Product and intended use
Define the configuration, people, information and tasks being assessed.
Platform versus Legal Engine
Public claim only
descrybe.ai is a move notice; current product, pricing and Claude connector live at descrybe.com. Legal Engine USD 25/month; Platform USD 50/month includes Engine. Do not buy both. Organisation named-user billing is separate. Host assistant subscriptions are extra.
Ask: Are we buying Engine-only connectors, the Platform workspace, or organisation seats?
DigitalOcean New York
Public claim only
Security and privacy: primary customer-data infrastructure is in DigitalOcean's New York City region on multi-tenant provider-managed hardware. Service providers may process in other locations. No dedicated tenancy or Australian region.
Ask: Confirm every country of storage and OpenAI inference for our account.
Citator, DescrybeLM, connectors
Public claim only
Platform: DescrybeLM guided research, brief checking, citator tools, search, Word export, saved history (150 full runs/month on the published Platform plan). Legal Engine: 13 research tools in ChatGPT, Claude, Copilot, Perplexity and the Open Connector. FAQ: Descrybe is not training its own foundation model.
Ask: Which tools are enabled, and can we disable file/brief upload?
US primary law only
Public claim only
FAQ: all available US state appellate/supreme and federal district/appellate/supreme opinions, including bankruptcy and special courts, plus growing statutes/regulations; 300 million records with documented provenance. Australian law is not described.
Ask: Confirm there is no Australian corpus we might rely on by mistake.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Connector context is the host's
Not confirmed
Security: Descrybe receives the specific tool request, not the whole assistant tenant, email or files. The assistant provider decides what text is placed in arguments (question, citation, quote, jurisdiction). Copilot may be on by default in Microsoft 365 tenants. No Australian client-consent template.
Ask: What exactly does each connector send, and how do we disclose US processing to clients?
OpenAI API; opted out of training
Public claim only
Security/privacy: current primary LLM is OpenAI's API. Descrybe has not opted in to training. OpenAI may retain API abuse-monitoring logs up to 30 days. Models may change without user-by-user notice unless the change is material to terms or privacy. No customer model choice.
Ask: Name the OpenAI models and region, and notify us before any provider change.
Named in privacy; no dated list URL
Public claim only
Privacy 16 September 2026 names DigitalOcean, Clerk, Stripe, OpenAI API, Resend, Mailchimp, and analytics/advertising that may include Google, Meta, LinkedIn, Reddit, TikTok and OpenAI advertising-measurement when tags are enabled. No separate dated subprocessor page or objection right.
Ask: Provide a dated list with locations and confirm ad pixels never see matter text.
No Descrybe-owned training; OpenAI opted out
Public claim only
Terms: Descrybe does not use Customer Content to train Descrybe-owned models and does not authorise third-party AI providers to use Customer Content to train their general-purpose models. Privacy/security repeat the OpenAI API opt-out. Descrybe and providers may still process Customer Content to provide, secure, maintain, troubleshoot and improve the Services.
Ask: Confirm in writing that 'improve the Services' excludes training or fine-tuning on our prompts.
Improve the Services; ad pixels on the website
Public claim only
Terms allow processing to improve the Services, prevent fraud and comply with law. Privacy: website analytics/advertising cookies; analytics code is designed to omit emails and Stripe/Clerk identifiers. Matter prompts are a different channel from marketing pixels, but the boundary should be confirmed.
Ask: Do product prompts ever enter analytics or advertising tools, and can we disable marketing pixels?
History plus 30-day OpenAI logs
Public claim only
Privacy: retain as reasonably necessary; Platform history can be deleted per entry; Legal Engine has no customer-facing history and keeps operational records; OpenAI abuse monitoring up to 30 days; backups/security records may outlast active-view deletion. Live default is not numbered in days.
Ask: State default retention for Platform history, Engine logs, brief-review extracts and backups.
Request to info@descrybe.com
Public claim only
Privacy: request account or personal-information deletion at info@descrybe.com, subject to billing, fraud, security and transaction records. Original brief-review uploads are not deliberately kept as persistent files after text extraction; extracted text may remain. No 30-day certified-deletion SLA.
Ask: Will you delete production, backups and OpenAI logs on a stated timetable and certify?
