Legal-specific · Due diligence and data rooms · Medium confidence
DDLoop
DDLoop Pty Ltd · DDLoop platform as described on the vendor pages read (home, FAQ, security, legal, for lawyers). The Terms and Conditions, EULA and Privacy Policy PDFs were not opened; the investors and insolvency pages are not covered.
Australian platform that orders, collates and reports public-register searches for legal due diligence — ASIC, PPSR, IP Australia, insolvency, litigation and land titles — and exports the data into a firm's own Word report precedents.
Opens a private software assessment of DDLoop for one task, with this profile’s questions to hand.
Due-diligence document reviewData extractionDocument automationConflict checkingIP search and clearance
Published facts
Deployment
SaaS
Hosting regions
Australia
Australian region
Yes
Assurance
SOC 2 (badge only; report type, auditor, date and scope not published)
Training on customer content
Unknown
Retention summary
No retention period is published. The security page states 'Your search data is yours. DDLoop does not use or share your data for purposes other than conducting the searches you request and to make sure we're giving you the best services possible.' Earlier searches are evidently retained for the stale-data indicators and the search-to-search comparison the vendor describes, but no period, no in-life deletion route and no post-termination position is published. The Privacy Policy and Terms and Conditions PDFs were not opened.
Integrations
iManage, NetDocuments, practice management and billing systems, Microsoft Word export into the firm's own templates, single sign-on with SAML and SCIM
Pricing summary
No pricing page, plan list or price appears in the site navigation or on any of the five vendor pages read. The published route to access is 'Book a Demo', and the FAQ directs a prospective user to book a demo or use the contact form. Whether the fee is per seat, per matter or per search, and whether register search fees are passed through, is not published. The Terms and Conditions PDF dated 19 August 2026 was not opened.
Legal content coverage
Public-register sources named by the vendor: ASIC Connect corporate information and ASIC published insolvency notices; the Personal Property Securities Register; IP Australia trade marks, patents and design registrations; individuals' corporate and bankruptcy history; litigation and court history; property and land titles across state registries; and the WHOIS domain name registry. Evidence of each search is retained as register extracts, screenshots, certificates and search reports, with the IP Australia Search Report and PPSR search certificates named. Which state land titles registries and which courts are covered is not stated. The vendor publishes its own currency and accuracy disclaimer in the FAQ.
Australian presence
Yes — Australian contracting entity named on the legal page under 'Legal Entities' as DDLoop Pty Ltd (ACN 658 895 624), which is also the footer entity on every page read; a United Kingdom entity, DDLoop UK Ltd (Company Number 14949763) at 124 City Road, London, is named on the same page. The vendor states 'DDLoop is a LegalTech company made in Sydney, Melbourne and London by lawyers, for lawyers' and the FAQ describes it as 'an Australian LegalTech platform'. The security page states all data is stored in Australia on Australian servers; the Privacy Collection Notice on the legal page adds that third parties may store, transfer or access personal information outside Australia. The customers listed are the logos the vendor publishes on its home and security pages; two case-study pages (Talbot Sayer, Kain Lawyers) were not opened, so the scope of each engagement is not established. The pages carry an Acknowledgement of Country naming Gadigal (Eora Nation) and Wurundjeri Woi Wurrung and Bunurong (East Kulin Nations) lands.
Product and intended use
Define the configuration, people, information and tasks being assessed.
Plans, pricing route and what this profile covers
Not confirmed
No pricing page, plan list or price appears anywhere in the site navigation or on the five vendor pages read (home, FAQ, security, legal, for lawyers). The only route to access published is 'Book a Demo', and the FAQ answer to 'I want to try DDLoop, how do I get started?' directs the reader to book a demo or use the contact form. Three audience pages are published — for lawyers, for investors and for insolvency professionals — but nothing read states whether these are different products, different plans or one product described three ways. This profile covers the platform as described on the pages read.
Ask: What are the plans and prices, is the fee per seat, per matter or per search, and are the register search fees passed through at cost or marked up?
The FAQ describes 'an Australian LegalTech platform', reached through a browser; the log-in link on every page points to dashboard.ddloop.app. The security page states 'Our Australian servers and data localisation policy ensures all data is stored securely in Australia.' No on-premises, private-cloud or self-hosted option appears on any page read, and the hosting provider is not named — the security page states only that 'All data is hosted on ISO-certified infrastructure'.
