Product and intended use
Define the configuration, people, information and tasks being assessed.
What the platform does
Public claim only
The platform page, checked 2026-09-27, is headed 'Compliance AI, built around your risk tolerance' and states 'Haast ingests the regulations your industry enforces, your internal policies, and the compliance decisions your team has already made - then builds custom agents that reflect how you judge risk.' Two workflows are published: review of regulated content before publication, where 'Marketers get instant compliance feedback right inside the tools they already use'; and continuous monitoring afterwards - 'Monitor all live assets and channels for compliance issues - including partners, influencers, and anyone linked to your brand.' Stated formats: 'PDFs, video, audio, Word docs, images'.
Ask: Which of the published workflows are in the standard subscription, and which require a separate module or professional-services engagement?
Editions, plans and pricing
Not confirmed
No price, plan tier, seat count or unit of charge appears on any page read, and a map of haast.io run on 2026-09-27 returned no pricing page. The site publishes a demo booking form, a contact-sales form, a request-for-proposal form and a return-on-investment calculator instead.
Ask: What are the plan tiers, what is the unit of charge (seat, asset reviewed, agent, channel monitored), and what is the minimum term?
Deployment
Public claim only
The Usage Policy (last updated 27 March 2024) describes 'the Haast Software as a Service platform ("Haast Platform" or "the Services")', so a hosted multi-tenant service is the published model. No on-premises, private-cloud, self-hosted or customer-tenant option appears on any page read, and no cloud provider, region or data centre is named in either published policy.
Ask: Which cloud provider and which regions host the platform, and is a single-tenant or Australian-region deployment available?
How rules are built and tuned
Public claim only
The platform page states rule-building is joint: 'Our legal engineers work alongside your team in the early stages to build the rules, grounded in the regulations your industry enforces, your internal playbooks, and your organization's appetite for risk.' It also publishes a per-task design - 'Every compliance task gets its own dedicated agent, rather than one all-purpose agent stretched across everything' - and per-agent thresholds: 'Set your tolerance agent by agent, not one blanket threshold for everything.' Multi-entity use is stated: 'You can run different rule sets and risk thresholds per product line, region, team, or campaign.'
Ask: Is the legal-engineer rule-building work included in the subscription or charged separately, and who owns the resulting rule set if the subscription ends?
Regulations and jurisdictions covered
Not confirmed
No regulator, rule set, jurisdiction or content-update cycle is named on any page read. The platform page's own answer to the published question 'Which regulations and jurisdictions does Haast cover?' lists customer touchpoints rather than regulations. The vendor publishes industry pages for financial services, retail and FMCG, pharmaceuticals and healthcare, telecommunications, and gambling, gaming and wagering; those pages were not fetched within the operation budget.
Ask: Which Australian regulators and instruments are covered out of the box - for example ASIC RG 234, the AANA codes, the ACL, the Therapeutic Goods Advertising Code, state gambling advertising rules - and how quickly are amendments reflected?
Permitted and prohibited use
Public claim only
The Usage Policy (last updated 27 March 2024) restricts the platform to a customer's own content: 'The Haast platform is intended solely to enable a company to monitor for compliance issues across its own and authorised third parties digital content. Users must not use the Haast platform for the purposes of researching or otherwise monitoring or scanning content of other organisations including competitors.' Breach may result in 'throttling, restrictions or suspension of your access'.
Ask: Does the prohibition on monitoring other organisations' content prevent a law firm from using the platform to review a client's competitor's advertising in a complaint or litigation context?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 and not found. A map of haast.io searched for 'ai llms' among other terms and returned no /llms.txt, /ai-info, /ai or /for-ai URL, and none of the four pages read - platform, Usage Policy, privacy policy and about - carries a block addressed to AI models, assistants, crawlers or LLMs, or any instruction on how to describe the product. Crawler allow and disallow directives were not examined; those are access control, not narrative control.
