Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and modules covered
Public claim only
The vendor's own navigation names seven modules, checked 2026-09-27: AI Red Flags, AI Contract Review, Q&A, Change Tracker, Project Management, Disclosure Schedules and Related Documents (multi-document review). Audiences named are Law Firms, In-House Legal and Funds. Two of the seven modules carry AI in their name; the other five are not described as AI. The /product page, which holds the per-module detail, was not read.
Ask: Which of the seven modules are in the plan we would buy, and which are charged separately or gated by plan?
What the platform does
Public claim only
Home page, checked 2026-09-27: 'Find the issues across the data room', 'Never miss a red flag - Every document, every jurisdiction', 'Trace every finding back to source', and a Red Flags Report described as '48 issues, ranked and ready in one place' with high, medium and low severities. The report panel showing '2,467 documents scanned' and 48 issues is an illustrative panel on a marketing page, not a published benchmark. A Change Tracker module is named and the page says 'Every change tracked' and 'Track a changing data room'; whether that compares document versions or lists data-room activity was not established, so no document-comparison capability is recorded.
Ask: Does Change Tracker compare successive versions of the same document, or report additions and removals in the data room, and can it produce a version-to-version difference report?
Deployment model
Public claim only
Terms cl 1.1 provide 'web-based subscription services in relation to legal due diligence project management' accessed under a Plan; the definitions describe 'Deeligence Systems' as 'the underlying computer servers or other hardware or systems used by Deeligence'. No on-premises or self-hosted option appears on the site or in the terms read 2026-09-27. The security page says a customer may 'Choose where your data is hosted, with dedicated infrastructure in the United States, the United Kingdom or Australia'.
Ask: If we take the Australian infrastructure, is that dedicated single-tenant infrastructure or a shared tenancy in an Australian region, and does it include backups, logs and any model inference?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A site map with search terms including 'ai' returned only the root URL and listed no /llms.txt, /ai-info, /ai or /for-ai page. The home page, security page, Terms and Conditions and privacy policy were read in full and contain no heading or block addressed to AI models, assistants, LLMs or crawlers, and no instruction to describe the product in a particular way. The home page carries a marketing comparison headed 'There is a better way', setting 'Traditional diligence' and 'Generic AI' against the product; that is a comparison section, not content directing how AI should describe the product, and it names no competitor. No machine-readable question-and-answer in which the vendor answers a comparative question about itself was found in the pages read; /faq was not read.
Ask: Do you publish any page or embedded block - for example /llms.txt, an AI-information page or structured question-and-answer data - that tells AI models or crawlers how to describe Deeligence?
Contracting entity and governing law
Public claim only
The Terms and Conditions name Deeligence Pty Ltd (ACN 665 609 307 and UK Company No FC043030) of 380 City Road, Southbank 3006, Victoria, Australia, and cl 12.3 applies the laws of Victoria with non-exclusive jurisdiction of the courts of that jurisdiction. The privacy policy names the same entity and states that for UK data protection law the data controller is Deeligence Pty Ltd, ICO registration ZC083688.
Ask: Will an Australian firm contract with Deeligence Pty Ltd under the Victorian-law terms, and does any part of the service sit under a UK-registered arrangement?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client and counterparty material in the platform
Public claim only
Terms cl 6.2: the customer warrants it has obtained all necessary consents in relation to the use of the Data, that uploading, storage and use will not breach any laws and that the Data will not infringe third-party intellectual property, and indemnifies Deeligence against third-party intellectual property and privacy claims arising from the Data. Deeligence 'does not control, is not responsible for and provides no warranty in relation to the Data'. Clause 1.4 puts sole responsibility for use of the service and its results on the customer.
Ask: For a data room holding a target's and third parties' confidential material under a confidentiality undertaking, what consents do you expect us to hold before upload, and will you vary the cl 6.2 warranty and indemnity?
Which models and providers process documents
Not confirmed
No model, model family, model provider or hosting provider is named on the home page, the security page, the Terms and Conditions or the privacy policy read 2026-09-27. The product is described as 'Agentic AI' and the terms refer only generically, at cl 1.7, to 'Third Party Applications or ... third party providers' that may be required to provide particular features.
Ask: Which large language model providers process our documents, in which regions, under what zero-retention arrangement, and will you name them in the order form?
Subprocessor list
Not confirmed
No subprocessor list, trust centre or DPA is published; a site map run on 2026-09-27 returned only the root URL and no such page. The privacy policy discloses personal information to 'Third-party suppliers and service providers (including providers for the operation of our websites and/or our business or in connection with providing services to our clients)' without naming any. The security page says a 'Data Processing Agreement standard for enterprise customers' but does not publish it.
Ask: Please provide the current subprocessor list with each party's role and country, and a commitment to notify us before adding one.
