General-purpose · Due diligence and data rooms · Medium confidence
Hebbia · Hebbia as described on the homepage (Matrix and Max over a firm's documents) and the security page, including the dedicated-tenant option. No order-form modules were published.
Document analysis workspace for investors, bankers, lawyers, consultants and large companies, with Matrix over large file sets and a stated no-training position.
Opens a private software assessment of Hebbia for one task, with this profile’s questions to hand.
| Deployment | SaaS, Private cloud |
|---|---|
| Hosting regions | United States, European Union / EEA |
| Australian region | Unknown |
| Assurance | ISO/IEC 42001:2023, SOC 2 Type 2, ISO 27001:2022 |
| Training on customer content | No |
| Pricing summary | No price list was on the pages read. |
| Legal content coverage | The homepage names lawyers among the users. It does not name an Australian or other primary-law collection. The worked examples on the homepage are financial filings and earnings material. |
| Australian presence | Unknown — The security page offers US and EU regional processing and a dedicated tenant. Australia is not named. |
Define the configuration, people, information and tasks being assessed.
Public claim only
The homepage presents Matrix for work over large document sets and Max as a collaborative analyst. The security page adds regional processing in the US and EU and an optional dedicated tenant. No module price list was published.
Ask: Which of Matrix, Max and a dedicated tenant are in our order, and which region is selected?
Public claim only
The security page says Hebbia runs across the US and EU, with regional processing for storage and inference, and can deploy on a dedicated tenant. It describes siloed environments, isolated from other customers. Australia is not named.
Ask: Is a dedicated tenant available in a named region, and is any Australian region offered?
Public claim only
The homepage describes Matrix over thousands of files, including financial filings in the worked examples, and says the product is trusted by investors, bankers, lawyers, consultants and Fortune 500 companies. It does not describe a legal-research citator.
Ask: For a legal deployment, which document types can be loaded, and does every answer cite the source passage?
Public claim only
Lawyers are named as users. The visible examples are corporate filings and earnings material, not Australian case law or legislation.
Ask: If we use it on Australian matters, what legal content, if any, is supplied by Hebbia rather than by our documents?
Record the practical work needed to introduce and maintain the software.
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on licence and pricing unit.
Ask: What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on integrations.
Ask: What is the written position on integrations for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on support and service levels.
Ask: What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it?
Compare complete work at the required quality, including checking and correction.
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on independent quality evidence.
Ask: What is the written position on independent quality evidence for the deployment we would buy, and which contract or policy states it?
Public claim only
The product answers questions and builds tables over documents the customer loads. The homepage frames it for institutional decisions. It is not a court-form or advice product.
Ask: Which of our diligence tasks will run only over the data room, and who checks a figure before it is used?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
The pages do not discuss client consent or engagement-letter language. Isolation from other customers is a security claim, not a client-authority term.
Ask: What description of data use can we give a client whose documents are loaded?
Not confirmed
The security page refers to model providers but does not name them.
Ask: Name the model providers and the region of each endpoint used for our tenancy.
Not confirmed
No subprocessor list was on the pages read. Model providers are mentioned only as parties that do not train on customer data.
Ask: Provide the subprocessor list, with locations, and the notice period for changes.
Public claim only
The security page says documents, prompts and outputs are never used to train Hebbia's models or any model provider Hebbia works with. It is a security-page statement, not a contract extracted here.
Ask: Will that no-training statement be in our DPA, including for model providers and for dedicated-tenant deployments?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on feedback and secondary use.
Ask: What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on retention.
Ask: What is the written position on retention for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on deletion and export.
Ask: What is the written position on deletion and export for the deployment we would buy, and which contract or policy states it?
Public claim only
The security page says Hebbia does not have direct access to customer data and that production access is restricted through just-in-time access management. It also says the customer can see who accessed data, when, and what they did.
Ask: Who can grant just-in-time access, is it notified to us, and how long does it last?
Public claim only
The security page describes zero-trust access, siloed customer environments and an audit of access. SSO and customer MFA were not stated.
Ask: Does the dedicated tenant support our identity provider and MFA, and can we export the access log?
Public claim only
The security page says data is encrypted at rest and in transit. It does not name TLS or AES versions.
Ask: Which protocols and key arrangements apply in the region we select?
Public claim only
The security page displays ISO/IEC 42001:2023, SOC 2 Type 2, ISO 27001:2022 and GDPR, and says data is encrypted at rest and in transit. Reports, dates and encryption algorithms were not published on the page.
Ask: Provide the current ISO 27001, ISO 42001 and SOC 2 reports, including scope and period.
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on contract, dpa and liability.
Ask: What is the written position on contract, dpa and liability for the deployment we would buy, and which contract or policy states it?
Public claim only
Regional processing is offered in the US and EU. The page does not say whether a US tenancy can call an EU model or the reverse, and it does not mention Australia.
Ask: For the region on our order, confirm that storage and inference stay in that region, including model providers.
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on incidents and breach notice.
Ask: What is the written position on incidents and breach notice for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on changes to terms and models.
Ask: What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on exit, return and deletion.
Ask: What is the written position on exit, return and deletion for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on connectors and external tools.
Ask: What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on web search and open-web grounding.
Ask: What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it?
Not confirmed
The homepage describes analysis and collaboration. It does not say the system can send email, trade or file a document without a person.
Ask: Which actions, if any, can an agent take outside the workspace without a user confirming them?
Not confirmed
No required human-review step is stated. The homepage presents output for the user's decision.
Ask: Where must a lawyer or analyst check a Matrix answer before it is relied on?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI due diligence and data rooms tools Australia
