Legal-specific · Drafting assistants · Medium confidence
HAQQ Inc. · HAQQ Cloud in a chosen region (EU, US or Middle East) versus Private Cloud or On-Premise, as described in the Terms/Privacy/DPA last updated 29 June 2026. Personal versus Business subscriptions differ on controller/processor roles.
Modular legal-technology ecosystem (e-Firm, Legal AI/Justinian agents, e-Client) with published DPA-in-terms and regional hosting options excluding Australia.
Opens a private software assessment of HAQQ (Justinian) for one task, with this profile’s questions to hand.
| Deployment | SaaS, Private cloud, On-premises |
|---|---|
| Hosting regions | European Union / EEA, United States, Another named location |
| Australian region | No |
| Training on customer content | No |
| Retention summary | Customer configures retention; purge produces a verification log. After termination, a 90-day export window then deletion from active systems; backups may persist up to one year unless law requires longer. |
| Pricing summary | Legal AI usage is metered in Credits (Book V). No public price list. Fees sit on the Order Form or Official Proposal. |
| Legal content coverage | Legal AI retrieval/drafting over customer-authorised sources and a Legal Directory. No Australian licensed primary-law corpus is described. |
| Australian presence | No — Available regions stated as European Union, United States and Middle East. Privacy examples include GDPR and several Middle Eastern statutes, not the Australian Privacy Act. |
Define the configuration, people, information and tasks being assessed.
Public claim only
HAQQ Inc. Terms 29 June 2026. Security: HAQQ Cloud in a chosen region; Private Cloud in the customer's cloud tenancy with customer-held keys; On-Premise on customer hardware. Product modules include e-Firm, Legal AI (Justinian), e-Client. Credits meter Legal AI.
Ask: Which hosting model, region and modules are on our Order Form?
Public claim only
Security: available regions are the European Union, the United States and the Middle East. Privacy N: in-region hosting by default where committed in an Order Form or configuration; cross-border transfers may still occur for support, security, billing, subprocessors, redundancy or law.
Ask: Write the region into the Order Form and list any permitted support/subprocessor exceptions.
Public claim only
Terms define Legal AI (retrieval, summarisation, drafting, extraction, workflow assistance, AI Agent, Firm Digital Twin) and e-Firm matter management. Security: seven-layer Justinian architecture with guardrails and configurable human approval for consequential agent actions.
Ask: Which Legal AI features and agent tools are enabled on our tenant?
Not confirmed
Privacy lists GDPR, UK GDPR and several Middle Eastern privacy laws as examples. No licensed Australian case-law or legislation corpus was described on pages reviewed.
Ask: Does Legal AI retrieve Australian primary law, or only customer-uploaded and other named sources?
Record the practical work needed to introduce and maintain the software.
Public claim only
Terms: Delaware law and Delaware courts (unless a signed agreement says otherwise). Credits are a metering unit, not currency. No public price list.
Ask: Confirm fees, credit rates, term and whether we can negotiate Australian law/forum.
Public claim only
Security: SSO, MFA and role-based access across surfaces; data-and-integrations layer. Named DMS/PMS connectors were not listed on the security or privacy pages reviewed.
Ask: Which SSO IdP and DMS connectors are in production for our SKU?
Not confirmed
Terms include Book XI Elite Support; the SLA body was not extracted in this pass. Security FAQ: support access to a specific matter requires explicit customer approval and expires.
Ask: What support tier, hours and security contact apply on our Order Form?
Compare complete work at the required quality, including checking and correction.
Not confirmed
No Vals AI or Stanford RegLab result was found. Quality claims were not independently evidenced in this pass.
Ask: May we trial on our documents with a scored error log?
Public claim only
Terms: an AI Agent acts on the Customer's instruction and does not exercise independent legal judgment. AI Outputs are Customer Data. Fit is drafting/research assistance inside a configured tenant, with human approval for consequential agent steps.
Ask: Which agent tools will we allow, and which remain lawyer-only?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Public claim only
Privacy J: Customer must have notices, consents, professional authorisations and a lawful basis for data it submits, including sensitive matter files. No Australian client-disclosure template was published.
Ask: Provide a client-disclosure for EU/US/ME hosting and Legal AI, which we can adapt for APP 8.
Not confirmed
Security: foundation-model layer with no training and BYOK. Privacy authorises AI infrastructure subprocessors but does not name OpenAI/Anthropic/Google on the pages reviewed. Model mix is therefore unknown.
Ask: Name every model provider, region and whether ZDR applies on our tenant.
Public claim only
Privacy L: customer authorises subprocessors; HAQQ will maintain a list (platform, Trust Center, email, schedule or on request) with function and location where practicable. 30 days' prior written notice of new material subprocessors (shorter for emergencies); 15 days to object, then alternatives or terminate the affected Product.
Ask: Provide the current named list with countries before we upload matter data.
Public claim only
Privacy B and DPA summary: HAQQ's internal product development does not involve training, fine-tuning or improving AI models on Customer Data, Matter Data, prompts, outputs or User content, except where expressly agreed in a separately signed written agreement and permitted by law. Security FAQ: never used to train.
