Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
DIAMS Infinity is published as one of five products in the vendor's Digital IP line, alongside Simple IP, DIAMS iQ, Octimine and the Dennemeyer API, and sits within a group that also sells managed IP administration, IP legal services and IP consulting. The product page (read 2026-09-27) describes it as the next generation of the vendor's DIAMS line and as a cloud intellectual-property management system. No plan, edition, module list or feature tiering is published, and no order form or terms of service was found, so what a subscription includes — and whether the AI search and assistant are included or separately licensed — is not established.
Ask: Which edition of DIAMS Infinity would we be quoted, are the AI natural-language search and the AI assistant included in the base subscription or licensed separately, and can they be disabled?
What the product does, and which part is AI
Public claim only
Per the product page (read 2026-09-27): docketing, deadline tracking and task management; direct connectivity to patent and trademark office databases with automatic checks against office records and a data-audit feature; “country law-aware calculations” for deadlines and procedural rules; a central hub for tasks, matters and documents; customisable dashboards; guest-user places for colleagues and external counsel; and user management and permissions. The functions the page attributes to AI are narrower than its framing: an “Artificial Intelligence (AI) natural language search” that retrieves records from the system, restated on the same page as “AI-supported search to help users access the right information quickly”, and “An AI assistant with full portfolio knowledge” that helps users navigate legal status, filings and asset details; a demo tile names the feature “AI assistant for IPMS data retrieval”. The page's FAQ block separately states the product “is an AI-native IP asset platform”, which is the vendor's characterisation; the mechanisms the same page describes for its main work are office-data connectivity and a jurisdiction-specific rules engine.
Ask: Which steps in the product are performed by a language model and which by deterministic rules, and what does the AI assistant have access to beyond the customer's own portfolio records?
Deployment and data location
Not confirmed
The product page states deployment is cloud. Nothing further is established: no hosting provider, data-centre country or region, no statement of whether a customer can choose a location, and no on-premises or private-cloud option was found. The privacy policy states that recipients such as “hosting or IT maintenance service providers” “may possibly be located in countries outside of the European Economic Area”, without naming any, and the site publishes no security page, trust centre, architecture document or data-location page. Three URL maps of dennemeyer.com in the preceding research pass, one of them searched for data-protection, legal-notice and terms-of-use terms, surfaced no such document.
Ask: Where is DIAMS Infinity hosted for an Australian customer — provider, country and region for the application, backups, search index and the AI functions — and is an Australian data location available?
Governing law and contracting entity
Public claim only
The Legal information page (read 2026-09-27) states that use of the website “is governed by the laws of Luxembourg”; that is the website, not a software contract, and no governing-law clause for DIAMS Infinity was found. The same page divides the group: “Administrative and Software services are offered by our IP Solutions division with its respective local entities” while “IP Legal and related services are offered by our IP law firms”, and states the group entities “operate and carry on business as independent, separate and autonomous legal entities” with no entity able to “obligate or otherwise bind” another. The only Australian entity published is Dennemeyer & Associates Australia Pty Ltd, ABN 11 155 531 981, Level 14, 330 Collins St, Melbourne, which the page attributes to the legal-services side. The Offices page returned only European office cards in the scrape read, so no Australian IP Solutions entity was identified.
Ask: Which Dennemeyer entity would contract with us for DIAMS Infinity, what is its ACN or ABN, and what governing law and jurisdiction does that entity's agreement use?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately. No page or block directing AI models, assistants or crawlers how to describe the product was found: three URL maps of dennemeyer.com in the preceding research pass, one of them searched for terms that would surface such a page, returned no /llms.txt, /ai-info, /for-ai or equivalent, and none of the five pages read here carries such a block. Recorded as not found rather than absent, because a URL map does not reliably discover an unlinked file and only five pages were read. The product page's own FAQ does state the product “is an AI-native IP asset platform”, which is recorded in this profile as the vendor's characterisation rather than as evidence about the mechanism.
