is downloadable. The AWS certifications listed on the same page (ISO 27001, ISO 27018, FedRAMP, SOC 1, SOC 2) are attributed to AWS, not to Dazychain.
Ask: Provide the ISO 27001 certificate showing edition, certification body, certificate number and scope statement, and the latest SOC 2 report with its type and period - and confirm whether DazychainAI and the Bedrock integration are inside that scope.
Contracting and documents
Not confirmed
No subscription agreement, master services agreement, terms of service, data processing agreement or AI addendum was found on the site or in a 60-URL filtered map on 2026-09-27; the only published policy documents are the Privacy Policy and the Security page. No company name, ABN or ACN is published on the pages read. The Privacy Policy directs privacy enquiries to 'admin@yarris.com' and to 'Dazychain, Attn: Privacy Officer, 4/447 Collins Street, Melbourne VIC, 3000, Australia'. The security page refers to the operating organisation as 'Yarris' twice: 'Yarris turns on S3 scanning by a third-party virus scanner before project commencement' and 'Yarris makes full use of AWS multi-availability zones'. The site footer carries a Yarris Technologies logo with the line 'Yarris Technologies creates platforms that streamline complex business services'. No published statement names the contracting entity or states a parent-subsidiary relationship.
Ask: Which legal entity contracts with us, what is its ACN or ABN, what is its relationship to Yarris Technologies, and can you provide the subscription agreement and a data processing agreement?
Cross-border transfers
Not confirmed
Three vendor statements of different dates do not line up. The Privacy Policy (dated 2024-12-06 on the page) states 'Dazychain stores its data on servers located in Australia. We will not disclose your personal information outside of Australia without your consent.' The security page (dated 2026-09-07) states 'Application data is hosted in Amazon data centres in Australia and the USA, while the database is hosted by cloud provider Object Rocket, also in Australia and the USA', and that documents are stored in S3 'in Amazon data centers in Australia and the USA'. The AI FAQ (dated 2026-09-24) states 'DazychainAI runs on AWS Bedrock infrastructure in Australia or United States of America depending on your location. Keeping data within your designated geographic boundaries.' The Privacy Policy is the oldest of the three and is the only one that states Australia only.
Ask: Which statement applies to us: Australia only per the Privacy Policy, or Australia and the USA per the security page and the AI FAQ - and will you commit in writing to Australian regions for application, database, documents, backups and Bedrock inference?
Incident and breach notification
Not confirmed
No incident-response or breach-notification commitment appears on the four pages read. The security page covers monitoring and threat tooling - 'We utilise AWS Shield, Amazon Inspector, Amazon Cloudfront, Amazon Guard Duty and AWS's Web Application Firewall to monitor, identify and log vulnerabilities for remediation' - and a 'fully developed Disaster Recovery and Business Continuity Program', but sets out no notification window, channel or process for a security incident or an eligible data breach. The Privacy Policy describes a complaints process to the Privacy Officer but does not mention the Notifiable Data Breaches scheme.
Ask: What is the notification window and channel for a suspected eligible data breach affecting our matters, who notifies affected individuals, and is the commitment contractual?
Change notice
Public claim only
The Privacy Policy states 'Dazychain may amend this Privacy Policy at any time and for any reason. The updated version will be available at dazychain.com/privacy-policy. Dazychain may highlight changes on our website but you should check the Privacy Policy regularly for changes.' There is no advance-notice commitment. No published document addresses notice of changes to the product, to the AI functions, to the Bedrock models used, or to the plan inclusions; the pricing table carries items marked 'Coming soon' on all tiers (SharePoint integration, document libraries and knowledge base) without dates.
Ask: Will you give advance written notice before changing the Privacy Policy, the AI functions, the Bedrock models used, or what is included in our plan?
Exit and data portability
Not confirmed
No export or transition process is published. The pricing table lists 'Exportable reports and dashboards' on all three plans and 'Full text search across documents' on all three, but API access appears only on the Optimize plan, so on the published material the programmatic route to a full extract is confined to the top tier. Retention after termination is 'the period requested by the customer, usually one month' per the security page. Nothing published describes the format of an exit extract, whether documents, version history, matter data and AI outputs are included, or what assistance is provided.
Ask: On exit, in what format do we receive matters, documents, version history and AI outputs, is Optimize-tier API access required to obtain it, and what does that cost?
Connectors and data flows
Public claim only
Published connectors are SSO (Entra, Okta, SCIM, ADFS), Outlook, Gmail and DocuSign on all three plans, API access on Optimize only, SharePoint 'Coming soon' on Optimize, and an Outlook add-in named in the Privacy Policy. The AI page describes an internal client portal and 'a secure collaboration portal' for sharing matters and documents with internal clients, 'Off-platform sharing' appears in the pricing table on all plans, and an external firm collaboration portal on Scale and Optimize. The security page states 'We don't share data with third parties. Users may choose to share information with external lawyers if they wish.'
Ask: When a matter or document is shared through the external firm portal or 'off-platform sharing', where does the data go, and can an external recipient invoke an AI function on it?
Retrieval outside the tenancy
Public claim only
The FAQ states 'DazychainAI works only within the matter or document it's engaged on it doesn't access data outside that context' and 'DazychainAI uses only the data within the specific document or matter you are working on, combined with AWS Bedrock's AI services'. Neither statement uses the words web or internet, and neither addresses retrieval from legal databases or public sources. The page body separately claims the platform automates 'legal research', which the FAQ's list of present capability does not include.
Ask: Does any DazychainAI function retrieve from the internet or from any source outside our tenancy, and if legal research is offered, what corpus does it read?
What the AI can change without a user acting
Public claim only
The FAQ states 'DazychainAI only accesses data when a user actively engages an AI function, such as clicking a button', which describes invocation rather than write behaviour. The page body describes automated writes: client intake forms 'create matters automatically, assign them to the correct lawyer, and fill in the matter details', and self-service document generation takes intake-form answers into 'a pre-approved template, instantly generating a tailored document that can be reviewed or sent back to the client without manual intervention'. The pricing table places advanced intake routing and workflow automation on the Optimize plan only. No page states which of these writes require a human to confirm.
Ask: Which automated steps write to the matter record or send a document out without a lawyer confirming - specifically automated matter creation, lawyer assignment and self-service document generation - and can each be put behind approval?
Human review of AI output
Public claim only
The FAQ states 'AI extractions in Dazychain are designed to be highly accurate, but like any automated system, they may require review. Users can easily validate and edit extractions directly within the platform, ensuring that all data is correct before it is finalized or shared.' Review is described as available rather than required, and the phrase 'may require review' is not tied to any control that prevents an unreviewed output being shared. Nothing published states whether a reviewer is recorded in the audit trail, or whether AI output is labelled as AI-generated when shared with an internal client or an external firm.
Ask: Can an AI summary, extraction or playbook comparison be shared with an internal client or external firm without a lawyer reviewing it, is the reviewer recorded in the audit trail, and is the output labelled as AI-generated?
