---
title: "DDLoop (DDLoop Pty Ltd)"
url: "https://ailawframework.com/software/ddloop"
type: "software_profile"
site: "AI Law Framework"
id: "ddloop"
vendor: "DDLoop Pty Ltd"
category: "Legal-specific"
segment: "Due diligence and data rooms"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# DDLoop (DDLoop Pty Ltd)

> Australian platform that orders, collates and reports public-register searches for legal due diligence — ASIC, PPSR, IP Australia, insolvency, litigation and land titles — and exports the data into a firm's own Word…

Canonical page: https://ailawframework.com/software/ddloop  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: DDLoop platform as described on the vendor pages read (home, FAQ, security, legal, for lawyers). The Terms and Conditions, EULA and Privacy Policy PDFs were not opened; the investors and insolvency pages are not covered.

Australian platform that orders, collates and reports public-register searches for legal due diligence — ASIC, PPSR, IP Australia, insolvency, litigation and land titles — and exports the data into a firm's own Word report precedents.

## Capabilities

- Due-diligence document review
- Data extraction
- Document automation
- Conflict checking
- IP search and clearance

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia |
| Australian region | Yes |
| Assurance | SOC 2 (badge only; report type, auditor, date and scope not published) |
| Training on customer content | Unknown |
| Retention | No retention period is published. The security page states 'Your search data is yours. DDLoop does not use or share your data for purposes other than conducting the searches you request and to make sure we're giving you the best services possible.' Earlier searches are evidently retained for the stale-data indicators and the search-to-search comparison the vendor describes, but no period, no in-life deletion route and no post-termination position is published. The Privacy Policy and Terms and Conditions PDFs were not opened. |
| Integrations | iManage, NetDocuments, practice management and billing systems, Microsoft Word export into the firm's own templates, single sign-on with SAML and SCIM |
| Legal content coverage | Public-register sources named by the vendor: ASIC Connect corporate information and ASIC published insolvency notices; the Personal Property Securities Register; IP Australia trade marks, patents and design registrations; individuals' corporate and bankruptcy history; litigation and court history; property and land titles across state registries; and the WHOIS domain name registry. Evidence of each search is retained as register extracts, screenshots, certificates and search reports, with the IP Australia Search Report and PPSR search certificates named. Which state land titles registries and which courts are covered is not stated. The vendor publishes its own currency and accuracy disclaimer in the FAQ. |
| Pricing | No pricing page, plan list or price appears in the site navigation or on any of the five vendor pages read. The published route to access is 'Book a Demo', and the FAQ directs a prospective user to book a demo or use the contact form. Whether the fee is per seat, per matter or per search, and whether register search fees are passed through, is not published. The Terms and Conditions PDF dated 19 August 2026 was not opened. |
| Australian presence | Yes. Australian contracting entity named on the legal page under 'Legal Entities' as DDLoop Pty Ltd (ACN 658 895 624), which is also the footer entity on every page read; a United Kingdom entity, DDLoop UK Ltd (Company Number 14949763) at 124 City Road, London, is named on the same page. The vendor states 'DDLoop is a LegalTech company made in Sydney, Melbourne and London by lawyers, for lawyers' and the FAQ describes it as 'an Australian LegalTech platform'. The security page states all data is stored in Australia on Australian servers; the Privacy Collection Notice on the legal page adds that third parties may store, transfer or access personal information outside Australia. The customers listed are the logos the vendor publishes on its home and security pages; two case-study pages (Talbot Sayer, Kain Lawyers) were not opened, so the scope of each engagement is not established. The pages carry an Acknowledgement of Country naming Gadigal (Eora Nation) and Wurundjeri Woi Wurrung and Bunurong (East Kulin Nations) lands. |
| Website | https://ddloop.app/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plans, pricing route and what this profile covers | Not confirmed | No pricing page, plan list or price appears anywhere in the site navigation or on the five vendor pages read (home, FAQ, security, legal, for lawyers). The only route to access published is 'Book a Demo', and the FAQ answer to 'I want to try DDLoop, how do I get started?' directs the reader to book a demo or use the contact form. Three audience pages are published — for lawyers, for investors and for insolvency professionals — but nothing read states whether these are different products, different plans or one product described three ways. This profile covers the platform as described on the pages read. | What are the plans and prices, is the fee per seat, per matter or per search, and are the register search fees passed through at cost or marked up? | [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) |
