Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and what is published about it
Public claim only
The vendor's own service page states 'Clarity is a data platform that helps organisations strengthen public trust by responding to data intensive events with fast and accurate discovery, investigation and remediation. Clarity leverages artificial intelligence to accelerate information extraction from millions of documents every year to create efficiencies through automation, reduce costs and improve the speed and quality of decision outcomes for our financial services, legal and government clients.' Four capability groups are published - Vision, Speech, Language and Redaction - and nothing else: no module list, plan, edition, version or release stage. The page is a service marketing page; no product documentation, security page, terms or privacy document specific to Clarity was found.
Ask: Is Clarity a product we can license and run against our own matters, or only a platform Deloitte operates on our behalf within an engagement?
The four published capability groups
Public claim only
Vision: 'Extract text, key-value pairs, tables and structures from documents and forms. Automate detection of checkboxes, dates, PII and signatures. Use visual data processing to enrich video content with people, objects, extracted text, scene detection, and more.' Speech: 'Extract rich insights from audio data that powers discovery of new forms of content such as spoken words, topics, sentiment and speaker identities, across multiple languages.' Language: 'Classify text into relevant categories and identify entities such as names, tax file numbers, ID document fields, and PII in text. Tailor and finetune text classification to your organisation's needs.' Redaction: 'Automate redaction of objects, entities and PII in documents, images and audio to protect customer information and fulfil privacy obligations.' The heading also names contract analysis, but no contract-specific feature, clause library or comparison function is described anywhere on the pages read.
Ask: What does 'contract analysis' consist of in Clarity, and which of the four capability groups performs it?
Deployment and hosting - not published
Not confirmed
No deployment model, hosting provider, hosting region, tenancy model or architecture is published for Clarity on any page read. The page states outputs are interoperable - 'Integrate enriched data, predictions and insights into downstream systems, reports and business processes' - and the Discovery and Data Management page states the vendor's assets are integrated into the standard workflows of eDiscovery and review platforms, naming none. facts.deployment records 'saas' only because the controlled vocabulary has no value for 'not published' or 'operated by the vendor inside an engagement'; it is not a published fact and should not be read as one. facts.hostingRegions and facts.australianRegion are recorded as unknown for the same reason.
Ask: Where is Clarity hosted, in which cloud and which region, and does any of our data leave Australia during processing?
Jurisdiction and applicable law
Not confirmed
No governing law, forum or contractual document for Clarity is published. The Deloitte Australia Privacy Statement commits the firm, when handling personal information, to comply with 'the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth)' along with State and Territory legislation, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), and to comply with other jurisdictions' data protection laws such as the GDPR where applicable. That statement governs the firm's handling of personal information and its websites; it is not a Clarity product agreement. The Language capability names Australian data types - 'tax file numbers, ID document fields' - but no Australian legal content or court rule set is claimed.
Ask: Which engagement terms and governing law would apply to a Clarity engagement, and would the Australian Privacy Principles be expressly incorporated?
Who it is published for
Public claim only
The service page names 'our financial services, legal and government clients'. The Discovery and Data Management page states 'Deloitte Discovery and Data Management helps inhouse counsel, law firms and government agencies to control costs and mitigate risk across the entire information management life-cycle', and offers Audio-visual Analytics and Document Intelligence as services a client 'can engage us for'. Published use cases are document discovery, remediation, investigations and contract analysis, including identifying and redacting 'Personally and Sensitive Identifiable Information (P/SII)'.
Ask: For a law firm rather than a corporate client, what is the engagement shape - does our firm operate Clarity, or does Deloitte process our client's documents?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 and not found on the pages read. What was checked: the full text of the Clarity service page, the Discovery and Data Management page and the Deloitte Australia Privacy Statement, none of which contains a block addressed to AI models, assistants, crawlers or 'LLMs', or any instruction about how the product should be described; and a URL listing of deloitte.com/au, which surfaced no /llms.txt, /ai-info, /ai or /for-ai path. The check is limited: deloitte.com is a very large site, the URL listing was keyword-filtered rather than exhaustive, and no credit was spent guessing at unlisted paths, so a page outside the three read and outside that listing would not have been seen. No comparative or superlative self-description in a published question-and-answer set was found on the pages read.
