Product and intended use
Define the configuration, people, information and tasks being assessed.
EveOS Enterprise versus evaluation/beta
Public claim only
This profile covers Eve Enterprise SaaS under the public Terms of Service / MSA (Butler Labs, Inc. d/b/a Eve Legal), DPA and SLA. Evaluation, pilot, beta and preview features are AS IS, without warranty, indemnity, SLA or support, and data may be deleted at any time. HIPAA-covered PHI requires a separate BAA; medical records held as counsel (not as a HIPAA covered entity) are permitted Customer Data.
Ask: Confirm the Order SKUs (EveOS, Agents, voice/outbound, Research), that we are not on Evaluation Use, and whether a BAA is in or out.
AWS US regions only
Public claim only
DPA Annex: all Customer data stored in AWS US regions as of the last updated date; no European international transfers currently. Homepage FAQ: 100% of data storage and processing inside US AWS regions with no cross-border replication. Azure is listed as a US OCR subprocessor, not the primary store.
Ask: Confirm the AWS US region(s) for our tenancy, backups and LLM inference, and that no AU or EU region is available.
Intake through trial; agentic and voice
Public claim only
EveOS surfaces include Analyst, Atlas, Agents, Auditor and Research. Use cases: intake and 24/7 voice agent, medical overviews, drafting, demand letters, communications agent, propounding and responding to discovery, trial. Agentic Features that file, serve or contact courts/clients require prior attorney review under the Terms.
Ask: Which of voice intake, outbound communications, discovery agents and Atlas/Analyst will be enabled, and which remain Evaluation Use?
US plaintiff product; California law; US-only hosting
Public claim only
Aimed at US plaintiff practices (PI, employment, workers' compensation, SSDI, medical malpractice). Terms: California law; exclusive Santa Clara County courts; one-year claim limit except non-payment and customer indemnity. Data stays in AWS US. No Australian region or Australian primary-law collection was found.
Ask: What APP 8 wording do you provide for an Australian firm sending medical and matter files to AWS US, and is any Australian law coverage in Eve Research?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Matter and medical data in US AWS; voice/outbound
Not confirmed
Eve holds case files and medical records. Voice intake and outbound communications agents contact prospective and current clients. Terms require attorney approval before agentic filing/service and restrict solicitation. Data is US-only. Isolation is claimed at organisation, user and workflow levels.
Ask: Can we disable voice/outbound agents and Eve Research per matter, and what US-region description can we give clients?
AWS, OpenAI, Anthropic, GCP; ZDR required
Public claim only
Subprocessor list: AWS (US, production infrastructure and LLM), Azure (US, OCR), GCP (US, LLM), OpenAI (US), Anthropic (US). Terms: Eve will submit Input through ZDR-enabled third-party models except as instructed by Customer, and will not allow those providers to train public models on Input/Output. DPA Annex III repeats ZDR and no public-model training.
Ask: Which of OpenAI, Anthropic, GCP and AWS Bedrock process our tenancy, and is ZDR on for every path including Evaluation Use?
Published US list including eval and analytics
Public claim only
Public list: AWS, Azure, GCP, OpenAI, Anthropic, Turbopuffer (search), Braintrust (evaluation), Grafana, Sentry, Segment, Amplitude, Snowflake (list continues). All named locations are United States. DPA: customer authorises subprocessors; list may be updated. Notice/objection period is in the DPA/Agreement rather than on the list page itself.
Ask: Confirm the processors in scope for our Order, 30-day notice/objection, and whether Braintrust/Segment/Amplitude receive Customer Data or only telemetry.
No training of public models; ZDR
Public claim only
Terms s.6.3 / DPA 3.4: third-party model providers must not retain Customer Personal Data other than transiently or via ZDR, must not train public LLMs on it, and human review is only as needed under confidentiality. Homepage: never used to train shared models. Customer is forbidden from using the Service or Output to train or distill their own or third-party models.
Ask: Confirm ZDR and no-training cover OpenAI, Anthropic, GCP and AWS, including Braintrust evaluations, unless we opt in in writing.
Usage Data and Braintrust
Not confirmed
Terms: Eve may collect Usage Data (excluding Customer Data) to improve and develop the Service and other offerings, and may disclose it aggregated/de-identified. Braintrust is listed as an evaluation platform. In-product feedback buttons were not described beyond that.
Ask: Does Braintrust receive prompts or documents, and can we disable evaluation/feedback use of our Content?
ZDR at the model; Service retains Customer Data
Public claim only
ZDR refers to the model endpoint, not Eve's own retention of Input. Customer Data remains in the Service during the Term. Backups/archives follow Eve's retention schedule after deletion. No numbered live-matter day count for prompts stored in Eve itself.
Ask: Provide a numbered retention schedule for files, prompts, Output, voice recordings, logs and backups while a Matter is live.
30-day retrieval then delete; confirmation on request
Public claim only
Terms 10.2: 30 days after termination to retrieve Customer Data; then the instance including Customer Data is deleted, subject to archives/backups on Eve's schedule and legal holds (at customer expense). DPA s.6: written confirmation of deletion on request within 30 days after deletion. Evaluation Use data may be deleted at any time.
Ask: On exit, what is deleted from AWS, OpenAI/Anthropic/GCP, Braintrust and backups, within how many days, with what certificate?
Background screening; compelled disclosure with notice
Public claim only
DPA Annex II: personnel background screening where permitted, confidentiality obligations, annual security/privacy training. Terms: Confidential Information may be disclosed to legal process with prompt notice if not prohibited, limited to the portion required. LLM human review only as necessary under confidentiality.