| Deployment model | Public claim only | The FAQ describes 'an Australian LegalTech platform', reached through a browser; the log-in link on every page points to dashboard.ddloop.app. The security page states 'Our Australian servers and data localisation policy ensures all data is stored securely in Australia.' No on-premises, private-cloud or self-hosted option appears on any page read, and the hosting provider is not named — the security page states only that 'All data is hosted on ISO-certified infrastructure'. | Who is the hosting provider, in which Australian region does the tenant sit, and is a single-tenant or dedicated-database option available? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Functions the vendor describes, and what the platform expressly does not do | Public claim only | The vendor describes a register-search and reporting platform. Per the FAQ, users 'enter company names, ACNs or ABNs' and the platform collates register information 'directly through the register or through 3rd party information brokers and augmenting it with DDLoop's own risk-based analysis and flagging system'. The for-lawyers page names the outputs: automated corporate structure charts, 'Live Data Monitoring — Stay across all changes with notifications', out-of-date search indicators, comparison of new searches against earlier ones, 'Evidence for Everything — Extracts, screenshots, certificates and reports', and export of search data into the firm's own Microsoft Word precedents to produce due diligence reports or opinion letters. The vendor states two express limits on its own security page: 'The platform does not allow the user to upload documents to our platform, nor allow any direct interaction with any AI systems/models through prompts.' Neither the home page nor the FAQ uses the words AI, artificial intelligence, machine learning or generative at any point. | What does the risk-based analysis and flagging system actually flag, what technique produces the flags, and can a firm see the rule or logic behind a flag? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/) |
| Registers and jurisdictions covered | Public claim only | The for-lawyers page names eight search types: ASIC corporate information from ASIC extracts; PPSR registrations for security interests over assets or shares; trade marks registered or applied for with IP Australia; an insolvency scan of ASIC published notices with proof of search; key people checks covering individuals' corporate and bankruptcy history; litigation and court history; property titles 'across state registries'; and other registered intellectual property covering patents and design registrations. The FAQ adds ASIC Connect and the WHOIS domain name registry. The FAQ names the evidence returned with each search, including an IP Australia Search Report for a trade mark search and PPSR search certificates. Which state land title registries are covered, and which courts are covered by the litigation history search, are not stated on any page read. | Which state and territory land titles registries and which courts and tribunals are covered by the property and litigation searches, and how current is each source? | [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq) |
| Named integrations | Public claim only | The home page states the platform 'Works with iManage, Netdocuments and your PMS & billing systems', and the for-lawyers page states 'Integrations — Works with your DMS and billing systems'. An integrations page is published in the site navigation at ddloop.app/integrations and was not opened, so what each integration does — whether it writes search evidence into a matter workspace, or only exports a file — is not established. The Microsoft Word export into the firm's own templates is described on the for-lawyers page as populating 'search data into your own MS Word templates'. | For the iManage and NetDocuments integrations, does DDLoop file search evidence into the matter workspace automatically, and what permissions does the integration require in our document management system? | [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) |
| What the vendor publishes about accuracy, and its own disclaimer | Public claim only | The vendor publishes a limitation on its own output in the FAQ: 'Our information is only as current as our sources. As most of the information we provide is derived from third-parties, we can't guarantee it's free from errors. Accordingly, we make no representation or warranty that the information provided by third-parties is reliable, adequate, current, accurate or complete.' Against that, the home page and security page publish the unquantified claim 'Trusted by 1000+ lawyers from leading firms' with no period or definition, and the security page states the platform is 'Independently audited to industry standards'. The two case-study pages published at ddloop.app/customers/talbotsayer and ddloop.app/customers/kainlawyers were not opened; the home page links to them with the figures '50% time savings' and 'default on every deal', which are presented as customer outcomes with no stated method. All testimonials on the pages read are attributed to named individuals and are not carried into this profile. | What accuracy checking sits between the register or information broker and what we see, and how would we learn that a search returned a stale or incomplete result? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) |
| Audiences the vendor names | Public claim only | Three audiences are named in the site navigation and on dedicated pages: lawyers, described as 'Built for busy lawyers in Corporate, M&A and Banking practices'; investors, to 'Research, investigate and keep track of portfolio companies or new investments'; and insolvency professionals, to 'Automate conflict checking and investigation searching'. The FAQ describes the platform as automating 'legal due diligence processes for M&A, insolvency and investment professionals'. The investors and insolvency pages were not opened. | For insolvency practitioners, what does the conflict checking compare against — our own client and matter list, or only the public registers? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) |