Ask: Do you publish any page or embedded block instructing AI systems or crawlers how to describe DIAMS Infinity?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client and portfolio data in
Not confirmed
Nothing published addresses what a customer may put into the product, who owns it, or what the vendor may do with it: there is no terms of service, no acceptable-use statement and no data processing agreement on the site. The privacy policy governs personal data the vendor collects as controller through its website and business relationships, not customer content held in the application. The Legal information page asks visitors not to send confidential information “unless a formal client relationship has been established”, which addresses website contact rather than the product. A firm's own portfolio and client data would be governed only by the written engagement referred to on that page, which is not published.
Ask: In the DIAMS Infinity agreement, who owns the data we load, what may Dennemeyer do with it, and is there any restriction on loading client-confidential or privileged material?
Model provider
Not confirmed
No foundation model, model family, model provider or inference location is named anywhere on the five pages read, including the product page that names the AI search and the AI assistant three times. The privacy policy names only website analytics providers (Matomo and Leadfeeder Group GmbH) and refers generically to “hosting or IT maintenance service providers”. There is no subprocessor list, trust centre or security page on the site in which a model provider could be published.
Ask: Which model, from which provider, answers an AI search or assistant question in DIAMS Infinity, in which country does that inference run, and is a self-hosted or in-region model option available?
Subprocessors
Not confirmed
No subprocessor or subcontractor list is published. The privacy policy states the vendor “works with service providers such as hosting or IT maintenance service providers” and may share personal data with affiliated companies, “collectively ‘Dennemeyer IP Group’”, pointing to the Offices page for the entity list; it names no processor for the application and no AI provider. The Offices page as returned in the scrape read listed only European offices. Three URL maps of the site in the preceding research pass surfaced no subprocessor list, DPA or trust centre.
Ask: Provide the list of subprocessors for DIAMS Infinity, including hosting, any AI or search provider, and any group entity that can access our tenancy, each with its country.
Use of customer content for model training
Not confirmed
Nothing published states whether customer portfolio data, queries to the AI search, or the assistant's inputs and outputs are used to train, fine-tune or evaluate any model. The product page markets the AI features without any data-handling statement; the privacy policy does not mention artificial intelligence, machine learning or model training at all; and there is no terms of service or DPA on the site in which such a commitment could sit. This absence is the finding: the vendor publishes no training position for a product it describes as “AI-native”.
Ask: Will you warrant in the agreement that our portfolio data, our AI queries and the assistant's outputs are never used to train, fine-tune or evaluate any model, including by a model provider?
Feedback, prompts and telemetry
Not confirmed
Nothing published states whether prompts, AI queries, assistant conversations or in-product usage telemetry are stored, for how long, or whether anyone at the vendor reviews them. The privacy policy describes website analytics only — Matomo, and Leadfeeder Group GmbH for identifying business visitors with shortened IP values — and website access logs kept for security analysis and “promptly deleted on a regular basis”. Neither the product page nor any other page read addresses in-application telemetry or a feedback mechanism.
Ask: Are AI queries and assistant conversations logged, for how long, and does any Dennemeyer person or process read them for support or product improvement?
Retention
Not confirmed
No retention period for data held in the application is published. The privacy policy states personal data is retained “as long as needed to fulfil the purpose for which it was processed or as required by applicable laws or regulations”, then securely deleted or anonymised, and that website access logs are “promptly deleted on a regular basis” — but it is a controller-side website and business-relationship notice, not a statement about a customer's IP portfolio records, documents, deadlines or AI query history in DIAMS Infinity.
Ask: State the retention periods for our portfolio records, documents, deadline history, audit logs and AI query history, both during the subscription and after it ends.
Deletion
Not confirmed
No deletion commitment, timeframe or certification is published for data held in the application. The privacy policy gives the individual-rights position under the GDPR — the vendor “will respond to all legitimate requests for information and where applicable, to correct, amend, or delete your Personal Data” — and states that on expiry of the applicable retention period personal data is securely destroyed. Nothing addresses deletion of a customer's tenancy data on request or on termination, and no terms of service or DPA is published in which it could.
Ask: On termination, within how many days is all of our data deleted from the application, from backups and from any AI provider, and will you certify the deletion in writing?
