---
title: "Debtrak IntelliEdge (Debtrak Pty Limited (the Privacy Policy & Notice also names Debtrak UK Ltd and Debtrak Software Pty Ltd, without saying which entity contracts))"
url: "https://ailawframework.com/software/debtrak-intelliedge"
type: "software_profile"
site: "AI Law Framework"
id: "debtrak-intelliedge"
vendor: "Debtrak Pty Limited (the Privacy Policy & Notice also names Debtrak UK Ltd and Debtrak Software Pty Ltd, without saying which entity contracts)"
category: "Legal-specific"
segment: "Practice management"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Debtrak IntelliEdge (Debtrak Pty Limited (the Privacy Policy & Notice also names Debtrak UK Ltd and Debtrak Software Pty Ltd, without saying which entity contracts))

> AI inside an enterprise collections and recovery platform sold to Australian government, banking, insurance and agency operations: account summarisation, next-action recommendation, propensity scoring, scripting and a…

Canonical page: https://ailawframework.com/software/debtrak-intelliedge  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The IntelliEdge AI layer across the Debtrak collections platform, licensed per operator with all features and environments included. Customer-controlled BYOC Azure or AWS deployments, and the UK and NZ deployments, need separate review.

AI inside an enterprise collections and recovery platform sold to Australian government, banking, insurance and agency operations: account summarisation, next-action recommendation, propensity scoring, scripting and a voice agent.

## Capabilities

- Matter management
- Document summarisation
- Practice analytics
- Agentic workflows
- Compliance monitoring
- Document automation

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, Private cloud |
| Hosting regions | Australia, United Kingdom |
| Australian region | Stated, not guaranteed |
| Assurance | ISO/IEC 27001:2022 - listed as Certified on the vendor's Sprinto-hosted Trust Center; no certificate, number or scope statement published, IRAP - the security page states an 'IRAP-assessed deployment pattern aligned to the OFFICIAL:Sensitive classification'; the pricing and comparison pages say 'IRAP-aligned'; no assessment report, date or assessor is published, Annual penetration test by an independent CREST-certified firm, with an executive summary stated to be available under NDA on request |
| Training on customer content | Your account only |
| Retention | Security page: audit logs are 'immutable, retained for the period required by the engagement (typically seven years for government and ten for banking)' and streamable to the customer's SIEM - so the period is set per engagement, not by a published default. Privacy Policy & Notice (10 June 2026) sets no period, stating retention for as long as there is a relationship plus an ongoing business need, then deletion or anonymisation; the Data Retention Policy is listed on the Trust Center behind 'Request access'. No period is published for debtor account records, AI-generated summaries or Voice AI recordings. |
| Integrations | Core banking platforms named as Temenos, Finacle, Mambu and Avaloq, plus mainframe gateways, ERPs named as SAP, Oracle and NetSuite, Payment gateways, Dialler systems, SIEM (streaming audit-log feed), BI and data-warehouse layers, Microsoft Entra ID SSO with conditional access and MFA enforcement, Headless API for custom frontends, Debtor channels: SMS, email, letter, phone, WhatsApp, web portal and Voice AI |
| Legal content coverage | No legal content library is published. The platform is stated to encode regulatory rule sets as workflow controls rather than as research material: ACCC Debt Collection Guidelines and ASIC Debt Collection Guidelines in the contact-frequency engine, plus ASIC RG 96, AFCA, hardship and vulnerability frameworks, model litigant principles and hardship referral mandates for government clients, UK FCA conduct rules and Consumer Duty, UK GDPR and the NZ Privacy Act 2020. Legal-recovery functions named on the vendor's comparison page include statutory demand drafting, external lawyer instruction workflow, director and guarantor pursuit, secured asset registers and multi-jurisdictional commercial litigation tracking. |
| Pricing | Quote-based. The pricing page states 'Debtrak is licensed per operator and scales with your team, not your debt book. Every environment and every feature is included', that 'Debtrak is licensed per operator per month. The rate steps down as your seat count rises', and that production, disaster recovery, UAT and integration environments are part of the platform fee rather than separate licences. Implementation, data migration and integration are 'scoped separately during a short discovery phase'. No price is published: the page states enterprise and government deployments 'differ too much for a single published price to be honest'. The vendor's comparison page adds 'enterprise pricing on application; per operator per month at tiered seat bands; paid discovery before deployment', that annual commitments attract a discount, and that discovery typically runs four to six weeks. |
