---
title: "HAQQ (Justinian) (HAQQ Inc.)"
url: "https://ailawframework.com/software/haqq"
type: "software_profile"
site: "AI Law Framework"
id: "haqq"
vendor: "HAQQ Inc."
category: "Legal-specific"
segment: "Drafting assistants"
confidence: "medium"
last_reviewed: "2026-09-21"
---

# HAQQ (Justinian) (HAQQ Inc.)

> Modular legal-technology ecosystem (e-Firm, Legal AI/Justinian agents, e-Client) with published DPA-in-terms and regional hosting options excluding Australia.

Canonical page: https://ailawframework.com/software/haqq  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: HAQQ Cloud in a chosen region (EU, US or Middle East) versus Private Cloud or On-Premise, as described in the Terms/Privacy/DPA last updated 29 June 2026. Personal versus Business subscriptions differ on controller/processor roles.

## Capabilities

- Legal research
- Contract drafting
- Document summarisation
- Knowledge search
- Matter management
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, Private cloud, On-premises |
| Hosting regions | European Union / EEA, United States, Another named location |
| Australian region | No |
| Training on customer content | No |
| Retention | Customer configures retention; purge produces a verification log. After termination, a 90-day export window then deletion from active systems; backups may persist up to one year unless law requires longer. |
| Legal content coverage | Legal AI retrieval/drafting over customer-authorised sources and a Legal Directory. No Australian licensed primary-law corpus is described. |
| Pricing | Legal AI usage is metered in Credits (Book V). No public price list. Fees sit on the Order Form or Official Proposal. |
| Australian presence | No. Available regions stated as European Union, United States and Middle East. Privacy examples include GDPR and several Middle Eastern statutes, not the Australian Privacy Act. |
| Website | https://www.haqq.ai |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Cloud, private cloud, on-prem | Public claim only | HAQQ Inc. Terms 29 June 2026. Security: HAQQ Cloud in a chosen region; Private Cloud in the customer's cloud tenancy with customer-held keys; On-Premise on customer hardware. Product modules include e-Firm, Legal AI (Justinian), e-Client. Credits meter Legal AI. | Which hosting model, region and modules are on our Order Form? | [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions); [HAQQ — Security](https://www.haqq.ai/security) |
| EU, US or Middle East | Public claim only | Security: available regions are the European Union, the United States and the Middle East. Privacy N: in-region hosting by default where committed in an Order Form or configuration; cross-border transfers may still occur for support, security, billing, subprocessors, redundancy or law. | Write the region into the Order Form and list any permitted support/subprocessor exceptions. | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| Legal AI agents and e-Firm | Public claim only | Terms define Legal AI (retrieval, summarisation, drafting, extraction, workflow assistance, AI Agent, Firm Digital Twin) and e-Firm matter management. Security: seven-layer Justinian architecture with guardrails and configurable human approval for consequential agent actions. | Which Legal AI features and agent tools are enabled on our tenant? | [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions); [HAQQ — Security](https://www.haqq.ai/security) |
| No Australian corpus described | Not confirmed | Privacy lists GDPR, UK GDPR and several Middle Eastern privacy laws as examples. No licensed Australian case-law or legislation corpus was described on pages reviewed. | Does Legal AI retrieve Australian primary law, or only customer-uploaded and other named sources? | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Security](https://www.haqq.ai/security) |
| Order Form; Delaware law | Public claim only | Terms: Delaware law and Delaware courts (unless a signed agreement says otherwise). Credits are a metering unit, not currency. No public price list. | Confirm fees, credit rates, term and whether we can negotiate Australian law/forum. | [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) |
| SSO/MFA claimed | Public claim only | Security: SSO, MFA and role-based access across surfaces; data-and-integrations layer. Named DMS/PMS connectors were not listed on the security or privacy pages reviewed. | Which SSO IdP and DMS connectors are in production for our SKU? | [HAQQ — Security](https://www.haqq.ai/security) |
| Elite Support is a separate book | Not confirmed | Terms include Book XI Elite Support; the SLA body was not extracted in this pass. Security FAQ: support access to a specific matter requires explicit customer approval and expires. | What support tier, hours and security contact apply on our Order Form? | [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions); [HAQQ — Security](https://www.haqq.ai/security) |
| No independent benchmark found | Not confirmed | No Vals AI or Stanford RegLab result was found. Quality claims were not independently evidenced in this pass. | May we trial on our documents with a scored error log? | [HAQQ — Security](https://www.haqq.ai/security) |