Ask: Does Haast publish any file or page, such as an llms.txt or an AI-information page, that tells AI systems how to describe the product?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
What may be uploaded, and on whose authority
Public claim only
The privacy policy (last updated 31 March 2026) contemplates data supplied by an employer as well as the individual: 'We may collect and process personal information that you or your employer provide to us.' The Usage Policy limits use to 'its own and authorised third parties digital content' and requires users to 'comply with all applicable laws, regulations, and industry standards relevant to their use of the services, including but not limited to data protection and privacy laws'. Nothing read addresses legal professional privilege, client confidentiality or a law firm acting for a client.
Ask: What authority does the vendor expect before a firm uploads a client's unpublished marketing material or privileged compliance advice, and does any term address privilege?
Model and provider
Not confirmed
Not published. No model, model family, model vendor or version is named on any of the four pages read, including both published policies. The platform page describes the mechanism only as agents and explains hallucination control in configuration terms: 'Because the rules are yours, not the model's ... The AI's job is to check content against those rules and explain its reasoning; the authority for what's right or wrong always comes from your configured standards, not the model's guesswork.' The privacy policy refers to 'infrastructure providers (such as cloud hosting services)' without naming any.
Ask: Which foundation models and providers does the platform call, in which regions do they run inference, and are they named in the agreement so a change requires notice?
Subprocessors
Not confirmed
No subprocessor list is published and no trust centre appears on the site map run 2026-09-27. The privacy policy (last updated 31 March 2026) states only that 'We may share your data with third party vendors, service providers, contractors or agents ... who perform services for us or on our behalf', that Google user data 'is only disclosed to our infrastructure providers (such as cloud hosting services) to the minimum extent necessary', and that 'All third parties who process your data are required to maintain equivalent security standards'. None is named, and no notification process for adding one is published.
Ask: Will the vendor provide a named subprocessor list with processing locations, and commit to advance notice and an objection right when it changes?
Training on customer content
Public claim only
The platform page states, in answer to its own published question 'Is our data secure? Is it used to train AI models?': 'Your content is used only to run your compliance reviews and to improve accuracy on your own account - it is never used to train shared or third-party AI models.' The privacy policy (last updated 31 March 2026) makes a narrower binding statement, limited to Google-sourced data: that data 'is never used to train models or improve our services in ways that extend beyond delivering your requested features'. The two statements differ in scope, and neither describes the mechanism of the per-account improvement, its retention, or how it is separated between tenants.
Ask: In contractual terms, what exactly is done with our content to 'improve accuracy on your own account' - fine-tuning, retrieval, rule updates or reviewer-labelled examples - and can that be switched off?
Reviewer feedback loop
Public claim only
The platform page publishes a learning loop from reviewer decisions: 'when your reviewers give feedback on a decision, the system learns from it - so it gets more accurate on your content the more you use it', and 'every time your lawyers give feedback on the platform, it teaches Haast more about your standards, so our system keeps sharpening over time'. No page read states whether that feedback is confined to the customer's tenant, who reviews it, or how long it is kept. The privacy policy separately states the vendor uses personal information 'to request feedback on our Services' and 'to evaluate and improve our Services, products, and your experience'.
Ask: Is reviewer feedback used only within our own tenant, and will the agreement say so and give us the ability to delete it?
Retention
Public claim only
The privacy policy (last updated 31 March 2026) states 'We will only keep your personal information for as long as necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law', and that where there is no ongoing legitimate business need it will 'either delete or anonymise such information, or where this is not possible (e.g. where it has been stored in backup archives), then we will continue to securely store your personal information'. Google user data is 'retained only as long as necessary to deliver the service'. No period is stated for reviewed content, flags, agent reasoning or audit records.
Ask: What are the retention periods for reviewed assets, flags, agent reasoning and audit logs, and can they be set per customer?