Ask: Who is the hosting provider, in which Australian region does the tenant sit, and is a single-tenant or dedicated-database option available?
Functions the vendor describes, and what the platform expressly does not do
Public claim only
The vendor describes a register-search and reporting platform. Per the FAQ, users 'enter company names, ACNs or ABNs' and the platform collates register information 'directly through the register or through 3rd party information brokers and augmenting it with DDLoop's own risk-based analysis and flagging system'. The for-lawyers page names the outputs: automated corporate structure charts, 'Live Data Monitoring — Stay across all changes with notifications', out-of-date search indicators, comparison of new searches against earlier ones, 'Evidence for Everything — Extracts, screenshots, certificates and reports', and export of search data into the firm's own Microsoft Word precedents to produce due diligence reports or opinion letters. The vendor states two express limits on its own security page: 'The platform does not allow the user to upload documents to our platform, nor allow any direct interaction with any AI systems/models through prompts.' Neither the home page nor the FAQ uses the words AI, artificial intelligence, machine learning or generative at any point.
Ask: What does the risk-based analysis and flagging system actually flag, what technique produces the flags, and can a firm see the rule or logic behind a flag?
The for-lawyers page names eight search types: ASIC corporate information from ASIC extracts; PPSR registrations for security interests over assets or shares; trade marks registered or applied for with IP Australia; an insolvency scan of ASIC published notices with proof of search; key people checks covering individuals' corporate and bankruptcy history; litigation and court history; property titles 'across state registries'; and other registered intellectual property covering patents and design registrations. The FAQ adds ASIC Connect and the WHOIS domain name registry. The FAQ names the evidence returned with each search, including an IP Australia Search Report for a trade mark search and PPSR search certificates. Which state land title registries are covered, and which courts are covered by the litigation history search, are not stated on any page read.
Ask: Which state and territory land titles registries and which courts and tribunals are covered by the property and litigation searches, and how current is each source?
Deliberate check for vendor content directing how AI describes the product
Not confirmed
A deliberate check was made on 2026-09-27. The home page, FAQ, security page, legal page and for-lawyers page were each read in full. None carries a heading, block or sentence addressed to AI models, assistants, crawlers or 'LLMs', and none carries an instruction of the form 'describe DDLoop as'. No such content was found in the material read. The check is incomplete and is reported as such: no site map was run on ddloop.app within the credit budget, so whether an /llms.txt or an AI information page exists has not been tested.
Ask: Do you publish any page, block or file addressed to AI models, assistants or crawlers describing how DDLoop should be represented?
Record the practical work needed to introduce and maintain the software.
Named integrations
Public claim only
The home page states the platform 'Works with iManage, Netdocuments and your PMS & billing systems', and the for-lawyers page states 'Integrations — Works with your DMS and billing systems'. An integrations page is published in the site navigation at ddloop.app/integrations and was not opened, so what each integration does — whether it writes search evidence into a matter workspace, or only exports a file — is not established. The Microsoft Word export into the firm's own templates is described on the for-lawyers page as populating 'search data into your own MS Word templates'.
Ask: For the iManage and NetDocuments integrations, does DDLoop file search evidence into the matter workspace automatically, and what permissions does the integration require in our document management system?
Compare complete work at the required quality, including checking and correction.
What the vendor publishes about accuracy, and its own disclaimer
Public claim only
The vendor publishes a limitation on its own output in the FAQ: 'Our information is only as current as our sources. As most of the information we provide is derived from third-parties, we can't guarantee it's free from errors. Accordingly, we make no representation or warranty that the information provided by third-parties is reliable, adequate, current, accurate or complete.' Against that, the home page and security page publish the unquantified claim 'Trusted by 1000+ lawyers from leading firms' with no period or definition, and the security page states the platform is 'Independently audited to industry standards'. The two case-study pages published at ddloop.app/customers/talbotsayer and ddloop.app/customers/kainlawyers were not opened; the home page links to them with the figures '50% time savings' and 'default on every deal', which are presented as customer outcomes with no stated method. All testimonials on the pages read are attributed to named individuals and are not carried into this profile.
Ask: What accuracy checking sits between the register or information broker and what we see, and how would we learn that a search returned a stale or incomplete result?
