---
title: "Exterro ARMOURop for Exterro FTK (Exterro, Inc.)"
url: "https://ailawframework.com/software/exterro-ftk-armour"
type: "software_profile"
site: "AI Law Framework"
id: "exterro-ftk-armour"
vendor: "Exterro, Inc."
category: "Legal-specific"
segment: "Digital forensics and investigations"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Exterro ARMOURop for Exterro FTK (Exterro, Inc.)

> Digital-forensics software in which the examiner states the investigative objective, AI plans and sequences the forensic steps, Exterro's own code executes them on premises, and the examiner validates the findings.

Canonical page: https://ailawframework.com/software/exterro-ftk-armour  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Exterro ARMOURop, the on-premises agentic AI for Exterro FTK, plus the AI described on the FTK page, as published 2026-09-27. The separate ARMOUR framework page, the FTK licence terms and Exterro's hosted products need separate review.

## Capabilities

- eDiscovery document review
- Agentic workflows
- Document classification
- Transcription
- Data extraction
- Document summarisation
- Knowledge search

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | On-premises |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | ISO 27001:2022, SOC 2 Type II (2025 report, listed behind a request-access gate), FedRAMP Moderate, TISAX, HITRUST e1 (2025 certificate), UK Cyber Essentials 3.2 |
| Training on customer content | Unknown |
| Retention | For ARMOURop, retention is the agency's because the product is on-premises: the vendor states 'ARMOURop operates on-premises inside the examiner's controlled forensic environment. Sensitive evidence is not sent to public cloud services, and evidence, workflows, findings, and validation remain under agency and examiner control.' The trust centre's controls list, read 2026-09-27, shows 'Data retention procedures established' and 'Data classification policy established' under Data and privacy, with no period or scope shown on the overview page. For the hosted Review Services the Master Service Agreement read 2026-09-27 states no retention period at all, states that 'Exterro does not store physical media', and asserts a possessory lien: 'Customer acknowledges and agrees that Exterro has a possessory lien over any Customer Source Material or other data stored on the System', exercisable while an invoice is more than 30 days unpaid. No retention period for ARMOURop prompts, AI plans or generated findings is published. |
| Integrations | Exterro FTK (standalone), Exterro FTK Central, Exterro FTK Imager Pro, Exterro FTK Enterprise (remote endpoint collection), Exterro FTK Connect, Cloud and SaaS connectors, Mobile extractions from Cellebrite UFED and XRY parsed in the same case (per the FTK page) |
| Pricing | No price is published. The ARMOURop page read 2026-09-27 offers an evaluation — 'See what ARMOURop can do in 14 days' — and a demo request, with no list price, no unit of charge and no indication whether ARMOURop is a separate licence or an addition to an FTK licence. The 60-URL site map returned no pricing page. The Exterro Review Services Master Service Agreement read 2026-09-27 puts prices in a statement of work rather than in the agreement: 'Exterro shall invoice Customer, and Customer shall pay Exterro, according to the prices and terms set forth in the SOW', with invoices net 30 days and a 1.5% monthly service charge on late payment. That agreement governs Review Services, not the on-premises software licence. |
| Australian presence | Unknown. No Australian entity, office, reseller or contracting party is named on any page read, and no ACN or ABN was found. The trust centre read 2026-09-27 states 'Exterro is based in Portland, Oregon' and 'Exterro also has a fully owned development site in Coimbatore, India.' The Master Service Agreement is governed by Oregon law with arbitration in Portland: 'This Agreement shall be governed by and construed in all respects in accordance with the laws of the state of Oregon' and disputes 'shall be resolved by arbitration in accordance with the then effective arbitration rules of (and by filing a claim with) Arbitration Service of Portland, Inc.' The published subprocessor list names no Australian region: Amazon Web Services 'US, EU, CA Regions', Google Cloud Platform 'United States, EU', Microsoft Azure 'United States' and Snowflake 'United States'. AUSTRALIAN RESIDENCY FOR THIS PRODUCT turns on the deployment rather than on an Exterro region: ARMOURop is published as on-premises inside the examiner's environment, and FTK Standalone is published as able to run air-gapped — 'a self-contained workstation application explicitly built for offline forensic labs and high-security government networks. It runs entirely within your hardware perimeter with zero external cloud or network dependencies required.' That statement is made about FTK Standalone, not about ARMOURop, and nothing read states where the AI planning step in ARMOURop runs or whether it can run with no external network dependency. Australian residency is therefore recorded as unknown rather than assumed from the on-premises claim. The legal entity is recorded as 'Exterro, Inc.' on the strength of the video credit line published on the ARMOURop page read 2026-09-27, 'Product Overview: Exterro ARMOURop from Exterro, Inc on Vimeo'; every other page read carries only '© 2026 Exterro'. |
