---
title: "Hebbia (Hebbia)"
url: "https://ailawframework.com/software/hebbia"
type: "software_profile"
site: "AI Law Framework"
id: "hebbia"
vendor: "Hebbia"
category: "General-purpose"
segment: "Due diligence and data rooms"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# Hebbia (Hebbia)

> Document analysis workspace for investors, bankers, lawyers, consultants and large companies, with Matrix over large file sets and a stated no-training position.

Canonical page: https://ailawframework.com/software/hebbia  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Hebbia as described on the homepage (Matrix and Max over a firm's documents) and the security page, including the dedicated-tenant option. No order-form modules were published.

## Capabilities

- Due-diligence document review
- Document summarisation
- Data extraction
- Knowledge search

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, Private cloud |
| Hosting regions | United States, European Union / EEA |
| Australian region | Unknown |
| Assurance | ISO/IEC 42001:2023, SOC 2 Type 2, ISO 27001:2022 |
| Training on customer content | No |
| Legal content coverage | The homepage names lawyers among the users. It does not name an Australian or other primary-law collection. The worked examples on the homepage are financial filings and earnings material. |
| Pricing | No price list was on the pages read. |
| Australian presence | Unknown. The security page offers US and EU regional processing and a dedicated tenant. Australia is not named. |
| Website | https://www.hebbia.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan and modules | Public claim only | The homepage presents Matrix for work over large document sets and Max as a collaborative analyst. The security page adds regional processing in the US and EU and an optional dedicated tenant. No module price list was published. | Which of Matrix, Max and a dedicated tenant are in our order, and which region is selected? | [Hebbia — home](https://www.hebbia.com/); [Hebbia — security](https://www.hebbia.com/security) |
| Deployment and hosting | Public claim only | The security page says Hebbia runs across the US and EU, with regional processing for storage and inference, and can deploy on a dedicated tenant. It describes siloed environments, isolated from other customers. Australia is not named. | Is a dedicated tenant available in a named region, and is any Australian region offered? | [Hebbia — security](https://www.hebbia.com/security) |
| Product surfaces | Public claim only | The homepage describes Matrix over thousands of files, including financial filings in the worked examples, and says the product is trusted by investors, bankers, lawyers, consultants and Fortune 500 companies. It does not describe a legal-research citator. | For a legal deployment, which document types can be loaded, and does every answer cite the source passage? | [Hebbia — home](https://www.hebbia.com/) |
| Jurisdiction and legal content | Public claim only | Lawyers are named as users. The visible examples are corporate filings and earnings material, not Australian case law or legislation. | If we use it on Australian matters, what legal content, if any, is supplied by Hebbia rather than by our documents? | [Hebbia — home](https://www.hebbia.com/) |
| Licence and pricing unit | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on licence and pricing unit. | What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Integrations | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on integrations. | What is the written position on integrations for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Support and service levels | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on support and service levels. | What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Independent quality evidence | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on independent quality evidence. | What is the written position on independent quality evidence for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Task fit | Public claim only | The product answers questions and builds tables over documents the customer loads. The homepage frames it for institutional decisions. It is not a court-form or advice product. | Which of our diligence tasks will run only over the data room, and who checks a figure before it is used? | [Hebbia — home](https://www.hebbia.com/) |
| Client authority and client-facing use | Not confirmed | The pages do not discuss client consent or engagement-letter language. Isolation from other customers is a security claim, not a client-authority term. | What description of data use can we give a client whose documents are loaded? | [Hebbia — security](https://www.hebbia.com/security) |
| Model providers | Not confirmed | The security page refers to model providers but does not name them. | Name the model providers and the region of each endpoint used for our tenancy. | [Hebbia — security](https://www.hebbia.com/security) |
| Subprocessors | Not confirmed | No subprocessor list was on the pages read. Model providers are mentioned only as parties that do not train on customer data. | Provide the subprocessor list, with locations, and the notice period for changes. | [Hebbia — security](https://www.hebbia.com/security) |
| Training on customer content | Public claim only | The security page says documents, prompts and outputs are never used to train Hebbia's models or any model provider Hebbia works with. It is a security-page statement, not a contract extracted here. | Will that no-training statement be in our DPA, including for model providers and for dedicated-tenant deployments? | [Hebbia — security](https://www.hebbia.com/security) |
| Feedback and secondary use | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on feedback and secondary use. | What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Retention | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on retention. | What is the written position on retention for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Deletion and export | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on deletion and export. | What is the written position on deletion and export for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Human access to customer content | Public claim only | The security page says Hebbia does not have direct access to customer data and that production access is restricted through just-in-time access management. It also says the customer can see who accessed data, when, and what they did. | Who can grant just-in-time access, is it notified to us, and how long does it last? | [Hebbia — security](https://www.hebbia.com/security) |
| Access control | Public claim only | The security page describes zero-trust access, siloed customer environments and an audit of access. SSO and customer MFA were not stated. | Does the dedicated tenant support our identity provider and MFA, and can we export the access log? | [Hebbia — security](https://www.hebbia.com/security) |
| Encryption | Public claim only | The security page says data is encrypted at rest and in transit. It does not name TLS or AES versions. | Which protocols and key arrangements apply in the region we select? | [Hebbia — security](https://www.hebbia.com/security) |
| Assurance and certifications | Public claim only | The security page displays ISO/IEC 42001:2023, SOC 2 Type 2, ISO 27001:2022 and GDPR, and says data is encrypted at rest and in transit. Reports, dates and encryption algorithms were not published on the page. | Provide the current ISO 27001, ISO 42001 and SOC 2 reports, including scope and period. | [Hebbia — security](https://www.hebbia.com/security) |
| Contract, DPA and liability | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on contract, dpa and liability. | What is the written position on contract, dpa and liability for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Cross-border transfers | Public claim only | Regional processing is offered in the US and EU. The page does not say whether a US tenancy can call an EU model or the reverse, and it does not mention Australia. | For the region on our order, confirm that storage and inference stay in that region, including model providers. | [Hebbia — security](https://www.hebbia.com/security) |
| Incidents and breach notice | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on incidents and breach notice. | What is the written position on incidents and breach notice for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Changes to terms and models | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on changes to terms and models. | What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Exit, return and deletion | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on exit, return and deletion. | What is the written position on exit, return and deletion for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Connectors and external tools | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on connectors and external tools. | What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Web search and open-web grounding | Not confirmed | The pages read on 2026-10-10 (the Hebbia homepage and security page) do not state a position on web search and open-web grounding. | What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it? | [Hebbia — home](https://www.hebbia.com/) |
| Actions the system can take | Not confirmed | The homepage describes analysis and collaboration. It does not say the system can send email, trade or file a document without a person. | Which actions, if any, can an agent take outside the workspace without a user confirming them? | [Hebbia — home](https://www.hebbia.com/) |
| Human review of output | Not confirmed | No required human-review step is stated. The homepage presents output for the user's decision. | Where must a lawyer or analyst check a Matrix answer before it is relied on? | [Hebbia — home](https://www.hebbia.com/) |

## Notes

Certification names are taken from the security page, which does not attach a report or date. No model-provider list, DPA or price was on the pages read.

## Sources

- [Hebbia — home](https://www.hebbia.com/) (checked 2026-10-10)
- [Hebbia — security](https://www.hebbia.com/security) (checked 2026-10-10)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.