---
title: "DoxAI Redact AI (DoxAI Australia Pty Ltd)"
url: "https://ailawframework.com/software/doxai-redact-ai"
type: "software_profile"
site: "AI Law Framework"
id: "doxai-redact-ai"
vendor: "DoxAI Australia Pty Ltd"
category: "General-purpose"
segment: "Compliance and privacy"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# DoxAI Redact AI (DoxAI Australia Pty Ltd)

> Automated redaction software that detects personal and sensitive information in documents, images, audio and video and removes or masks it, with templates, keyword and manual redaction and a review step before export.

Canonical page: https://ailawframework.com/software/doxai-redact-ai  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Redact AI as sold on the DoxAI platform, under the platform terms of 6 March 2026. Legal-adjacent, not legal-only. The other ten DoxAI products, the API tier and any enterprise agreement need separate review.

## Capabilities

- Compliance monitoring
- Redaction

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | SOC 2 Type 2 — asserted in body text and a badge image on the product page and repeated in the FAQ; no report, auditor, scope statement or trust page is published or linked on any page read, ISO/IEC 27001 — asserted in the same badge set and FAQ list; no certificate, certifying body or scope statement published or linked, ISO/IEC 42001 — a badge appears in the product page compliance strip, but the FAQ's own list of standards supported (GDPR, PCI DSS, SOC 2 Type 2, HIPAA, ISO 27001) does not include it; no certificate or scope statement published, GDPR, PCI DSS and HIPAA — asserted as 'compliant' or 'supports compliance with' in body text and badges; the FAQ states controls 'are supported by annual external audits and regular cybersecurity penetration testing', without naming an auditor or publishing a summary |
| Training on customer content | Yes |
| Retention | Not reconcilable from the documents published. The product and help FAQ state customer documents are not reused to train AI models and that data is 'processed only for the intended redaction purpose and automatically redacted with in 24h after redaction' (the FAQ's wording; whether 'redacted' there means deleted is not defined). The platform terms take a different position: they define Data Sets as input plus output, state that Anonymised Data Sets are 'complete property of DoxAI Australia Pty Ltd', authorise DoxAI to use Data Sets to train AI/ML/LLM models subject to anonymisation and its Reinforcement Training Policy, and set no retention period. The privacy policy (19 August 2026) publishes no general retention period and cross-refers to a section headed 'How long we keep your Identification Information' that does not appear on the page. On termination the terms state the account will be deleted; they say nothing about Data Sets or Anonymised Data Sets. |
| Integrations | API, iFrame embed, Other DoxAI platform products (Extract AI, Categorise AI, Cross-Check AI, Fraud Check AI) |
| Pricing | No price is published for Redact AI. No pricing page exists anywhere in the 40-URL site map Phase 2 ran over doxai.co, none is linked from the product or help page, and the only calls to action are 'Book a Free Demo' and 'Contact us'. The platform terms do publish the charging mechanisms: clause 8.8 states purchasers have three methods of buying Digital Products, being Subscription, Pay As You Go and Buckets (prepurchased groups of requests that expire); subscription fees are paid in advance per billing cycle and renew automatically until cancelled, and DoxAI may change subscription inclusions or fees on 30 days' notice with a cancellation right. |
| Australian presence | Yes. CONTRACTING ENTITY, from clause 2.1 of the Terms and Conditions dated 6 March 2026: 'These terms and conditions (Terms) are entered into between DoxAI Australia Pty Ltd ACN 660 177 837'. The same entity and ACN appear in the notices block at the end of the terms and in the Privacy Collection Notice, and the site footer carries 'DoxAI ABN 15 660 177 837'. The Privacy Policy dated 19 August 2026 is given jointly by DoxAI Australia Pty Ltd (ACN 660 177 837) and a second entity, DoxAI Operations Pty Ltd (ACN 696 297 211), and does not say which of the two handles Redact AI content. One clause inside the data-training section of the terms reads 'DoxAI Australis Ltd', an apparent typographical variant; a further variant, 'DOXAI AUSTRALIA LIMITED', appears in cached search-result snippets of a New South Wales government supplier profile and an electronic-signature disclosure that were not opened for this profile. Those variants are recorded, not resolved. Governing law is New South Wales with exclusive jurisdiction in New South Wales courts, and unresolved disputes go to a mediator appointed, if the parties cannot agree, by the Law Society of New South Wales. AUSTRALIAN DATA RESIDENCY: NOT ESTABLISHED. The Privacy Policy and the Privacy Collection Notice both state 'We may store personal information overseas' and that third parties 'may also store, transfer or access personal information outside of Australia', naming no country, while the product page markets 'Choose your Data Location' and 'Local data sovereignty to meet regulations' as marketing text. No published residency commitment, region list or statement of where inference runs was found on any page read. |