Three audiences are named in the site navigation and on dedicated pages: lawyers, described as 'Built for busy lawyers in Corporate, M&A and Banking practices'; investors, to 'Research, investigate and keep track of portfolio companies or new investments'; and insolvency professionals, to 'Automate conflict checking and investigation searching'. The FAQ describes the platform as automating 'legal due diligence processes for M&A, insolvency and investment professionals'. The investors and insolvency pages were not opened.
Ask: For insolvency practitioners, what does the conflict checking compare against — our own client and matter list, or only the public registers?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to run searches and what the platform accepts as input
Public claim only
The security page sets out what the platform takes in, which bears directly on the authority question: it states DDLoop 'only collects and transmits' two things — 'Publicly available data' being 'information that any member of the public may access, or purchase access to, via the internet (ie non-confidential and non-sensitive)', giving ASIC company extracts, PPSR search results, IP Australia trade mark searches and Google searches as examples; and 'User inputted project identifiers', described as 'optional, pseudonymised information a user can input about a project (ie matter code names such as Project Cannon Ball or Project Red Sparrow or abstract matter numbers) that contain neither confidential Client nor law firm information'. It further states 'The platform does not allow the user to upload documents to our platform'. The Terms and Conditions PDF dated 19 August 2026 and the End User Licence Agreement dated 17 November 2023, both published on the legal page, were not opened, so any customer warranty about authority is not established.
Ask: Do the Terms and Conditions require anything of us before we search a target entity or an individual, and is the entity searched treated as confidential information of our client?
No AI position is established on the vendor's own material. Neither the home page nor the FAQ uses the words AI, artificial intelligence, machine learning, model or generative at any point; the nearest vendor wording is the FAQ statement that register information is augmented 'with DDLoop's own risk-based analysis and flagging system', which names no technique. The only vendor statement mentioning AI at all is a negative one on the security page: the platform does not 'allow any direct interaction with any AI systems/models through prompts'. No model, model family or AI provider is named anywhere on the pages read. Two third-party press reports describe the product as AI, and are recorded here as third-party descriptions rather than vendor claims: Startup Daily, 9 May 2025, reporting the Lander & Rogers LawTech Hub cohort, states 'DDLoop's AI Risk engine helps lawyers process 1000s of data points, reducing the risk of incorrect searches and inaccurate reporting'; Startup Daily, 27 October 2025, describes 'its AI-powered platform' in reporting the 2025 Legal Pitch Night result. Neither is the vendor publishing the claim.
Ask: Does the risk-based analysis and flagging system use machine learning or a large language model, and if so which model, which provider, and in which country does that processing run?
The vendor confirms that third parties sit in the search path but names none of them. The FAQ states register information is collated 'directly through the register or through 3rd party information brokers', that 'In some cases, we use third-party services to retrieve the information', and that 'Your searches are governed by the terms and conditions of those third-party services'. The security page names the Australian Business Register as one example: 'We use third-party services (for example, the Australian Business Register) to conduct searches.' No subprocessor list, hosting provider or information broker is published on any page read. The Privacy Collection Notice on the legal page states personal information may be disclosed to 'any third parties engaged by us and acting on our behalf' without naming them.
Ask: Name every information broker and service provider in the search path and the hosting provider, and will you publish or contractually commit to a subprocessor list with notice of changes?
Whether customer search data is used to train or improve anything
Public claim only
The security page states 'Your search data is yours. DDLoop does not use or share your data for purposes other than conducting the searches you request and to make sure we're giving you the best services possible.' The second limb of that sentence is an improvement purpose with no stated boundary, and nothing read states whether it includes training or tuning any model. No training, fine-tuning or de-identification clause was found on any page read, and the Terms and Conditions and Privacy Policy PDFs were not opened. The security page does state the platform does not 'allow any direct interaction with any AI systems/models through prompts'.
Ask: Does 'to make sure we're giving you the best services possible' include using our searches to train, tune or evaluate any model or scoring system, and will you exclude that contractually?
Nothing on the pages read addresses feedback, suggestions or corrections a user makes inside the platform, or whether they are retained or used to improve the service. The End User Licence Agreement dated 17 November 2023 and the Terms and Conditions dated 19 August 2026, where a feedback licence would ordinarily sit, are published as PDFs on the legal page and were not opened within the credit budget.
Ask: If a lawyer corrects or dismisses a flag raised by the analysis system, is that correction retained and used to change how the system flags for other customers?
