---
title: "Haast (Haast Pty Ltd)"
url: "https://ailawframework.com/software/haast"
type: "software_profile"
site: "AI Law Framework"
id: "haast"
vendor: "Haast Pty Ltd"
category: "Legal-specific"
segment: "Compliance and privacy"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Haast (Haast Pty Ltd)

> Platform that reviews regulated marketing and advertising content against rules built from a customer's own regulations, policies and past compliance decisions before publication, and monitors published channels…

Canonical page: https://ailawframework.com/software/haast  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The Haast software-as-a-service platform as published on the vendor's platform page, with the Word, Figma, Notion, Workfront, Chrome and Google Docs surfaces. Plan tiers and any enterprise agreement need separate review.

Platform that reviews regulated marketing and advertising content against rules built from a customer's own regulations, policies and past compliance decisions before publication, and monitors published channels afterwards.

## Capabilities

- Compliance monitoring
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | ISO 27001 (stated in the vendor's platform page and privacy policy; no certificate number, certification body or scope statement published), SOC 2 Type II (stated in the vendor's privacy policy; no report, audit period or auditor published) |
| Training on customer content | Your account only |
| Retention | The privacy policy (last updated 31 March 2026) states personal information is kept 'for as long as necessary for the purposes set out in this privacy notice', and that where there is no ongoing legitimate business need the vendor will 'either delete or anonymise such information, or where this is not possible (e.g. where it has been stored in backup archives), then we will continue to securely store your personal information'. Google user data that is temporarily stored is 'retained only as long as necessary to deliver the service'. No retention period is published for reviewed content, flags, agent reasoning or audit records, and deletion is by email request to support@haast.io. |
| Integrations | Microsoft Word, Figma, Notion, Workfront, Chrome extension, Google Docs (announced separately on the vendor's blog and confirmed in the privacy policy's Google API section) |
| Legal content coverage | The vendor states the platform ingests 'the regulations your industry enforces', the customer's internal policies and the compliance decisions its team has already made, with industry pages published for financial services, retail and FMCG, pharmaceuticals and healthcare, telecommunications, and gambling, gaming and wagering. No regulator, instrument, jurisdiction or content-update cycle is named on any page read; the platform page's own answer to 'Which regulations and jurisdictions does Haast cover?' names none. |
| Pricing | No price, plan tier, seat count or unit of charge appears on any page read, and a map of haast.io run 2026-09-27 returned no pricing page. The site publishes a demo booking form, a contact-sales form, a request-for-proposal form and a return-on-investment calculator instead. |
| Australian presence | Unknown. The provider is named as 'Haast Pty Ltd' in the vendor's own Usage Policy (last updated 27 March 2024) and privacy policy (last updated 31 March 2026), and the site footer carries a 2026 copyright notice in the same name. No ACN or ABN, no registered office, no street address and no country appears on any of the four pages read, and the Australian Business Register and ASIC were not searched - that is outside the scope of this worktree. The vendor's own footer links to a LinkedIn company page with an originalSubdomain=au parameter, which is not a statement of domicile and is not recorded as one. No hosting region, no Australian data-residency statement and no statement about where inference runs appears anywhere read. Four case-study pages exist on the site map at slugs naming four organisations; they were not fetched within the operation budget, so no customer is recorded as verified. |
| Website | https://haast.io/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| What the platform does | Public claim only | The platform page, checked 2026-09-27, is headed 'Compliance AI, built around your risk tolerance' and states 'Haast ingests the regulations your industry enforces, your internal policies, and the compliance decisions your team has already made - then builds custom agents that reflect how you judge risk.' Two workflows are published: review of regulated content before publication, where 'Marketers get instant compliance feedback right inside the tools they already use'; and continuous monitoring afterwards - 'Monitor all live assets and channels for compliance issues - including partners, influencers, and anyone linked to your brand.' Stated formats: 'PDFs, video, audio, Word docs, images'. | Which of the published workflows are in the standard subscription, and which require a separate module or professional-services engagement? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Editions, plans and pricing | Not confirmed | No price, plan tier, seat count or unit of charge appears on any page read, and a map of haast.io run on 2026-09-27 returned no pricing page. The site publishes a demo booking form, a contact-sales form, a request-for-proposal form and a return-on-investment calculator instead. | What are the plan tiers, what is the unit of charge (seat, asset reviewed, agent, channel monitored), and what is the minimum term? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions) |
| Deployment | Public claim only | The Usage Policy (last updated 27 March 2024) describes 'the Haast Software as a Service platform ("Haast Platform" or "the Services")', so a hosted multi-tenant service is the published model. No on-premises, private-cloud, self-hosted or customer-tenant option appears on any page read, and no cloud provider, region or data centre is named in either published policy. | Which cloud provider and which regions host the platform, and is a single-tenant or Australian-region deployment available? | [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| How rules are built and tuned | Public claim only | The platform page states rule-building is joint: 'Our legal engineers work alongside your team in the early stages to build the rules, grounded in the regulations your industry enforces, your internal playbooks, and your organization's appetite for risk.' It also publishes a per-task design - 'Every compliance task gets its own dedicated agent, rather than one all-purpose agent stretched across everything' - and per-agent thresholds: 'Set your tolerance agent by agent, not one blanket threshold for everything.' Multi-entity use is stated: 'You can run different rule sets and risk thresholds per product line, region, team, or campaign.' | Is the legal-engineer rule-building work included in the subscription or charged separately, and who owns the resulting rule set if the subscription ends? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Regulations and jurisdictions covered | Not confirmed | No regulator, rule set, jurisdiction or content-update cycle is named on any page read. The platform page's own answer to the published question 'Which regulations and jurisdictions does Haast cover?' lists customer touchpoints rather than regulations. The vendor publishes industry pages for financial services, retail and FMCG, pharmaceuticals and healthcare, telecommunications, and gambling, gaming and wagering; those pages were not fetched within the operation budget. | Which Australian regulators and instruments are covered out of the box - for example ASIC RG 234, the AANA codes, the ACL, the Therapeutic Goods Advertising Code, state gambling advertising rules - and how quickly are amendments reflected? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Surfaces and integrations | Public claim only | The platform page states review happens 'in the tools your teams already work in - Word, Figma, Notion, Workfront, or straight from a Chrome extension', and separately promotes a Google Docs integration: 'The Haast x Google Docs integration is one part of a broader marketing compliance review platform'. The privacy policy (last updated 31 March 2026) confirms the Google connection in binding terms, stating that 'When you connect your Google account to Haast, we may access certain Google user data (such as Google Docs content) solely to provide the Haast platform features you have requested and authorised.' | Which integrations are generally available today, and what permission scope does each request in Microsoft 365 and Google Workspace? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Permitted and prohibited use | Public claim only | The Usage Policy (last updated 27 March 2024) restricts the platform to a customer's own content: 'The Haast platform is intended solely to enable a company to monitor for compliance issues across its own and authorised third parties digital content. Users must not use the Haast platform for the purposes of researching or otherwise monitoring or scanning content of other organisations including competitors.' Breach may result in 'throttling, restrictions or suspension of your access'. | Does the prohibition on monitoring other organisations' content prevent a law firm from using the platform to review a client's competitor's advertising in a complaint or litigation context? | [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions) |
| Support channels | Public claim only | The Usage Policy directs questions to support@haast.io and the privacy policy uses the same address for access, correction and deletion requests. The site footer publishes hello@haast.io and links a demo booking, a contact-sales form and a request-for-proposal form. No support hours, response target or service level appears on any page read. | What support hours, response targets and escalation path apply, and are they contractual or best endeavours? | [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Published evidence about accuracy | Public claim only | The platform page attributes accuracy to the design rather than to a measurement: 'Each compliance rule is handled by its own dedicated agent rather than one general-purpose agent stretched across everything, which means more consistent results and fewer false positives.' No precision, recall, false-positive rate, benchmark or independent evaluation is published on any page read. The vendor publishes case-study pages for four named organisations; those pages were not fetched within the operation budget, so no customer and no customer-reported result is recorded here. | What false-positive and false-negative rates has the vendor measured on comparable content, and will it run a scored pilot on our own material before contract? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Stated position on replacing reviewers | Public claim only | The platform page states the workflow keeps human reviewers in it: 'Content owners address what's raised and send the asset on; reviewers then approve it, add guidance, or give feedback on Haast's analysis' and 'The whole loop runs inside your existing approval process rather than replacing it.' The page's published answer to 'Does Haast replace our compliance team?' does not address the question it asks; its text is about franchisee and distributor adaptations of marketing material. | Does the vendor represent that any content can be approved without a human reviewer, and does any contractual term address reliance on an agent's clearance? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27 and not found. A map of haast.io searched for 'ai llms' among other terms and returned no /llms.txt, /ai-info, /ai or /for-ai URL, and none of the four pages read - platform, Usage Policy, privacy policy and about - carries a block addressed to AI models, assistants, crawlers or LLMs, or any instruction on how to describe the product. Crawler allow and disallow directives were not examined; those are access control, not narrative control. | Does Haast publish any file or page, such as an llms.txt or an AI-information page, that tells AI systems how to describe the product? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy); [Haast about page](https://haast.io/about) |
| What may be uploaded, and on whose authority | Public claim only | The privacy policy (last updated 31 March 2026) contemplates data supplied by an employer as well as the individual: 'We may collect and process personal information that you or your employer provide to us.' The Usage Policy limits use to 'its own and authorised third parties digital content' and requires users to 'comply with all applicable laws, regulations, and industry standards relevant to their use of the services, including but not limited to data protection and privacy laws'. Nothing read addresses legal professional privilege, client confidentiality or a law firm acting for a client. | What authority does the vendor expect before a firm uploads a client's unpublished marketing material or privileged compliance advice, and does any term address privilege? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy); [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions) |
| Model and provider | Not confirmed | Not published. No model, model family, model vendor or version is named on any of the four pages read, including both published policies. The platform page describes the mechanism only as agents and explains hallucination control in configuration terms: 'Because the rules are yours, not the model's ... The AI's job is to check content against those rules and explain its reasoning; the authority for what's right or wrong always comes from your configured standards, not the model's guesswork.' The privacy policy refers to 'infrastructure providers (such as cloud hosting services)' without naming any. | Which foundation models and providers does the platform call, in which regions do they run inference, and are they named in the agreement so a change requires notice? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Subprocessors | Not confirmed | No subprocessor list is published and no trust centre appears on the site map run 2026-09-27. The privacy policy (last updated 31 March 2026) states only that 'We may share your data with third party vendors, service providers, contractors or agents ... who perform services for us or on our behalf', that Google user data 'is only disclosed to our infrastructure providers (such as cloud hosting services) to the minimum extent necessary', and that 'All third parties who process your data are required to maintain equivalent security standards'. None is named, and no notification process for adding one is published. | Will the vendor provide a named subprocessor list with processing locations, and commit to advance notice and an objection right when it changes? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Training on customer content | Public claim only | The platform page states, in answer to its own published question 'Is our data secure? Is it used to train AI models?': 'Your content is used only to run your compliance reviews and to improve accuracy on your own account - it is never used to train shared or third-party AI models.' The privacy policy (last updated 31 March 2026) makes a narrower binding statement, limited to Google-sourced data: that data 'is never used to train models or improve our services in ways that extend beyond delivering your requested features'. The two statements differ in scope, and neither describes the mechanism of the per-account improvement, its retention, or how it is separated between tenants. | In contractual terms, what exactly is done with our content to 'improve accuracy on your own account' - fine-tuning, retrieval, rule updates or reviewer-labelled examples - and can that be switched off? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Reviewer feedback loop | Public claim only | The platform page publishes a learning loop from reviewer decisions: 'when your reviewers give feedback on a decision, the system learns from it - so it gets more accurate on your content the more you use it', and 'every time your lawyers give feedback on the platform, it teaches Haast more about your standards, so our system keeps sharpening over time'. No page read states whether that feedback is confined to the customer's tenant, who reviews it, or how long it is kept. The privacy policy separately states the vendor uses personal information 'to request feedback on our Services' and 'to evaluate and improve our Services, products, and your experience'. | Is reviewer feedback used only within our own tenant, and will the agreement say so and give us the ability to delete it? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Retention | Public claim only | The privacy policy (last updated 31 March 2026) states 'We will only keep your personal information for as long as necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law', and that where there is no ongoing legitimate business need it will 'either delete or anonymise such information, or where this is not possible (e.g. where it has been stored in backup archives), then we will continue to securely store your personal information'. Google user data is 'retained only as long as necessary to deliver the service'. No period is stated for reviewed content, flags, agent reasoning or audit records. | What are the retention periods for reviewed assets, flags, agent reasoning and audit logs, and can they be set per customer? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Deletion | Public claim only | The privacy policy (last updated 31 March 2026) states 'Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, and change that information or delete it. To review, update or delete your personal information, or if you have any questions about this privacy policy, please email us at support@haast.io.' Deletion is therefore by email request, qualified by local law. No timeframe, no self-service deletion, no end-of-contract deletion commitment and no backup-purge period is published. | On termination, within what period is all customer content, derived data and backup copy deleted, and will the vendor certify deletion? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Vendor personnel access | Not confirmed | Not published. Neither policy states whether vendor staff can read customer content, on what basis, with what approval or logging. The privacy policy notes content may be visible to other users of the same customer - 'Such information will typically only be made available to other users within your organisation' - and states 'We require secure authentication, including multi-factor authentication, to access systems containing sensitive data', which addresses authentication rather than who is entitled to look. | Which vendor roles can access our content, including the legal engineers who build our rules, is that access logged and time-bound, and can it be made approval-gated? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Access control and administration | Not confirmed | The Usage Policy (last updated 27 March 2024) states 'Access to the services is limited to authorised users only. Users are responsible for maintaining the security of their login credentials and must not share their account details with unauthorised individuals.' The privacy policy states multi-factor authentication is required to reach systems holding sensitive data on the vendor's side. Nothing read describes customer-side roles, single sign-on, SCIM provisioning, permission scoping per brand or region, or an administrator audit log, although the platform page states different rule sets and thresholds can run 'per product line, region, team, or campaign'. | Does the platform support SAML or OIDC single sign-on, SCIM provisioning, role-based permissions per brand or business unit, and an exportable administrator audit log? | [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy); [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Encryption | Public claim only | The privacy policy (last updated 31 March 2026) states 'We encrypt sensitive data both in transit using TLS/SSL protocols and at rest using industry-standard encryption algorithms', and that the vendor maintains 'firewalls and intrusion detection systems' and conducts 'regular security audits and vulnerability assessments'. Google user data that is temporarily stored is 'encrypted at rest and in transit'. No algorithm, key length, key management or customer-managed key option is stated, and the statement is qualified to 'sensitive data' rather than all customer content. | Which encryption algorithms and key-management arrangements apply to all customer content, not only data classified as sensitive, and are customer-managed keys available? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Independent assurance | Public claim only | Two pages state the same two certifications. The platform page states 'Haast is ISO 27001 certified and SOC 2 compliant', and the privacy policy (last updated 31 March 2026) states 'We also maintain ISO 27001 and SOC2 Type II certifications, which are independently audited to validate our commitment to information security.' No certificate number, certification body, audit period, scope statement, SOC 2 report or trust centre is published, and the site map returned no security page. | Will the vendor supply the ISO 27001 certificate with its scope statement and the current SOC 2 Type II report under non-disclosure, and does the certified scope cover the production platform that processes our content? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Contract documents and the contracting entity | Public claim only | The only terms published are a Usage Policy at /terms-and-conditions (last updated 27 March 2024), which names the provider as 'Haast Pty Ltd' and covers acceptable use and prohibited activities only. It contains no service levels, no warranties, no liability provisions, no governing law, no term or termination provisions and no data-processing terms. The privacy policy (last updated 31 March 2026) is issued by the same named entity. No master services agreement, order form or data processing agreement is published anywhere on the site, and the site map returned none. | Which entity contracts with an Australian customer, what is its ACN or ABN, and will the vendor provide the master services agreement and data processing agreement that sit behind the published Usage Policy? | [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Cross-border processing and hosting location | Not confirmed | No hosting region, data centre location, residency option or cross-border transfer clause appears on any page read. The privacy policy (last updated 31 March 2026) states automatically collected technical information is needed 'to maintain the security and operation of our Services, and for our international analytics and reporting purposes', which indicates processing across more than one country without naming any. No Australian data-residency statement exists on any page read, and no page read says where inference runs. | In which countries is customer content stored and processed, including by any model provider, and is an Australian-only processing option available and contractually committed? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Incident and breach notification | Public claim only | The privacy policy (last updated 31 March 2026) states 'In the event of a data breach, we maintain an incident response plan and will notify you as required by law.' No notification timeframe, no contact channel for security incidents, no commitment to notify the customer rather than only affected individuals, and no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) appears on any page read. | Will the agreement commit to notifying us of a security incident affecting our content within a fixed period, regardless of whether the Notifiable Data Breaches threshold is met? | [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Change notice | Public claim only | The two published documents differ. The Usage Policy (last updated 27 March 2024) states 'Haast reserves the right to modify this Policy at any time without prior notice. Users are responsible for regularly reviewing the Policy to stay informed of any updates or changes.' The privacy policy (last updated 31 March 2026) states 'If we make material changes to this privacy policy, we will notify you by either prominently posting a notice of such changes or sending you a direct notification.' Neither document addresses notice of changes to the product itself, to the models used, or to an agent's behaviour, and no product change or version notice appears on any page read. | What notice will we receive before a change to the models, agents or thresholds that could alter review outcomes, and is any prior version of an agent retained for audit? | [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Export and exit | Not confirmed | Nothing read describes exporting the configured rule set, the review history, flags with their reasoning, or the audit trail on exit, and no termination or data-return provision is published. The platform page states reasoning is visible in the product - every flag 'comes with its reasoning: which rule was applied, what triggered it, and why' - without saying whether that record can be extracted. | On exit, in what format are our rules, review history and flag reasoning returned, and for how long do we retain access to the audit trail? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions) |
| Connectors and monitored channels | Public claim only | The platform page names review surfaces - 'Word, Figma, Notion, Workfront, or straight from a Chrome extension' - plus a separately announced Google Docs integration, and states the monitoring limb covers 'all live assets and channels ... including partners, influencers, and anyone linked to your brand'. The privacy policy (last updated 31 March 2026) states the Google connection may access 'Google Docs content' under the Google API Services User Data Policy including its Limited Use requirements. No list of monitored channel types, no authentication model per connector and no crawl frequency is published. | Which channels can be monitored, how is access to each authenticated, and what does the monitoring limb fetch from third-party and influencer channels? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) |
| Open-web access | Public claim only | The published monitoring workflow involves fetching live published material: 'Monitor all live assets and channels for compliance issues - including partners, influencers, and anyone linked to your brand' and 'Stay ahead of the regulators'. No page read states whether the review limb also queries the open web or an external search service when assessing a claim, nor whether regulatory source material is retrieved live or from a stored corpus. | Does the review limb make outbound web requests when assessing content, and can that be disabled for confidential pre-release material? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| What the agents can do | Public claim only | The platform page describes agents that flag, explain and suggest, with the disposition left to people: 'Content owners address what's raised and send the asset on; reviewers then approve it, add guidance, or give feedback on Haast's analysis.' It also states 'risks are flagged instantly with suggested fixes' and that for live content 'Haast keeps monitoring your assets and channels after publishing, flagging new risks as they appear.' No page read describes an agent publishing, editing, withdrawing or blocking content itself, and no control over what an agent may do is described. | Can any agent take an action on our systems - editing, blocking or unpublishing an asset - and what per-agent permission controls exist over that? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) |
| Human review before reliance | Public claim only | The platform page places the approval decision with the customer's reviewers and states every flag carries its reasoning: 'which rule was applied, what triggered it, and why', with 'the authority for what's right or wrong always comes from your configured standards, not the model's guesswork'. There is no published disclaimer, no statement that output is not legal advice, and no contractual allocation of responsibility for a missed breach; the Usage Policy is silent on output reliability. | Does the vendor accept any responsibility for a compliance breach that its agents cleared, and is there a published statement that output is not legal advice? | [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform); [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions) |

