Legal-specific · Document automation · Medium confidence
Abacus Data Systems, Inc. · HotDocs document automation, desktop and cloud, plus the data processing addendum. The addendum defines HotDocs as Abacus Data Systems, Inc. and its affiliates. No generative model is described on the product page.
Document automation that turns templates and questionnaires into assembled documents, offered on desktop and in the cloud, with a published data processing addendum.
Opens a private software assessment of Mitratech HotDocs for one task, with this profile’s questions to hand.
| Deployment | SaaS, On-premises |
|---|---|
| Hosting regions | Unknown |
| Australian region | Unknown |
| Training on customer content | Unknown |
| Retention summary | The data processing addendum says that after the service ends, HotDocs will return or make personal data available for retrieval, and will then delete copies by rendering them unrecoverable, except as required by law. The customer is told to back up data where retrieval is not provided. |
| Integrations | Open API, CRM, matter-management and HR systems as data sources |
| Pricing summary | No price list was on the pages read. Fees sit on a service order form. The product page claims up to a 90% reduction in document creation time. |
| Legal content coverage | Templates can include jurisdiction-specific clauses and rules configured by the customer. No primary-law database is named. |
| Australian presence | Unknown — The product page says the software is used in 60+ countries. Australia is not named. The addendum says cloud personal data is hosted in the data-centre region specified on the service order, if one is specified, and that HotDocs may access data globally for support and security. |
Define the configuration, people, information and tasks being assessed.
Public claim only
The product page describes desktop and cloud document automation: templates, questionnaires, conditional logic, clause libraries, batch generation and an open API. The addendum applies where the EULA or terms incorporate it, and fees and region sit on the service order. No generative AI feature is described on the product page.
Ask: Which deployment, desktop or cloud, is on our order, and which template libraries are included?
Public claim only
The product page offers desktop and cloud. The addendum says personal data in a cloud environment is hosted in the data-centre region named on the service order, if specified, and will not be migrated without the client's prior written authorisation. HotDocs may still access data globally for security, maintenance, support and change management.
Ask: Name the data-centre region on the order, and list the support locations that may access it.
Public claim only
The product page describes smart templates that populate clauses and figures from rules, no-code questionnaires, version control, batch processing, and an open API. It cites LegalTech Hub tier-1 status and a reduction in document creation time of up to 90%. Those are vendor and third-party marketing claims. No generative model is described.
Ask: Which of those features are in the current cloud release, and is any generative drafting feature switched on?
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on jurisdiction and legal content.
Ask: What is the written position on jurisdiction and legal content for the deployment we would buy, and which contract or policy states it?
Record the practical work needed to introduce and maintain the software.
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on licence and pricing unit.
Ask: What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on integrations.
Ask: What is the written position on integrations for the deployment we would buy, and which contract or policy states it?
Public claim only
Data-subject requests that the client cannot action in the product go through HotDocs support, and HotDocs may charge for extra effort. The product page does not publish support hours.
Ask: What support hours cover Australia, and what is the severity matrix?
Compare complete work at the required quality, including checking and correction.
Public claim only
The product page cites LegalTech Hub tier-1 status, 1 million-plus end users, 60-plus countries, 30-plus years, and up to 90% less document-creation time. No independent accuracy study was attached.
Ask: What error rate should we expect on our templates, and who maintains them when the law changes?
Public claim only
The product assembles documents from templates and answers. It does not, on the page read, research law or review a third party's draft. Jurisdiction-specific clauses are rules the customer configures.
Ask: Which of our precedents will be templated, and who signs off a generated document before it is sent?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Public claim only
The client warrants it has a lawful ground to send personal data, including notices and consents. The addendum says HotDocs does not provide legal advice. Generated documents are the client's.
Ask: What client notice is required before a questionnaire collects personal information?
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on model providers.
Ask: What is the written position on model providers for the deployment we would buy, and which contract or policy states it?
Public claim only
The client agrees HotDocs may use affiliates and third-party subprocessors. Notice is given, and the client has 14 calendar days to object on data-protection grounds. If the objection is not resolved, the client may terminate the relevant service without being released from payment obligations. The addendum says a list is published at a further link that was not opened. Subprocessors must meet the same protection level, and the client may request audit confirmation.