No retention period for search data, project data or search evidence is published on any page read. The security page asserts ownership ('Your search data is yours') without stating how long it is held, and the platform's stale-data indicators and monitoring imply that earlier searches are retained for comparison ('Compare your new searches against old ones'), but no period is stated. The Privacy Policy PDF dated 14 April 2026 and the Terms and Conditions PDF dated 19 August 2026 were not opened.
Ask: How long are our projects, searches and search evidence retained, and can retention be set per matter so that searches are purged after completion?
No deletion commitment or mechanism is published on any page read. A 'User Rights Handling Process' dated 14 April 2026 is published as a PDF on the legal page and was not opened; its title indicates it addresses individual data subject rights rather than a customer right to have project and search data deleted. The Privacy Collection Notice on the legal page refers the reader to the Privacy Policy for access and correction, and names no deletion route.
Ask: Can we delete a project and all of its searches and evidence on demand, what happens in backups, and will you confirm deletion in writing?
Nothing read states whether DDLoop personnel can see a customer's projects, searches or project identifiers, under what approval, or whether such access is logged. The security page states 'While DDLoop uses publicly available data, how you use that information is completely confidential' and that project identifiers are pseudonymised matter code names containing no confidential client or firm information, which reduces what personnel could learn but is not a statement about access. The security page states 'robust access controls are enforced across all systems' without describing who they apply to.
Ask: Which DDLoop personnel can see our project list, the entities we have searched and the timing of those searches, and is that access logged and available to us?
The security page states 'Enterprise-grade SSO with SAML and SCIM compatibility' and, under Secure Development, that 'robust access controls are enforced across all systems'. Whether multi-factor authentication is available without single sign-on, what roles exist inside a firm account, whether project visibility can be restricted to a deal team, and whether network restrictions such as internet protocol allowlisting are offered are not stated on any page read.
Ask: Can project visibility be restricted to a named deal team, what roles exist, and is multi-factor authentication enforceable for firms not using single sign-on?
The security page states 'Data at rest is encrypted using AES-256. Data in transit is encrypted with TLS 1.2 or higher.' No key management arrangement is described, and no customer-managed key option is mentioned. The same page states data is hosted 'on ISO-certified infrastructure' without naming the provider or the certificate.
Ask: Who holds and rotates the encryption keys, and which entity holds the ISO certification referred to as covering the hosting infrastructure?
The security page publishes a section headed 'Highest Levels of Compliance' stating 'Independently audited to industry standards' with a single badge image labelled 'SOC 2 Certification'. No report type (Type I or Type II), no auditor, no report date, no scope statement and no trust centre or request-access route are published, and no ISO certificate held by DDLoop itself is claimed — the ISO reference on the same page is to the hosting infrastructure. The page invites a security review by email: 'To request additional cybersecurity information, please reach out to support@ddloop.app'.
Ask: Is the SOC 2 a Type I or Type II report, who is the auditor, what period does it cover, what is in scope, and will you provide it under a non-disclosure agreement?
The legal page (checked 2026-09-27) publishes the document set and the legal entities. The documents are Terms and Conditions updated 19 August 2026, an End User Licence Agreement updated 17 November 2023, a Privacy Policy updated 14 April 2026, a Cookie Policy updated 30 May 2025 and a User Rights Handling Process updated 14 April 2026, each as a downloadable PDF. Under 'Legal Entities' the page names two: for Australia, 'DDLoop Pty Ltd (ACN 658 895 624)'; for the United Kingdom, 'DDLoop UK Ltd (Company Number 14949763)' at 124 City Road, London. The same Australian entity appears in the footer of every page read. Which entity contracts with an Australian firm, the governing law, the liability position and any data processing terms are inside the PDFs, which were not opened within the credit budget.
Ask: Would our engagement be with DDLoop Pty Ltd under Australian law, what is the liability cap, and does the agreement include data processing terms or a separate data processing agreement?
Where data is held and whether it leaves Australia
Not confirmed
Two vendor statements sit at different levels of generality. The security page states 'Our Australian servers and data localisation policy ensures all data is stored securely in Australia.' The Privacy Collection Notice on the legal page states 'We store personal information in Australia. Where we disclose your personal information to third parties, those third parties may store, transfer or access personal information outside of Australia.' The second statement contemplates offshore access by third parties, which the first does not address, and the FAQ confirms third-party information brokers and services sit in the search path. The vendor also publishes a United Kingdom legal entity. The named data localisation policy itself is not published on any page read.