Need-to-know operations staff
Public claim only
Security: production customer-data access limited to authorised technical operations personnel on a need-to-know basis for operations, support, security, debugging, legal/compliance or customer-requested assistance. No ticket-scoped customer approval workflow is described.
Ask: Is staff access logged, time-limited and customer-approved?
Named-user OAuth; no shared workspaces
Public claim only
Security: named-user accounts and OAuth; shared credentials and pooled access are not supported. Structured around individual accounts, not shared organisation, matter-based workspaces or vault ACLs. Copilot enablement is a Microsoft-tenant admin control.
Ask: How do we provision and deprovision named users for a firm, and is SSO available?
HTTPS/TLS; DigitalOcean at rest
Public claim only
Security: HTTPS/TLS in transit. DigitalOcean managed databases and Spaces are described as encrypted at rest and in transit. No customer-managed keys.
Ask: Confirm TLS version and at-rest algorithms on our Spaces/database.
SOC 2 not yet completed
Public claim only
Security: SOC 2 readiness work is in progress; Descrybe has not completed an independent SOC 2 examination and does not claim SOC 2 or ISO 27001. It relies on DigitalOcean, Clerk and Stripe having their own SOC/security programmes.
Ask: When will a SOC 2 Type II report covering Descrybe's production be available?
Massachusetts Terms; no public DPA
Public claim only
Terms: Massachusetts law; Boston/Suffolk or D. Mass. courts if not arbitrated; NAM arbitration with class waiver and 30-day opt-out; broad limitation of liability. No public DPA URL. Privacy is a notice, not a processor contract.
Ask: Will you sign a DPA with APP 8, 72-hour notice and audit rights before we connect Copilot/Claude?
US hosting and OpenAI
Public claim only
Customer data stored in DigitalOcean NYC; OpenAI API processing; other providers may process in other locations. No SCCs or Australian transfer wording in the privacy notice extract.
Ask: List every country of processing, including OpenAI and advertising vendors, for APP 8.
Notice as required by law
Public claim only
Security/privacy: incident procedures exist; if Descrybe determines notice is required, it will notify as required by applicable law or a written agreement. Timing may depend on investigation and law-enforcement. No 72-hour contractual SLA.
Ask: Commit in writing to notify us within 72 hours of a confirmed incident affecting our account.
Posted policy updates; model changes
Public claim only
Privacy may be updated by posting a new date, with additional notice when required by law. Security: models may be updated without user-by-user notice unless the change is material to terms, privacy or processing commitments. No subprocessor objection right.
Ask: Will material processor or model changes be emailed 30 days in advance?
Cancel in-product; deletion on request
Public claim only
Pricing/FAQ: stop renewals from the account; access continues to period end; no refunds. Platform history is user-deletable. Account deletion via info@descrybe.com. Export of a full workspace archive is not described.
Ask: What export is available for saved research, and when are Engine logs purged after cancel?
Focused tool requests
Public claim only
Security: connecting Legal Engine does not by itself grant access to the assistant conversation, tenant or files. A tool request may still include text the assistant places in arguments. Public connector toolset has no file-upload tool. Copilot Source may be on by default in Microsoft 365.
Ask: Show the request schema for each connector and how we disable Copilot Source tenant-wide.
Corpus retrieval, not open web
Public claim only
Product is retrieval against Descrybe's structured US corpus. Open-web browsing by Descrybe itself is not described. Host assistants (ChatGPT, Perplexity) may still search the web on their own terms.
Ask: Does any Descrybe tool call the open web, and can we use Engine inside an assistant that has web search off?
Research tools, not send/file
Public claim only
Public Legal Engine tools are search, cite, quote-check and source retrieval. No send-email or court-filing tool is described. Open Connector could be wired by the firm to other systems.
Ask: Confirm Engine cannot send email or write to third-party systems unless we build that in the Open Connector.
No Descrybe human review of outputs
Public claim only
Terms: unless Descrybe expressly states otherwise, it does not human-review or validate Outputs. Focused citation/quote checks are not a certification that an entire analysis is accurate. FAQ: always verify with the original opinion.
Ask: Will we treat every Engine answer as unverified until a lawyer has opened the sources?