Use of our documents to improve the product or train models
Public claim only
Terms cl 6.1 grants Deeligence a non-exclusive, irrevocable, royalty-free licence to use and reproduce the Data, including Data in Service Outputs, for '(a) purposes related to the provision of the Services; and (b) Deeligence undertaking data analytics, development or improvement of the Subscription Services or other products of Deeligence or other similar activities but only where Deeligence utilises de-identified versions of such Data and Service Outputs'. The security page separately states 'Your documents are never used to train models for other customers'. The two statements cover different ground: the terms permit de-identified use for improving other Deeligence products, and the security page addresses training models for other customers. No opt-out is published.
Ask: Will you contract that our documents and outputs are not used to train or improve any model or product outside our tenancy, and how is 'de-identified' applied to a data room that identifies the target on every page?
Feedback and collaboration on new features
Public claim only
Terms cl 5.3: comments, suggestions or other feedback, and any contribution the customer makes when Deeligence collaborates on implementing new functionality, are Feedback which Deeligence 'may freely use, copy, disclose, licence, distribute and exploit ... in any manner without any obligation, royalty or restriction', under a perpetual and irrevocable licence, with the customer consenting on behalf of its users even where use might otherwise infringe moral rights.
Ask: If our lawyers help shape a red-flag rule set or a playbook during implementation, does cl 5.3 give you the right to reuse it for other customers, and can that be carved out?
How long documents and outputs are kept
Public claim only
Terms cl 6.3: Deeligence is under no obligation to provide back-up, archiving or record keeping for Data or Service Outputs, the customer must maintain its own, and Deeligence is not liable for lost or deleted data; Deeligence 'may implement its own internal back-up policies ... (information available on request)'. The privacy policy (version current at 20 December 2026) says 'Due diligence materials uploaded by clients are retained in accordance with our contractual arrangements and applicable regulatory requirements' and gives no period. No retention period for documents, Q&A records or AI outputs is published.
Ask: What is the default retention period for documents, Q&A records, AI outputs and backups, how long do backups persist after deletion, and can we set a matter-level retention rule?
Deletion on request and at the end of a deal
Public claim only
The security page states 'Data can be deleted from the platform upon request', checked 2026-09-27. The Terms and Conditions contain no deletion obligation: cl 9.2 says that on termination Deeligence may disconnect the customer's access and disable all credentials, and cl 6.3 disclaims any back-up or archiving duty. No deletion timeframe, scope over backups, or certificate of destruction is published.
Ask: On written request and on termination, within how many days is our data deleted from the platform, from backups and from any model provider, and will you certify deletion?
Vendor staff access to a live data room
Not confirmed
Nothing read on 2026-09-27 states whether Deeligence personnel can read documents in a customer data room, or under what approval and logging. The privacy policy says personal information may be disclosed to 'Our employees and related bodies corporate to perform the services and for our internal business purposes'. The security page describes role-based access for the customer's own users and an audit log of every action on a matter, and the terms at cl 6.4 commit only to 'all reasonable steps' on security.
Ask: Which of your personnel or contractors can access documents in our data room, is access requested and logged case by case, and can support access be gated on our written authorisation?
Authentication, permissions and audit
Public claim only
Security page, checked 2026-09-27: 'Every user sees only what their role and matter allow. Permissions are set at the project level and enforced throughout'; 'Every account protected by multi-factor authentication as standard, with single sign-on available for enterprise firms'; and 'Every action on a matter, from document access to export, is logged and available for review'. Terms cl 2 make the customer responsible for credentials, require it to withdraw access when a user leaves, and reserve Deeligence's right to change or revoke credentials on notice. No SSO or provisioning standard is named.
Ask: Is multi-factor authentication enforced for every user by default, which single sign-on and provisioning standards are supported on our plan, and can we export the audit log?
Encryption of documents
Public claim only
Security page, checked 2026-09-27: 'Data is encrypted in transit and at rest, using industry-standard protocols across every layer of the platform.' The Terms and Conditions do not mention encryption; cl 6.4 commits to 'all reasonable steps' and to 'commercially reasonable and current data protection and virus screening procedures and technologies', with further detail available on request. No cipher, key management or customer-managed key option is published.
Ask: Which ciphers and key management do you use, who holds the keys, and will the encryption statement on the security page be warranted in our agreement?
Certifications and independent testing
Public claim only
Under the heading 'Independently verified' the security page lists 'GDPR Compliant', 'SOC 2 In progress' and 'ISO 27001 Compliant', checked 2026-09-27. No certificate number, scope statement, audit period or certifying body is published, and 'In progress' is not a certification. The page also states that 'Regular penetration testing and vulnerability assessments are carried out by independent third parties'; no report or summary is offered on the site.
Ask: Can you provide the ISO 27001 certificate with its scope and certifying body, the expected date of a SOC 2 Type II report, and the latest penetration test summary under a confidentiality undertaking?
Contract structure and liability
Public claim only
The published Terms and Conditions, marked 'Version current at 30 September 2023', operate between Deeligence Pty Ltd and the customer named in an Order Form, with the Plan determining features and limits (cl 1.2). Annual Plans renew automatically (cl 3.2). Liability is capped at the fees paid in the 12 months before the customer first notifies the claim, consequential loss is excluded on both sides (cl 10.3), and the service is supplied 'as-is' and 'as available' (cl 10.1). Order of precedence is the Terms, then the Order Form, then referenced documents (cl 12.2).