| Australian presence | Yes. The Privacy Policy & Notice (10 June 2026) states "When we refer to 'we' (or 'our' or 'us'), that means Debtrak Pty Limited, Debtrak UK Ltd, and Debtrak Software Pty Ltd. Our headquarters are in Australia but we operate and have offices all over the world", and that 'Debtrak UK Limited (company number 07131823) is our representative in Europe' for EU and UK data-protection purposes. No ABN or ACN is published on any page read, and no page states which entity contracts with an Australian customer. The vendor's own comparison page states the product was 'founded in Sydney in 2002' and names customers including Revenue NSW ('more than a dozen NSW agency portfolios on a single tenant'), the South Australian Attorney-General's Department, QBE Insurance, BMW Australia Finance, Shell Energy, Cloud Collections, NCO/Transcom, PRA Group, Probe Group and Thames Water, without stating which are in which country; only those the page ties to Australia, plus QBE which gives a testimonial on the security page, are listed above. The security page states 'All data for Australian customers stays in Australian Azure regions with no replication or backup outside Australia.' That statement appears on a product page; no terms of use, subscription agreement or data processing agreement is published anywhere on the site, so Australian residency is recorded as stated rather than guaranteed. |
| Website | https://debtrak.com/features/intelliedge |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and licensing scope covered | Public claim only | IntelliEdge is published as the AI layer across the Debtrak collections platform rather than as a separate product: the feature page calls it 'The next generation of Debtrak' and states 'IntelliEdge is the AI layer that sits across Debtrak. It is not a feature added to a platform - it is a continuous decisioning engine'. The pricing page states 'Debtrak is licensed per operator and scales with your team, not your debt book. Every environment and every feature is included', lists 'Omnichannel engagement SMS, email, letter, phone, web portal, and Voice AI through IntelliEdge' among what is included, and states production, disaster recovery, UAT and integration environments are part of the platform fee. No page states whether IntelliEdge can be licensed off, or priced separately. | Can the platform be licensed with IntelliEdge disabled, is any part of IntelliEdge priced separately from the per-operator licence, and which components are on by default? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Pricing (per-operator licensing, quote-based)](https://debtrak.com/pricing) |
| What the AI components do | Public claim only | The IntelliEdge page names five AI components. 'LLM Account Summaries: AI-generated comprehensive account summaries reduce call setup time. Agents see the full account story at a glance - payment history, contact attempts, arrangements, and risk signals - in one concise summary', updating in real time and including 'the recommended next action, and any compliance flags an agent must observe'. 'Next Best Action Engine: Intelligent recommendation engine suggesting the optimal contact strategy, call script, settlement offer, or escalation path for every account - based on historical data across 40M+ accounts', proposing an action 'with confidence and expected uplift versus the alternatives'. 'Predictive Analytics: Propensity-to-pay scoring and dollar value prediction'. 'AI-Driven Call Scripts: Dynamic script recommendations based on account context, debtor profile, and historical success patterns'. 'Voice AI Agent: Automated voice agent handles routine outbound calls - payment reminders, arrangement confirmations, and initial contact attempts', which 'handles the conversation end-to-end with full compliance recording and escalation to a human agent on any complexity signal'. All of this is on the vendor's own feature page; no model, evaluation or accuracy evidence accompanies it. | Demonstrate each of the five IntelliEdge components on our own portfolio, and show what an account summary, a Next Best Action recommendation and a Voice AI call transcript look like end to end. | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge) |
| Deployment and hosting | Public claim only | The security page states 'The reference architecture sits in Azure Australia regions with all data and processing remaining onshore' for Australian government engagements, and that 'Customers operating under data sovereignty obligations that require their own tenancy can deploy into customer-controlled BYOC Azure or AWS environments while still receiving the standard support, monitoring, and update cadence applicable to the platform.' The IntelliEdge page describes a 'Headless Architecture' with 'API-first design lets enterprise clients build entirely custom frontends connected to the IntelliEdge backend'. The vendor's comparison page states 'BYOC Azure or AWS deployment supported for organisations requiring tenancy isolation'. Nothing published states whether IntelliEdge, including Voice AI and the LLM that produces account summaries, runs inside a BYOC tenancy or calls out of it. | In a BYOC Azure or AWS deployment, do the LLM account summaries, Voice AI and Next Best Action models run inside our tenancy, or does the platform call an external service? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Jurisdiction, regulatory framing and legal-recovery functions | Public claim only | The security page states 'ACCC and ASIC Debt Collection Guidelines are encoded in the platform's contact-frequency engine' so that a collector 'cannot accidentally breach call frequency limits, send notices outside permitted hours, or attempt contact during a recorded vulnerability hold - the system simply prevents the action, logs the attempt, and returns a clear explanation to the operator', and that the same engine handles 'GDPR data subject access requests, UK FCA conduct rules, and the bespoke obligations imposed by individual government clients (such as model litigant principles and hardship referral mandates)'. The comparison page lists the legal-recovery functions: 'director and guarantor account linking, related entity views, secured asset registers, statutory demand drafting, external lawyer instruction workflow, commercial recovery escalation paths, and multi-jurisdictional commercial litigation tracking', and names ASIC RG 96, AFCA, UK FCA Consumer Duty, UK GDPR and the NZ Privacy Act 2020. No governing-law clause is published: no terms of use document was found on the site, although the Privacy Policy refers to 'our terms of use'. | Which law governs the agreement, and which of the regulatory rule sets you say are encoded are warranted, as opposed to configured by us at implementation? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Licence and ownership of data and output | Not confirmed | No licence, subscription agreement or terms of use document was found on the site or in a 59-URL filtered map taken on 2026-09-27, although the Privacy Policy states 'Check out our terms of use for more information on how we treat your other data'. Nothing published addresses ownership of customer account data, of the per-customer IntelliEdge models trained on it, or of AI-generated account summaries, scores and recommendations. | Provide the terms of use the Privacy Policy refers to, and state in writing who owns the per-customer IntelliEdge model weights and the AI-generated summaries, scores and recommendations. | [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) |
| Integrations and identity | Public claim only | The comparison page states '30+ pre-built enterprise integrations including major core banking platforms (Temenos, Finacle, Mambu, Avaloq, mainframe gateways), ERPs (SAP, Oracle, NetSuite), payment gateways, dialler systems, finance and accounting systems, SIEM, BI and warehouse layers', with a 'Headless API-first architecture'. The security page states SSO uses 'hardened Microsoft Entra ID integration' with 'conditional access policies with MFA enforcement', and that audit logs are 'available to the customer's SIEM via a streaming feed'. The IntelliEdge page adds omnichannel channels: 'SMS, email, phone, WhatsApp, web portal, and Voice AI'. | Which integrations and channels carry debtor personal information to a third party - in particular WhatsApp messaging, the SMS gateway and the telephony carrier behind Voice AI - and where is each hosted? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Support, implementation and service levels | Public claim only | The pricing page states implementation, data migration and integration are 'scoped separately during a short discovery phase'. The comparison page sets out the phases: 'a paid Discovery phase (4-6 weeks), Configuration and Build (8-12 weeks), Integration and Testing (4-8 weeks depending on integration count), User Acceptance Testing (2-4 weeks), Training (1-2 weeks), and Go-Live with hypercare', and states new client portfolios using pre-built import templates 'can go live within days inside an existing tenant'. The security page commits to incident notification timings (see incidents). No uptime commitment, support hours, response target or status page appears on the pages read. | What uptime commitment, support hours and response targets apply, and are they backed by service credits? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Pricing (per-operator licensing, quote-based)](https://debtrak.com/pricing); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Check for vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. A filtered site map returned 59 URLs and none is an /llms.txt, /ai-info, /ai or /for-ai path. The five debtrak.com pages read in full - IntelliEdge, Security & Compliance, Pricing, Privacy Policy & Notice and the comparison guide - and the Trust Center overview contain no block addressed to AI models, assistants, crawlers or 'LLMs', and no 'Instructions for AI Assistants' heading. A filtered map is not a complete crawl, so this records an absence across the URL set and the pages read rather than proof that no such file exists. | Do you publish any page, file or metadata that tells AI assistants or crawlers how to describe Debtrak, and do you maintain an llms.txt or equivalent? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Pricing (per-operator licensing, quote-based)](https://debtrak.com/pricing); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Vendor-published comparison page that ranks the vendor's own product | Public claim only | On its own domain the vendor publishes a page titled 'Best Debt Collection Software in Australia: 2026 Comparison Guide', introduced as 'An independent guide to the leading enterprise debt collection software platforms used in Australia in 2026', checked 2026-09-27. Under 'Top platforms compared' the vendor's own product is listed first, as '1. Debtrak (Sydney, Australia)'. The page's Frequently Asked Questions ask and answer comparative and superlative questions about the vendor: 'What is the best debt collection software in Australia for enterprise organisations?' is answered 'Debtrak is among the leading software platforms', and 'Which Australian debt collection platform is best for government revenue recovery?' is answered 'Debtrak meets all four conditions out of the box'. The page also makes statements about named competitors' certifications and data residency, and carries the line 'Information about competitor products in this guide is drawn from publicly available material as of May 2026.' This catalogue records no ranking of its own; the page is recorded because it is the vendor's published material in machine-readable question-and-answer form. | Which statements about competitors' certifications, AI capability and Australian data residency in your comparison guide were confirmed with those vendors, on what date, and how is the guide's description of itself as independent reconciled with its publication on your own domain? | [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Authority to process debtor personal information | Public claim only | The Privacy Policy & Notice (10 June 2026) addresses Debtrak as a controller of the personal data of its own website and service users, setting out lawful bases of consent, contractual obligation and legal obligation, and states 'For European Union and United Kingdom data protection purposes, when we act as a controller in relation to your personal data, Debtrak UK Limited (company number 07131823) is our representative in Europe.' It does not address Debtrak's role as processor of the debtor personal information a creditor or agency loads into the platform, nor the customer's obligations to those debtors. The security page states access is limited to 'Closed groups with access to allocated clients and entities only'. | Which document appoints Debtrak as processor of our debtors' personal information, what does it require of us in notifying debtors, and does it cover Voice AI call recordings? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) |
| Model and model provider | Not confirmed | No model, model family, version or provider is named anywhere on the five debtrak.com pages read or on the Trust Center overview. The IntelliEdge page uses the heading 'LLM Account Summaries' without naming the model or its provider, and describes Voice AI as a system that 'speaks naturally' without naming a speech or language model. The only infrastructure named is Azure ('Azure Australia regions', 'UK Azure regions', 'BYOC Azure or AWS'), which identifies a hosting region rather than a model provider. | Which large language model and which provider generate account summaries and drive Voice AI, is inference performed inside the Azure tenancy that holds our data, and will we be notified before either changes? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Subprocessors | Not confirmed | No subprocessor list is published. The Privacy Policy states data may be disclosed to 'other companies in the Debtrak group of companies' and to regulators, law enforcement, courts and others where necessary or consented, and does not list service providers at all. The security page names Microsoft Entra ID and Azure, and refers to 'an independent CREST-certified penetration testing firm' without naming it. The Trust Center lists policy documents behind a 'Request access' control and shows no subprocessor register. The channels described on the IntelliEdge page - SMS, WhatsApp, telephony for Voice AI - imply third parties that are not named anywhere. | Provide the current subprocessor list naming every provider and its region, including the LLM provider, the speech provider behind Voice AI, the telephony carrier, the SMS gateway and the WhatsApp channel provider. | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Use of customer content for model training | Not confirmed | Two statements on the same IntelliEdge page do not sit together. Under 'Continuous learning from your own data' the page states 'IntelliEdge models are trained on each customer's own data. A government revenue agency's model is different from a bank's, which is different from an agency's. Models retrain on a rolling basis as outcomes accumulate, so the recommendations improve continuously without consultancy intervention.' The description of the Next Best Action Engine on the same page states its recommendations are 'based on historical data across 40M+ accounts', and the page elsewhere states 40M+ accounts are 'managed across all clients'. Nothing published states whether the LLM that produces account summaries, or the Voice AI, is trained or fine-tuned on customer content, or whether any content leaves the tenancy to reach a model provider. | Is any model, including the Next Best Action engine, trained or evaluated on data from other customers' accounts, and will you warrant that our account data is not used outside our own tenant models? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge) |