| Website | https://www.exterro.com/digital-forensics-software/armourop |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| What ARMOURop is, and how it relates to FTK | Public claim only | The vendor's own page carries the product: 'Exterro ARMOURop is an on-premises, AI-powered solution that coordinates forensic investigations across evidence stored within the examiner's controlled environment. The examiner defines the objective, AI plans the supported workflow, Exterro's proprietary forensic code performs the authorized analysis, and the examiner validates the findings and determines what the evidence supports.' It is presented as a layer over the FTK family rather than a separate platform, with FTK, FTK Imager Pro and FTK Central listed as complementary tools. The site navigation separately lists 'ARMOUR (Autonomous AI Framework)' under the platform menu, at a different URL that was not read, so whether ARMOUR and ARMOURop are the same thing under different names is not established. | Is ARMOURop a separate licence from FTK, and what is the relationship between ARMOURop and the ARMOUR autonomous AI framework listed under your platform menu? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| What the AI does, and which module does it | Public claim only | Two named AI components appear on the two pages read, and they should not be conflated. ARMOURop, from its own page: AI 'interprets the investigative objective and determines which supported forensic steps to run and in what order', then 'Exterro's proprietary code performs the authorized work, including supported media analysis, transcription, known-hash comparison, communications review, artifact analysis, correlation, labeling, bookmarking, and findings organization. The result is executed analysis, not an AI-generated suggestion.' It also 'connects supported findings across media, communications, files, people, locations, devices, and events' and 'prioritizes the files, frames, communications, artifacts, and relationships most likely to advance the investigation'. Exterro Intelligence, from the FTK page, is described as 'The AI engine behind our digital forensic technology' that 'dramatically accelerates complex evidence review by instantly summarizing massive datasets and precisely identifying critical forensic artifacts', and elsewhere as a 'privacy-first AI stack' that automatically conducts 'semantic searches, correlating artifacts, and summarizing long chat threads'. | Which AI functions come with FTK as Exterro Intelligence and which require ARMOURop, and do the two share a model? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| Deployment and where processing happens | Public claim only | ARMOURop is published as on-premises only: 'ARMOURop operates on-premises inside the examiner's controlled forensic environment. Sensitive evidence is not sent to public cloud services, and evidence, workflows, findings, and validation remain under agency and examiner control.' The FTK page states of the base product that 'FTK Standalone is a self-contained workstation application explicitly built for offline forensic labs and high-security government networks. It runs entirely within your hardware perimeter with zero external cloud or network dependencies required.' That air-gapped claim is made about FTK Standalone and is not repeated for ARMOURop. Nothing read states where the AI planning step runs, whether it needs outbound connectivity, or what happens to ARMOURop in an air-gapped laboratory. | Does ARMOURop function with no outbound network connectivity, and if it does not, what does it send out and to which country? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| Release stage | Public claim only | The ARMOURop page read 2026-09-27 carries no beta or preview marker, publishes a product-overview video and law-enforcement product brief, and offers 'See what ARMOURop can do in 14 days', so it reads as available at that date. The FTK page carried it as a promotional overlay rather than as a listed FTK feature. No version number, release date or release notes were found on either page or in the 60-URL site map, and the overlay's wording refers to it as 'Exterro Armour for FTK' while the page itself is titled ARMOURop. | Which ARMOURop release is current, which FTK versions does it require, and where are its release notes published? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit); [Firecrawl site map of www.exterro.com, 60 URLs, searched for ARMOUR, FTK, agentic ai, security, trust, subprocessors and dpa pages](https://www.exterro.com) |
| Integration surface | Public claim only | Integration is within the Exterro forensic family on the pages read: ARMOURop names FTK, FTK Imager Pro and FTK Central as complementary tools, and FTK's own page names FTK Central, FTK Imager, remote endpoint collection through FTK Enterprise, FTK Connect and cloud and SaaS connectors, plus a native mobile tab that 'parses data from Cellebrite (UFED) or XRY right alongside computer images, cloud files, and internet history in one unified interface'. The overlay wording adds that ARMOURop acts 'across live endpoints'. No integration with a practice-management, document-management or eDiscovery review platform is published on the pages read. | Which FTK components must be licensed for ARMOURop to reach live endpoints, and does it act on FTK Central cases as well as standalone ones? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| Support | Not confirmed | Nothing read states support hours, response targets, escalation or regional coverage. The ARMOURop and FTK pages offer a demo and a trial; the trust centre publishes a compliance email address and a security address for reporting 'a security incident or suspected vulnerability'; the Master Service Agreement's only availability commitment is a service credit for hosted System downtime, which does not apply to an on-premises product. No Australian support presence is named anywhere. | What support hours and response targets apply to ARMOURop for an Australian laboratory, and is any support delivered in Australian time zones? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Published performance figures | Public claim only | Figures are published with a hedge and without a method. The ARMOURop page states 'Representative investigation workloads demonstrate how ARMOURop can help examiners begin working sooner' and gives three: '1–5 Minutes — Begin investigating 1 TB of evidence versus 4–6 hours traditionally'; '1–3 Hours — Grade 10,000 images and videos for CSAM versus at least one week'; and 'Approximately 1 Hour — Perform facial detection across 10,000 files versus approximately three days.' The FTK page adds '70% — AI-assisted workflows slash the manual review time of datasets by 70%', '3x — Triple your investigation throughput without adding headcount' and a claim of ingestion throughput 'up to 400x faster than manual workflows'. No corpus, hardware specification, date, accuracy measure or independent verification accompanies any of them, and no accuracy or error rate is published for the CSAM grading or facial detection figures — only speed. The FTK page also uses the wording 'the proven leader in digital forensics', and a resource title on it reads 'the features that make the FTK Suite of digital forensics solutions the industry leader'; both are recorded here as the vendor's own marketing wording and are carried into no field of this profile. | On what hardware, corpus and date were the ARMOURop workload figures measured, and what were the precision and recall for the CSAM grading and facial detection runs? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| Tasks the vendor puts it to | Public claim only | The published framing is criminal and regulatory investigation rather than civil discovery: 'Surface case-relevant evidence earlier so investigators and prosecutors receive defensible direction faster', 'Reduce backlog pressure — Move more evidence through the laboratory with existing staff', and a law-enforcement product brief as the repeated download. FTK's page adds corporate use: 'Deliver verified, defensible findings that support legal, HR, and security outcomes.' The named workloads are media grading including CSAM, facial detection, communications review, artifact analysis and correlation across people, locations, devices and events. | Which of these workloads do Australian corporate and law-firm customers use, as opposed to law-enforcement agencies, and does the licence distinguish them? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| Jurisdiction | Public claim only | Nothing read is Australian. The Master Service Agreement read 2026-09-27 is governed by Oregon law with arbitration through Arbitration Service of Portland, and its data-notice clause is framed by reference to United States and European law: 'To the extent Customer's Source Material contains personal health information as defined in HIPAA, personal data as defined under the GDPR, or any other type of data covered by a government law or regulation, Customer agrees to provide written notice of this issue to Exterro prior to delivery of any such Source Material.' No Australian privacy, evidence or court requirement is referenced on any page read, and no Australian contracting entity is published. | Which entity contracts with an Australian customer, under which law and forum, and will you accept Australian Privacy Principles obligations by contract? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Which agreement covers the software | Not confirmed | The document read does not appear to be the one that would license ARMOURop. The agreement published at the vendor's master-service-agreement URL is headed 'Exterro Review Services Master Service Agreement', revision date 24 November 2021, and is written for a hosted managed-review engagement: it refers throughout to Source Material delivered to Exterro, to Exterro providing access to 'eDiscovery software, computer networks, databases and servers used by Exterro', and to Services under a statement of work. ARMOURop is an on-premises product installed in the customer's own environment. The site map lists separate documents that were not read, including 'legal-terms-and-conditions-eula', 'terms-of-service' and 'website-terms-of-use', one of which is likely to be the software licence. The two positions therefore do not align, and this profile records the Review Services agreement for what it is. | Which document licenses ARMOURop and FTK on premises — the EULA at your legal-terms-and-conditions page — and does it carry different data and AI terms from the Review Services agreement? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement); [Firecrawl site map of www.exterro.com, 60 URLs, searched for ARMOUR, FTK, agentic ai, security, trust, subprocessors and dpa pages](https://www.exterro.com) |