Ask: Which third parties can store, transfer or access data outside Australia, in which countries, and does the data localisation policy bind them as well as your own servers?
No incident response process, notification commitment or notification timeframe is published on any page read, and no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) appears on the security page, the FAQ or the legal page. The Privacy Policy PDF dated 14 April 2026, where a breach notification statement would ordinarily sit, was not opened.
Ask: Within what time will you notify us of a security incident affecting our projects or searches, and who inside our firm is notified?
Notice of changes to the service and the documents
Not confirmed
The legal page publishes an 'Updated' date against each document — Terms and Conditions 19 August 2026, Privacy Policy and User Rights Handling Process 14 April 2026, Cookie Policy 30 May 2025, End User Licence Agreement 17 November 2023 — which shows changes are dated, but no notice period or notification method is published. No release notes, changelog or product updates page appears in the site navigation, and nothing read commits the vendor to notify customers before changing a register source, an information broker or the analysis and flagging behaviour.
Ask: Will you notify us before changing an information broker, a register source or the flagging logic, and how much notice do we get of a change to the Terms and Conditions?
No export, portability or transition commitment on termination is published on any page read. In normal operation the vendor describes export of search data into the firm's own Microsoft Word templates and retention of search evidence as extracts, screenshots, certificates and reports, so material can be taken out matter by matter during the subscription; nothing read states what happens to projects and evidence still in the platform when a subscription ends, or for how long they remain retrievable.
Ask: On termination, can we bulk export every project with its search evidence, in what format, and for how long does it remain available?
The home page states the platform 'Works with iManage, Netdocuments and your PMS & billing systems' and the for-lawyers page states it 'Works with your DMS and billing systems'. Export into the firm's own Microsoft Word precedents is described on the for-lawyers page as 'Populate search data into your own MS Word templates', with 'BYO precedents to create client-ready DD reports or opinion letters'. Single sign-on is stated as 'SAML and SCIM compatibility'. An integrations page published at ddloop.app/integrations was not opened, and no application programming interface is named on the pages read.
Ask: Is there an API, and for each named integration what data moves in which direction and what permissions does it need in our systems?
Whether the platform retrieves material from the internet
Public claim only
The platform retrieves from external sources by design, and the vendor says so. The security page states DDLoop collects and transmits 'Publicly available data - information that any member of the public may access, or purchase access to, via the internet', and lists among its examples 'ASIC searches (company extracts), PPSR search results, IP Australia trade mark searches and Google searches'. The FAQ adds the WHOIS domain name registry and states that some retrieval runs through third-party services and information brokers, and that 'Your searches are governed by the terms and conditions of those third-party services'. What a Google search contributes to a report, and what search terms are sent, are not stated on any page read.
Ask: What search terms are sent to Google or to any general web search, what part of the report do those results feed, and is each retrieval recorded as evidence with its date?
Two vendor-described behaviours act without a user pressing a button each time: ordering searches from registers and information brokers, which the FAQ says the platform does on the entity identifiers the user enters, and 'Live Data Monitoring - Stay across all changes with notifications' together with 'Stale indicators' for out-of-date information on the for-lawyers page. Searches from official registers are ordinarily chargeable, so what the platform can order without a user step is a cost as well as a control question, and nothing read states whether re-searching is automatic or prompted. The security page states the platform does not allow 'any direct interaction with any AI systems/models through prompts' and does not allow document upload, so nothing generative is described as acting.
Ask: Can the platform re-run or order a chargeable register search without a user action — for example when monitoring detects a change — and who approves that spend?
Review of the platform's output before it is relied on
Public claim only
The vendor's own FAQ disclaimer is the clearest statement of where responsibility sits: 'Our information is only as current as our sources. As most of the information we provide is derived from third-parties, we can't guarantee it's free from errors. Accordingly, we make no representation or warranty that the information provided by third-parties is reliable, adequate, current, accurate or complete.' Against that, the platform is designed so that each search is accompanied by primary evidence a lawyer can check — extracts, screenshots, certificates and search reports, including an IP Australia Search Report and PPSR search certificates — and structure charts and flags are presented alongside that evidence. No published document read states a review obligation, because the Terms and Conditions and End User Licence Agreement PDFs were not opened.
Ask: Does every figure in an exported Word report trace to a retained register extract or certificate with its search date, so a reviewer can check the report against primary evidence?
