Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and licensing scope covered
Public claim only
IntelliEdge is published as the AI layer across the Debtrak collections platform rather than as a separate product: the feature page calls it 'The next generation of Debtrak' and states 'IntelliEdge is the AI layer that sits across Debtrak. It is not a feature added to a platform - it is a continuous decisioning engine'. The pricing page states 'Debtrak is licensed per operator and scales with your team, not your debt book. Every environment and every feature is included', lists 'Omnichannel engagement SMS, email, letter, phone, web portal, and Voice AI through IntelliEdge' among what is included, and states production, disaster recovery, UAT and integration environments are part of the platform fee. No page states whether IntelliEdge can be licensed off, or priced separately.
Ask: Can the platform be licensed with IntelliEdge disabled, is any part of IntelliEdge priced separately from the per-operator licence, and which components are on by default?
What the AI components do
Public claim only
The IntelliEdge page names five AI components. 'LLM Account Summaries: AI-generated comprehensive account summaries reduce call setup time. Agents see the full account story at a glance - payment history, contact attempts, arrangements, and risk signals - in one concise summary', updating in real time and including 'the recommended next action, and any compliance flags an agent must observe'. 'Next Best Action Engine: Intelligent recommendation engine suggesting the optimal contact strategy, call script, settlement offer, or escalation path for every account - based on historical data across 40M+ accounts', proposing an action 'with confidence and expected uplift versus the alternatives'. 'Predictive Analytics: Propensity-to-pay scoring and dollar value prediction'. 'AI-Driven Call Scripts: Dynamic script recommendations based on account context, debtor profile, and historical success patterns'. 'Voice AI Agent: Automated voice agent handles routine outbound calls - payment reminders, arrangement confirmations, and initial contact attempts', which 'handles the conversation end-to-end with full compliance recording and escalation to a human agent on any complexity signal'. All of this is on the vendor's own feature page; no model, evaluation or accuracy evidence accompanies it.
Ask: Demonstrate each of the five IntelliEdge components on our own portfolio, and show what an account summary, a Next Best Action recommendation and a Voice AI call transcript look like end to end.
Deployment and hosting
Public claim only
The security page states 'The reference architecture sits in Azure Australia regions with all data and processing remaining onshore' for Australian government engagements, and that 'Customers operating under data sovereignty obligations that require their own tenancy can deploy into customer-controlled BYOC Azure or AWS environments while still receiving the standard support, monitoring, and update cadence applicable to the platform.' The IntelliEdge page describes a 'Headless Architecture' with 'API-first design lets enterprise clients build entirely custom frontends connected to the IntelliEdge backend'. The vendor's comparison page states 'BYOC Azure or AWS deployment supported for organisations requiring tenancy isolation'. Nothing published states whether IntelliEdge, including Voice AI and the LLM that produces account summaries, runs inside a BYOC tenancy or calls out of it.
Ask: In a BYOC Azure or AWS deployment, do the LLM account summaries, Voice AI and Next Best Action models run inside our tenancy, or does the platform call an external service?
Jurisdiction, regulatory framing and legal-recovery functions
Public claim only
The security page states 'ACCC and ASIC Debt Collection Guidelines are encoded in the platform's contact-frequency engine' so that a collector 'cannot accidentally breach call frequency limits, send notices outside permitted hours, or attempt contact during a recorded vulnerability hold - the system simply prevents the action, logs the attempt, and returns a clear explanation to the operator', and that the same engine handles 'GDPR data subject access requests, UK FCA conduct rules, and the bespoke obligations imposed by individual government clients (such as model litigant principles and hardship referral mandates)'. The comparison page lists the legal-recovery functions: 'director and guarantor account linking, related entity views, secured asset registers, statutory demand drafting, external lawyer instruction workflow, commercial recovery escalation paths, and multi-jurisdictional commercial litigation tracking', and names ASIC RG 96, AFCA, UK FCA Consumer Duty, UK GDPR and the NZ Privacy Act 2020. No governing-law clause is published: no terms of use document was found on the site, although the Privacy Policy refers to 'our terms of use'.