Ask: Will our subscription run on these online terms or on a negotiated agreement, and will you agree a liability cap and a data processing agreement proportionate to a live transaction data room?
Where data is held and cross-border transfer
Public claim only
The security page offers a choice of 'dedicated infrastructure in the United States, the United Kingdom or Australia', checked 2026-09-27. The Terms and Conditions are silent on hosting location. The privacy policy says the countries to which data is sent 'may not have the same data protection laws as the country in which you initially provided the information' and that transfers will be performed in accordance with applicable law, and sets out UK transfer safeguards including adequacy and standard contractual clauses. Australian residency therefore rests on a marketing page, not on a contractual or published commitment.
Ask: Will you commit in the order form that our tenancy, its backups, logs, support access and any model inference stay in Australia, and list any exception?
Security breach notification
Public claim only
Terms cl 6.5: if Deeligence becomes aware of anything it believes compromises the security, safety, integrity or confidentiality of Data in its possession it must promptly notify the customer with reasonable details and mitigation steps, promptly use reasonable efforts to rectify and mitigate, and on request provide a report on the cause and the remediation taken. No notification deadline in hours is stated and the clause does not refer to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
Ask: What is your maximum notification time in hours, who is contacted, and what will you provide to support our own assessment under the Notifiable Data Breaches scheme?
Changes to the service and to the terms
Public claim only
Terms cl 8.1: Deeligence may vary features, functions and benefits, and 'where possible' will seek to give reasonable prior notice of a Material Deprecation, which triggers a right to terminate with a pro-rata refund; moving similar functionality to another part of the service is expressly not a Material Deprecation. Clause 8.2: the terms may be modified on notice, normally effective from the next term, but may take effect mid-term for new legal requirements or new features, in which case the customer's sole remedy is termination with a pro-rata refund.
Ask: Will you notify us in writing before changing the models, prompts or red-flag rule set, and is such a change a Material Deprecation for cl 8.1?
Getting data out at the end
Public claim only
Terms cl 9.2: on termination or expiry the customer must stop using the service, pay accrued fees and return Deeligence user resources, and Deeligence 'may disconnect the Customer's access to the Subscription Services and disable all Authentication Credentials'. The terms state no obligation to export, return or delete Data, and cl 6.3 places back-up and retrieval on the customer. Clause 9.3 lists the surviving clauses, including cl 6.1 and cl 6.2.
Ask: Before access is disconnected, what export of the data room, the Q&A record and the Red Flags Report will we receive, in what format, and for how long will it remain available?
Integrations and third-party applications
Public claim only
Terms cl 1.7: the service 'may interact with Third Party Applications or require Third Party Applications or third party providers be used to provide particular features or functionality', which the customer must obtain at its own cost and for which Deeligence gives no warranty and accepts no responsibility. No named integration - for example a virtual data room, a document management system or an email platform - appears on the home page, the security page, the terms or the privacy policy read 2026-09-27.
Ask: Which data rooms, document management systems and email platforms does Deeligence connect to, how do documents reach the platform, and are those connections inside your security commitments?
Outbound calls and external sources
Not confirmed
Nothing read on 2026-09-27 says whether the platform or its AI reaches the public internet or any external data source. The described workflow is confined to documents in the data room, with findings traced back to source documents, and cl 1.6(f) of the terms addresses only the accuracy of a search function over the customer's own uploaded information.
Ask: Does any part of the platform make outbound calls to the internet or to an external model service with document content, and can that be disabled for our tenancy?
What the agent does without a user's instruction
Public claim only
The home page describes 'Agentic AI that automates the document work, built around real due diligence workflow, with experts always in control' and, under the heading 'Experts at the centre. Not just humans in the loop.', a four-step sequence: 'See what the AI found', 'Trace it to source', 'Understand what changed', 'Apply judgment where it matters'. Terms cl 1.6(h) says parts of the service 'may provide recommendations, comments and prompts, including but not limited to predictive insights or statistical analysis'. Nothing read states which actions the agent can take without a user instruction, or what approval gates exist.
Ask: What can the agent do without a user pressing a button - amend a disclosure schedule, post a Q&A response, change a document's classification - and what approval gates each of those actions?
Reliance on outputs and the review step
Public claim only
Terms cl 1.6: Service Outputs are generated from the customer's Data; they do not constitute legal advice or legal services or any view or interpretation of a document; they do not take account of all the circumstances; 'Deeligence cannot guarantee the accuracy of any Service Outputs'; where a search function is enabled Deeligence cannot guarantee that results are complete or accurate; and recommendations, comments and prompts are not a substitute for professional advice. Clause 1.4 places sole responsibility for use and for the results on the customer.
Ask: What recall evidence do you have for red-flag screening on document sets like ours, and what review procedure do you recommend for documents the screen does not flag?