| Assistance, not legal judgment | Public claim only | Terms: an AI Agent acts on the Customer's instruction and does not exercise independent legal judgment. AI Outputs are Customer Data. Fit is drafting/research assistance inside a configured tenant, with human approval for consequential agent steps. | Which agent tools will we allow, and which remain lawyer-only? | [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions); [HAQQ — Security](https://www.haqq.ai/security) |
| Customer warrants lawful upload | Public claim only | Privacy J: Customer must have notices, consents, professional authorisations and a lawful basis for data it submits, including sensitive matter files. No Australian client-disclosure template was published. | Provide a client-disclosure for EU/US/ME hosting and Legal AI, which we can adapt for APP 8. | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| Providers not named publicly | Not confirmed | Security: foundation-model layer with no training and BYOK. Privacy authorises AI infrastructure subprocessors but does not name OpenAI/Anthropic/Google on the pages reviewed. Model mix is therefore unknown. | Name every model provider, region and whether ZDR applies on our tenant. | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| List on request; 30-day notice | Public claim only | Privacy L: customer authorises subprocessors; HAQQ will maintain a list (platform, Trust Center, email, schedule or on request) with function and location where practicable. 30 days' prior written notice of new material subprocessors (shorter for emergencies); 15 days to object, then alternatives or terminate the affected Product. | Provide the current named list with countries before we upload matter data. | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Data Processing Agreement summary](https://www.haqq.ai/dpa) |
| No training except signed agreement | Public claim only | Privacy B and DPA summary: HAQQ's internal product development does not involve training, fine-tuning or improving AI models on Customer Data, Matter Data, prompts, outputs or User content, except where expressly agreed in a separately signed written agreement and permitted by law. Security FAQ: never used to train. | Confirm the Order Form contains no training carve-out and that subprocessors are on ZDR/no-train terms. | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Data Processing Agreement summary](https://www.haqq.ai/dpa); [HAQQ — Security](https://www.haqq.ai/security) |
| Anonymised telemetry | Public claim only | Privacy: Derived Data is anonymised/aggregated telemetry for performance, reliability, capacity, diagnostics and security, and must not identify Customers, Users, Clients or data subjects. It may be retained indefinitely once irreversible. | Can prompt text appear in telemetry before anonymisation, and can we disable product analytics? | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| Customer-configured plus 90-day exit window | Public claim only | Security FAQ: customer configures retention; purging is automatic and produces a verification log; export anytime. Privacy Q: 90-day post-term export window, then delete from active production within a commercially reasonable period; backups up to one year. | Set our retention to 30 days or less for prompts and matter files, and confirm backup TTL. | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| Return or delete; certification on request | Public claim only | Privacy Q: customer elects return or delete in writing; default is delete if no election. Active-system deletion after the 90-day window; backups then anonymised or deleted when feasible. Written confirmation of deletion may be provided on request, subject to limitations. | Will you certify deletion of production, backups and subprocessors within a stated number of days? | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Data Processing Agreement summary](https://www.haqq.ai/dpa) |
| Nobody by default; support needs approval | Public claim only | Security FAQ: nobody at HAQQ can see customer data by default; access is role-based, least-privilege and logged; support access to a specific matter requires explicit approval and expires. Privacy I: authorised persons bound by confidentiality. | Is support access ticket-scoped in the product, and can we refuse it? | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| SSO, MFA, RBAC, ethical walls | Public claim only | Security: SSO, MFA, role-based access; one tenant per firm; no cross-matter mixing; ethical walls at the governance layer. Privacy: Customer configures permissions and retention. | Will SSO+MFA be mandatory, and how are ethical walls tested? | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| TLS 1.3 and BYOK claimed | Public claim only | Security: encryption in transit including TLS 1.3 where supported; enterprise customers can bring their own key; revoking the key ends HAQQ's ability to read the data. Privacy M lists encryption in transit and at rest and customer-managed keys where available for applicable tiers. | Is BYOK in our SKU, and what at-rest algorithm is used on HAQQ Cloud? | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| Alignment, not completed certification | Not confirmed | Security header lists SOC 2, ISO 27001, ISO 42001 and GDPR. FAQ: 'Compliant. ... We describe that as alignment rather than a completed third-party certification.' Privacy M: framework references are not a representation that every product is in the same certification scope. Treat as uncertified unless a report is produced. | Produce the current SOC 2 / ISO certificates with dates and scope, or confirm none exist yet. | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) |