Ask: Which law governs the agreement, and which of the regulatory rule sets you say are encoded are warranted, as opposed to configured by us at implementation?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A filtered site map returned 59 URLs and none is an /llms.txt, /ai-info, /ai or /for-ai path. The five debtrak.com pages read in full - IntelliEdge, Security & Compliance, Pricing, Privacy Policy & Notice and the comparison guide - and the Trust Center overview contain no block addressed to AI models, assistants, crawlers or 'LLMs', and no 'Instructions for AI Assistants' heading. A filtered map is not a complete crawl, so this records an absence across the URL set and the pages read rather than proof that no such file exists.
Ask: Do you publish any page, file or metadata that tells AI assistants or crawlers how to describe Debtrak, and do you maintain an llms.txt or equivalent?
Vendor-published comparison page that ranks the vendor's own product
Public claim only
On its own domain the vendor publishes a page titled 'Best Debt Collection Software in Australia: 2026 Comparison Guide', introduced as 'An independent guide to the leading enterprise debt collection software platforms used in Australia in 2026', checked 2026-09-27. Under 'Top platforms compared' the vendor's own product is listed first, as '1. Debtrak (Sydney, Australia)'. The page's Frequently Asked Questions ask and answer comparative and superlative questions about the vendor: 'What is the best debt collection software in Australia for enterprise organisations?' is answered 'Debtrak is among the leading software platforms', and 'Which Australian debt collection platform is best for government revenue recovery?' is answered 'Debtrak meets all four conditions out of the box'. The page also makes statements about named competitors' certifications and data residency, and carries the line 'Information about competitor products in this guide is drawn from publicly available material as of May 2026.' This catalogue records no ranking of its own; the page is recorded because it is the vendor's published material in machine-readable question-and-answer form.
Ask: Which statements about competitors' certifications, AI capability and Australian data residency in your comparison guide were confirmed with those vendors, on what date, and how is the guide's description of itself as independent reconciled with its publication on your own domain?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to process debtor personal information
Public claim only
The Privacy Policy & Notice (10 June 2026) addresses Debtrak as a controller of the personal data of its own website and service users, setting out lawful bases of consent, contractual obligation and legal obligation, and states 'For European Union and United Kingdom data protection purposes, when we act as a controller in relation to your personal data, Debtrak UK Limited (company number 07131823) is our representative in Europe.' It does not address Debtrak's role as processor of the debtor personal information a creditor or agency loads into the platform, nor the customer's obligations to those debtors. The security page states access is limited to 'Closed groups with access to allocated clients and entities only'.
Ask: Which document appoints Debtrak as processor of our debtors' personal information, what does it require of us in notifying debtors, and does it cover Voice AI call recordings?
Model and model provider
Not confirmed
No model, model family, version or provider is named anywhere on the five debtrak.com pages read or on the Trust Center overview. The IntelliEdge page uses the heading 'LLM Account Summaries' without naming the model or its provider, and describes Voice AI as a system that 'speaks naturally' without naming a speech or language model. The only infrastructure named is Azure ('Azure Australia regions', 'UK Azure regions', 'BYOC Azure or AWS'), which identifies a hosting region rather than a model provider.
Ask: Which large language model and which provider generate account summaries and drive Voice AI, is inference performed inside the Azure tenancy that holds our data, and will we be notified before either changes?
Subprocessors
Not confirmed
No subprocessor list is published. The Privacy Policy states data may be disclosed to 'other companies in the Debtrak group of companies' and to regulators, law enforcement, courts and others where necessary or consented, and does not list service providers at all. The security page names Microsoft Entra ID and Azure, and refers to 'an independent CREST-certified penetration testing firm' without naming it. The Trust Center lists policy documents behind a 'Request access' control and shows no subprocessor register. The channels described on the IntelliEdge page - SMS, WhatsApp, telephony for Voice AI - imply third parties that are not named anywhere.
Ask: Provide the current subprocessor list naming every provider and its region, including the LLM provider, the speech provider behind Voice AI, the telephony carrier, the SMS gateway and the WhatsApp channel provider.
Use of customer content for model training
Not confirmed
Two statements on the same IntelliEdge page do not sit together. Under 'Continuous learning from your own data' the page states 'IntelliEdge models are trained on each customer's own data. A government revenue agency's model is different from a bank's, which is different from an agency's. Models retrain on a rolling basis as outcomes accumulate, so the recommendations improve continuously without consultancy intervention.' The description of the Next Best Action Engine on the same page states its recommendations are 'based on historical data across 40M+ accounts', and the page elsewhere states 40M+ accounts are 'managed across all clients'. Nothing published states whether the LLM that produces account summaries, or the Voice AI, is trained or fine-tuned on customer content, or whether any content leaves the tenancy to reach a model provider.