Ask: Do you publish any page or embedded block addressed to AI assistants, crawlers or language models that describes Clarity or instructs how it should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material through the platform
Not confirmed
Nothing published addresses the authority, consents or engagement terms on which client material is put through Clarity. The Deloitte Australia Privacy Statement is a firm-level statement about the handling of personal information and the firm's websites, and requires nothing of a client in this respect. No acceptable-use policy, client warranty or terms of use specific to Clarity was found.
Ask: What warranty about rights and client consents would the engagement letter require from us before our client's documents are processed in Clarity?
Which models process the content
Not confirmed
No model provider, model family or model name is published. The Clarity page states only that the platform lets clients 'Leverage pretrained, production-grade machine learning models', without naming them or saying whether they are built by Deloitte, licensed from a third party, or accessed from a cloud provider's services. The Discovery and Data Management page refers to 'machine learning assets' and to creating bespoke solutions, again with no provider named.
Ask: Name each model and model host behind Vision, Speech, Language and Redaction, and state whether any is a third-party service and in which country it runs.
Sub-processors and offshore recipients
Not confirmed
No sub-processor list exists for Clarity. At firm level, the Deloitte Australia Privacy Statement states personal information may be disclosed to 'Other entities in the Deloitte Network' and to 'Third parties that we engage to assist us in providing professional services to our clients or in the operation of our business (i.e. our subcontractors, advisors, and suppliers)', and that 'These entities and third parties may sometimes be located in other countries, in particular the United States, Japan, Europe, Singapore, UK and India.' That statement is about personal information handled by the firm generally, not about matter content processed in Clarity, and it names no provider or platform.
Ask: For a Clarity engagement, list every sub-processor and Deloitte Network entity that would touch our matter data and the country each is in.
Whether client content improves the models
Not confirmed
Nothing published states whether client content is used to train, fine-tune or improve Clarity's models. Two published statements make the question sharper rather than answering it: the Clarity page offers 'pretrained, production-grade machine learning models' that, in the same sentence, 'learn and improve over time', and the Language capability offers to 'Tailor and finetune text classification to your organisation's needs'. Neither says whose data does the learning or fine-tuning, whether any tuned model is isolated to one client, or whether a tuned model persists after an engagement ends. The Deloitte Australia Privacy Statement says the firm may use 'non-personal, de-identified, and aggregated information' for purposes including data analytics and research, but does not address model training.
Ask: Does client content train, fine-tune or otherwise improve any Clarity model, is a tuned model isolated to us, and is it deleted when the engagement ends?
Corrections and derived data
Not confirmed
Nothing published states what happens to reviewer corrections, validation decisions or business rules created during a Clarity engagement, or who owns them. The Discovery and Data Management page states the firm will 'work with you to create business rules that work alongside these machine learning assets', without addressing ownership or reuse. The Deloitte Australia Privacy Statement states the firm 'may share non-personal, de-identified and aggregated information with third parties for several purposes, including data analytics, research, submissions, thought leadership and promotional purposes', which is a firm-level statement about personal information rather than about engagement work product.
Ask: Who owns the business rules, tuned classifiers and corrected training examples produced in our engagement, and can Deloitte reuse them for other clients?
Retention of matter content
Not confirmed
No retention statement, period or policy for Clarity is published. The Deloitte Australia Privacy Statement does not state a retention period for client or matter content, and there is no Clarity data-handling document. facts.retentionSummary is therefore null.
Ask: How long is our matter content, and every derived index or model artefact, retained after the engagement ends, and where is that written down?
Deletion and return of data
Not confirmed
No deletion commitment, deletion timeframe or certificate-of-destruction process is published for Clarity. The Deloitte Australia Privacy Statement gives individuals a route to access or correct personal information through the firm's Privacy Officer, and its heading refers to deletion, but it sets no deletion commitment for client matter content processed in a platform.