| Website | https://doxai.co/product/redact-ai/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | Redact AI is one of eleven products listed on the DoxAI platform and is grouped by the vendor under 'AI/ML Process Automation' with Fraud Check AI, Categorise AI, Extract AI and Cross-Check AI; two further categories, 'Agentic AI' and 'AI Governance', appear in the navigation with no product page behind them, only a demo request. Whether Redact AI can be licensed on its own is not published: the terms describe a marketplace in which purchasers buy 'Digital Products' by Subscription, Pay As You Go or Buckets, and no plan or module list for Redact AI appears on any page read. | Can Redact AI be contracted on its own, and what exactly is in the subscription, the Pay As You Go rate and a Bucket for our expected volume of disclosure and subpoena work? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Deployment model | Public claim only | Cloud SaaS. The product page describes cloud-based infrastructure with vertical and horizontal scaling and auto-scaling, and states the product is integrated 'into existing workflows or legacy systems via iFrame or API in less than a week'. No on-premises, private-cloud or self-hosted option is described anywhere on the pages read, and no hosting provider is named. | Is any deployment available where documents never leave infrastructure we control, and which cloud provider and region hosts the processing environment for an Australian customer? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/) |
| Published functions | Public claim only | Published functions, checked 2026-09-27: adaptive models that redact structured and unstructured content without relying on document layout; 'Dynamic Query Redaction', described as asking the model to redact specified phrases, information types or keywords with no extra training; more than 40 pre-built PII and business-sensitive-information templates plus user-created templates; manual drawing or selection of regions; keyword redaction; percentage redaction, which restricts the proportion of detected information redacted; OCR for handwriting and varied scripts; export of the original or converted formats; cryptographic signing of every PDF processed; and audio and video redaction by sound replacement and visual obfuscation. Stated formats include PDF, DOC, DOCX, XLS, XLSX, XML, PNG, JPG, JPEG, MP3, MP4, AVI and WAV. | Demonstrate percentage redaction, template creation and audio redaction on our own material, and state which functions use a model and which are deterministic keyword or region operations. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Australian framing and legal use | Public claim only | The FAQ is written to Australian law without claiming to give legal advice: it describes the Privacy Act 1988 (Cth) obligation to take reasonable steps to protect personal information, points to the Office of the Australian Information Commissioner for guidance, and explains the tax file number rule as a reason to redact TFNs. 'Legal documents' and 'legal identifiers' are named as use cases, and contracts, legal documents and board papers are named as suitable file types. The product contains no legal content set and is legal-adjacent rather than legal-specific. | Confirm the product makes no legal determination about privilege or relevance, and that decisions about what must be redacted in a disclosure or subpoena response remain ours. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Licence, fees and renewal | Public claim only | The terms grant 'a personal, non-exclusive, revocable, worldwide, non-transferable licence to use our Platform'. Subscription fees are paid in advance per billing cycle and the subscription 'will automatically renew at the end of the Billing Cycle' until cancelled. DoxAI may change subscription inclusions or fees on 30 days' notice, after which the customer may cancel with a pro-rata refund of prepaid fees. Buckets are non-transferable and expire. Fees are refundable only in accordance with consumer law rights and the terms, and no refund is offered for a change of mind. No price is published. | Provide a written quote with the subscription tier, per-document or per-page rate, Bucket expiry and any volume cap, and confirm whether fee and inclusion changes on 30 days' notice can be excluded for our term. | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/) |
| Integration | Public claim only | Integration is stated to be by iFrame or API into existing workflows or legacy systems, and the help centre links an API reference at api.doxai.co/docs and a support portal. The FAQ states Redact AI can integrate into document, data management, compliance and operational workflows and that it can be used together with Extract AI in a single workflow. No named integration with any practice-management or document-management system appears on the pages read, and the API reference was not opened. | Is there a supported integration with our document management system, and what does the API send and return for a matter file, including whether the source document is stored on DoxAI infrastructure at all? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Support | Public claim only | The FAQ states support channels are open 24 hours a day, seven days a week 'with response time up to 48 hours', and that DoxAI provides onboarding support and technical assistance. Notices under the terms go to support@doxai.co and a support portal at support.doxai.co, and the help centre links a ticket form. No severity matrix, uptime service level or Australian-hours commitment was found; the product page states '99.97% Uptime' as a figure with no service-level document behind it. | What contractual uptime and response times apply, what remedies attach to them, and is support delivered from Australia? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Published accuracy figures | Not confirmed | Two different accuracy figures are published for the same product on pages checked the same day: the product page hero and search description state '99.97% accuracy', while the FAQ on both the product page and the help page states 'Redact AI current accuracy rate is 99.78%'. Neither figure has a published test set, definition of accuracy, error type breakdown or evaluation method. Throughput and benefit figures (10,000 documents of up to 2,000 pages in one to two minutes, 100 times faster than manual redaction, a 45 per cent reduction in common human errors, eight times more effective on a 30-page document) are footnoted as 'based on current client outcomes and may vary'. No independent evaluation was found. | Which figure is current, and provide the measurement method for both: the test corpus, the definition of a miss, the false-negative rate on Australian identifiers such as TFNs and Medicare numbers, and whether handwriting and audio were measured separately. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Task fit for disclosure and privacy work | Public claim only | The published workflow is upload, redact by template or custom terms, then review and download, with approval-based workflows that allow users to review, adjust and confirm redactions before export or sharing, and an audit trail of redaction activity. Percentage redaction restricts the proportion of detected information that is redacted, which is a setting a firm would need to understand before relying on a batch. The FAQ states the product is not a consumer or free tool and that organisations needing defensible redaction should avoid free tools that may not permanently remove sensitive data. | On a sample brief of evidence, how many missed items and over-redactions occur, how long does the review step take per 100 pages, and is the redaction flattened so the underlying text cannot be recovered from the exported file? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Client authority and the terms' own prohibition on uploading personal information | Not confirmed | Clause 3.6(a) of the terms says the user must not do anything that 'would constitute a breach of an individual's privacy (including uploading private or personal information without an individual's consent) or any other legal rights', and the data section says 'You represent and warrant that you have all rights, licenses, and permissions needed to provide Input to our Services'. Redaction work in litigation, subpoena compliance and freedom-of-information responses routinely involves uploading personal information about people who have not consented, so the clause as drafted sits awkwardly against the product's published purpose. The terms also require each party to comply with the Australian Privacy Principles. | How do you read clause 3.6(a) where a law firm uploads a client file or a brief of evidence containing third parties' personal information without their consent, and will you confirm in writing that such use is permitted? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/) |
| Foundation-model providers | Not confirmed | No model, model family, version or provider is named on the product page, the help page, the terms, the privacy policy or the collection notice. The product page refers to 'artificial intelligence and machine learning' and 'our adaptive models'; the terms refer generically to 'AI/ML/LLM Models' and to a 'Reinforcement Training Policy' that is not published at any URL found. No model documentation, model card or third-party model disclosure was found, and no subprocessor list exists to infer one from. | Name every model used by Redact AI for detection, OCR, audio and video processing, whether any is a third-party or hosted model, the entity that operates it, and the country the inference runs in. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Subprocessors | Not confirmed | No subprocessor list or register exists at any URL found, and no DPA is published. The privacy policy discloses categories rather than named entities: 'employees, contractors and/or related entities', 'IT service providers, data storage, web-hosting and server providers', payment systems operators, marketing providers, professional advisers, insurers and potential business partners, plus named analytics tools (Google Analytics and LinkedIn Insight Tags) and a third-party payment processor, given as Stripe by way of example in the terms. None of those categories is tied to the processing of documents uploaded to Redact AI. | Provide a dated subprocessor register for Redact AI specifically, naming each entity, its country, what it processes, and our notice and objection rights before a new one is added. | [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/) |