| Use of agent behaviour and outcomes as feedback | Public claim only | The IntelliEdge page states of adaptive scripting that 'Agents retain full discretion to deviate; deviations and outcomes feed back into the model', and that models 'retrain on a rolling basis as outcomes accumulate'. So collector behaviour and call outcomes are captured as training signal by design. Nothing published states whether that signal is confined to the customer's own model, whether it can be switched off while keeping the recommendations, or whether individual collector performance derived from it is reported to the employer beyond the 'agent performance' dashboards named on the same page. | Can we keep IntelliEdge recommendations while opting out of the feedback loop that captures collector deviations, and does any collector-level feedback signal leave our tenancy? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge) |
| Retention | Not confirmed | The security page states audit logs are 'immutable, retained for the period required by the engagement (typically seven years for government and ten for banking), and available to the customer's SIEM via a streaming feed'. So the retention period is set per engagement rather than by a published default. The Privacy Policy sets no period, stating retention 'for as long as we have a relationship with you and for a period of time afterwards where we have an ongoing business need to retain it, in accordance with our data retention policies and practices', after which it will be 'deleted or anonymised'; the referenced Data Retention Policy is listed on the Trust Center behind 'Request access'. No retention period is published for debtor account records, AI-generated summaries or Voice AI call recordings. | What retention period will our engagement set for account records, AI-generated summaries and Voice AI recordings, and can you release the Data Retention Policy listed on your Trust Center? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Deletion and destruction | Public claim only | The Privacy Policy gives a right to erasure 'in certain circumstances' with a one-month response time, and the Trust Center's 'Your Data' section invites a request to 'request access, updates, migration, or deletion'. Against that, the security page states audit logs are 'immutable' and that every action is logged 'with timestamp, user, source IP, and where applicable a before-and-after diff', with retention typically seven to ten years. Nothing published reconciles the erasure right with immutable logs, and nothing addresses deletion of a debtor's AI-generated account summaries or of a Voice AI call recording. | If a debtor exercises the erasure right, what is deleted and what survives in the immutable audit log, and are AI-generated summaries and Voice AI recordings about that debtor deleted? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Vendor personnel access to customer data | Not confirmed | Nothing on the pages read states whether Debtrak personnel can read customer account records, under what conditions, whether that access is logged in the same immutable audit log, or whether the customer is notified. The security page describes 'granular role-based access controls reviewed on a quarterly basis as part of the ISMS audit cycle' and a security operations capability with 'continuous monitoring of authentication events, anomaly detection on data access patterns', but both are framed around customer users and platform monitoring. No background-check or break-glass statement appears. | Under what conditions can Debtrak support, engineering or security-operations staff read our debtor records, does that access appear in the immutable audit log we can stream, and can we require notification? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance) |
| Access control and authentication | Public claim only | The security page lists 'Data encryption at rest and in transit', 'Encrypted login to application and multiple databases', 'Multi-factor authentication', 'Closed groups with access to allocated clients and entities only' and 'Access level permissions on reports, clients, action flows, workflows, queues/tasks, and other operators', and adds 'hardened Microsoft Entra ID integration for SSO, conditional access policies with MFA enforcement, and granular role-based access controls reviewed on a quarterly basis as part of the ISMS audit cycle'. Nothing published states whether access to IntelliEdge output - account summaries, propensity scores, Next Best Action recommendations - can be permissioned separately from access to the account itself, or who may override a recommendation. | Can access to IntelliEdge summaries, scores and recommendations be permissioned separately from account access, and who is permitted to override a Next Best Action or a propensity score? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance) |
| Encryption | Public claim only | The security page states 'encrypted-at-rest storage using AES-256, TLS 1.3 for data in transit' and lists 'Data encryption at rest and in transit' and 'Encrypted login to application and multiple databases'. No statement addresses key management, key rotation, hardware security modules or customer-managed keys, and nothing states how keys are held in a customer-controlled BYOC Azure or AWS deployment. | Who holds and rotates the encryption keys in the standard deployment, and in a BYOC deployment can we hold customer-managed keys covering the databases, the audit log and Voice AI recordings? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance) |
