Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
Henchman was acquired by LexisNexis (announced 3 June 2024). The help centre is branded Lexis Create DMS / Lexis Create+, formerly Henchman; henchman.io currently shows a configuration placeholder. US Create+ FAQ: Henchman technology was incorporated into Create+ and Lexis+ with Protégé. AU pages contract-market via RELX Trading Australia Pty Limited. DMS integration and the Create DMS AI Assistant module are described as subscription-dependent.
Ask: Confirm the contracting entity, whether we are buying Create DMS only, full Create+ (Protégé in Word), or both, and which GTC/DPA PDF is on the Order.
Deployment model
Public claim only
Create+ is a Microsoft 365 add-in that can be centrally deployed by IT. Help centre covers Word and Outlook add-ins plus a Create DMS portal for admin. No on-premises Create DMS product was found. AU FAQ: Create+ only works with Microsoft Word 365.
Ask: Is deployment Word desktop, Mac, Word on the web and Outlook, and is any private-cloud option available for the clause index?
Product features in scope
Public claim only
Create DMS: search clauses/definitions from the connected contract database inside Word and Outlook; optional AI Assistant 'My contract' Q&A on the open document (not in Outlook). Create+: Protégé drafting in Word/Outlook, libraries, citation/Shepard's (US pages), AU Practical Guidance/CaseBase, PDF-to-Word, DocuSign, metadata scrub/redact. DMS connections are optional and not live-continuous on the US Create+ FAQ.
Ask: Which of clause search, permission mirroring, AI Assistant, Protégé, citation tools and DocuSign are on our Order, and which are generally available in Australia?
Governing law and Australian coverage
Not confirmed
No Create+-specific public GTC was found in this pass. The LN DPA (15 February 2026) has jurisdiction annexes for EEA/UK/Switzerland, LATAM, MEA and the United States, not Australia. AU Create+ is sold for Australian litigators and transactional drafting with Practical Guidance, Forms and Precedents and CaseBase. Create+ launched in Australia on 5 November 2025.
Ask: Which entity and governing law apply to our Create+/Create DMS Order, and will you accept Australian law and an APP-aligned DPA annex?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who is controller, and client-matter authority
Public claim only
LN DPA applies where it is referenced in the Agreement: LN processes personal data on documented customer instructions as processor. DMS pages: LN only accesses documents the customer chooses to connect. Help centre: default Create DMS can surface clauses without DMS permission mirroring unless the firm configures profiles or mirroring.
Ask: Confirm the DPA is incorporated for Create+/Create DMS, that we remain controller of matter data, and that permission mirroring (not the open default) is the contracted setting.
Foundation-model provider
Public claim only
Subprocessors list (17 September 2026) for Lexis Create+: AWS; Anthropic PBC (USA); Microsoft Corporation (AI functionality in Canada, France, Netherlands, USA); OpenAI, LLC (USA); DeepL SE (Finland); DocuSign. Lexis Create DMS: AWS; Anthropic (USA); Microsoft AI (Canada, France, Netherlands, USA); OpenAI (USA); DeepL (Finland). No customer model picker was described on Create+ pages. Product copy names Protégé as the assistant.
Ask: Which of OpenAI, Anthropic, Microsoft and DeepL actually process our Create DMS index and Protégé prompts, and can we disable US-located model providers?
Subprocessors and subprocessors list
Public claim only
LN publishes a service-by-service list last updated 17 September 2026. Create+ and Create DMS are separate rows. Affiliates listed at the top include RELX Trading Australia Pty Ltd and RELX (UK) Limited. DPA s 3.1: 14 days' website notice of list changes; customer may object within 14 days. The list does not name Henchman as a current legal entity.
Ask: Confirm our Order is mapped to the Create+ row, the Create DMS row, or both, and that 14-day objection applies to our tenancy.
Training and secondary use of customer content
Public claim only
US Create+ security copy: 'We never use customer data to train AI models' and 'Identifiable information is removed from AI interactions so that we can improve performance without compromising privacy.' DMS integration page repeats that customer data is never used to train AI models. Those statements are product-page claims, not DPA clauses. The DPA does not itself contain a no-training warranty.
Ask: Put a no-training warranty for Create+/Create DMS (vendor and OpenAI/Anthropic/Microsoft/DeepL) into the Order, including whether de-identified AI interactions are used to improve models.
Feedback and evaluation use
Public claim only
Create+ page says identifiable information is removed from AI interactions so LN can improve performance. No Create+-specific feedback-opt-out control was found. DPA limits processor staff to instructions and confidentiality.
Ask: Are Create+/Create DMS prompts, retrieved clauses or AI Assistant answers used for product improvement, and can that be contracted off?
Retention of prompts, documents and logs
Public claim only
DPA: duration of processing is the duration of the services until disposal under the Agreement. Create+ FAQ: DMS is not a live connection; the system accesses the DMS periodically to retrieve updates. No public day-count for the clause index, embeddings, AI Assistant context or backups was found.
Ask: State retention for the Create DMS index, embeddings, Protégé/AI Assistant prompts and outputs, and logs, including backup lag.
Deletion and certified erasure
Public claim only
DPA s 2.3(7): at the customer's choice, delete or return all personal data after the services end and delete existing copies unless law requires storage. Help centre: an admin can delete a user account (required even to change email). No certificate-of-deletion SLA or in-term purge of the clause index was found.
Ask: What is the maximum time to delete our Create DMS index and AI logs in-term and on exit, including backups, and will you issue a deletion certificate?
Vendor staff access to matter data
Public claim only
DPA: persons authorised to process personal data must be under confidentiality; they must not process except on instructions unless required by law. Affiliates providing support/data-centre operations include entities in the United States, South Africa, the Philippines, Australia and the UK. No Create+-specific support-access runbook was found.