Deletion
Public claim only
The privacy policy (last updated 31 March 2026) states 'Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, and change that information or delete it. To review, update or delete your personal information, or if you have any questions about this privacy policy, please email us at support@haast.io.' Deletion is therefore by email request, qualified by local law. No timeframe, no self-service deletion, no end-of-contract deletion commitment and no backup-purge period is published.
Ask: On termination, within what period is all customer content, derived data and backup copy deleted, and will the vendor certify deletion?
Vendor personnel access
Not confirmed
Not published. Neither policy states whether vendor staff can read customer content, on what basis, with what approval or logging. The privacy policy notes content may be visible to other users of the same customer - 'Such information will typically only be made available to other users within your organisation' - and states 'We require secure authentication, including multi-factor authentication, to access systems containing sensitive data', which addresses authentication rather than who is entitled to look.
Ask: Which vendor roles can access our content, including the legal engineers who build our rules, is that access logged and time-bound, and can it be made approval-gated?
Access control and administration
Not confirmed
The Usage Policy (last updated 27 March 2024) states 'Access to the services is limited to authorised users only. Users are responsible for maintaining the security of their login credentials and must not share their account details with unauthorised individuals.' The privacy policy states multi-factor authentication is required to reach systems holding sensitive data on the vendor's side. Nothing read describes customer-side roles, single sign-on, SCIM provisioning, permission scoping per brand or region, or an administrator audit log, although the platform page states different rule sets and thresholds can run 'per product line, region, team, or campaign'.
Ask: Does the platform support SAML or OIDC single sign-on, SCIM provisioning, role-based permissions per brand or business unit, and an exportable administrator audit log?
Encryption
Public claim only
The privacy policy (last updated 31 March 2026) states 'We encrypt sensitive data both in transit using TLS/SSL protocols and at rest using industry-standard encryption algorithms', and that the vendor maintains 'firewalls and intrusion detection systems' and conducts 'regular security audits and vulnerability assessments'. Google user data that is temporarily stored is 'encrypted at rest and in transit'. No algorithm, key length, key management or customer-managed key option is stated, and the statement is qualified to 'sensitive data' rather than all customer content.
Ask: Which encryption algorithms and key-management arrangements apply to all customer content, not only data classified as sensitive, and are customer-managed keys available?
Independent assurance
Public claim only
Two pages state the same two certifications. The platform page states 'Haast is ISO 27001 certified and SOC 2 compliant', and the privacy policy (last updated 31 March 2026) states 'We also maintain ISO 27001 and SOC2 Type II certifications, which are independently audited to validate our commitment to information security.' No certificate number, certification body, audit period, scope statement, SOC 2 report or trust centre is published, and the site map returned no security page.
Ask: Will the vendor supply the ISO 27001 certificate with its scope statement and the current SOC 2 Type II report under non-disclosure, and does the certified scope cover the production platform that processes our content?
Contract documents and the contracting entity
Public claim only
The only terms published are a Usage Policy at /terms-and-conditions (last updated 27 March 2024), which names the provider as 'Haast Pty Ltd' and covers acceptable use and prohibited activities only. It contains no service levels, no warranties, no liability provisions, no governing law, no term or termination provisions and no data-processing terms. The privacy policy (last updated 31 March 2026) is issued by the same named entity. No master services agreement, order form or data processing agreement is published anywhere on the site, and the site map returned none.
Ask: Which entity contracts with an Australian customer, what is its ACN or ABN, and will the vendor provide the master services agreement and data processing agreement that sit behind the published Usage Policy?
Cross-border processing and hosting location
Not confirmed
No hosting region, data centre location, residency option or cross-border transfer clause appears on any page read. The privacy policy (last updated 31 March 2026) states automatically collected technical information is needed 'to maintain the security and operation of our Services, and for our international analytics and reporting purposes', which indicates processing across more than one country without naming any. No Australian data-residency statement exists on any page read, and no page read says where inference runs.
