Legal-specific · eDiscovery and litigation · Medium confidence
Exterro · Exterro eDiscovery/forensics/governance with Assist for Data (in-house agentic AI). Other Exterro AI modules may differ. On-prem, customer VPC, or hybrid.
Data-risk platform with in-house agentic AI that the vendor says never trains on customer data and never sends data to third-party model APIs. ISO 27001 (Jan 2026), SOC 2 Type II, FedRAMP Moderate claimed.
Opens a private software assessment of Exterro Assist for Data for one task, with this profile’s questions to hand.
| Deployment | SaaS, On-premises, Private cloud, Hybrid |
|---|---|
| Hosting regions | Unknown |
| Australian region | Unknown |
| Model providers | Exterro in-house (Assist for Data) |
| Assurance | SOC 2 Type II, ISO 27001, FedRAMP Moderate, HITRUST |
| Training on customer content | No |
| Retention summary | Assist for Data: queries and outputs claimed to remain in the customer perimeter and follow the organisation's retention. SaaS retention periods not stated. |
| Pricing summary | No public list prices. |
| Australian presence | Unknown — On-prem/VPC could be hosted in AU by the customer. No AU SaaS region stated. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Exterro eDiscovery, digital forensics and data governance. Assist for Data is the in-house agentic AI (ARMOUR). Distinct from generic LLM APIs. On-prem, customer VPC, or hybrid.
Ask: Confirm Assist for Data versus other Exterro AI, and deployment model.
Public claim only
On-prem, private cloud (customer VPC), or hybrid. Processing claimed to stay in the customer environment; no data to external model providers.
Ask: Which deployment for our tenant?
Public claim only
eDiscovery through production, FTK forensics, Subpoena Manager, data governance. Assist for Data analyses/summarises in-platform.
Ask: Which modules?
Not confirmed
Portland, Oregon HQ. No AU region described. On-prem would keep data wherever we host.
Ask: AU hosting or on-prem in AU?
Record the practical work needed to introduce and maintain the software.
Not confirmed
No public price.
Ask: Quote?
Public claim only
RBAC including who may use Assist.
Ask: SSO/SCIM?
Not confirmed
Not specified.
Ask: SLA?
Compare complete work at the required quality, including checking and correction.
Public claim only
Model versions pinned; results validated; not a generic LLM. No independent accuracy study.
Ask: Validation metrics on our data types?
Not confirmed
Fit for in-platform eDiscovery/forensics with HITL. Agentic workflows still need lawyer control.
Ask: Which workflows will agents run?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Typically internal legal/compliance.
Ask: External users?
Public claim only
In-house agentic system, not a third-party API (vendor). Other Exterro AI features may differ.
Ask: Does any module still call OpenAI/Anthropic?
Not confirmed
Assist for Data claims zero third-party access. Broader Exterro SaaS subprocessors unknown.
Ask: Subprocessor list for our deployment?
Public claim only
TAS protocol: no training on customer data; no learning loop; no dataset reuse. Marketing article, not a signed DPA extract.
Ask: Put no-training in the contract for all modules.
Not confirmed
Privacy policy: calls may be recorded for training (sales/demo), not necessarily matter data.
Ask: Are product telemetry/feedback used to train Assist?
Public claim only
No storage of queries/outputs outside the customer perimeter; follows organisation retention.
Ask: What does Exterro retain in SaaS versus on-prem?
Not confirmed
Follows customer retention. SaaS deletion SLA unknown.
Ask: Certified deletion?
Public claim only
No access — processing in customer environment (vendor).
Ask: SaaS support access to matters?
Public claim only
RBAC; permission Assist separately.
Ask: SSO-only and Assist disable?
Public claim only
AES-256 and TLS 1.3; customer-managed keys with enterprise KMS.
Ask: Enable CMK?
Public claim only
SOC 2 Type II; ISO 27001 (29 Jan 2026); HITRUST; TISAX; FedRAMP Moderate. Reports not inspected.
Ask: Current SOC 2 and ISO 27001 scoped to Assist for Data.
Not confirmed
MSA not scraped.
Ask: DPA, cap, forum?
Public claim only
On-prem/VPC keeps inference inside the boundary. SaaS region unknown.
Ask: APP 8 for any SaaS path.
Not confirmed
Not specified.
Ask: Notice timeline?
Public claim only
Model versions pinned (vendor).
Ask: Notice before agent behaviour changes?
Not confirmed
Not specified.
Ask: Export/deletion?
Public claim only
Endpoints for FTK/ARMOUR.
Ask: Enabled connectors?
Public claim only
Closed-loop, no external model provider (Assist for Data).
Ask: Can any agent call the open web?
Not confirmed
Agentic AI can coordinate endpoint actions (ARMOUR for FTK). HITL claimed.
Ask: Which agent actions need human confirm before they run on endpoints?
Public claim only
Immutable audit logs of agent and human actions.
Ask: Export logs 12 months?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI ediscovery and litigation tools Australia