Ask: Confirm the Order Form contains no training carve-out and that subprocessors are on ZDR/no-train terms.
Public claim only
Privacy: Derived Data is anonymised/aggregated telemetry for performance, reliability, capacity, diagnostics and security, and must not identify Customers, Users, Clients or data subjects. It may be retained indefinitely once irreversible.
Ask: Can prompt text appear in telemetry before anonymisation, and can we disable product analytics?
Public claim only
Security FAQ: customer configures retention; purging is automatic and produces a verification log; export anytime. Privacy Q: 90-day post-term export window, then delete from active production within a commercially reasonable period; backups up to one year.
Ask: Set our retention to 30 days or less for prompts and matter files, and confirm backup TTL.
Public claim only
Privacy Q: customer elects return or delete in writing; default is delete if no election. Active-system deletion after the 90-day window; backups then anonymised or deleted when feasible. Written confirmation of deletion may be provided on request, subject to limitations.
Ask: Will you certify deletion of production, backups and subprocessors within a stated number of days?
Public claim only
Security FAQ: nobody at HAQQ can see customer data by default; access is role-based, least-privilege and logged; support access to a specific matter requires explicit approval and expires. Privacy I: authorised persons bound by confidentiality.
Ask: Is support access ticket-scoped in the product, and can we refuse it?
Public claim only
Security: SSO, MFA, role-based access; one tenant per firm; no cross-matter mixing; ethical walls at the governance layer. Privacy: Customer configures permissions and retention.
Ask: Will SSO+MFA be mandatory, and how are ethical walls tested?
Public claim only
Security: encryption in transit including TLS 1.3 where supported; enterprise customers can bring their own key; revoking the key ends HAQQ's ability to read the data. Privacy M lists encryption in transit and at rest and customer-managed keys where available for applicable tiers.
Ask: Is BYOK in our SKU, and what at-rest algorithm is used on HAQQ Cloud?
Not confirmed
Security header lists SOC 2, ISO 27001, ISO 42001 and GDPR. FAQ: 'Compliant. ... We describe that as alignment rather than a completed third-party certification.' Privacy M: framework references are not a representation that every product is in the same certification scope. Treat as uncertified unless a report is produced.
Ask: Produce the current SOC 2 / ISO certificates with dates and scope, or confirm none exist yet.
Public claim only
Book III of the Terms operates as the DPA (privacy notice hosts the full text). Accepting Terms puts it in force; a counter-signed copy is available on request. Delaware law/courts. Audit rights in Privacy O (summaries first; on-site with 30 days' notice, once per 12 months).
Ask: Will you counter-sign Book III plus SCCs and our APP 8 addendum?
Public claim only
Residency where committed. Privacy N: transfers may use adequacy, SCCs, UK addenda, supplementary measures or other lawful mechanisms. Cross-border still possible for support, billing, subprocessors and redundancy. Australia is not a listed region.
Ask: Map every country of storage, inference and support for our Order Form.
Public claim only
Privacy P: notify without undue delay after becoming aware; commercially reasonable efforts as soon as practicable and, where feasible, within 72 hours — described as a contractual outer target, not a licence to delay. Security FAQ also states 72 hours per GDPR. Customer remains responsible for notifying regulators/clients unless HAQQ has a direct duty.
Ask: Name the notification email path and confirm 72 hours applies to our Cloud tenant.
Public claim only
New material subprocessors: 30 days' written notice with function and location; 15 days to object. Terms hierarchy: signed agreement, then Official Proposal/Order Form, then Book III for privacy. Product Books can impose more specific obligations.
Ask: Will material model or region changes also get 30 days' written notice?
Public claim only
Privacy Q: 90-day export window in a structured, commonly used, machine-readable format; then delete (or return if elected). Backups up to one year. Certification on written request. Security FAQ: export anytime while live.
Ask: What export formats are supported, and will backups be in the deletion certificate?
Not confirmed
Architecture includes a data-and-integrations layer. Named third-party connectors were not listed on the security or privacy pages reviewed. AI Agents may invoke permitted tools within tenant permissions.
Ask: List every connector and tool the agent may call on our tenant, and how we disable them.
Not confirmed
Legal AI is described as retrieval over customer-authorised sources. Open-web search was not stated on pages reviewed.
Ask: Can Legal AI browse the open web, and can we disable it?
Public claim only
Security: Justinian agentic harness has guardrails, audit trails and configurable human approval for consequential agent actions. Terms: agents plan and execute steps including retrieving, drafting or invoking permitted tools within customer-configured permissions.
Ask: Which actions are 'consequential' by default, and can we require approval for every external call?
Public claim only
Terms: an AI Agent does not exercise independent legal judgment. Every action is claimed to be logged, attributable and exportable. No in-product mandatory sign-off before a lawyer relies on output was extracted.
Ask: Is there a mandatory human-accept step before exporting a draft or sending e-Client messages?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI drafting assistants tools Australia