Ask: Is any model, including the Next Best Action engine, trained or evaluated on data from other customers' accounts, and will you warrant that our account data is not used outside our own tenant models?
Use of agent behaviour and outcomes as feedback
Public claim only
The IntelliEdge page states of adaptive scripting that 'Agents retain full discretion to deviate; deviations and outcomes feed back into the model', and that models 'retrain on a rolling basis as outcomes accumulate'. So collector behaviour and call outcomes are captured as training signal by design. Nothing published states whether that signal is confined to the customer's own model, whether it can be switched off while keeping the recommendations, or whether individual collector performance derived from it is reported to the employer beyond the 'agent performance' dashboards named on the same page.
Ask: Can we keep IntelliEdge recommendations while opting out of the feedback loop that captures collector deviations, and does any collector-level feedback signal leave our tenancy?
Retention
Not confirmed
The security page states audit logs are 'immutable, retained for the period required by the engagement (typically seven years for government and ten for banking), and available to the customer's SIEM via a streaming feed'. So the retention period is set per engagement rather than by a published default. The Privacy Policy sets no period, stating retention 'for as long as we have a relationship with you and for a period of time afterwards where we have an ongoing business need to retain it, in accordance with our data retention policies and practices', after which it will be 'deleted or anonymised'; the referenced Data Retention Policy is listed on the Trust Center behind 'Request access'. No retention period is published for debtor account records, AI-generated summaries or Voice AI call recordings.
Ask: What retention period will our engagement set for account records, AI-generated summaries and Voice AI recordings, and can you release the Data Retention Policy listed on your Trust Center?
Deletion and destruction
Public claim only
The Privacy Policy gives a right to erasure 'in certain circumstances' with a one-month response time, and the Trust Center's 'Your Data' section invites a request to 'request access, updates, migration, or deletion'. Against that, the security page states audit logs are 'immutable' and that every action is logged 'with timestamp, user, source IP, and where applicable a before-and-after diff', with retention typically seven to ten years. Nothing published reconciles the erasure right with immutable logs, and nothing addresses deletion of a debtor's AI-generated account summaries or of a Voice AI call recording.
Ask: If a debtor exercises the erasure right, what is deleted and what survives in the immutable audit log, and are AI-generated summaries and Voice AI recordings about that debtor deleted?
Vendor personnel access to customer data
Not confirmed
Nothing on the pages read states whether Debtrak personnel can read customer account records, under what conditions, whether that access is logged in the same immutable audit log, or whether the customer is notified. The security page describes 'granular role-based access controls reviewed on a quarterly basis as part of the ISMS audit cycle' and a security operations capability with 'continuous monitoring of authentication events, anomaly detection on data access patterns', but both are framed around customer users and platform monitoring. No background-check or break-glass statement appears.
Ask: Under what conditions can Debtrak support, engineering or security-operations staff read our debtor records, does that access appear in the immutable audit log we can stream, and can we require notification?
Access control and authentication
Public claim only
The security page lists 'Data encryption at rest and in transit', 'Encrypted login to application and multiple databases', 'Multi-factor authentication', 'Closed groups with access to allocated clients and entities only' and 'Access level permissions on reports, clients, action flows, workflows, queues/tasks, and other operators', and adds 'hardened Microsoft Entra ID integration for SSO, conditional access policies with MFA enforcement, and granular role-based access controls reviewed on a quarterly basis as part of the ISMS audit cycle'. Nothing published states whether access to IntelliEdge output - account summaries, propensity scores, Next Best Action recommendations - can be permissioned separately from access to the account itself, or who may override a recommendation.
Ask: Can access to IntelliEdge summaries, scores and recommendations be permissioned separately from account access, and who is permitted to override a Next Best Action or a propensity score?
Encryption
Public claim only
The security page states 'encrypted-at-rest storage using AES-256, TLS 1.3 for data in transit' and lists 'Data encryption at rest and in transit' and 'Encrypted login to application and multiple databases'. No statement addresses key management, key rotation, hardware security modules or customer-managed keys, and nothing states how keys are held in a customer-controlled BYOC Azure or AWS deployment.
