---
title: "Exterro Assist for Data (Exterro)"
url: "https://ailawframework.com/software/exterro"
type: "software_profile"
site: "AI Law Framework"
id: "exterro"
vendor: "Exterro"
category: "Legal-specific"
segment: "eDiscovery and litigation"
confidence: "medium"
last_reviewed: "2026-09-21"
---

# Exterro Assist for Data (Exterro)

> Data-risk platform with in-house agentic AI that the vendor says never trains on customer data and never sends data to third-party model APIs. ISO 27001 (Jan 2026), SOC 2 Type II, FedRAMP Moderate claimed.

Canonical page: https://ailawframework.com/software/exterro  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Exterro eDiscovery/forensics/governance with Assist for Data (in-house agentic AI). Other Exterro AI modules may differ. On-prem, customer VPC, or hybrid.

## Capabilities

- eDiscovery document review
- Knowledge search
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, On-premises, Private cloud, Hybrid |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Model providers | Exterro in-house (Assist for Data) |
| Assurance | SOC 2 Type II, ISO 27001, FedRAMP Moderate, HITRUST |
| Training on customer content | No |
| Retention | Assist for Data: queries and outputs claimed to remain in the customer perimeter and follow the organisation's retention. SaaS retention periods not stated. |
| Pricing | No public list prices. |
| Australian presence | Unknown. On-prem/VPC could be hosted in AU by the customer. No AU SaaS region stated. |
| Website | https://www.exterro.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| productPlan | Public claim only | Exterro eDiscovery, digital forensics and data governance. Assist for Data is the in-house agentic AI (ARMOUR). Distinct from generic LLM APIs. On-prem, customer VPC, or hybrid. | Confirm Assist for Data versus other Exterro AI, and deployment model. | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out); [Exterro home](https://www.exterro.com/) |
| deployment | Public claim only | On-prem, private cloud (customer VPC), or hybrid. Processing claimed to stay in the customer environment; no data to external model providers. | Which deployment for our tenant? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| features | Public claim only | eDiscovery through production, FTK forensics, Subpoena Manager, data governance. Assist for Data analyses/summarises in-platform. | Which modules? | [Exterro home](https://www.exterro.com/); [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| jurisdiction | Not confirmed | Portland, Oregon HQ. No AU region described. On-prem would keep data wherever we host. | AU hosting or on-prem in AU? | [Exterro ISO 27001 certification (29 Jan 2026)](https://www.exterro.com/news-press/exterro-strengthens-customer-data-protections-and-trust-with-achievement-of-iso-27001-certification); [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| licence | Not confirmed | No public price. | Quote? | [Exterro home](https://www.exterro.com/) |
| integration | Public claim only | RBAC including who may use Assist. | SSO/SCIM? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| support | Not confirmed | Not specified. | SLA? | [Exterro home](https://www.exterro.com/) |
| qualityEvidence | Public claim only | Model versions pinned; results validated; not a generic LLM. No independent accuracy study. | Validation metrics on our data types? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| taskFit | Not confirmed | Fit for in-platform eDiscovery/forensics with HITL. Agentic workflows still need lawyer control. | Which workflows will agents run? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out); [Exterro home](https://www.exterro.com/) |
| clientAuthority | Not confirmed | Typically internal legal/compliance. | External users? | [Exterro home](https://www.exterro.com/) |
| modelProvider | Public claim only | In-house agentic system, not a third-party API (vendor). Other Exterro AI features may differ. | Does any module still call OpenAI/Anthropic? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| subprocessors | Not confirmed | Assist for Data claims zero third-party access. Broader Exterro SaaS subprocessors unknown. | Subprocessor list for our deployment? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| trainingUse | Public claim only | TAS protocol: no training on customer data; no learning loop; no dataset reuse. Marketing article, not a signed DPA extract. | Put no-training in the contract for all modules. | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| feedbackUse | Not confirmed | Privacy policy: calls may be recorded for training (sales/demo), not necessarily matter data. | Are product telemetry/feedback used to train Assist? | [Exterro privacy policy](https://www.exterro.com/privacy-policy); [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| retention | Public claim only | No storage of queries/outputs outside the customer perimeter; follows organisation retention. | What does Exterro retain in SaaS versus on-prem? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| deletion | Not confirmed | Follows customer retention. SaaS deletion SLA unknown. | Certified deletion? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| humanAccess | Public claim only | No access — processing in customer environment (vendor). | SaaS support access to matters? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| accessControl | Public claim only | RBAC; permission Assist separately. | SSO-only and Assist disable? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| encryption | Public claim only | AES-256 and TLS 1.3; customer-managed keys with enterprise KMS. | Enable CMK? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| assurance | Public claim only | SOC 2 Type II; ISO 27001 (29 Jan 2026); HITRUST; TISAX; FedRAMP Moderate. Reports not inspected. | Current SOC 2 and ISO 27001 scoped to Assist for Data. | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out); [Exterro ISO 27001 certification (29 Jan 2026)](https://www.exterro.com/news-press/exterro-strengthens-customer-data-protections-and-trust-with-achievement-of-iso-27001-certification) |
| contract | Not confirmed | MSA not scraped. | DPA, cap, forum? | [Exterro privacy policy](https://www.exterro.com/privacy-policy) |
| transfers | Public claim only | On-prem/VPC keeps inference inside the boundary. SaaS region unknown. | APP 8 for any SaaS path. | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| incidents | Not confirmed | Not specified. | Notice timeline? | [Exterro privacy policy](https://www.exterro.com/privacy-policy) |
| changes | Public claim only | Model versions pinned (vendor). | Notice before agent behaviour changes? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| exit | Not confirmed | Not specified. | Export/deletion? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| connectors | Public claim only | Endpoints for FTK/ARMOUR. | Enabled connectors? | [Exterro home](https://www.exterro.com/) |
| webSearch | Public claim only | Closed-loop, no external model provider (Assist for Data). | Can any agent call the open web? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |
| actionControl | Not confirmed | Agentic AI can coordinate endpoint actions (ARMOUR for FTK). HITL claimed. | Which agent actions need human confirm before they run on endpoints? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out); [Exterro home](https://www.exterro.com/) |
| humanReview | Public claim only | Immutable audit logs of agent and human actions. | Export logs 12 months? | [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) |

## Notes

T3. No-training is a blog/architecture claim, not a DPA extract. Other Exterro AI may not share Assist for Data's closed-loop design.

## Sources

- [Agentic AI That Is Secure by Design](https://www.exterro.com/resources/agentic-ai-that-is-secure-by-design-keeping-data-in-risks-out) (checked 2026-09-21)
- [Exterro ISO 27001 certification (29 Jan 2026)](https://www.exterro.com/news-press/exterro-strengthens-customer-data-protections-and-trust-with-achievement-of-iso-27001-certification) (checked 2026-09-21)
- [Exterro privacy policy](https://www.exterro.com/privacy-policy) (checked 2026-09-21)
- [Exterro home](https://www.exterro.com/) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.