| Check for vendor content directing how AI describes the product | Not confirmed | A deliberate check was made on 2026-09-27 and found nothing, with one limitation worth stating. A 60-URL firecrawl map of www.exterro.com with 'ARMOUR' among the search terms returned no /llms.txt, /ai-info, /ai or /for-ai page and no equivalent. The ARMOURop and FTK pages were searched for an 'Instructions for AI Assistants' style block and for the strings 'for LLMs', 'AI systems' and 'language model'; there was no match. The limitation: that same map did not return the /armour or /armourop pages either, although 'ARMOUR' was in the search terms and both pages exist and were found in the site navigation, so the map is demonstrably not a complete index of the site and the absence of an AI-directing page cannot be treated as conclusive. No URL was guessed. | Do you publish any page, file or embedded block intended to tell AI systems or crawlers how to describe Exterro or ARMOURop? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit); [Firecrawl site map of www.exterro.com, 60 URLs, searched for ARMOUR, FTK, agentic ai, security, trust, subprocessors and dpa pages](https://www.exterro.com) |
| Vendor answering comparative questions about itself in its own question-and-answer content | Public claim only | Recorded as a fact about the vendor's published material, with no comparison carried across. The FTK product page read 2026-09-27 carries a machine-readable question-and-answer block in which the vendor answers questions about its own product by comparison with named and unnamed competitors. Verbatim: 'EnCase and point solutions force you to wait for slow, linear disk scans every single time you run a query. FTK indexes all data upfront during ingestion.' Also: 'Most forensic software wastes your hardware's potential by running on single-threaded limits. FTK is engineered with true multi-core, multi-threaded optimization.' And: 'While flat-file tools force you to restart an ingestion from scratch after a crash, FTK's database architecture saves data state continuously.' This catalogue does not rank products; a vendor comparing itself with a named competitor inside its own question-and-answer content is a fact about the vendor's published material, and none of these comparisons is used anywhere in this profile. | Are the comparative statements in your FTK question-and-answer content based on published testing you can supply, and against which versions of the named products? | [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| Authority, and the contraband reporting clause | Public claim only | Two clauses in the Master Service Agreement read 2026-09-27 matter to a firm. First, the relationship is expressly not a legal one: 'Exterro does not offer, dispense, or agree to provide legal advice of any kind to anyone and Customer and Counsel, if any, acknowledge and agree that Exterro does not and is not authorized to practice law … and there is no attorney-client relationship between Exterro and Counsel or Customer.' Second, and specific to forensic work, a reporting obligation overrides confidentiality: 'If Customer transmits to Exterro contraband (e.g., child pornography) the possession, control, or distribution of which violates any law, Exterro may dispose of such contraband in strict accordance with applicable law, after consultation with Counsel of Customer. Exterro reserves the right to, and shall, with concurrent notification to Customer and/or Counsel, report the existence of, and surrender any such contraband to law enforcement officials.' The customer must also give written notice before delivering HIPAA-regulated, GDPR-regulated or other regulated data. These clauses are in the Review Services agreement; whether equivalents sit in the on-premises licence was not established. | Does the on-premises ARMOURop licence carry an equivalent contraband-reporting clause, and how does that interact with our obligations to our client where material is graded by AI rather than by an examiner? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Which model, and whose | Not confirmed | No model, model family, version or provider is named for ARMOURop. The ARMOURop page read 2026-09-27 contains no reference to a large language model, a model provider or a model name at all; it describes the division of labour as 'AI Plans. Exterro Executes.' without saying what performs the planning. The published subprocessor list on the trust centre does name AI infrastructure, but attributes it to a different module: Amazon Web Services is listed for 'AI processing via AWS Bedrock for Exterro Assist' and Google Cloud Platform for 'Exterro-managed AI infrastructure hosting for Exterro Assist'. Exterro Assist is not ARMOURop, and no subprocessor entry mentions ARMOURop or FTK. For an on-premises product, whether the planning model is bundled locally, called from Exterro's cloud or supplied by the customer is left open. | What model performs the ARMOURop planning step, where does it run for an on-premises installation, and can we supply our own model? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/) |