Vendor personnel access to customer data
Not confirmed
Nothing published states which vendor personnel can access a customer's tenancy, under what approval, or whether such access is logged and disclosed. The privacy policy lists “System Access Control” and “Data Access Control” among its technical and organisational measures without describing them. The group structure raises the question sharply and does not answer it: the Legal information page records that the same brand operates an IP law firm, an IP administration business, a consulting division and the software business as separate entities, and the privacy policy permits sharing personal data within the “Dennemeyer IP Group”. Nothing read establishes whether a firm's portfolio data in DIAMS Infinity is walled off from the group's managed-IP and law-firm businesses.
Ask: Which Dennemeyer entities and teams can access our tenancy, is that access logged and visible to us, and how is our data separated from the group's managed-IP and law-firm operations?
Authentication and permissions
Public claim only
The product page states the product provides user management and permission controls, and offers “unlimited guest-user places” so colleagues and external counsel can be given access. No detail is published: no statement of single sign-on, multi-factor authentication, session handling, role definitions, or what a guest user can see and do. The privacy policy lists “Physical Access Control” and “System Access Control” among its measures without describing them.
Ask: Does DIAMS Infinity support enforced single sign-on and multi-factor authentication for all users including guests, and what exactly can a guest user read, export or change?
Encryption
Not confirmed
No statement of encryption for application data was found. The privacy policy has a section headed “SSL or TLS encryption” which is about the website: it states the site uses SSL or TLS “to protect the transmission of confidential content, such as orders or requests that you send to us as a site operator”. It also lists “Transmission Control” and “Data Backup” among its measures without describing them. Nothing addresses encryption at rest, cipher strength or key management for DIAMS Infinity, and the site publishes no security page.
Ask: Is data in DIAMS Infinity encrypted at rest and in transit, with which algorithms and key management, and are customer-managed keys available?
Independent assurance
Public claim only
The only certification found is a quality-management one, published in a vendor blog post dated 17 May 2024: the group passed ISO 9001:2015 recertification “without any non-conformities”, “21 Dennemeyer entities in 13 countries are certified”, and the published scopes include “Providing Intellectual Property management services and Software in Intellectual Property area”. The post names none of the 21 entities and no certificate is published. No information-security assurance was found anywhere on the site — no ISO/IEC 27001, no SOC 2, no ISO/IEC 42001, no penetration-test summary and no trust centre — and three URL maps of the site in the preceding research pass surfaced none.
Ask: Does the entity that would supply DIAMS Infinity hold ISO/IEC 27001 or a SOC 2 Type II report covering this product, and will you provide the certificate or report with its scope and date?
Contract structure
Not confirmed
No contract, order form, terms of service or DPA is published. The Legal information page states only that “The responsibility for the provision of services to a customer/client is defined in a written engagement between the instructed Dennemeyer Group Entity and a customer/client”, and that group entities are separate and autonomous with no authority to bind one another — so the counterparty, the liability position, any warranty and any data-protection schedule all sit in an unpublished engagement. Nothing is established about liability caps, indemnities, warranties or the treatment of AI output.
Ask: Provide the standard DIAMS Infinity agreement and its data-protection schedule, and state the liability cap and whether any AI-specific terms apply to output from the search and assistant.
Offshore transfer
Public claim only
The only published statement is in the privacy policy, and it is about the vendor's controller-side processing rather than the application: recipients including “hosting or IT maintenance service providers” “may possibly be located in countries outside of the European Economic Area (‘Third Countries’), in which applicable laws do not offer the same level of data privacy protection as in your home country”, and in such cases the vendor takes measures “including the execution of GDPR Standard Contractual Clauses”. The framework is European: the controller is in Luxembourg, the named supervisory authority is the Commission Nationale pour la Protection des Données, and the Privacy Act 1988 (Cth) and Australian Privacy Principle 8 are not mentioned. No country is named for any transfer, and nothing addresses where an Australian customer's portfolio data or AI queries would go.
Ask: For an Australian customer, which countries will our data and our AI queries be processed in, and will you accept an Australian Privacy Principle 8 cross-border clause with Dennemeyer accountable for each overseas recipient?
