Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and SKUs in scope
Public claim only
This profile covers DISCO Ediscovery with Cecilia AI (Q&A, Doc Summaries, Single-Doc Q&A, Definitions, Auto Review and agentic Advanced Research). Hold, Request, Case Builder/Timelines, Vault, professional services (including managed review) and any government cloud are separate offerings with their own product terms.
Ask: Confirm the Order Form SKUs, whether Cecilia is enabled on every database, Auto Review versus Q&A, and whether professional-services reviewers will see our documents.
Cloud regions
Public claim only
DISCO is AWS-hosted SaaS. Logins are offered for US, Canada and EU. The subprocessor table lists AWS datacentres as US, EU and Canada. No Australian hosting region was listed.
Ask: Which AWS region will hold our production databases, backups and Cecilia inference, and is an Australia region available on request?
Cecilia and platform AI features
Public claim only
Cecilia Q&A interrogates the database with cited, highlighted passages and optional document-set scoping. Related tools: Doc Summaries, Single-Doc Q&A, Definitions, Auto Review (plain-English tag descriptions plus narrative justifications), Timelines from a complaint, and agentic Advanced Research. Cross-matter AI builds organisation-owned predictive models from prior tags.
Ask: Which of these features will be on in our tenancy, which are generally available versus new/agentic, and how is Auto Review billed versus Q&A?
No Australian region found
Public claim only
Available DISCO datacentres on the subprocessor list are US, EU and Canada. Cecilia LLM subprocessors include OpenAI (US, EU), Writer (US), Pinecone (US, EU) and Azure (US). An Australian law firm using DISCO would be sending matter data offshore unless a later Order Form says otherwise.
Ask: If we proceed, which country stores and infers on our matter data, and what APP 8 / client-consent wording do you provide?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client consent for offshore AI
Not confirmed
DISCO processes confidential discovery data. Hosting and LLM subprocessors are US/EU/Canada, not Australia. Cecilia can be scoped to a document set. No published client-exclusion or OCG flag was found.
Ask: Can we disable Cecilia per database or client, and what processing-location description can we give clients for APP 8 and OCGs?
LLM and vector subprocessors
Public claim only
The subprocessor list names OpenAI (LLM, US/EU), Writer (LLM, US), Pinecone (vector database, US/EU) and Microsoft Azure (cloud hosting, US), plus AWS. DISCO does not publish which Cecilia feature uses which model. Customers do not appear to choose the model.
Ask: Map each Cecilia feature to the provider, model version and country of inference for our instance, and whether we can exclude Writer or OpenAI.
Published subprocessor list
Public claim only
A public list names software/support processors (AWS, Salesforce, Okta, Mailgun, Google, Netsuite, Box, Snowflake, Pendo, Planhat, Pinecone, OpenAI, FullStory), professional-services review/translation firms (including India and UK), forensics vendors and affiliates in India and Canada. Notice period and objection rights were not stated on that page. The master DPA was not found.
Ask: What notice and objection rights apply to new subprocessors, and will professional-services reviewers in India be used on our matters?
LLM training versus cross-matter models
Public claim only
Cecilia Q&A FAQ: LLMs are not permitted to train on customer data or usage. The same statement appears on the AI features page. Separately, Cross-matter AI lets the organisation train predictive models on its own tags; DISCO says those models are owned by the customer and not accessible to other DISCO users. No signed DPA clause was reviewed.
Ask: Point to the Order/DPA clause covering prompts, documents, outputs, embeddings and cross-matter models, binding OpenAI, Writer and Pinecone.
Feedback and analytics subprocessors
Not confirmed
Pendo, FullStory and Snowflake appear as subprocessors for analytics, user insights and warehousing. Whether Cecilia ratings, Auto Review corrections or support tickets improve DISCO models was not stated.
Ask: Are reviewer corrections, Q&A ratings and Pendo/FullStory events used to improve Cecilia or cross-matter models, and can that be switched off?
LLM non-retention versus platform storage
Public claim only
Cecilia FAQ: LLMs may not retain customer data after returning a response. DISCO still stores the ediscovery database, work product and Vault copies. Pinecone holds vectors in the US/EU. Privacy-policy retention language covers website personal information, not Customer Data in the product.
Ask: Provide a retention schedule for databases, prompts, Cecilia outputs, embeddings, audit logs, Vault and Pinecone, including any provider abuse-monitoring window.
Deletion and Vault
Not confirmed
Core platform terms describe Vault nearline storage for inactive databases (work product retained; restore required before use). A public deletion period, certified destruction, or flow-down to OpenAI/Pinecone was not found. Website privacy deletion rights do not govern matter databases.
Ask: On matter close or termination, what is deleted from AWS, Vault, Pinecone and LLM providers, within how many days, and will you certify it?
Support and professional-services access
Not confirmed
The subprocessor list includes staffing providers for review services in the US, UK and India, plus DISCO India for IT and business support. Security pages do not describe a customer-controlled lockbox for DISCO employees. Box is listed as a file-transfer tool for customer support.