| Training on customer content | Not confirmed | The FAQ on the product and help pages answers 'Does Redact AI store or reuse customer data to train AI models?' with 'No. Redact AI does not reuse customer documents to train AI models.' The terms of 6 March 2026 say the opposite in substance: 'Notwithstanding anything in this Terms of Use DoxAI Australia Pty Ltd is authorised to use Data Sets for the purposes of training artificial intelligence, machine learning and large language models (AI/ML/LLM Models) and create new services or products', conditioned on compliance with a Reinforcement Training Policy and on anonymisation and de-identification so 'that the data cannot be used to identify any individual or entity'. Data Sets are defined as the customer's input and the output together; the customer keeps ownership of Original Input and Output but 'You don't own Anonymised Data Sets or any trained AI/ML/LLM Training Outcomes', which are stated to be DoxAI's property. Separately, clause 11.2 grants DoxAI a 'worldwide, irrevocable, perpetual, non-exclusive, transferable, royalty-free licence' over User Content including the right to 'feed machine learning or otherwise contribute to AI engines'. The Reinforcement Training Policy is not published at any URL found. | Which document governs our subscription, and will you contract out of the Data Sets training authorisation and the clause 11.2 machine-learning licence for our matter documents, provide the Reinforcement Training Policy, and state how anonymisation is tested on litigation material? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Feedback, telemetry and improvement | Public claim only | The privacy policy treats 'feedback and survey responses' and 'content you post, send, receive and share through our platform' as Profile Data, and lists a purpose of 'analytics, market research and business development, including to operate and improve our Services'. The terms' User Content clause grants a perpetual, transferable licence that expressly includes feeding machine learning, and the data section authorises use of Data Sets to 'maintain, develop, and improve' DoxAI's services, products and AI/ML/LLM models. No in-product control over feedback or telemetry is described, and no de-identified-analytics opt-out was found. | Can we disable all product-improvement and analytics use of our uploaded content, prompts, outputs and redaction corrections, and is that available as a contractual term rather than a setting? | [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/) |
| Retention of documents, outputs and derived data | Not confirmed | The FAQ states customer data 'remains within controlled environments and is processed only for the intended redaction purpose and automatically redacted with in 24h after redaction'. The word used is 'redacted', not deleted, and the sentence is not defined further anywhere on the pages read. The terms set no retention period for Data Sets, and give DoxAI ownership of Anonymised Data Sets and of training outcomes derived from them, with no time limit. The privacy policy of 19 August 2026 contains no general retention section at all and cross-refers to a heading, 'How long we keep your Identification Information', that does not appear on the page. The two positions cannot be reconciled from what is published. | State the retention period for uploaded source documents, redacted outputs, extracted text, OCR artefacts, audit logs and any embeddings or derived data sets, and confirm what 'automatically redacted with in 24h' means operationally. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Deletion and erasure | Public claim only | Clause 15.4 states that on expiry or termination 'we will remove your access to the Platform and your account will be deleted' and DoxAI will immediately cease providing the services. Nothing is said about deletion of uploaded documents, outputs, or the Anonymised Data Sets the terms treat as DoxAI's property, and no certified-deletion undertaking, deletion window or deletion-on-request mechanism for customer documents appears in the terms. The privacy policy gives individuals access and correction rights and a complaints path to the Office of the Australian Information Commissioner, but no deletion right for uploaded documents. | Will you delete all uploaded documents, outputs and derived data on request and on exit, within a stated period, and certify that deletion in writing including any copies held by hosting or model providers? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/) |