| Independent assurance and certification | Public claim only | The vendor's Trust Center, hosted on Sprinto, lists one certification: 'ISO 27001 v2022 - Certified'. It also lists policy documents (Information Security, Acceptable Usage, Access Control, Business Continuity, Data Retention, Disaster Recovery and '+37 more') behind a 'Request access' control, and no certificate or report is downloadable without a request. The security page states 'Debtrak's ISO 27001:2022 certified debt collection platform', that 'Debtrak operates an IRAP-assessed deployment pattern aligned to the OFFICIAL:Sensitive classification', and that it 'engages an independent CREST-certified penetration testing firm annually, with a public executive summary available under NDA on request', plus 'weekly vulnerability scans, monthly dependency audits, daily SAST analysis, and a bug bounty programme open to assessed researchers'. The pricing and comparison pages use the phrase 'IRAP-aligned' rather than IRAP-assessed. No SOC 2 appears on the Trust Center. Nothing states whether the IntelliEdge components are inside the certified or assessed scope. | Provide the ISO 27001 certificate with its scope statement and certificate number, the date, assessor and scope of the IRAP assessment, and confirm in writing whether Voice AI and the LLM account summaries are inside both scopes. | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Pricing (per-operator licensing, quote-based)](https://debtrak.com/pricing); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Contracting entity and documents | Not confirmed | No subscription agreement, master services agreement, terms of use, data processing agreement or AI schedule is published on the site or in the 59-URL filtered map, although the Privacy Policy refers to 'our terms of use'. Pricing is quote-based: the pricing page states 'Enterprise and government collections deployments differ too much for a single published price to be honest' and routes to a quote request. The Privacy Policy names three entities - 'Debtrak Pty Limited, Debtrak UK Ltd, and Debtrak Software Pty Ltd' - and states 'Our headquarters are in Australia but we operate and have offices all over the world', without saying which entity contracts with an Australian customer. No ABN or ACN is published on any page read; Debtrak UK Limited's company number 07131823 is published. | Which of the three named Debtrak entities contracts with us, what is its ACN and ABN, and can you provide the terms of use, a data processing agreement and an AI schedule covering Voice AI and LLM summaries? | [Debtrak - Pricing (per-operator licensing, quote-based)](https://debtrak.com/pricing); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) |
| Cross-border transfers | Not confirmed | The security page is unqualified: 'All data for Australian customers stays in Australian Azure regions with no replication or backup outside Australia. UK customer data stays in UK Azure regions.' The Privacy Policy & Notice is conditional: 'We do not transfer your data from the jurisdiction it was collected without ensuring an adequate level of protection is in place to protect your data prior to any transfer', and it permits disclosure to 'other companies in the Debtrak group of companies', naming a UK entity and stating that Debtrak has 'offices all over the world'. The two documents describe different positions: no transfer at all in one, and transfer subject to adequate protection in the other. Nothing published states where support, engineering or security-operations staff are located or whether they access Australian customer data from outside Australia. | Does 'no replication or backup outside Australia' also bar access to our data from your non-Australian offices and staff, is it a contractual term, and how does it sit with the intra-group transfer permission in the Privacy Policy? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) |
| Incident and breach notification | Public claim only | The security page states Debtrak 'operates a security operations capability dedicated to the platform: continuous monitoring of authentication events, anomaly detection on data access patterns, integration with the customer's own SIEM where required, and a defined incident response playbook with formal severity classification and escalation thresholds. Severity 1 incidents are notified to the customer within thirty minutes of detection with a written initial assessment within two hours.' This appears on a product page; no agreement was found that carries it, and the Privacy Policy does not mention the Notifiable Data Breaches scheme or any notification window. | Is the thirty-minute Severity 1 notification a contractual commitment with a remedy, what defines Severity 1, and who notifies affected debtors under the Notifiable Data Breaches scheme? | [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) |
| Change notice | Public claim only | The Privacy Policy states 'We may need to update this notice from time to time. Where a change is significant, we'll make sure we let you know - usually by sending you an email.' No published document addresses notice of changes to the platform or to the AI: nothing states what notice precedes a change to the Next Best Action model, to Voice AI behaviour or scripts, to the LLM behind account summaries, or to the compliance rule sets encoded in the contact-frequency engine. The IntelliEdge page states models 'retrain on a rolling basis as outcomes accumulate' and that the low-code workflow designer means 'Changes are live in minutes, not weeks'. | What notice do we receive before a model retrain changes Next Best Action behaviour, before the LLM or Voice AI provider changes, and before an encoded regulatory rule set is updated - and can a version be pinned? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) |