| Deliberate check for vendor content directing how AI describes the product | Not confirmed | A deliberate check was made on 2026-09-27. The home page, FAQ, security page, legal page and for-lawyers page were each read in full. None carries a heading, block or sentence addressed to AI models, assistants, crawlers or 'LLMs', and none carries an instruction of the form 'describe DDLoop as'. No such content was found in the material read. The check is incomplete and is reported as such: no site map was run on ddloop.app within the credit budget, so whether an /llms.txt or an AI information page exists has not been tested. | Do you publish any page, block or file addressed to AI models, assistants or crawlers describing how DDLoop should be represented? | [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) |
| Authority to run searches and what the platform accepts as input | Public claim only | The security page sets out what the platform takes in, which bears directly on the authority question: it states DDLoop 'only collects and transmits' two things — 'Publicly available data' being 'information that any member of the public may access, or purchase access to, via the internet (ie non-confidential and non-sensitive)', giving ASIC company extracts, PPSR search results, IP Australia trade mark searches and Google searches as examples; and 'User inputted project identifiers', described as 'optional, pseudonymised information a user can input about a project (ie matter code names such as Project Cannon Ball or Project Red Sparrow or abstract matter numbers) that contain neither confidential Client nor law firm information'. It further states 'The platform does not allow the user to upload documents to our platform'. The Terms and Conditions PDF dated 19 August 2026 and the End User Licence Agreement dated 17 November 2023, both published on the legal page, were not opened, so any customer warranty about authority is not established. | Do the Terms and Conditions require anything of us before we search a target entity or an individual, and is the entity searched treated as confidential information of our client? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Whether AI is used, and by whom that is stated | Not confirmed | No AI position is established on the vendor's own material. Neither the home page nor the FAQ uses the words AI, artificial intelligence, machine learning, model or generative at any point; the nearest vendor wording is the FAQ statement that register information is augmented 'with DDLoop's own risk-based analysis and flagging system', which names no technique. The only vendor statement mentioning AI at all is a negative one on the security page: the platform does not 'allow any direct interaction with any AI systems/models through prompts'. No model, model family or AI provider is named anywhere on the pages read. Two third-party press reports describe the product as AI, and are recorded here as third-party descriptions rather than vendor claims: Startup Daily, 9 May 2025, reporting the Lander & Rogers LawTech Hub cohort, states 'DDLoop's AI Risk engine helps lawyers process 1000s of data points, reducing the risk of incorrect searches and inaccurate reporting'; Startup Daily, 27 October 2025, describes 'its AI-powered platform' in reporting the 2025 Legal Pitch Night result. Neither is the vendor publishing the claim. | Does the risk-based analysis and flagging system use machine learning or a large language model, and if so which model, which provider, and in which country does that processing run? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/); [Startup Daily, 'Here are the 5 startups in the annual Lander & Rogers LawTech Hub', 9 May 2025 (third-party report)](https://www.startupdaily.net/topic/accelerator/here-are-the-5-startups-in-the-annual-lander-rogers-lawtech-hub/); [Startup Daily, 'DDLoop wins 2025 Legal Pitch Night with AI due diligence platform', 27 October 2025 (third-party report)](https://www.startupdaily.net/topic/accelerator/ddloop-wins-2025-legal-pitch-night-with-ai-due-diligence-platform/) |
| Third parties in the search path | Not confirmed | The vendor confirms that third parties sit in the search path but names none of them. The FAQ states register information is collated 'directly through the register or through 3rd party information brokers', that 'In some cases, we use third-party services to retrieve the information', and that 'Your searches are governed by the terms and conditions of those third-party services'. The security page names the Australian Business Register as one example: 'We use third-party services (for example, the Australian Business Register) to conduct searches.' No subprocessor list, hosting provider or information broker is published on any page read. The Privacy Collection Notice on the legal page states personal information may be disclosed to 'any third parties engaged by us and acting on our behalf' without naming them. | Name every information broker and service provider in the search path and the hosting provider, and will you publish or contractually commit to a subprocessor list with notice of changes? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Whether customer search data is used to train or improve anything | Public claim only | The security page states 'Your search data is yours. DDLoop does not use or share your data for purposes other than conducting the searches you request and to make sure we're giving you the best services possible.' The second limb of that sentence is an improvement purpose with no stated boundary, and nothing read states whether it includes training or tuning any model. No training, fine-tuning or de-identification clause was found on any page read, and the Terms and Conditions and Privacy Policy PDFs were not opened. The security page does state the platform does not 'allow any direct interaction with any AI systems/models through prompts'. | Does 'to make sure we're giving you the best services possible' include using our searches to train, tune or evaluate any model or scoring system, and will you exclude that contractually? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Use of feedback and in-product corrections | Not confirmed | Nothing on the pages read addresses feedback, suggestions or corrections a user makes inside the platform, or whether they are retained or used to improve the service. The End User Licence Agreement dated 17 November 2023 and the Terms and Conditions dated 19 August 2026, where a feedback licence would ordinarily sit, are published as PDFs on the legal page and were not opened within the credit budget. | If a lawyer corrects or dismisses a flag raised by the analysis system, is that correction retained and used to change how the system flags for other customers? | [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Retention of search data and project data | Not confirmed | No retention period for search data, project data or search evidence is published on any page read. The security page asserts ownership ('Your search data is yours') without stating how long it is held, and the platform's stale-data indicators and monitoring imply that earlier searches are retained for comparison ('Compare your new searches against old ones'), but no period is stated. The Privacy Policy PDF dated 14 April 2026 and the Terms and Conditions PDF dated 19 August 2026 were not opened. | How long are our projects, searches and search evidence retained, and can retention be set per matter so that searches are purged after completion? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Deletion on request and on exit | Not confirmed | No deletion commitment or mechanism is published on any page read. A 'User Rights Handling Process' dated 14 April 2026 is published as a PDF on the legal page and was not opened; its title indicates it addresses individual data subject rights rather than a customer right to have project and search data deleted. The Privacy Collection Notice on the legal page refers the reader to the Privacy Policy for access and correction, and names no deletion route. | Can we delete a project and all of its searches and evidence on demand, what happens in backups, and will you confirm deletion in writing? | [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Vendor personnel access to customer data | Not confirmed | Nothing read states whether DDLoop personnel can see a customer's projects, searches or project identifiers, under what approval, or whether such access is logged. The security page states 'While DDLoop uses publicly available data, how you use that information is completely confidential' and that project identifiers are pseudonymised matter code names containing no confidential client or firm information, which reduces what personnel could learn but is not a statement about access. The security page states 'robust access controls are enforced across all systems' without describing who they apply to. | Which DDLoop personnel can see our project list, the entities we have searched and the timing of those searches, and is that access logged and available to us? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Authentication, roles and network controls | Public claim only | The security page states 'Enterprise-grade SSO with SAML and SCIM compatibility' and, under Secure Development, that 'robust access controls are enforced across all systems'. Whether multi-factor authentication is available without single sign-on, what roles exist inside a firm account, whether project visibility can be restricted to a deal team, and whether network restrictions such as internet protocol allowlisting are offered are not stated on any page read. | Can project visibility be restricted to a named deal team, what roles exist, and is multi-factor authentication enforceable for firms not using single sign-on? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Encryption in transit and at rest | Public claim only | The security page states 'Data at rest is encrypted using AES-256. Data in transit is encrypted with TLS 1.2 or higher.' No key management arrangement is described, and no customer-managed key option is mentioned. The same page states data is hosted 'on ISO-certified infrastructure' without naming the provider or the certificate. | Who holds and rotates the encryption keys, and which entity holds the ISO certification referred to as covering the hosting infrastructure? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Independent audit and certification | Public claim only | The security page publishes a section headed 'Highest Levels of Compliance' stating 'Independently audited to industry standards' with a single badge image labelled 'SOC 2 Certification'. No report type (Type I or Type II), no auditor, no report date, no scope statement and no trust centre or request-access route are published, and no ISO certificate held by DDLoop itself is claimed — the ISO reference on the same page is to the hosting infrastructure. The page invites a security review by email: 'To request additional cybersecurity information, please reach out to support@ddloop.app'. | Is the SOC 2 a Type I or Type II report, who is the auditor, what period does it cover, what is in scope, and will you provide it under a non-disclosure agreement? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Contracting entity and contract documents | Public claim only | The legal page (checked 2026-09-27) publishes the document set and the legal entities. The documents are Terms and Conditions updated 19 August 2026, an End User Licence Agreement updated 17 November 2023, a Privacy Policy updated 14 April 2026, a Cookie Policy updated 30 May 2025 and a User Rights Handling Process updated 14 April 2026, each as a downloadable PDF. Under 'Legal Entities' the page names two: for Australia, 'DDLoop Pty Ltd (ACN 658 895 624)'; for the United Kingdom, 'DDLoop UK Ltd (Company Number 14949763)' at 124 City Road, London. The same Australian entity appears in the footer of every page read. Which entity contracts with an Australian firm, the governing law, the liability position and any data processing terms are inside the PDFs, which were not opened within the credit budget. | Would our engagement be with DDLoop Pty Ltd under Australian law, what is the liability cap, and does the agreement include data processing terms or a separate data processing agreement? | [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Where data is held and whether it leaves Australia | Not confirmed | Two vendor statements sit at different levels of generality. The security page states 'Our Australian servers and data localisation policy ensures all data is stored securely in Australia.' The Privacy Collection Notice on the legal page states 'We store personal information in Australia. Where we disclose your personal information to third parties, those third parties may store, transfer or access personal information outside of Australia.' The second statement contemplates offshore access by third parties, which the first does not address, and the FAQ confirms third-party information brokers and services sit in the search path. The vendor also publishes a United Kingdom legal entity. The named data localisation policy itself is not published on any page read. | Which third parties can store, transfer or access data outside Australia, in which countries, and does the data localisation policy bind them as well as your own servers? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq) |
| Security incident and breach notification | Not confirmed | No incident response process, notification commitment or notification timeframe is published on any page read, and no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) appears on the security page, the FAQ or the legal page. The Privacy Policy PDF dated 14 April 2026, where a breach notification statement would ordinarily sit, was not opened. | Within what time will you notify us of a security incident affecting our projects or searches, and who inside our firm is notified? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Notice of changes to the service and the documents | Not confirmed | The legal page publishes an 'Updated' date against each document — Terms and Conditions 19 August 2026, Privacy Policy and User Rights Handling Process 14 April 2026, Cookie Policy 30 May 2025, End User Licence Agreement 17 November 2023 — which shows changes are dated, but no notice period or notification method is published. No release notes, changelog or product updates page appears in the site navigation, and nothing read commits the vendor to notify customers before changing a register source, an information broker or the analysis and flagging behaviour. | Will you notify us before changing an information broker, a register source or the flagging logic, and how much notice do we get of a change to the Terms and Conditions? | [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Getting data out at the end | Not confirmed | No export, portability or transition commitment on termination is published on any page read. In normal operation the vendor describes export of search data into the firm's own Microsoft Word templates and retention of search evidence as extracts, screenshots, certificates and reports, so material can be taken out matter by matter during the subscription; nothing read states what happens to projects and evidence still in the platform when a subscription ends, or for how long they remain retrievable. | On termination, can we bulk export every project with its search evidence, in what format, and for how long does it remain available? | [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) |
| Integrations and connections to other systems | Public claim only | The home page states the platform 'Works with iManage, Netdocuments and your PMS & billing systems' and the for-lawyers page states it 'Works with your DMS and billing systems'. Export into the firm's own Microsoft Word precedents is described on the for-lawyers page as 'Populate search data into your own MS Word templates', with 'BYO precedents to create client-ready DD reports or opinion letters'. Single sign-on is stated as 'SAML and SCIM compatibility'. An integrations page published at ddloop.app/integrations was not opened, and no application programming interface is named on the pages read. | Is there an API, and for each named integration what data moves in which direction and what permissions does it need in our systems? | [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Whether the platform retrieves material from the internet | Public claim only | The platform retrieves from external sources by design, and the vendor says so. The security page states DDLoop collects and transmits 'Publicly available data - information that any member of the public may access, or purchase access to, via the internet', and lists among its examples 'ASIC searches (company extracts), PPSR search results, IP Australia trade mark searches and Google searches'. The FAQ adds the WHOIS domain name registry and states that some retrieval runs through third-party services and information brokers, and that 'Your searches are governed by the terms and conditions of those third-party services'. What a Google search contributes to a report, and what search terms are sent, are not stated on any page read. | What search terms are sent to Google or to any general web search, what part of the report do those results feed, and is each retrieval recorded as evidence with its date? | [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security); [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq) |