Ask: When can DISCO or review-vendor staff open our databases, is access logged to us, and will you notify us of legal process seeking our documents?
SSO, MFA and database permissions
Public claim only
SSO via SAML and email two-factor authentication are documented. Cecilia Q&A can be scoped to a document set. Query-time permission trimming for Q&A, ethical walls and SCIM were not demonstrated on the pages reviewed.
Ask: Demonstrate SAML SSO-only, immediate deprovisioning, and that Cecilia cannot retrieve documents a user is not permitted to open, including caches.
Encryption
Public claim only
Ediscovery security FAQ: TLS 1.2 or greater in transit over the public internet; AES-256 or greater at rest. AI features are stated to use the same encryption and access controls. Customer-managed keys were not mentioned.
Ask: Confirm TLS 1.2+ and AES-256 cover databases, Cecilia prompts/outputs, embeddings, logs, backups and the OpenAI/Writer/Pinecone links, and whether CMK is available.
SOC 2 and ISO
Public claim only
Security pages claim SOC 2 Type 2 (security, availability and privacy), SOC 3, ISO 27001 and display an ISO 27701 badge. Annual penetration testing is stated. Report dates, exceptions and whether Cecilia/OpenAI/Writer sit in scope were not inspected. ISO 42001 is not listed.
Ask: Provide current SOC 2 Type II and ISO 27001/27701 artefacts under NDA with Cecilia and named LLM subprocessors in scope.
Master terms not public
Not confirmed
Website Terms of Use state they do not govern the ediscovery software. Public product-term supplements exist for Cecilia (GB metric) and the core platform (Vault). The master Terms and Conditions, DPA, liability cap, output ownership and governing law for the software were not found on the public legal index.
Ask: Provide the master Terms and Conditions and DPA for DISCO Ediscovery and Cecilia, including APP alignment, confidentiality of prompts/outputs, IP indemnity and Australian law/forum options.
Cross-border processing
Public claim only
A Data Privacy Framework notice exists for EU/UK/Swiss transfers. Datacentres listed are US, EU and Canada. LLM/vector processing includes US (Writer, Azure, Pinecone, OpenAI) and EU (OpenAI, Pinecone). No Australian region. Privacy policy covers website personal information transfers separately.
Ask: For APP 8, list every overseas recipient of our matter data if we buy US or EU hosting with Cecilia enabled.
Incident notice
Not confirmed
Security FAQ says DISCO has information-security incident management controls. A public numbered notification period and NDB cooperation clause were not found. A status page is linked from the site footer.
Ask: What contractual hours apply from discovery of a suspected incident affecting our data, including OpenAI/Writer/Pinecone, and will you support our Notifiable Data Breaches assessment?
Model and product change
Not confirmed
Weekly/monthly release notes are published on a support article. Cecilia product terms do not state model-pinning or notice before changing OpenAI or Writer. Subprocessor-list change notice is not specified on the list page.
Ask: Will you notify us before changing Cecilia's model provider or inference region, and can we re-test Auto Review first?
Export and Vault on exit
Not confirmed
Productions and Vault restore are product features. No public post-termination export window, certified deletion or escrow was found. Website Terms of Use do not apply to the software.
Ask: On termination, how long can we export natives, productions, tags, Cecilia outputs and audit logs, and when is remaining data deleted from AWS, Vault and Pinecone?
Collection and API connectors
Not confirmed
A high-speed uploader and AWS hosting are described. A DISCO API exists. Box and Dropbox are listed as file-transfer subprocessors. A published catalogue of M365/Google connectors and MCP was not found on the pages reviewed (unlike some competitors).
Ask: List every collection connector and API scope we would enable, and how we disable them without a ticket.
Answers limited to the database
Public claim only
Cecilia Q&A FAQ states answers are based on information within the customer's database, with citations to source documents. Scoping can further limit the set. Open-web search as a Cecilia tool was not described.
Ask: Confirm Cecilia Q&A, Auto Review and Advanced Research cannot call the open web on our databases.
Agentic Advanced Research
Not confirmed
Cecilia Advanced Research is marketed as autonomous multi-step reasoning with 'full visibility along the way'. What the agent may do without a click (search, tag, export, produce) is not specified in the public Q&A FAQ. Auto Review writes tags into the database.
Ask: Which Cecilia agent actions require per-step approval, and how do we disable Auto Review and Advanced Research immediately?
Citations and human checking
Public claim only
Cecilia Q&A returns cited source documents and highlighted passages. Auto Review supplies narrative justifications for tags. No contractual clause requiring human review before reliance was found in the public Cecilia product terms; those terms mainly set the GB metric. Professional-services managed review is a paid human layer, not a product gate.
Ask: Can we require named reviewer sign-off before Auto Review tags or Cecilia answers are produced or exported, with an audit export?