Ask: In which countries is customer content stored and processed, including by any model provider, and is an Australian-only processing option available and contractually committed?
Incident and breach notification
Public claim only
The privacy policy (last updated 31 March 2026) states 'In the event of a data breach, we maintain an incident response plan and will notify you as required by law.' No notification timeframe, no contact channel for security incidents, no commitment to notify the customer rather than only affected individuals, and no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) appears on any page read.
Ask: Will the agreement commit to notifying us of a security incident affecting our content within a fixed period, regardless of whether the Notifiable Data Breaches threshold is met?
Change notice
Public claim only
The two published documents differ. The Usage Policy (last updated 27 March 2024) states 'Haast reserves the right to modify this Policy at any time without prior notice. Users are responsible for regularly reviewing the Policy to stay informed of any updates or changes.' The privacy policy (last updated 31 March 2026) states 'If we make material changes to this privacy policy, we will notify you by either prominently posting a notice of such changes or sending you a direct notification.' Neither document addresses notice of changes to the product itself, to the models used, or to an agent's behaviour, and no product change or version notice appears on any page read.
Ask: What notice will we receive before a change to the models, agents or thresholds that could alter review outcomes, and is any prior version of an agent retained for audit?
Export and exit
Not confirmed
Nothing read describes exporting the configured rule set, the review history, flags with their reasoning, or the audit trail on exit, and no termination or data-return provision is published. The platform page states reasoning is visible in the product - every flag 'comes with its reasoning: which rule was applied, what triggered it, and why' - without saying whether that record can be extracted.
Ask: On exit, in what format are our rules, review history and flag reasoning returned, and for how long do we retain access to the audit trail?
Connectors and monitored channels
Public claim only
The platform page names review surfaces - 'Word, Figma, Notion, Workfront, or straight from a Chrome extension' - plus a separately announced Google Docs integration, and states the monitoring limb covers 'all live assets and channels ... including partners, influencers, and anyone linked to your brand'. The privacy policy (last updated 31 March 2026) states the Google connection may access 'Google Docs content' under the Google API Services User Data Policy including its Limited Use requirements. No list of monitored channel types, no authentication model per connector and no crawl frequency is published.
Ask: Which channels can be monitored, how is access to each authenticated, and what does the monitoring limb fetch from third-party and influencer channels?
Open-web access
Public claim only
The published monitoring workflow involves fetching live published material: 'Monitor all live assets and channels for compliance issues - including partners, influencers, and anyone linked to your brand' and 'Stay ahead of the regulators'. No page read states whether the review limb also queries the open web or an external search service when assessing a claim, nor whether regulatory source material is retrieved live or from a stored corpus.
Ask: Does the review limb make outbound web requests when assessing content, and can that be disabled for confidential pre-release material?
What the agents can do
Public claim only
The platform page describes agents that flag, explain and suggest, with the disposition left to people: 'Content owners address what's raised and send the asset on; reviewers then approve it, add guidance, or give feedback on Haast's analysis.' It also states 'risks are flagged instantly with suggested fixes' and that for live content 'Haast keeps monitoring your assets and channels after publishing, flagging new risks as they appear.' No page read describes an agent publishing, editing, withdrawing or blocking content itself, and no control over what an agent may do is described.
Ask: Can any agent take an action on our systems - editing, blocking or unpublishing an asset - and what per-agent permission controls exist over that?
Human review before reliance
Public claim only
The platform page places the approval decision with the customer's reviewers and states every flag carries its reasoning: 'which rule was applied, what triggered it, and why', with 'the authority for what's right or wrong always comes from your configured standards, not the model's guesswork'. There is no published disclaimer, no statement that output is not legal advice, and no contractual allocation of responsibility for a missed breach; the Usage Policy is silent on output reliability.
Ask: Does the vendor accept any responsibility for a compliance breach that its agents cleared, and is there a published statement that output is not legal advice?