| Vendor personnel access to content | Public claim only | The FAQ states security controls include 'comprehensive audit logs', role-based access management, 'approval based data access', multi-factor authentication across the organisation, IP filtering and 'controlled processing environments'. The privacy policy permits disclosure of personal information to DoxAI's 'employees, contractors and/or related entities' and to IT, data storage, web-hosting and server providers. No published statement limits vendor staff access to uploaded documents to a ticketed, time-boxed basis, and no customer-visible access log is described. | Who at DoxAI or its contractors can open a document we upload, under what approval, from which country, and can we obtain a log of every such access for our tenant? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Access control and account roles | Public claim only | Clause 4.3 of the terms sets three account roles: Owners, who created the account and control all settings including billing and access management; Admins; and Members, whose access is limited as determined by Owners or Admins and who cannot reach billing or access-management settings. Clause 4.7 prohibits sharing usernames and passwords and clause 4.8 makes the account holder liable for all activity on the account. Multi-factor authentication and IP filtering are asserted in the FAQ as organisational controls. No single sign-on, SCIM provisioning or enforced MFA for customer users is described on any page read. | Is SAML or OIDC single sign-on with enforced MFA available for our users, can we scope access per matter or per team, and can we export a user-level activity log? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/) |
| Encryption | Public claim only | The FAQ states security controls include 'encryption at rest and in transit', and the product page repeats encryption for data in transit and at rest in a marketing bullet. No algorithm, TLS version, key management arrangement or customer-managed key option is published anywhere on the pages read. Separately, the product page states every PDF the platform processes is cryptographically signed, which is an integrity control rather than encryption. | State the encryption algorithms and TLS versions used for uploaded documents in transit and at rest, who holds and rotates the keys, whether customer-managed keys are available, and whether audio and video files are encrypted the same way. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Independent assurance | Public claim only | The product page shows a compliance strip of six badge images (GDPR, AICPA SOC, ISO 27001, ISO 42001, PCI DSS, HIPAA) and states in body text that the product is 'GDPR, SOC 2 Type 2, ISO 27001, ISO 42001, PCI DSS, and HIPAA compliant'. The FAQ states DoxAI 'supports compliance with GDPR, PCI DSS, SOC 2 Type 2, HIPAA, and ISO 27001' and that controls are 'supported by annual external audits and regular cybersecurity penetration testing'. The FAQ list omits ISO 42001, which the badge strip includes. No certificate, attestation report, auditor name, certifying body, scope statement, bridge letter or penetration-test summary is published or linked, and no trust centre or security page exists at any URL found in the site map. | Provide the SOC 2 Type 2 report, the ISO 27001 and ISO 42001 certificates with their scope statements and certifying bodies, and the most recent penetration-test summary, and confirm Redact AI processing is inside the audited scope. | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Contract, entity, liability and forum | Public claim only | The only agreement published is a set of marketplace platform terms dated 6 March 2026, entered into between DoxAI Australia Pty Ltd ACN 660 177 837 and the user, drafted around 'Listing Partners' selling 'Digital Products' to 'Purchasers' rather than around a software service DoxAI itself supplies; clause 5.1 states DoxAI 'only make available the DoxAI Services' and is not party to any agreement between a purchaser and a listing partner. Governing law is New South Wales with exclusive jurisdiction there, and disputes go first to a senior-representative meeting then mediation, with the Law Society of New South Wales appointing a mediator if the parties cannot agree. Aggregate liability is capped at fees paid in the preceding 12 months or $1,000 where none were paid, consequential loss is excluded on both sides, and Australian Consumer Law rights are preserved. There is no data processing addendum, no AI schedule, no security schedule and no confidentiality obligation on DoxAI in respect of uploaded documents beyond clause 17.3's mutual non-disclosure of confidential information accessed on the platform. | Which entity contracts with us for Redact AI, DoxAI Australia Pty Ltd or DoxAI Operations Pty Ltd, and will you provide an enterprise agreement with a data processing addendum, a security schedule, a confidentiality undertaking over uploaded documents and a liability cap that is not limited to 12 months of fees? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/) |
| Cross-border transfers and data location | Not confirmed | The Privacy Policy and the Privacy Collection Notice both state 'We may store personal information overseas' and that the third parties to whom personal information is disclosed 'may also store, transfer or access personal information outside of Australia', with the qualification that overseas disclosure will be in accordance with the Australian Privacy Principles. Neither names a country, a provider or a region. The only exception published is identification information for the identity-verification service, which is held 'in the country that issued the identity document you provided'. The product page markets 'Choose your Data Location' and 'Local data sovereignty to meet regulations'. Those statements are not reconcilable without more: one is a binding notice permitting overseas storage of unspecified scope, the other is marketing text with no published mechanism behind it. | For an Australian customer, in which country are uploaded documents stored and processed, is an Australia-only option contractually available including for inference, backups, logs and support access, and which APP 8 mechanism do you rely on for any overseas disclosure? | [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/); [DoxAI Australia Pty Ltd Privacy Collection Notice](https://doxai.co/privacy-collection-notice/); [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/) |