Ask: Who holds and rotates the encryption keys in the standard deployment, and in a BYOC deployment can we hold customer-managed keys covering the databases, the audit log and Voice AI recordings?
Independent assurance and certification
Public claim only
The vendor's Trust Center, hosted on Sprinto, lists one certification: 'ISO 27001 v2022 - Certified'. It also lists policy documents (Information Security, Acceptable Usage, Access Control, Business Continuity, Data Retention, Disaster Recovery and '+37 more') behind a 'Request access' control, and no certificate or report is downloadable without a request. The security page states 'Debtrak's ISO 27001:2022 certified debt collection platform', that 'Debtrak operates an IRAP-assessed deployment pattern aligned to the OFFICIAL:Sensitive classification', and that it 'engages an independent CREST-certified penetration testing firm annually, with a public executive summary available under NDA on request', plus 'weekly vulnerability scans, monthly dependency audits, daily SAST analysis, and a bug bounty programme open to assessed researchers'. The pricing and comparison pages use the phrase 'IRAP-aligned' rather than IRAP-assessed. No SOC 2 appears on the Trust Center. Nothing states whether the IntelliEdge components are inside the certified or assessed scope.
Ask: Provide the ISO 27001 certificate with its scope statement and certificate number, the date, assessor and scope of the IRAP assessment, and confirm in writing whether Voice AI and the LLM account summaries are inside both scopes.
Contracting entity and documents
Not confirmed
No subscription agreement, master services agreement, terms of use, data processing agreement or AI schedule is published on the site or in the 59-URL filtered map, although the Privacy Policy refers to 'our terms of use'. Pricing is quote-based: the pricing page states 'Enterprise and government collections deployments differ too much for a single published price to be honest' and routes to a quote request. The Privacy Policy names three entities - 'Debtrak Pty Limited, Debtrak UK Ltd, and Debtrak Software Pty Ltd' - and states 'Our headquarters are in Australia but we operate and have offices all over the world', without saying which entity contracts with an Australian customer. No ABN or ACN is published on any page read; Debtrak UK Limited's company number 07131823 is published.
Ask: Which of the three named Debtrak entities contracts with us, what is its ACN and ABN, and can you provide the terms of use, a data processing agreement and an AI schedule covering Voice AI and LLM summaries?
Cross-border transfers
Not confirmed
The security page is unqualified: 'All data for Australian customers stays in Australian Azure regions with no replication or backup outside Australia. UK customer data stays in UK Azure regions.' The Privacy Policy & Notice is conditional: 'We do not transfer your data from the jurisdiction it was collected without ensuring an adequate level of protection is in place to protect your data prior to any transfer', and it permits disclosure to 'other companies in the Debtrak group of companies', naming a UK entity and stating that Debtrak has 'offices all over the world'. The two documents describe different positions: no transfer at all in one, and transfer subject to adequate protection in the other. Nothing published states where support, engineering or security-operations staff are located or whether they access Australian customer data from outside Australia.
Ask: Does 'no replication or backup outside Australia' also bar access to our data from your non-Australian offices and staff, is it a contractual term, and how does it sit with the intra-group transfer permission in the Privacy Policy?
Incident and breach notification
Public claim only
The security page states Debtrak 'operates a security operations capability dedicated to the platform: continuous monitoring of authentication events, anomaly detection on data access patterns, integration with the customer's own SIEM where required, and a defined incident response playbook with formal severity classification and escalation thresholds. Severity 1 incidents are notified to the customer within thirty minutes of detection with a written initial assessment within two hours.' This appears on a product page; no agreement was found that carries it, and the Privacy Policy does not mention the Notifiable Data Breaches scheme or any notification window.
Ask: Is the thirty-minute Severity 1 notification a contractual commitment with a remedy, what defines Severity 1, and who notifies affected debtors under the Notifiable Data Breaches scheme?
Change notice
Public claim only
The Privacy Policy states 'We may need to update this notice from time to time. Where a change is significant, we'll make sure we let you know - usually by sending you an email.' No published document addresses notice of changes to the platform or to the AI: nothing states what notice precedes a change to the Next Best Action model, to Voice AI behaviour or scripts, to the LLM behind account summaries, or to the compliance rule sets encoded in the contact-frequency engine. The IntelliEdge page states models 'retrain on a rolling basis as outcomes accumulate' and that the low-code workflow designer means 'Changes are live in minutes, not weeks'.