| Whether the product takes actions on its own | Public claim only | Two vendor-described behaviours act without a user pressing a button each time: ordering searches from registers and information brokers, which the FAQ says the platform does on the entity identifiers the user enters, and 'Live Data Monitoring - Stay across all changes with notifications' together with 'Stale indicators' for out-of-date information on the for-lawyers page. Searches from official registers are ordinarily chargeable, so what the platform can order without a user step is a cost as well as a control question, and nothing read states whether re-searching is automatic or prompted. The security page states the platform does not allow 'any direct interaction with any AI systems/models through prompts' and does not allow document upload, so nothing generative is described as acting. | Can the platform re-run or order a chargeable register search without a user action — for example when monitoring detects a change — and who approves that spend? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers); [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) |
| Review of the platform's output before it is relied on | Public claim only | The vendor's own FAQ disclaimer is the clearest statement of where responsibility sits: 'Our information is only as current as our sources. As most of the information we provide is derived from third-parties, we can't guarantee it's free from errors. Accordingly, we make no representation or warranty that the information provided by third-parties is reliable, adequate, current, accurate or complete.' Against that, the platform is designed so that each search is accompanied by primary evidence a lawyer can check — extracts, screenshots, certificates and search reports, including an IP Australia Search Report and PPSR search certificates — and structure charts and flags are presented alongside that evidence. No published document read states a review obligation, because the Terms and Conditions and End User Licence Agreement PDFs were not opened. | Does every figure in an exported Word report trace to a retained register extract or certificate with its search date, so a reviewer can check the report against primary evidence? | [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq); [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) |

## Notes

MATERIAL FINDING FOR THE REGISTER, reported to the Maestro rather than resolved here: DDLoop's AI position is not established on the vendor's own material. The home page and FAQ do not use the words AI, artificial intelligence, machine learning, model or generative at any point; the vendor's own wording is 'DDLoop's own risk-based analysis and flagging system' with no technique stated, and the only vendor sentence mentioning AI is a negative one on the security page, that the platform does not 'allow any direct interaction with any AI systems/models through prompts'. The 'AI Risk engine' description traces to Startup Daily's report of the Lander & Rogers LawTech Hub cohort, which is a press write-up and under the project standard is context, never a vendor claim. Whether the product belongs in an AI register on this evidence is a scope decision for the Maestro. Read for this profile: the home page, FAQ, security page, legal page and for-lawyers page. Not opened within the credit budget: the five binding PDFs published on the legal page (Terms and Conditions 19 August 2026, End User Licence Agreement 17 November 2023, Privacy Policy 14 April 2026, Cookie Policy 30 May 2025, User Rights Handling Process 14 April 2026), the integrations page, the investors and insolvency pages, and the two case studies. As a result nine of the twenty critical controls stand at not_verified. Capability gap reported, not invented: no CAPABILITY value expresses ordering, collating and reporting official public-register searches and the evidence of each search, which is the whole of what this product does; the closest existing values were used instead, following the convention already set for comparable products. A second, lower-priority gap: monitoring a register for changes to an entity already searched has no value, and compliance-monitoring was not used because the vendor does not frame it as a compliance obligation.

## Sources

- [DDLoop home page — platform, register coverage, integrations and customer logos](https://ddloop.app/) (checked 2026-09-27)
- [DDLoop FAQ — what it is, how it works, where the data comes from](https://ddloop.app/faq) (checked 2026-09-27)
- [DDLoop Security page — data residency, encryption, SSO, what data the platform uses](https://ddloop.app/security) (checked 2026-09-27)
- [DDLoop 'The Legal Stuff' page — document list, Privacy Collection Notice and legal entities](https://ddloop.app/legal) (checked 2026-09-27)
- [DDLoop for lawyers page — due diligence coverage, structure charts, Word export](https://ddloop.app/for-lawyers) (checked 2026-09-27)
- [Startup Daily, 'Here are the 5 startups in the annual Lander & Rogers LawTech Hub', 9 May 2025 (third-party report)](https://www.startupdaily.net/topic/accelerator/here-are-the-5-startups-in-the-annual-lander-rogers-lawtech-hub/) (checked 2026-09-27)
- [Startup Daily, 'DDLoop wins 2025 Legal Pitch Night with AI due diligence platform', 27 October 2025 (third-party report)](https://www.startupdaily.net/topic/accelerator/ddloop-wins-2025-legal-pitch-night-with-ai-due-diligence-platform/) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.