Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan and modules
Public claim only
The homepage describes one platform for firms, mediators, family services and the public, covering intakes, balance sheets, disclosure, parenting arrangements and document generation. No priced tiers were published. The security FAQ says users and matters are unlimited, with a 50 MB limit per file.
Ask: Is there a single subscription, and are public self-service users in the same tenancy as a firm?
Deployment and hosting
Public claim only
The security FAQ says the service and client data are stored on AWS, in the jurisdiction of origin. For Australia that is the Sydney and Melbourne data centres. Data is encrypted at rest and continuously backed up. No on-premises option is described.
Ask: Confirm our matters are stored only in Sydney or Melbourne, including backups and support copies.
Product surfaces
Public claim only
The homepage describes intake questionnaires based on the financial statement, two-way disclosure links, smart forms for court forms and orders, interactive balance sheets with percentage outcomes and two-pool calculations, parenting calendars, and generation of balance sheets, heads of agreement, chronologies, financial statements and indexes in Word and Excel.
Ask: Which court forms are maintained, for which courts, and who updates them when a form changes?
Jurisdiction and legal content
Public claim only
The product is built for Australian family property and parenting matters. Generated documents include court forms and orders. No case-law collection is named.
Ask: Which federal and state family-law forms are in the library, and how current are they?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and client-facing use
Public claim only
The lawyer or mediator who creates the matter is described as owning the information entered. Clients can be sent intake and disclosure links. The public can also start a matter through a questionnaire. Shareable links must be sent only to trusted parties, and that responsibility sits with the user.
Ask: What notice does a client see on an intake or disclosure link, and who is the contracting party for a public user?
Model providers
Not confirmed
The pages read on 2026-10-10 (the FamilyProperty homepage, security FAQ, partners page and 2021 Smokeball post) do not state a position on model providers.
Ask: What is the written position on model providers for the deployment we would buy, and which contract or policy states it?
Subprocessors
Public claim only
AWS is named for hosting and Stripe for card payments. No other subprocessor list was published. The FAQ says data is not shared, sold or exposed, while also naming those providers.
Ask: Provide the full subprocessor list, including AWS regions and Stripe, and any support tools that can see matter data.
Training on customer content
Not confirmed
No model is described. The security FAQ says information is not shared, sold or exposed, which is not a statement about model training.
Ask: Confirm that matter data is not used to train any model, including any future AI feature.
Feedback and secondary use
Not confirmed
The pages read on 2026-10-10 (the FamilyProperty homepage, security FAQ, partners page and 2021 Smokeball post) do not state a position on feedback and secondary use.
Ask: What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it?
Retention
Not confirmed
The security FAQ says the retention policy is at point 9 of the privacy policy. That policy was not read. Customers can update or delete matters and attachments, including archived matters.
Ask: Provide point 9 of the privacy policy and the backup retention period after a matter is deleted.
Deletion and export
Public claim only
Customers can delete matters and attachments. Export is by Word documents, individual files and ZIP packages. The security FAQ does not say when backups of a deleted matter are destroyed.
Ask: After we delete a matter, when is it removed from backups, and what export do we keep?
Human access to customer content
Public claim only
The security FAQ says FamilyProperty may access and view customer data for support, training or other issues, and only where reasonably necessary to address the request.
Ask: Is support access logged and notified, and can we require approval before staff open a matter?
Access control
Public claim only
Two-factor authentication can be enabled by each user, using Google Authenticator, Microsoft Authenticator or a similar app. It is per user, not enforced for the whole firm. Only people given Admin or User access can add or amend a matter. Shareable links, once created, are the user's responsibility.
Ask: Can an administrator require MFA for every user, and can shareable links be expired or restricted?
Encryption
Public claim only
The security FAQ says data, including uploaded files, is encrypted from browser-server transmission, through processing, and when stored, and is encrypted at rest. It does not name TLS or AES versions. Card numbers are not stored; Stripe processes payments.
Ask: Which encryption standards apply in transit and at rest, and where are the keys held?
Assurance and certifications
Not confirmed
The pages read on 2026-10-10 (the FamilyProperty homepage, security FAQ, partners page and 2021 Smokeball post) do not state a position on assurance and certifications.
Ask: What is the written position on assurance and certifications for the deployment we would buy, and which contract or policy states it?
Contract, DPA and liability
Not confirmed
The security FAQ is not a customer agreement. No master terms were read. The 2021 post says existing subscribers would not be impacted by the Smokeball combination.
Ask: Who is the contracting entity today, Smokeball or FamilyProperty, and which terms apply?
Cross-border transfers
Public claim only
Australian data is stored in Sydney and Melbourne. The FAQ says data is stored in the jurisdiction of origin. It does not discuss support access from outside Australia.
Ask: Can support staff outside Australia view a matter, and under what safeguard?
Incidents and breach notice
Public claim only
The security FAQ says FamilyProperty will notify the subscriber without undue delay and in writing on becoming aware of a data breach affecting client data. A specific hour count is not stated. Vulnerabilities can be reported to support@familyproperty.com.au.
Ask: What does 'without undue delay' mean in the agreement, and does it meet the Notifiable Data Breaches scheme timetable?
Changes to terms and models
Public claim only
The security FAQ says it is regularly reviewed and is the primary source of truth for security, and was last updated 29 January 2025. No customer notice period for a change is stated.
Ask: How will we be told if hosting, subprocessors or form logic changes?
Exit, return and deletion
Public claim only
Export is available as Word, individual files and ZIP. Deletion of matters is available to the customer. The agreement's exit clause was not published.
Ask: On termination, how long do we have to export, and when are backups destroyed?
Connectors and external tools
Not confirmed
The pages read on 2026-10-10 (the FamilyProperty homepage, security FAQ, partners page and 2021 Smokeball post) do not state a position on connectors and external tools.
Ask: What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it?
Web search and open-web grounding
Not confirmed
The pages read on 2026-10-10 (the FamilyProperty homepage, security FAQ, partners page and 2021 Smokeball post) do not state a position on web search and open-web grounding.
Ask: What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it?
Actions the system can take
Public claim only
Document generation and calculations run when the user asks. Shareable links, once created, can be forwarded. No unattended filing to a court is described.
Ask: Can a shareable link or a generated form be sent to the other party without a second approval?
Human review of output
Not confirmed
Generation is described as a button-click from the screen into Word, Excel or a court form. No in-product certification step is stated.
Ask: What review is required before a generated court form or consent order is filed or sent?