| Subprocessors | Public claim only | A subprocessor list is published on the trust centre, read 2026-09-27, with four entries and their regions: Amazon Web Services, 'Public Cloud Infrastructure', 'US, EU, CA Regions', for 'Data hosting and storage as selected by customers \| AI processing via AWS Bedrock for Exterro Assist'; Google, 'Google Cloud Platform (GCP)', 'United States, EU', for 'Data hosting and storage as selected by customers \| Exterro-managed AI infrastructure hosting for Exterro Assist'; Microsoft Azure, 'United States', for 'Data hosting and storage as selected by customers'; and Snowflake, 'Data Analytics', 'United States', for 'Analytics and Legal Hold data archival for customers hosted with AWS US'. No Australian region appears in any entry, no entry is attributed to ARMOURop or FTK, and the trust centre publishes no notice obligation before the list changes, although it offers a 'Subscribe to updates' option. | Which of these subprocessors, if any, is involved in an on-premises ARMOURop installation, and will you notify us before adding a subprocessor that touches forensic evidence? | [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/) |
| Training on customer content | Not confirmed | Nothing read states whether evidence, prompts or AI plans are used to train or improve any model. The ARMOURop page's data statement is about location, not about training: 'Sensitive evidence is not sent to public cloud services, and evidence, workflows, findings, and validation remain under agency and examiner control.' That is consistent with no training but does not say so. The Master Service Agreement contains no clause about model training or about the use of customer data to improve the service, and the trust centre overview read 2026-09-27 makes no training statement. The FTK page's description of Exterro Intelligence as a 'privacy-first AI stack' is marketing wording with no definition attached. | Will you commit in the licence that evidence, prompts, AI plans and findings are never used to train, fine-tune or evaluate any model, including by any model provider? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Use of corrections and telemetry | Not confirmed | Nothing read addresses what happens to examiner corrections or to product telemetry. The ARMOURop workflow expressly involves the examiner excluding false leads and refining the inquiry — 'The examiner defines scope, reviews supporting evidence, excludes false leads, refines the inquiry' — but no page states whether those corrections, the prompts, the plans or usage telemetry leave the examiner's environment. The Master Service Agreement has no feedback or usage-data clause. | Does an on-premises ARMOURop installation send any telemetry, prompt text or correction data to Exterro, and can that be disabled? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Retention | Not confirmed | For ARMOURop, retention is the agency's own configuration, because evidence, workflows, findings and validation are stated to remain 'under agency and examiner control' inside the examiner's environment. What is not published is whether ARMOURop creates additional artefacts — plans, prompt history, intermediate AI output — that persist and need their own retention treatment in a laboratory's evidence-handling policy. The trust centre's controls list shows 'Data retention procedures established' with no detail on the overview page, and the controls page itself was not opened. For hosted Review Services the Master Service Agreement sets no retention period and states 'Exterro does not store physical media.' | What artefacts does ARMOURop write to disk beyond FTK's own case data, where do they sit, and how should they be treated in our evidence retention policy? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Deletion | Not confirmed | No deletion right or process is published. The Master Service Agreement read 2026-09-27 contains no deletion, return-or-destroy or certificate-of-destruction clause; its only clause about the custody of customer material runs the other way, asserting a possessory lien over Source Material while an invoice is more than 30 days unpaid. Nothing read describes how to delete ARMOURop's AI plans, prompt history or generated findings independently of deleting the FTK case. | How do we delete ARMOURop's plans, prompts and generated findings for a closed matter, and will you certify destruction for any copy held by Exterro? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Vendor staff access | Public claim only | For an on-premises installation the vendor states that control stays with the agency, and the contractual position on the hosted side is a need-to-know one with a wide list of categories. The Master Service Agreement read 2026-09-27 permits disclosure of Confidential Information — which for the customer expressly includes 'all Source Material, communications between Customer and Counsel in relation to the same, and any privileged communications or information' — to 'employees, independent contractors, subcontractors, attorneys, vendors, and accountants' who 'have a need to know such information for the purposes described in this Agreement'. The trust centre read 2026-09-27 states Exterro 'has a fully owned development site in Coimbatore, India', and its controls list shows 'Production environment access restricted', 'Production database access restricted' and 'Production OS access restricted'. Nothing read states whether Exterro staff can access an on-premises ARMOURop installation for support, or whether such access is logged. | Can Exterro personnel or its India development site access an on-premises ARMOURop installation or its logs for support, and is that access approved and logged in a record we can obtain? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement); [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop) |