## Notes

Four vendor pages were read: the platform page, the Usage Policy published at /terms-and-conditions (27 March 2024), the privacy policy (31 March 2026) and the about page. The two policies are the only documents approaching binding force on the site; there is no master services agreement, no data processing agreement, no subprocessor list, no security page and no trust centre anywhere on the site map run 2026-09-27. Unpublished on the pages read: hosting provider and region, whether Australian data residency is available, where inference runs, which models or model providers are called, the identity of any subprocessor, pricing and unit of charge, the ACN or ABN and registered address of Haast Pty Ltd, customer-side access-control features, export and exit arrangements, and any accuracy measurement. facts.trainingOnCustomerContent is recorded as 'unknown' rather than 'no' or 'yes' because the vendor's published position does not fit the controlled vocabulary: the platform page states customer content 'is used only to run your compliance reviews and to improve accuracy on your own account - it is never used to train shared or third-party AI models', and the TRAINING list has no value for adaptation confined to the customer's own tenant. 'no' would misstate the page and 'yes' would overstate it. The vocabulary gap is reported to the Maestro rather than resolved here. The capability values compliance-monitoring and agentic-workflows are the closest defensible existing values: CAPABILITY has no value for pre-publication review of marketing and advertising content against regulator-sourced rules, which is the platform's first published workflow, and that gap is also reported. facts.ownership is recorded as 'private' because the vendor's own documents name a proprietary limited company and nothing read names a parent or a listing; no ownership statement was found. The four case-study pages and the five industry pages on the site map were not fetched within the five-operation budget, so no customer, no named regulator and no industry-specific rule set is recorded as verified. Recorded as tenant_only on 2026-09-27 when that value was added to the controlled TRAINING list. Previously 'unknown', because the enum had no value for adaptation confined to the customer's own account and 'no' would have misstated the vendor's page while 'yes' would have overstated it. The vendor's wording remains a vendor_claim on a product page, and the binding privacy policy makes only the narrower Google-sourced-data statement.

## Sources

- [Haast platform page - 'Compliance AI, built around your risk tolerance'](https://haast.io/platform) (checked 2026-09-27)
- [Haast terms and conditions - Usage Policy (last updated 27 March 2024)](https://haast.io/terms-and-conditions) (checked 2026-09-27)
- [Haast privacy policy (last updated 31 March 2026)](https://haast.io/privacy-policy) (checked 2026-09-27)
- [Haast about page](https://haast.io/about) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.