| Exit and data portability | Not confirmed | No exit, transition or export provision is published on the pages read. The published routes that could bear on it are the 'Headless API-first design', the audit-log 'streaming feed' to the customer's SIEM, and BYOC deployment into a customer-controlled Azure or AWS environment. Nothing states in what format an exit extract is delivered, whether it includes arrangements, contact history, AI-generated summaries, scores and Voice AI recordings, over what period, or at what cost. The Trust Center 'Your Data' section mentions 'migration' as a request type without describing it. | On exit, in what format do we receive the complete account, arrangement, contact-history, audit-log and AI-output record including Voice AI recordings, over what period, and at what cost? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) |
| Connectors and outbound channels | Public claim only | The IntelliEdge page states omnichannel engagement reaches debtors 'on their preferred channel - SMS, email, phone, WhatsApp, web portal, and Voice AI', and describes a debtor self-service portal where debtors 'view balances, set up payment arrangements, upload documents, and manage their accounts', plus a client performance portal providing 'Real-time performance monitoring and data exchange for your clients'. The comparison page lists 30+ enterprise integrations including core banking platforms, ERPs, payment gateways, dialler systems, SIEM and BI layers. The security page adds the SIEM streaming feed for audit logs. No page names the providers behind the SMS, WhatsApp or telephony channels. | Can individual channels be disabled - specifically WhatsApp - and does the client performance portal expose AI-generated summaries or scores to your customer's own clients? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Retrieval outside the tenancy | Not confirmed | Nothing on the pages read states whether any IntelliEdge component retrieves information from outside the customer's data. Recommendations are attributed to 'historical data across 40M+ accounts' and to 'account context, debtor profile, and historical success patterns', and summaries to the account record; no page says whether a request reaches any external endpoint during a debtor interaction, or whether Voice AI speech processing occurs outside the Azure tenancy. | During a debtor interaction, does any IntelliEdge component call an endpoint outside our tenancy - a public LLM API, a speech service, a web lookup - and in which region does each such endpoint run? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance) |
| What the AI does without a human acting | Public claim only | IntelliEdge is published as taking real-world action. The Voice AI Agent 'handles routine outbound calls - payment reminders, arrangement confirmations, and initial contact attempts', and 'For straightforward outbound and inbound calls - payment reminders, arrangement check-ins, balance confirmations - Voice AI handles the conversation end-to-end with full compliance recording and escalation to a human agent on any complexity signal. The system speaks naturally, follows the same compliance rules a human collector would, and integrates with the same workflow engine, so a Voice AI interaction is indistinguishable in the audit trail from a human call.' The compliance engine acts as a hard control on human agents: 'the system simply prevents the action, logs the attempt, and returns a clear explanation to the operator'. The page does not say what defines a 'complexity signal', or whether Voice AI can conclude a payment arrangement. | Which actions can Voice AI complete without a human - can it agree or vary a payment arrangement, or accept a hardship or vulnerability disclosure - what triggers escalation, and is the debtor told they are speaking to an automated agent? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance) |
| Human review and sign-off | Public claim only | The IntelliEdge page states the objective is 'keeping the collections team out of work that does not benefit from human judgement', that agents open an account with an AI-generated summary and 'start the conversation with context', and that on scripts 'Agents retain full discretion to deviate'. Voice AI escalates 'to a human agent on any complexity signal'. Nothing published states whether a human reviews a Voice AI interaction afterwards, whether an AI-generated account summary is checked against the underlying record before it is relied on, or whether a human must approve an escalation the Next Best Action engine recommends - including the escalation paths the comparison page ties to legal steps, namely statutory demand drafting, external lawyer instruction workflow and commercial litigation tracking. | Is human sign-off required before an account is escalated to a legal step - statutory demand, external lawyer instruction, litigation - on an IntelliEdge recommendation, and is the approving person recorded? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Published evidence of quality | Not confirmed | No accuracy figure, evaluation, benchmark, error rate or independent review of any IntelliEdge component is published on the pages read. The published figures are operational scale rather than AI performance: '40M+ Accounts managed across all clients', '$2B+ In debt recovered annually', '1,500+ Configurable functions'; none carries a date, definition or source. The Next Best Action engine is said to present 'confidence and expected uplift versus the alternatives' with no statement of how either is calculated or validated. The comparison page's own evaluation criterion for AI is 'Productionised on real customer data, not pilot demos', which it does not then evidence for any product including its own. | What evaluation exists for the propensity-to-pay score, the Next Best Action uplift figure and the accuracy of LLM account summaries, on what data, and what error rates were observed? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |
| Tasks the AI is published as doing, and the legal-recovery functions it is not said to touch | Public claim only | The five IntelliEdge components are all collections-side: account summarisation, next-action recommendation, propensity and value prediction, script recommendation and automated voice contact. The legal-recovery functions are published separately, on the vendor's comparison page, as platform capability: 'director and guarantor account linking, related entity views, secured asset registers, statutory demand drafting, external lawyer instruction workflow, commercial recovery escalation paths, and multi-jurisdictional commercial litigation tracking', with the note that 'The same platform a collector uses for consumer hardship workflow handles a commercial recovery officer's statutory demand and director pursuit work.' No published statement says an AI component drafts a statutory demand, instructs a lawyer or assesses a litigation step; the only link published is that Next Best Action may recommend an 'escalation path'. | Does any IntelliEdge component draft or populate a statutory demand, prepare a lawyer instruction, or recommend commencing proceedings - and if it recommends an escalation path, what does that path include? | [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge); [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) |

## Notes

Six pages were read on 2026-09-27: the IntelliEdge feature page, the Security & Compliance page, the pricing page, the Privacy Policy & Notice (10 June 2026), the vendor's own comparison guide, and the Sprinto-hosted Trust Center overview. What could not be verified: no model, model family or provider is named for the LLM account summaries or Voice AI; no subprocessor list exists, so the speech, telephony, SMS and WhatsApp providers are unnamed; no terms of use, subscription agreement, data processing agreement or AI schedule is published, although the Privacy Policy refers to terms of use; no ABN or ACN is published and which of the three named Debtrak entities contracts is not stated; vendor-personnel access to customer data, exit and export, and any retrieval outside the tenancy are all unaddressed. Two internal tensions are recorded rather than resolved: the IntelliEdge page states models are 'trained on each customer's own data' while describing Next Best Action as based on 'historical data across 40M+ accounts' which the same page attributes to all clients; and the security page's 'no replication or backup outside Australia' sits against the Privacy Policy's permission for intra-group transfer with adequate protection and its statement of offices worldwide. The ISO 27001 and IRAP statements do not say whether the AI components are inside scope. Category is recorded as Legal-specific because this is a vertical product, not a general-purpose assistant; the basis for its place in this register is the legal-recovery side of the platform - statutory demand drafting, external lawyer instruction workflow and multi-jurisdictional commercial litigation tracking - and no published statement says an AI component touches those functions. Vocabulary notes: SEGMENT has no debt-recovery or collections value, so practice-management is used as the closest defensible value; CAPABILITY has no value for summarising a structured account or case record (document-summarisation is used), for propensity or payment-outcome scoring (practice-analytics is used) or for an autonomous voice agent conducting outbound contact (agentic-workflows is used). Each gap is reported to the Maestro.

## Sources

- [Debtrak - IntelliEdge AI feature page](https://debtrak.com/features/intelliedge) (checked 2026-09-27)
- [Debtrak - Security & Compliance feature page](https://debtrak.com/features/security-and-compliance) (checked 2026-09-27)
- [Debtrak - Pricing (per-operator licensing, quote-based)](https://debtrak.com/pricing) (checked 2026-09-27)
- [Debtrak - Privacy Policy & Notice (last updated 10 June 2026)](https://debtrak.com/privacy) (checked 2026-09-27)
- [Debtrak - 'Best Debt Collection Software in Australia: 2026 Comparison Guide' (vendor's own comparison page)](https://debtrak.com/best-debt-collection-software-australia) (checked 2026-09-27)
- [Debtrak Trust Center (Sprinto-hosted; compliance and resources listing)](https://debtrak.trust.site/) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.