Ask: Provide the current subprocessor list and the notice address we must monitor.
Not confirmed
The addendum limits processing of personal data to providing the service, following documented instructions, or meeting regulatory obligations. It does not mention model training. The product page does not describe a model.
Ask: Confirm that template answers and generated documents are not used to train a model.
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on feedback and secondary use.
Ask: What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it?
Public claim only
The addendum does not set a fixed retention period during the subscription. On termination it requires return or retrieval, then deletion, except as required by law. Detail is deferred to the incorporating documents, which were not read.
Ask: What is the retrieval window after termination, and how long do backups keep personal data?
Public claim only
After termination, or after the retrieval period, HotDocs will delete copies by rendering personal data unrecoverable, except as required by law. Where the product does not provide retrieval, the client is told to keep its own backup.
Ask: Confirm retrieval is available for our deployment, and the format of the export.
Public claim only
Staff and subprocessors with access to personal data are subject to confidentiality arrangements. The addendum does not describe a customer approval step before staff open a template answer.
Ask: Can your staff open questionnaire answers, and is that access logged?
Not confirmed
The addendum requires the security measures in the incorporating documents, which were not read. The product page does not mention SSO or MFA.
Ask: Which access controls, including SSO and MFA, apply to the cloud service?
Not confirmed
The addendum says transmission and encryption controls are those in the incorporating documents. Those documents were not read, and the product page does not name TLS or AES.
Ask: Provide the encryption standards for the cloud service in transit and at rest.
Not confirmed
The addendum says that if an audit request is already covered by an SSAE 16/ISAE 3402 Type 2, ISO, NIST, PCI DSS, HIPAA or similar report from the prior twelve months, the client agrees to accept that report. It does not state that HotDocs currently holds any one of those. No certificate was on the product page.
Ask: Which of those reports do you currently hold for HotDocs cloud, and what is the period?
Public claim only
The addendum is incorporated into an EULA or terms that incorporate it by reference, and prevails over those documents except where it says otherwise. The data transfer agreement prevails over the addendum where they conflict. The client is the controller and HotDocs is the processor. Sensitive data is excluded unless the order says otherwise. Governing law of the EULA was not read. Questions go to security@mitratech.com.
Ask: Provide the EULA and order that incorporate this addendum, including governing law, liability and whether Australian privacy law is named.
Public claim only
If a region is named on the order, the cloud environment stays there unless the client authorises a move. Global access for support is still permitted. Transfers of EEA or Swiss personal data to a country without an adequacy decision are subject to HotDocs's data transfer agreement and standard contractual clauses. Australian transfers are not discussed.
Ask: If our users are in Australia, what transfer mechanism covers access from support outside Australia?
Public claim only
HotDocs evaluates incidents that indicate unauthorised access to personal data. If it determines a personal-data breach, it will inform the client without undue delay and at the latest within 72 hours, then provide the nature, measures, categories and other information reasonably known. Public statements are coordinated. This is a GDPR-style clause. The Notifiable Data Breaches scheme is not named.
Ask: Does the 72-hour clause apply to Australian personal information, and who receives the notice?
Public claim only
Subprocessor changes can be objected to within 14 days. Cloud region cannot be changed without written authorisation. The addendum does not state a notice period for changes to the product page's feature set.
Ask: How are changes to template behaviour or cloud controls notified?
Public claim only
Exit is return or retrieval, then deletion, as above. The client pays outstanding fees. Audit costs are the client's. No Australian exit addendum was read.
Ask: State the exit timetable in the order, including template libraries we authored.
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on connectors and external tools.
Ask: What is the written position on connectors and external tools for the deployment we would buy, and which contract or policy states it?
Not confirmed
The pages read on 2026-10-10 (the HotDocs product page and the HotDocs data processing addendum) do not state a position on web search and open-web grounding.
Ask: What is the written position on web search and open-web grounding for the deployment we would buy, and which contract or policy states it?
Public claim only
Batch processing can generate large volumes without an end user in the loop, according to the product page. The addendum does not limit that feature.
Ask: Which batches can run unattended, and who is accountable for a document they produce?
Not confirmed
No required lawyer review of a generated document is stated. Questionnaires are completed by a user.
Ask: Where is the required check before a generated document is sent to a client or filed?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI document automation tools Australia
