Product and intended use
Define the configuration, people, information and tasks being assessed.
Self-serve Free/Pro/Business versus Enterprise
Public claim only
This profile covers GenieAI SaaS under the Product Terms of Use and public DPA: Free (terminable at will, £1,000 liability cap), Pro, Business and custom Enterprise (Order Form). Word add-in, company knowledge/playbooks (Business+) and template library are in scope. Website Terms of Service are separate.
Ask: Confirm our package (Pro versus Business versus Enterprise), whether company knowledge/playbooks are on, and whether a signed Order Form replaces the click-wrap Terms.
AWS UK and EU; no AU region
Public claim only
Security: hosted on Amazon Web Services with data storage in UK and EU data centres. Subprocessor table: AWS UK and EU; MongoDB UK and EU. Google Cloud is listed with 'global data centres'. OpenAI and Anthropic US and EU. No Australian hosting region.
Ask: Which AWS region will hold our workspace, and do OpenAI/Anthropic/Google Cloud process our documents outside the UK/EU?
Draft, review, negotiate, Word, templates
Public claim only
Product: create contracts, review and negotiate, AI contract assistant, ask-your-document, Word add-in, 500+ templates. Business adds company knowledge, playbooks, department spaces and smart forms. Enterprise adds unlimited users/tokens and international coverage. Free plan locks exports until upgrade.
Ask: Which of Word add-in, playbooks, company knowledge and template jurisdictions will be enabled, and which remain Enterprise-only?
English company; AU templates; UK/EU hosting
Public claim only
Genie AI Limited, London. Product Terms: English law and English courts (with a carve-out to sue in the customer's country to protect IP). About page claims 150+ jurisdictions. An Australia marketing/template locale exists. Hosting is UK/EU AWS, not Australia.
Ask: Which Australian law (Commonwealth and state) do templates and review actually cover, and will our files stay in the UK or also go to US OpenAI/Anthropic?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Customer contracts in UK/EU AWS; US LLM path
Not confirmed
Genie processes uploaded contracts as processor (DPA). OpenAI and Anthropic (US and EU) see inputs/outputs under claimed ZDR. Mixpanel/Segment/HubSpot/RB2B/Apollo are marketing/analytics paths for personal data. Privacy-aware sharing is claimed on every plan. No per-client AI exclusion was documented.
Ask: Can we keep documents out of US OpenAI/Anthropic and disable analytics subprocessors, and what description can we give clients?
OpenAI and Anthropic with claimed ZDR
Public claim only
Security: currently OpenAI and Anthropic under Zero Data Retention; inputs and outputs not retained by the provider after processing. Subprocessor table: OpenAI and Anthropic, US and EU data centres. Specific model names were not listed. Customer model choice is not described.
Ask: Which OpenAI and Anthropic models and regions process our workspace, and is ZDR in the signed DPA for both?
Published list including US LLMs and marketing tools
Public claim only
Public table: AWS (UK/EU), Google Cloud (global), Mixpanel, Segment, Mailchimp, MongoDB (UK/EU), CloudAMQP (EU), Hotjar (EU), Stripe (global), Sentry, HubSpot, OpenAI (US/EU), Anthropic (US/EU), RB2B (US; person-level ID US-only), Apollo (US). Changes are posted on the page with no stated objection period. DPA: customer pre-approves published subprocessors.
Ask: Confirm which of these process our workspace content versus website marketing, and what notice we get before a new LLM is added.
Never train on customer content
Public claim only
Security page: customer documents, prompts and confidential data are never used to train shared or internal AI models; third-party providers under ZDR. A model-training policy page is linked. Product Terms assign ownership of Your Data to the customer. These statements are marketing/security pages plus Terms, not a separately numbered DPA training clause in the scrape reviewed.
Ask: Confirm in the DPA that documents, prompts, outputs and logs are not used to train Genie, OpenAI or Anthropic models.
Hotjar, Mixpanel, HubSpot
Public claim only
Hotjar (EU) is listed for user-behaviour analytics and feedback. Mixpanel, Segment and HubSpot process analytics/CRM personal data. In-product thumbs-up/down for drafts was not described. Product Terms grant a perpetual licence to use the customer's name and logo for marketing unless revoked (30 days to stop new materials).
Ask: Can we disable Hotjar/Mixpanel and the logo licence, and is any draft content used as evaluation data?
No public day count for live workspaces
Not confirmed
Workspace Owner can delete a workspace. ZDR applies to LLM providers, not to Genie's own AWS/MongoDB store. Privacy Notice covers personal data, not a numbered contract-file schedule.
Ask: Provide a numbered retention schedule for documents, prompts, outputs, logs and backups while a workspace is live.
Workspace delete; LLM ZDR; no certificate described
Not confirmed
Workspace Owner may delete a workspace. Deleted documents still count toward usage limits. No public post-termination export window or deletion certificate for AWS/MongoDB was found. LLM ZDR is claimed after processing.