| Incident and breach notification | Not confirmed | Neither the terms nor the privacy policy nor the collection notice contains a data-breach notification clause, a notification period, or any reference to the Notifiable Data Breaches scheme or the eligible-data-breach obligation under the Privacy Act 1988 (Cth). The privacy policy sets out a complaints process and points to the Office of the Australian Information Commissioner, and the terms require the customer to notify DoxAI immediately of any unauthorised use of its account. The FAQ states the product 'supports post incident reviews, audits, and regulatory reporting requirements'. No incident history was published on any page read. | Within how many hours of discovery will you notify us of a security incident affecting our documents, what will the notice contain, how do you support our own notifiable-data-breach assessment, and have you had any reportable incident in the last 24 months? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Change notice | Public claim only | Clause 3.3 allows DoxAI to amend the terms at any time by written notice, with the variation effective 30 days after the notice; a customer whose rights are adversely affected may cancel from the date of the change, and prepaid subscription fees are refunded pro rata in Credits valid for three years. Clauses 8.12 and 8.13 give 30 days' notice of changes to subscription inclusions or fees with a cancellation right. The privacy policy may be varied 'at any time and at our discretion' by publishing the amended version, with no notice period. Nothing published gives notice of, or a right to object to, a change of model, processing location or subprocessor. | Will you give us advance written notice before changing the model, the processing region or any subprocessor used by Redact AI, and a right to object, given the terms only cover changes to the terms and fees? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/) |
| Export and exit | Public claim only | Clause 15.1 allows the customer to terminate at any time using the cancel-account function, effective from the end of the current billing cycle. On termination DoxAI removes access and deletes the account, and where DoxAI terminates for the customer's unremedied default the customer also pays DoxAI's reasonable additional costs. A pro-rata refund of prepaid fees is given only where termination is due to DoxAI's breach. No data export or download mechanism for previously processed documents is described in the terms; the product's own function set includes multi-format export of processed files during use. | What export can we take on exit, for how long after cancellation can we retrieve processed documents and audit logs, and what happens to derived data sets you treat as your property? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/) |
| Third-party APIs and marketplace products | Not confirmed | Clause 3.4 states 'We may use, or Digital Products may contain, third party APIs. Your use of third party APIs will be subject to their terms of use', and that DoxAI's terms prevail over the third-party terms where they are inconsistent. No third-party API used by Redact AI is named. Because the platform is structured as a marketplace, products bought from other 'Listing Partners' are governed by those partners' own terms or, failing that, by Standard Listing Partner Terms of Licence to which DoxAI states it is not a party, and listing partners must hold cyber liability insurance of at least $2,000,000. | Which third-party APIs does Redact AI call, what do they receive, and is DoxAI the supplier of Redact AI itself or a listing partner's product on its own platform? | [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/) |
| Open-web retrieval | Not confirmed | Nothing on the pages read describes open-web search, browsing or external retrieval by Redact AI: the described inputs are files a user uploads, and the FAQ adds knowledge bases and databases as sources it can operate over. There is, however, no published statement that the product performs no external lookup, so the absence of any description is recorded rather than treated as an assurance. | Does Redact AI make any outbound call to an external service or the open web while processing a document, for example for OCR, entity lookup or model inference, and can that be disabled? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| What the product does without a person | Public claim only | The published behaviour is bounded: detect, redact, then present for review and download, with approval-based workflows before export and an audit trail. Percentage redaction is described as restricting the proportion of detected information that is redacted, which is an automated limit a firm would need to set deliberately. The vendor also states data-purge rules operate automatically. 'Agentic AI' is a separate DoxAI category in the navigation with no published product behind it, so no autonomous action is described for Redact AI. | Can Redact AI be configured to export or send redacted documents without a person approving them, and what does percentage redaction do to items it detects but does not redact? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |
| Human review before release | Public claim only | The FAQ states the product supports human-in-the-loop review so users can validate and approve redactions before documents are finalised, and that approval-based workflows allow users to review, adjust and confirm redactions prior to exporting or sharing, which 'ensures organisational control and accountability'. The terms contain no human-oversight clause and no allocation of responsibility for a missed redaction; responsibility for the input sits with the customer under the data section and clause 12.1(c). | Can the approval step be made mandatory and attributed to a named reviewer, is a full audit record of what was detected and not redacted exportable, and who bears responsibility if a redaction is missed? | [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/); [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/); [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) |

## Notes

Four firecrawl operations were spent on this product, the full cap: the terms, the privacy policy, the help-centre page for Redact AI and the privacy collection notice. The product page was already cached from Phase 2 and cost nothing. The Phase 2 requirement to establish the Australian contracting entity from a binding page is met: clause 2.1 of the terms names DoxAI Australia Pty Ltd ACN 660 177 837, which is now recorded as published_terms rather than from a search snippet. The entity-name inconsistency Phase 2 flagged is recorded but not resolved: the privacy policy adds a second entity, DoxAI Operations Pty Ltd ACN 696 297 211, without saying which handles Redact AI content; one clause of the terms reads 'DoxAI Australis Ltd'; and 'DOXAI AUSTRALIA LIMITED' appears in cached search snippets of a New South Wales supplier profile and an electronic-signature disclosure that were not opened. NOT REACHED because it does not exist at any URL found: a data processing addendum, a subprocessor list or register, a security or trust page, an ISO or SOC certificate or report, a penetration-test summary, a pricing page, and the 'Reinforcement Training Policy' that the terms make a condition of AI training. That absence is the finding for subprocessors, incidents and part of assurance. The help-centre page for Redact AI turned out to carry the same FAQ as the product page plus a navigation tree and links to an API reference at api.doxai.co/docs and a support portal, so it added no data-handling detail; the API reference was not opened. Two departures from Phase 2 to note. First, Phase 2 recorded the vendor's FAQ statement that customer documents are not reused to train AI models; the terms read today authorise exactly that on anonymised data sets and make the anonymised sets and the training outcomes DoxAI's property, so facts.trainingOnCustomerContent is recorded as 'yes' and the control is logged as conflicting_evidence with both texts quoted. Second, Phase 2 recorded '99.97% accuracy' from the product page; the FAQ on the same page states 99.78%, so the two figures are recorded as conflicting rather than either being adopted. facts.hostingRegions is 'unknown' and facts.australianRegion is 'unknown' deliberately: the binding notices permit overseas storage without naming a country, and the product page's 'Choose your Data Location' and 'Local data sovereignty' lines are marketing with no published mechanism, so no residency finding can be made. No AI-directing content was found across the five pages read (no llms.txt or /ai-info appeared in the 40-URL site map Phase 2 ran), so nothing is recorded under fieldId 'information'; the check is limited to those pages. Client logos on the product page (Australian banks, a non-bank lender, a trustee company and other financial-services businesses) are logos on a marketing page, not customer references, so facts.australia.customersNamed is left empty. Capability gap carried forward from Phase 2: the controlled CAPABILITY list has no value for redaction, and 'compliance-monitoring' is the closest defensible value even though this product detects and removes rather than monitors. Capability list updated 2026-09-27 when the controlled vocabulary was extended from 19 to 38 values: added redaction. Values already present were kept, because they remain true descriptions of what the product does.

## Sources

- [DoxAI Redact AI product page](https://doxai.co/product/redact-ai/) (checked 2026-09-27)
- [DoxAI Terms and Conditions (last update 6 March 2026)](https://doxai.co/terms-and-condition/) (checked 2026-09-27)
- [DoxAI Privacy Policy (last update 19 August 2026)](https://doxai.co/privacy-policy/) (checked 2026-09-27)
- [DoxAI Australia Pty Ltd Privacy Collection Notice](https://doxai.co/privacy-collection-notice/) (checked 2026-09-27)
- [DoxAI Help Centre — Redact AI](https://doxai.co/help/ai-ml-process-automation/redact-ai/) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.