Ask: On completion, will Deloitte delete all copies, extracts, indexes and derived artefacts of our matter data and certify that in writing, and within how many days?
Who inside the firm can see the content
Not confirmed
Nothing published states which Deloitte personnel can access matter content in Clarity, whether access is logged, or whether the client is told about access. The Discovery and Data Management page describes the delivery team as 'data scientists, engineers and full-stack developers working alongside eDiscovery practitioners, digital forensic specialists and eHearing experts', which indicates a staffed delivery model but sets out no access control. The Deloitte Australia Privacy Statement lists 'Administrative and technical controls to restrict access to personal information to only those people who need access' at firm level.
Ask: Which named roles can open our matter content in Clarity, is every access logged, and can we receive that access log?
Authentication and user administration
Not confirmed
No authentication, single sign-on, multi-factor, role model or user-administration detail is published for Clarity, and no client-facing interface is described. The Deloitte Australia Privacy Statement records firm-level physical and technical controls, including staff security passes and access restriction, but nothing platform-specific.
Ask: If our people use Clarity directly, how do they authenticate, is single sign-on with multi-factor supported, and what roles exist?
Encryption
Not confirmed
No encryption statement for Clarity is published. The Deloitte Australia Privacy Statement lists 'Technological security measures, including fire walls, encryption, and anti-virus software' among firm-level protections for personal information, without stating what is encrypted, in transit or at rest, with which algorithms or key management, and without reference to Clarity.
Ask: Is matter content in Clarity encrypted in transit and at rest, with what key management, and who holds the keys?
Independent assurance
Public claim only
No assurance report or certification is published for Clarity: no SOC 2, no ISO/IEC 27001, no ISO/IEC 42001, no IRAP assessment and no penetration-test summary was found on the service page, the Discovery and Data Management page or the Privacy Statement, and there is no trust centre or security page for the platform. facts.assurance is therefore empty. GDPR: the vendor's own page states "compliance with security and privacy laws, regulations or frameworks like the NIS directive, TISAX, GDPR and other international data privacy legislation. Deloitte has a multidiscipli" (https://www.deloitte.com/hu/en/services/consulting-risk/services/cyber/it-risk-and-audit.html, checked 2026-10-10). ISO 27001: the vendor's own page states "load SOC2 eBook](https://hu.register-deloittece.com/forms/registration.html?docid=135) ##### 03 ISO 27001 Being on top of cyber challenges is instrumental for business leaders and ma" (https://www.deloitte.com/hu/en/services/consulting-risk/services/cyber/it-risk-and-audit.html, checked 2026-10-10). SOC 2: the vendor's own page states "ionable recommendations tailored to the unique risk profiles of the organizations. ##### 02 SOC1, SOC2 READINESS & AUDIT An efficiently managed IT security control environment is" (https://www.deloitte.com/hu/en/services/consulting-risk/services/cyber/it-risk-and-audit.html, checked 2026-10-10).
Ask: Does Clarity hold ISO/IEC 27001 certification or an IRAP assessment, and can we see the certificate or report with its scope?
Contract structure
Not confirmed
No contract, master services agreement, order form, service schedule or data processing agreement for Clarity is published. The only contractual-looking links on the pages read are the site-wide 'Terms of Use', 'Cookies' and 'Privacy' footer links, and the Terms of Use governs use of the website rather than the platform; it was not opened in this pass. The site footer states that DTTL 'and each of its member firms and related entities are legally separate and independent entities, which cannot obligate or bind each other in respect of third parties. DTTL and each DTTL member firm and related entity is liable only for its own acts and omissions'. Acquisition is by 'Contact us' or 'Submit RFP', so the terms would come from an engagement letter that is not published.
Ask: Provide the engagement letter and any Clarity service schedule, including liability, indemnity, data processing and professional-conduct terms, before we put client documents into it.