Incident notification
Not confirmed
No incident-notification commitment was found. The privacy policy states that “Ensuring that Personal Data is appropriately protected from data breaches is a top priority” and that adequate technical and organisational measures are in place, but sets out no notification obligation, no timeframe and no contact path for a security incident affecting a customer's data, and there is no terms of service or DPA on the site in which one could sit. German affiliates have a designated data protection officer contact and Romanian affiliates a local one; no equivalent contact is published for an Australian customer.
Ask: Who would notify us of a security incident affecting our tenancy, within what time, and with what information to support a Notifiable Data Breaches assessment under the Privacy Act 1988 (Cth)?
Change notification
Not confirmed
No change or versioning policy is published for the product, and no release notes, changelog or deprecation policy was found. The privacy policy carries no version or effective date in the text read, so it cannot be told when it last changed. Because no terms of service is published, nothing establishes how the vendor may change the service, the AI functions or the terms, or what notice a customer would get. The product is published as the successor to an earlier generation of the same line, with the predecessor still listed separately, and no migration or support-end statement for that predecessor was found.
Ask: How will you notify us before a change to the AI search or assistant, or to the deadline rules engine, and what is the support and migration position for customers still on DIAMS iQ?
Exit and data portability
Not confirmed
No export, portability or exit provision is published for the application. The privacy policy carries only the GDPR data-portability right for personal data processed on consent: the individual may “request that we transfer the Personal Data we have collected to another controller, or directly to you”. Nothing states what a customer can export from DIAMS Infinity, in what format, whether docketing history, deadline calculations, documents and audit trails are included, or what assistance is available on termination.
Ask: What can we export from DIAMS Infinity in machine-readable form — records, documents, deadline history and audit logs — at what cost, and for how long after termination do we keep access to do it?
Connections into firm systems
Public claim only
The published connections are outbound to patent and trademark office databases — direct connectivity, automatic checks against office records, and a data-audit feature — and inbound access for guest users. Nothing published describes a connection into a customer's own document management system, email, finance system or identity provider, and the group's separately published Dennemeyer API is a different product. What credentials or permissions any connection requires, and whether office connectivity is one-way, is not stated.
Ask: Does DIAMS Infinity connect to our document management, email, identity provider or finance systems, and what permissions would each connection require?
External retrieval
Not confirmed
The product page describes the AI functions as operating over the customer's own records — “natural language search” that retrieves records from the IP management system and an assistant “with full portfolio knowledge” — and a demo tile names the feature “AI assistant for IPMS data retrieval”. Whether either function can reach outside the tenancy, for example to office databases, to the group's own IP data, or to the internet, is not stated on any page read, and the office-connectivity feature is described separately from the AI features.
Ask: Can the AI search or assistant retrieve anything from outside our tenancy — office databases, Dennemeyer's own datasets, or the internet — and can that be switched off?
Control over automated action
Not confirmed
The AI functions are published as retrieval only: search and question answering over portfolio records. Nothing states whether the AI functions can change a record, create or complete a task, alter a deadline or send a communication, and nothing describes a confirmation step or an audit record for any action taken through them. The non-AI parts of the product do act on data — automatic checks against office records and jurisdiction-specific deadline calculations — and the page does not say whether a calculated deadline is written to the docket automatically or after review.
Ask: Can the AI assistant change any record, deadline or task, and when the rules engine recalculates a deadline, is the change applied automatically or does a person approve it?
Human review of output
Not confirmed
No accuracy caveat, confidence indicator, citation-to-record behaviour or review requirement is published for the AI search or the AI assistant, and there are no published terms in which a disclaimer could sit. The only related published statement is the general website disclaimer on the Legal information page: the content of the website “does not constitute legal advice”, guidance on a specific legal matter requires consulting a qualified attorney, and “no liability is assumed for the content of this website”. For a product whose output includes statutory deadline calculations and answers about legal status, nothing establishes what a user must check or what the assistant shows as its source.
Ask: Does the AI assistant cite the record and field each answer came from, does it indicate uncertainty, and what do you require a user to verify before relying on an answer about a legal status or a deadline?