| Published Book III DPA; Delaware terms | Public claim only | Book III of the Terms operates as the DPA (privacy notice hosts the full text). Accepting Terms puts it in force; a counter-signed copy is available on request. Delaware law/courts. Audit rights in Privacy O (summaries first; on-site with 30 days' notice, once per 12 months). | Will you counter-sign Book III plus SCCs and our APP 8 addendum? | [HAQQ — Data Processing Agreement summary](https://www.haqq.ai/dpa); [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) |
| Region on the Order Form; SCCs available | Public claim only | Residency where committed. Privacy N: transfers may use adequacy, SCCs, UK addenda, supplementary measures or other lawful mechanisms. Cross-border still possible for support, billing, subprocessors and redundancy. Australia is not a listed region. | Map every country of storage, inference and support for our Order Form. | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Security](https://www.haqq.ai/security) |
| 72-hour outer target | Public claim only | Privacy P: notify without undue delay after becoming aware; commercially reasonable efforts as soon as practicable and, where feasible, within 72 hours — described as a contractual outer target, not a licence to delay. Security FAQ also states 72 hours per GDPR. Customer remains responsible for notifying regulators/clients unless HAQQ has a direct duty. | Name the notification email path and confirm 72 hours applies to our Cloud tenant. | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Security](https://www.haqq.ai/security) |
| 30-day subprocessor notice | Public claim only | New material subprocessors: 30 days' written notice with function and location; 15 days to object. Terms hierarchy: signed agreement, then Official Proposal/Order Form, then Book III for privacy. Product Books can impose more specific obligations. | Will material model or region changes also get 30 days' written notice? | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) |
| 90-day export then delete | Public claim only | Privacy Q: 90-day export window in a structured, commonly used, machine-readable format; then delete (or return if elected). Backups up to one year. Certification on written request. Security FAQ: export anytime while live. | What export formats are supported, and will backups be in the deletion certificate? | [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy); [HAQQ — Security](https://www.haqq.ai/security) |
| Integrations layer not named | Not confirmed | Architecture includes a data-and-integrations layer. Named third-party connectors were not listed on the security or privacy pages reviewed. AI Agents may invoke permitted tools within tenant permissions. | List every connector and tool the agent may call on our tenant, and how we disable them. | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) |
| Not described | Not confirmed | Legal AI is described as retrieval over customer-authorised sources. Open-web search was not stated on pages reviewed. | Can Legal AI browse the open web, and can we disable it? | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) |
| Configurable human approval | Public claim only | Security: Justinian agentic harness has guardrails, audit trails and configurable human approval for consequential agent actions. Terms: agents plan and execute steps including retrieving, drafting or invoking permitted tools within customer-configured permissions. | Which actions are 'consequential' by default, and can we require approval for every external call? | [HAQQ — Security](https://www.haqq.ai/security); [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) |
| Agent does not exercise legal judgment | Public claim only | Terms: an AI Agent does not exercise independent legal judgment. Every action is claimed to be logged, attributable and exportable. No in-product mandatory sign-off before a lawyer relies on output was extracted. | Is there a mandatory human-accept step before exporting a draft or sending e-Client messages? | [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions); [HAQQ — Security](https://www.haqq.ai/security) |

## Notes

Published DPA-in-terms is unusually detailed. SOC 2/ISO marks on the security page are described in the FAQ as alignment rather than completed third-party certification. Model providers not named. No Australian region. Trust-centre URL exists but was not fully scraped in this pass.

## Sources

- [HAQQ — Security](https://www.haqq.ai/security) (checked 2026-09-21)
- [HAQQ — Terms of Service (29 June 2026)](https://www.haqq.ai/terms-and-conditions) (checked 2026-09-21)
- [HAQQ — Privacy Notice / Book III DPA (29 June 2026)](https://www.haqq.ai/privacy) (checked 2026-09-21)
- [HAQQ — Data Processing Agreement summary](https://www.haqq.ai/dpa) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.