Ask: Is support access per-ticket with our approval, logged to us, and will you notify us of legal process seeking matter content?
SSO and MFA claimed; isolation by org/user/workflow
Public claim only
Homepage FAQ: authentication and authorisation controls, SSO and MFA; isolation at organisation, user and workflow levels. Customer is responsible for Credentials. SCIM was not specified in the Terms excerpt reviewed.
Ask: Do you support SAML/OIDC SSO-only, MFA enforcement, SCIM and matter-level ethical walls that Agents cannot cross?
AES-256 at rest; TLS 1.2+ in transit
Public claim only
Homepage FAQ and DPA Annex II: encrypted at rest with AES-256 and in transit with TLS 1.2+. DPA requires industry-accepted strong encryption. CMK was not mentioned.
Ask: Confirm TLS 1.2+ and AES-256 for backups and all LLM/OCR paths, and whether CMK is available.
SOC 2 Type II; ISO 27001 or equivalent in DPA
Public claim only
Homepage: SOC II Type 2 and HIPAA compliant. DPA: Eve will maintain SOC-2, ISO-27001, NIST 800-53 or a substantially equivalent standard, and will provide the then-current SOC 2 Type II (or equivalent) on written request no more than once per 12 months, including via a self-service security resource. Reports were not downloaded.
Ask: Provide the current SOC 2 Type II and ISO 27001 (if held) covering US AWS and LLM features, including period and entities in scope, plus a BAA if we will upload HIPAA PHI.
Public MSA; California law; 12-month fee cap
Public claim only
Public Enterprise Terms (Butler Labs, Inc.). California law; Santa Clara County courts; claims within one year except non-payment and customer indemnity. Aggregate liability capped at fees paid or payable for the Service in the 12 months before the first incident; consequential damages and data loss excluded. DPA liability is subject to that cap. Customer owns Customer Data (including Input and Output) and licenses Eve to process it. Customer indemnifies Eve for Customer Data, Output, Agentic Features and outbound communications (including TCPA/CAN-SPAM).
Ask: Will Enterprise raise the cap for confidentiality/data breach, add APP flow-down, and accept Australian or NSW law/forum?
US-only; no current EU transfers
Public claim only
DPA: all Customer data in AWS US regions; Annex I states Eve currently conducts no International Data Transfers under European Data Protection Law, and will update before commencing any. SCCs/UK Addendum are incorporated if/when transfers occur. Subprocessors named are all United States. An Australian firm would be sending data to the US.
Ask: Confirm in writing that there is no processing outside the US (including support and LLM inference) for our tenancy.
72 hours after confirmed Security Incident
Public claim only
DPA 2.2: notify Customer without undue delay and in any event within 72 hours after Eve confirms a Security Incident (confirmed breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access). Unsuccessful attacks are excluded. Eve does not notify data subjects or regulators on the customer's behalf unless required by law. Customer bears notification costs.
Ask: Will you treat a suspected (not yet confirmed) incident affecting our matter data as notifying us inside 72 hours, and support an NDB assessment?
Subprocessor and model-provider changes
Public claim only
DPA authorises Eve to engage subprocessors and update the public list. Terms: Eve will inform Customer without undue delay of planned third-party discontinuation affecting Customer. Model list (OpenAI, Anthropic, GCP, AWS) can change. Evaluation features may be modified or withdrawn at any time.
Ask: Will our Order require 30-day notice and objection before adding LLM providers or changing AWS region?
30-day retrieval then deletion
Public claim only
Thirty days' limited access after termination to retrieve Customer Data if requested in writing and the customer remains in compliance; then deletion. Archive/backup copies deleted in the ordinary course. Written deletion confirmation on request within 30 days after deletion. Customer must destroy nonpublic Documentation and certify.
Ask: How do we export natives, Output, voice recordings, discovery drafts and audit logs in those 30 days, in what format?
Voice, outbound comms, Google, CMS unspecified
Not confirmed
Voice agent and communications agent place outbound calls; Terms impose TCPA/CAN-SPAM and professional-conduct limits and attorney approval for court/government contacts. Google Workspace access is described in privacy. Customer must not let an Agentic Feature authenticate to a third-party system without rights.
Ask: What phone/email/Google/CMS scopes are requested, what is sent outbound, and how do we disable voice and communications agents without a ticket?
Eve Research; open web not specified
Not confirmed
Eve Research is a product surface. Whether it queries licensed databases or the open web was not stated on the homepage, Terms or DPA. Isolation is claimed to the firm's workspace.
Ask: Confirm Eve Research and Agents do not call the open web on our matters unless we enable it, and which authorities they query.
Agentic filing and outbound restricted by contract
Public claim only
Terms 3.1: Customer will not enable an Agentic Feature to take any action having legal effect in a Matter (filing, serving, executing, submitting or transmitting to a court, tribunal, arbitrator, government, opposing party or client) without prior review and approval by a licensed attorney in the relevant jurisdiction. Outbound communications have additional advertising and no-contact rules. Kill-switch mechanics were not described beyond disabling features in the Order.
Ask: How do we freeze all Agentic Features and voice/outbound immediately, and which actions can still run without a named approver?
Contractual attorney oversight of Output
Public claim only
Terms: Customer will use the Service and Output only with oversight of licensed professionals, will review all Output for accuracy and completeness, and remains solely responsible for legal advice, strategy and filings. Agentic court/client actions need prior attorney approval. Evaluation Use has no warranty.
Ask: Can we require named sign-off in-product before a demand, discovery response or outbound message is sent, with an export of who approved which items?