| Who can launch an AI workflow | Public claim only | The trust centre's controls list, read 2026-09-27, shows organisational and infrastructure controls including 'Password policy enforced', 'Visitor procedures enforced', 'Production deployment access restricted' and 'Change management procedures enforced', with further controls behind a 'View more' link that was not opened. Those are controls over Exterro's own production environment. On the product itself, the only access statement is that the examiner 'sets scope' and 'defines scope'; nothing read describes roles, permissions, or whether the authority to launch an ARMOURop workflow against live endpoints can be separated from the authority to examine a case already loaded. | Can the right to launch an ARMOURop workflow against live endpoints be restricted to nominated senior examiners, separately from ordinary case access? | [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop) |
| Encryption | Not confirmed | No encryption statement was found on any page read. The ARMOURop and FTK pages make no reference to encryption in transit or at rest; the trust centre overview read 2026-09-27 lists control categories without an encryption control among those displayed, and its controls page was not opened; the Master Service Agreement contains no security schedule and no encryption clause. For a product that reaches live endpoints, the absence of a published statement about the channel to those endpoints is the finding. | What encryption protects the channel between ARMOURop and a live endpoint, and what encrypts the case store and ARMOURop's own artefacts at rest? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Independent assurance | Public claim only | A trust centre publishes the assurance position, read 2026-09-27, with badges for 'ISO 27001:2022', 'SOC 2', 'FedRAMP Moderate', 'TiSAX', 'HITRUST' and 'UK Cyber Essentials 3.2', and a resources list naming an ISMS policy statement, an 'Exterro ISO 27001 Certificate', a '2025 Exterro SOC 2 Type II Report', an 'Exterro SOC2 Bridge Letter', a '2026 Exterro HITRUST e1', a 'CyberEssentials certification for 2026-2027', an 'Exterro SIG Questionnaire' and a legacy '2023 Zapproved SOC 2 Type II Report with HIPAA'. Every document sits behind a 'Request access' gate and none was obtained, so the scope of each report is unknown — in particular whether ARMOURop, FTK or an on-premises deployment falls inside any of them. The trust centre notes that 'Vanta connects to a company's core systems to continuously monitor these controls.' No IRAP assessment is listed. | Does the SOC 2 Type II scope include ARMOURop and the FTK products, and will you provide the report, the bridge letter and the scope statement under NDA? | [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/) |
| Contract terms in the document that is published | Public claim only | The Exterro Review Services Master Service Agreement, revision date 24 November 2021, read 2026-09-27, is accepted by use: 'By using Exterro's software applications, Customer agrees to the terms and conditions set forth below.' Its commercial terms include net 30 invoices with a 1.5% monthly late charge, termination by either party on not less than 30 days' written notice, liability capped at 'THE AMOUNT OF FEES PAID TO EXTERRO DURING THE FOUR MONTH PERIOD PRECEDING THE EVENTS GIVING RISE TO SUCH LIABILITY', mutual indemnities limited to third-party claims caused by negligent or worse conduct, a 12-month mutual non-solicitation, Oregon law and arbitration in Portland. It also reserves a unilateral amendment right: 'Exterro reserves the right to modify this Agreement as it deems necessary.' There is no data-protection schedule, no DPA reference, no security annexe, no breach-notification clause and no AI-specific clause of any kind in it. | Will you negotiate a data-protection and AI schedule, a longer liability cap and removal of the unilateral amendment right for an Australian engagement? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Cross-border transfer | Public claim only | Two published facts and one gap. The published subprocessor list names regions for every hosting subprocessor and none of them is Australian: AWS 'US, EU, CA Regions', Google Cloud 'United States, EU', Azure 'United States', Snowflake 'United States'. The trust centre also names a wholly owned development site in Coimbatore, India. The gap: for ARMOURop specifically the vendor states 'Sensitive evidence is not sent to public cloud services' and that evidence remains under agency control, which points away from any transfer of evidence, but nothing read states whether the AI planning step, telemetry or support diagnostics cross a border. The Master Service Agreement contains no transfer clause and no transfer mechanism. | For an on-premises ARMOURop installation in Australia, does anything at all leave the country — planning calls, telemetry or support diagnostics — and under what mechanism? | [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Incident notification and disclosure practice | Public claim only | Practice is published; obligation is not. The trust centre read 2026-09-27 carries a dated Updates feed with four security communications, including one published 10 March 2026 about an indicator-of-compromise notification received on 8 December 2025 concerning the Gainsight application, in which Exterro states it 'has not seen any indication of compromise or unauthorized access to systems that hold customer data', and earlier notices about Snowflake in June 2024 and two CVE sets. It