Ask: What notice do we receive before a model retrain changes Next Best Action behaviour, before the LLM or Voice AI provider changes, and before an encoded regulatory rule set is updated - and can a version be pinned?
Exit and data portability
Not confirmed
No exit, transition or export provision is published on the pages read. The published routes that could bear on it are the 'Headless API-first design', the audit-log 'streaming feed' to the customer's SIEM, and BYOC deployment into a customer-controlled Azure or AWS environment. Nothing states in what format an exit extract is delivered, whether it includes arrangements, contact history, AI-generated summaries, scores and Voice AI recordings, over what period, or at what cost. The Trust Center 'Your Data' section mentions 'migration' as a request type without describing it.
Ask: On exit, in what format do we receive the complete account, arrangement, contact-history, audit-log and AI-output record including Voice AI recordings, over what period, and at what cost?
Connectors and outbound channels
Public claim only
The IntelliEdge page states omnichannel engagement reaches debtors 'on their preferred channel - SMS, email, phone, WhatsApp, web portal, and Voice AI', and describes a debtor self-service portal where debtors 'view balances, set up payment arrangements, upload documents, and manage their accounts', plus a client performance portal providing 'Real-time performance monitoring and data exchange for your clients'. The comparison page lists 30+ enterprise integrations including core banking platforms, ERPs, payment gateways, dialler systems, SIEM and BI layers. The security page adds the SIEM streaming feed for audit logs. No page names the providers behind the SMS, WhatsApp or telephony channels.
Ask: Can individual channels be disabled - specifically WhatsApp - and does the client performance portal expose AI-generated summaries or scores to your customer's own clients?
Retrieval outside the tenancy
Not confirmed
Nothing on the pages read states whether any IntelliEdge component retrieves information from outside the customer's data. Recommendations are attributed to 'historical data across 40M+ accounts' and to 'account context, debtor profile, and historical success patterns', and summaries to the account record; no page says whether a request reaches any external endpoint during a debtor interaction, or whether Voice AI speech processing occurs outside the Azure tenancy.
Ask: During a debtor interaction, does any IntelliEdge component call an endpoint outside our tenancy - a public LLM API, a speech service, a web lookup - and in which region does each such endpoint run?
What the AI does without a human acting
Public claim only
IntelliEdge is published as taking real-world action. The Voice AI Agent 'handles routine outbound calls - payment reminders, arrangement confirmations, and initial contact attempts', and 'For straightforward outbound and inbound calls - payment reminders, arrangement check-ins, balance confirmations - Voice AI handles the conversation end-to-end with full compliance recording and escalation to a human agent on any complexity signal. The system speaks naturally, follows the same compliance rules a human collector would, and integrates with the same workflow engine, so a Voice AI interaction is indistinguishable in the audit trail from a human call.' The compliance engine acts as a hard control on human agents: 'the system simply prevents the action, logs the attempt, and returns a clear explanation to the operator'. The page does not say what defines a 'complexity signal', or whether Voice AI can conclude a payment arrangement.
Ask: Which actions can Voice AI complete without a human - can it agree or vary a payment arrangement, or accept a hardship or vulnerability disclosure - what triggers escalation, and is the debtor told they are speaking to an automated agent?
Human review and sign-off
Public claim only
The IntelliEdge page states the objective is 'keeping the collections team out of work that does not benefit from human judgement', that agents open an account with an AI-generated summary and 'start the conversation with context', and that on scripts 'Agents retain full discretion to deviate'. Voice AI escalates 'to a human agent on any complexity signal'. Nothing published states whether a human reviews a Voice AI interaction afterwards, whether an AI-generated account summary is checked against the underlying record before it is relied on, or whether a human must approve an escalation the Next Best Action engine recommends - including the escalation paths the comparison page ties to legal steps, namely statutory demand drafting, external lawyer instruction workflow and commercial litigation tracking.
Ask: Is human sign-off required before an account is escalated to a legal step - statutory demand, external lawyer instruction, litigation - on an IntelliEdge recommendation, and is the approving person recorded?