Ask: On exit, how long do we have to export, and when are remaining copies deleted from AWS, MongoDB, OpenAI and Anthropic, with what certificate?
Restricted, logged staff access
Public claim only
Security: access to customer data is restricted, logged and reviewed; production access MFA over encrypted connections; quarterly access reviews. Compelled-disclosure notice to the customer is not in the security-page extract reviewed.
Ask: Is support access per-ticket with our approval, logged to us, and will you notify us of legal process seeking our contracts?
Workspace roles; MFA on production, not clearly on customers
Public claim only
Product Terms: Workspace Owner and Administrators manage users and roles. Security: MFA is required for Genie staff production access. Customer-facing SSO/MFA enforcement was not specified.
Ask: Do paid plans support SAML/OIDC SSO-only and MFA enforcement for Authorised Users?
AES-256 at rest; TLS 1.2+
Public claim only
Security page: AES-256 at rest and TLS 1.2 or higher in transit; encryption-key access restricted. These are ISO-register controls, not a downloaded SOC 2.
Ask: Confirm TLS 1.2+ and AES-256 for backups and OpenAI/Anthropic paths, and whether CMK is available on Enterprise.
ISO 27001:2022; SOC 2 not held
Public claim only
ISO/IEC 27001:2022, certificate 310012019, Citation ISO Certification; certificate/SoA on request under NDA. Security page states SOC 2 is not held. DPA: customer may request the latest ISO 27001 audit summary no more than once per 12 months. A third-party comparison page claiming SOC 2 Type 2 is inconsistent with the vendor's security page.
Ask: Provide the current ISO 27001 certificate and SoA covering AWS UK/EU and the OpenAI/Anthropic path.
Product Terms; English law; 12-month fee cap (Free £1,000)
Public claim only
Product Terms + DPA (+ Order Form if custom). English law; English courts. Paid-plan aggregate liability limited to fees paid or payable in the 12 months before the first event; Free Package £1,000. Death/personal injury/fraud cannot be limited. Customer owns Your Data. Perpetual logo licence unless revoked. Genie is not a law firm.
Ask: Will Enterprise raise the cap for confidentiality/data breach, drop the logo licence, and accept NSW or Australian law/forum?
UK/EU AWS; US OpenAI/Anthropic; Google Cloud global
Public claim only
AWS and MongoDB: UK and EU. OpenAI and Anthropic: US and EU (ZDR claimed). Google Cloud: global. Mixpanel, Segment, HubSpot, Sentry: US and EU. RB2B/Apollo: US. DPA includes EU SCCs and UK IDTA where applicable. Security: never had a data breach (vendor statement).
Ask: Name every country of storage and inference for our workspace, including OpenAI/Anthropic US, in writing.
Without undue delay; ICO where required
Public claim only
Security: if a personal data breach occurred, Genie would notify affected customers without undue delay and report to the UK ICO where required. Claims never to have had a data breach. No 72-hour figure is on the security page.
Ask: Within how many hours of discovering a suspected incident affecting our contracts will you notify us, and will you support an NDB assessment?
Subprocessor page updates; 30-day fee-increase notice
Public claim only
Subprocessor list: changes posted on the page; check back regularly; no objection window stated. Fees: 30 days' notice, effective next period, with a right to cancel. Product Terms otherwise apply as updated for new sign-ups after cancellation.
Ask: Will Enterprise require 30-day notice and objection before adding LLM providers or changing AWS region?
Workspace delete; 30-day cancel-before-renewal
Not confirmed
Cancel custom/annual by written notice at least 30 days before period end. Workspace Owner can delete a workspace. No public bulk-export format or certified AWS deletion window was found. Logo licence continues until revoked.
Ask: How do we export drafts, playbooks and audit logs on exit, in what format, and when are remaining copies deleted?
Word add-in; analytics pixels
Not confirmed
Word (and Excel) add-in is a listed feature. Hotjar, Mixpanel, Segment and HubSpot process usage/marketing data. No iManage/NetDocuments connector was found on the pages reviewed.
Ask: What does the Word add-in send to Genie, and how do we disable Hotjar/Mixpanel without a ticket?
Templates and assistant; open web not specified
Not confirmed
Drafting is described against templates, company knowledge and uploaded documents. Open-web search as a Genie feature was not found on the security or product-terms pages reviewed.
Ask: Confirm draft/review/ask-your-document do not call the open web on our contracts.
No public agentic send/sign path
Public claim only
Marketing describes a legal agent that completes work according to rules, including negotiating redlines. Public Terms do not describe autonomous sending or signing. Free/Pro are document-generation tools with export locks on Free.
Ask: Which actions can run without a named approver (export, share, negotiate), and how do we freeze AI generation immediately?
Not a law firm; customer responsible
Public claim only
Product Terms: Genie is not a regulated law firm; no SRA Compensation Fund. Customer owns and is responsible for quality and legality of Your Data. Security: issues that need a human are to be surfaced. No clause requiring a qualified lawyer to approve each export.
Ask: Can we require named sign-off before a draft is exported, with a log of who approved which documents?