also publishes a reporting address: 'If you wish to report a security incident or suspected vulnerability, please email security@exterro.com', and a subscription to updates. Against that, the Master Service Agreement read 2026-09-27 contains no breach-notification clause, no timeframe and no obligation to notify a named contact. | What notification timeframe will you commit to contractually for an incident affecting our data, and how would an incident in an on-premises ARMOURop component reach us? | [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Change notice | Public claim only | The Master Service Agreement read 2026-09-27 sets notice periods for the hosted service and then reserves the right to shorten them: 'Exterro shall use reasonable efforts to give Customer thirty (30) days' notice of any Update to the Subscription Services or the Exterro Platform. Exterro shall use reasonable efforts to give Customer ten (10) days' notice of any upgrade to the infrastructure network, hardware or software', with the qualification that 'Exterro may provide Customer with a shorter, or no, notice period of an Update if necessary, in the reasonable judgment of Exterro, to maintain the availability, security or performance of the Subscription Service'. Maintenance is stated as typically Thursday nights 6:00 pm to around 2:00 am Pacific time, which is Australian business hours. The agreement also reserves the right to modify itself 'as it deems necessary'. Nothing read commits to notice before a change to the AI planning behaviour of an on-premises product. | Will you give notice before a change to ARMOURop's AI planning behaviour or its model, and can we pin a version for the life of a matter? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |
| Exit | Public claim only | One point in the customer's favour and one to negotiate. In favour: for an on-premises deployment the evidence, workflows and findings are already in the agency's environment, so there is nothing to retrieve from the vendor. To negotiate: the Master Service Agreement read 2026-09-27 permits termination by either party on not less than 30 days' written notice, and conditions the release of material on payment — 'Exterro will provide Customer a copy of Customer's Source Material or any other data or information in Exterro's possession, so long as Customer's account remains in good standing and all outstanding amounts are paid in full prior to Exterro releasing data to Customer' — backed by a possessory lien and a right to 'retain possession of any Customer Source Material in Exterro's possession or any other data stored on the System, and any images produced or databases created or modified by Exterro' while an invoice is more than 30 days unpaid. For a laboratory holding evidence for a live proceeding that is a material term. | Does the possessory lien apply to anything in an on-premises ARMOURop deployment, and will you carve out evidence needed for a live proceeding from it? | [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement); [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop) |
| Connectors and reach into live systems | Public claim only | The reach is wider than a loaded case file. The FTK page promotional overlay states that ARMOURop 'translates natural language queries into controlled forensic action across live endpoints', and the ARMOURop page describes work 'across media, communications, hashes, artifacts, memory, and other evidence'. FTK's own family includes remote endpoint collection through FTK Enterprise and 'Cloud & SaaS Connectors', and the FTK page states that mobile extractions from Cellebrite UFED or XRY are parsed in the same case. Nothing read states which connectors ARMOURop may drive, or whether its reach can be limited to evidence already collected rather than to live endpoints. | Which connectors and live-endpoint actions can ARMOURop drive, and can it be restricted to evidence already preserved in the case? | [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit); [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop) |
| Web or external retrieval | Not confirmed | Nothing read describes internet or external retrieval by ARMOURop, and the on-premises framing points away from it: 'Sensitive evidence is not sent to public cloud services.' The FTK page states of the base product that FTK Standalone runs 'with zero external cloud or network dependencies required'. Neither page states whether ARMOURop itself performs or can perform any external lookup — for example a hash reputation service or an external intelligence source — or whether such lookups can be disabled. | Does ARMOURop perform any external lookup, such as hash reputation or threat intelligence, and can external lookups be disabled in a laboratory build? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) |
| What the AI decides and executes | Not confirmed | This is the control question for this product, and the vendor states the division of labour plainly: 'AI Plans. Exterro Executes. The Examiner Decides. AI interprets the investigative objective and determines which supported forensic steps to run and in what order. Exterro's proprietary code performs the authorized analysis, while the examiner sets scope, reviews the evidence, validates the findings, and owns every conclusion.' The vendor is explicit that this is execution rather than suggestion: 'ARMOURop does more than summarize evidence or recommend what to do next … The result is executed analysis, not an AI-generated suggestion.' The published counterweight is that the examiner may 'review the planned steps and maintain control of scope'. What is not published is whether that review is a required gate before execution or an option, whether a plan can be edited or partially approved, and what the audit record of each executed step contains. | Is examiner approval of the AI plan a mandatory gate before any step executes, can individual steps be refused, and what does the audit record of each executed step contain? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop) |