Cross-border transfer
Not confirmed
No statement about cross-border processing or storage of matter content in Clarity is published. At firm level, the Deloitte Australia Privacy Statement states personal information may be disclosed to Deloitte Network entities and engaged third parties that 'may sometimes be located in other countries, in particular the United States, Japan, Europe, Singapore, UK and India', and that the firm will 'take steps to ensure that those recipients implement appropriate safeguards'. Whether any Clarity processing, model inference or support occurs outside Australia is not addressed anywhere on the pages read, so facts.australianRegion is unknown.
Ask: Will all Clarity processing, inference and support for our matter occur in Australia, and if not, in which countries and under what safeguards?
Breach notification
Not confirmed
No incident or breach notification commitment for Clarity is published, and the Deloitte Australia Privacy Statement contains no notification trigger, recipient or timeframe and no reference to the Notifiable Data Breaches scheme. No status page or incident history was found.
Ask: Within what period would Deloitte notify us of a security incident affecting our matter data in Clarity, and who makes the Notifiable Data Breaches assessment?
Changes to the platform and how they are communicated
Not confirmed
No change log, release notes, versioning or deprecation policy for Clarity is published, and no notification commitment for changes to models or capabilities was found. The Clarity page states the models 'learn and improve over time' without saying how a change is recorded or communicated. Whether a model change mid-engagement would be disclosed is not addressed.
Ask: How would a change to a Clarity model or capability part-way through our matter be recorded and notified, and can we pin a version for defensibility?
Exit and portability
Not confirmed
No exit, portability or data-return provision for Clarity is published. The Clarity page's Interoperable bullet - 'Integrate enriched data, predictions and insights into downstream systems, reports and business processes' - describes output integration, not exit; no export format, load file or handover process is described.
Ask: At the end of the engagement, in what format are enriched data, coding decisions and redacted documents handed back, and what does Deloitte keep?
Connectors and data movement
Not confirmed
No connector, API or integration list is published for Clarity. The vendor states its assets are integrated into the standard workflows of eDiscovery and review platforms and that insights can be pushed into downstream systems, but names no platform, no protocol and no direction of data flow. Whether Clarity reaches into a client's own systems, or works only on data delivered to Deloitte, is not stated.
Ask: Does Clarity connect to our systems directly, or do we transfer data to Deloitte, and by what mechanism is that transfer made?
Access to the open web
Not confirmed
Nothing published states whether Clarity retrieves anything from the internet. The published capabilities all operate on client-supplied content - documents, forms, images, audio and video - but there is no statement confirming or denying outbound retrieval or enrichment from external sources.
Ask: Does any Clarity capability enrich or verify content against external or internet sources, and can that be turned off for our matter?
What the platform does automatically
Public claim only
The published automation is substantial and described without any statement of confirmation steps: 'Automate detection of checkboxes, dates, PII and signatures', 'Classify text into relevant categories and identify entities', and 'Automate redaction of objects, entities and PII in documents, images and audio to protect customer information and fulfil privacy obligations'. Automated redaction changes documents, and nothing published states whether a redaction is applied to a working copy or the original, whether a person approves each one, or whether an automated redaction can be reversed. The Deloitte Australia Privacy Statement separately states, of the firm generally, that 'We may use automated processes to support decisions about individuals' with safeguards 'including impact assessments, periodic review, transparency, and the ability for individuals to request further information or human intervention'.
Ask: In an automated redaction run, is each redaction reviewed before it is applied, is the unredacted original preserved, and is the redaction reversible and logged?
Human review of output
Not confirmed
No human-review or human-in-the-loop statement for Clarity is published, and no disclaimer about output accuracy was found on the service page. The Discovery and Data Management page states the firm will 'Target and focus review and investigation efforts on content that was previously unreachable by human experts' and describes working with the client to create business rules alongside the machine learning assets, which implies a staffed workflow but states no review obligation, sampling regime or quality-control step. At firm level the Privacy Statement offers individuals 'the ability... to request further information or human intervention' where automated processes support decisions about them.
Ask: What quality control sits between a Clarity output and a document produced to the other side - sampling rate, reviewer seniority, and who signs off?