Ask: Is staff access to our clause index and prompts logged, MFA-gated, limited to ticketed support, and available as an audit export? Which affiliate locations can see our data?
SSO, MFA, roles and audit logs
Public claim only
Create DMS supports default (no specific permissions), permission profiles, or mirroring iManage/NetDocuments so users only see clauses from documents they can already access. AU press claims permission mirroring. Help centre does not document customer Entra SSO or exportable audit logs. Microsoft 365 add-in deployment is via organisational IT.
Ask: Will our tenancy use DMS permission mirroring (not the open default), Entra SSO, mandatory MFA and exportable audit logs?
Encryption in transit and at rest
Public claim only
US Create+ and AU press claim encryption of customer data. DPA s 6.1 lists pseudonymisation and encryption of personal data as examples of TOMs, not a named algorithm. No public statement of TLS version, at-rest ciphers or customer-managed keys for Create DMS was found.
Ask: Confirm TLS version, at-rest algorithm, key custody for the Create+/Create DMS AWS tenancy, and whether CMK is available.
SOC, ISO and other audits
Not confirmed
Create+ marketing refers to regular third-party audits and 'recognized security certifications' without naming ISO 27001 or SOC 2 for Create+ or Create DMS. The LexisNexis Trust Center URL exists but was not opened in this pass. DPA allows customer audits no more than once per year on 30 days' notice.
Ask: Provide the current SOC 2 Type II / ISO 27001 reports whose scope includes Create+ and Create DMS, and the Trust Center packages we can rely on.
Contract, DPA, liability and indemnity
Not confirmed
Public LN DPA (15 February 2026) is processor terms that apply when referenced in the Agreement. No Create+-specific public GTC, liability cap or IP indemnity was found in this pass. AU Create+ marketing is under RELX Trading Australia Pty Limited. DPA has no Australian Privacy Act annex.
Ask: Provide the Order, GTCs and confirmation the DPA is incorporated, with an Australian-law liability cap and APP 8 wording for Create+/Create DMS.
Cross-border transfers and residency
Public claim only
Create+ AWS locations: Australia, Canada, Ireland, South Africa, UK, USA; OpenAI and Anthropic USA; Microsoft AI in Canada, France, Netherlands, USA; DeepL Finland; DocuSign includes Australia. Create DMS AWS locations: Canada, Ireland, South Africa, USA — Australia is not listed. DPA s 5: transfers subject to appropriate safeguards; SCCs for EEA/UK/CH. No APP 8 assessment was published.
Ask: Pin our Create+ and Create DMS processing to named AWS regions (including whether AU is used) and list every US model-provider flow of matter text.
Breach notification
Public claim only
DPA s 7.1: LN will notify the customer without undue delay after becoming aware of a personal data breach and reasonably respond to requests for further information. No 72-hour customer-notice SLA is in that clause. No Create+-specific public incident history was found.
Ask: Write a 72-hour (or faster) customer-notice SLA for Create+/Create DMS into the Order, including the notification email.
Unilateral term and product changes
Public claim only
DPA s 3.1: subprocessors may change with at least 14 days' website notice and a 14-day objection window. Product pages do not publish a customer-notice period for AI-model or hosting-region changes. Help centre and branding have already shifted from Henchman to Lexis Create+.
Ask: Will material model-provider, hosting-region or training-use changes require 30 days' written notice and a right to terminate without penalty?
Export, termination and lock-in
Public claim only
DPA: delete or return personal data at the end of the services, then delete copies unless law requires storage. No Create DMS-specific export of the clause index, embeddings or libraries was found. Generated Word documents remain in the customer's Microsoft 365/DMS. 12-month or other term is not published.
Ask: On termination, in what formats and within how many days can we export the Create DMS index and team libraries, and is deletion certified?
PMS, DMS and agent connectors
Public claim only
Create DMS connectors documented: iManage Cloud and on-prem/Work, SharePoint cloud and on-prem, OneDrive, Google Drive, OpenText eDocs, NetDocuments. Where no DMS connector exists, customers dump files to SharePoint/OneDrive/Google Drive for crawling. Create+ also lists DocuSign. US FAQ: not a live DMS connection. No public MCP or outbound agent connector for Create DMS was found.
Ask: Which connectors are in our Order, what is indexed (full text vs clauses), sync frequency, and is any MCP/agent interface in scope?
Open-web search and browsing
Not confirmed
Create+ pages describe grounding in firm documents and subscribed LexisNexis sources. No Create+ or Create DMS page in this pass described an open-web search tool. Protégé General AI on Lexis+ (separate product) is out of scope unless enabled inside Create+.
Ask: Does Create+ or the Create DMS AI Assistant send matter text to an open-web search index, and can that be disabled on our Order?
What the tool may do without a click
Public claim only
Drafting actions are user-initiated in Word/Outlook. Backend DMS crawl is periodic, not live. AI Assistant answers questions about the open document when the user asks. AU pages mention sending the final document for signing with DocuSign. No unsupervised multi-step agent runbook was found on the help centre (AU press uses 'agentic AI' as marketing for Create+).
Ask: Which actions (index sync, generate, insert clause, send to DocuSign) require an in-product confirmation on our tenancy?
Required lawyer review before client use
Not confirmed
No Create+ term requiring a lawyer to review output before client send was found. RELX Responsible AI Principles are cited for human oversight at product-marketing level. AI Assistant and Protégé generate answers and drafts that a lawyer would still need to verify.
Ask: Will you contract that Protégé and AI Assistant output is not legal advice and must be lawyer-reviewed before filing or client send?