| Human review of the findings | Public claim only | The vendor publishes a human-in-the-loop position repeatedly and in express terms. Under the heading 'human in the loop — Keep the examiner in command': 'The examiner defines scope, reviews supporting evidence, excludes false leads, refines the inquiry, and determines what the findings support. ARMOURop performs repetitive investigative work and documents the workflow, but the examiner retains authority over validation, interpretation, reporting, and every case conclusion.' Elsewhere: 'Every surfaced finding remains subject to examiner review and validation', and 'the examiner validates the findings and determines what the evidence supports'. The FTK page makes the same claim for Exterro Intelligence: 'Because this AI is built on transparent, human-guided workflows, every insight you uncover remains fully explainable and strictly defensible in court.' All of this is on product pages; the Master Service Agreement read 2026-09-27 contains no equivalent acknowledgment that outputs require human verification. | Is the human-review position warranted anywhere in the licence, and what documentation does ARMOURop produce to evidence the examiner's validation of each AI-planned step? | [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop); [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit); [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) |

## Notes

Five firecrawl operations, at the cap: a 60-URL site map and the FTK product page in stage one; the ARMOURop product page, the trust centre and the master service agreement in stage two. WHAT IS UNUSUALLY WELL PUBLISHED: a trust centre with a named subprocessor list including each subprocessor's regions, an assurance list with report names, and a dated feed of security communications going back to 2024. WHAT THAT LIST SHOWS FOR AUSTRALIA: no Australian region in any subprocessor entry, and a wholly owned development site in Coimbatore, India. THE SCOPE PROBLEM to be aware of when reading this profile: the only agreement Exterro publishes at its master-service-agreement URL is the Exterro Review Services Master Service Agreement of 24 November 2021, which is written for a hosted managed-review engagement, while ARMOURop is on-premises software. The site map lists a separate EULA and terms of service that were not read and that are likely to be the actual software licence, so the contract, exit, change and confidentiality findings here are recorded from the Review Services agreement and labelled as such. Similarly, the AI infrastructure named in the subprocessor list — AWS Bedrock and Exterro-managed hosting on Google Cloud — is attributed to Exterro Assist, a different module, and is not attributed to ARMOURop; this profile does not carry it across. THE OPEN QUESTION that matters most: nothing read states where ARMOURop's AI planning step runs. FTK Standalone is published as able to run air-gapped with 'zero external cloud or network dependencies required', but that claim is not repeated for ARMOURop, so Australian residency is recorded as unknown rather than inferred from the on-premises architecture. Ownership is left unknown because no page read states it. A separate profile in this catalogue covers Exterro's eDiscovery platform and its Assist for Data module; this entry is confined to the forensics line and its ARMOURop AI, and the two should be read together rather than merged. ALSO RECORDED AS A FACT: the FTK page's question-and-answer block contains the vendor answering questions about its own product by comparison with a named competitor and with unnamed categories of competitor. Three verbatim examples are in the intendedUse consideration. This catalogue never ranks, and none of those comparisons is used anywhere in this profile. Segment re-mapped to digital-forensics-investigations on 2026-09-27 when that value was added to the controlled SEGMENT list (previously ediscovery-litigation, used because no closer value existed).

## Sources

- [Close Cases Faster with Exterro ARMOURop — product page](https://www.exterro.com/digital-forensics-software/armourop) (checked 2026-09-27)
- [Exterro FTK Forensic Toolkit — product page, including its question-and-answer block and the ARMOUR for FTK overlay](https://www.exterro.com/digital-forensics-software/ftk-forensic-toolkit) (checked 2026-09-27)
- [Exterro's Trust Center — compliance badges, controls, subprocessor list and security updates](https://trustcenter.exterro.com/) (checked 2026-09-27)
- [Exterro Review Services Master Service Agreement — revision date 24 November 2021](https://www.exterro.com/exterro-master-service-agreement) (checked 2026-09-27)
- [Firecrawl site map of www.exterro.com, 60 URLs, searched for ARMOUR, FTK, agentic ai, security, trust, subprocessors and dpa pages](https://www.exterro.com) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.