Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan
Public claim only
Ask iManage is the DMS-native assistant on the iManage platform (Work AI). FAQ: Mailbox Assistant, AI Services and Ask iManage are not in a standard cloud subscription and must be purchased as additional products. iManage AI is only available on the cloudimanage.com endpoint.
Ask: Is Ask iManage on our cloud subscription or a paid add-on, and are we on cloudimanage.com?
Deployment
Public claim only
AI runs inside the iManage platform; Ask FAQ: data processed by iManage AI stays on the iManage platform and retains iManage security and governance. Cloudimanage FAQ titles refer to Azure Blob Storage. EMEA regional centres (Switzerland, UAE, 2024) are described as built on Microsoft Azure. AU cloud storage is listed via NEXTDC.
Ask: Which region is our iManage tenant in, and does Ask inference stay in that region?
Features
Public claim only
Natural-language search across the repository with cited answers, clause extract, redline analysis, summaries, tabular insights, playbook analysis against the organisation's positions.
Ask: Which Ask features will be enabled for which libraries?
Australia
Public claim only
Subprocessor list: NEXTDC Limited, Australia, data-centre provider for multiple iManage Cloud services (storage only). iManage LLC lists an Australian branch office for support/operations. AI Enrichment is advertised as available in Australia (English). Named Australian customer: RSM Australia (iManage Cloud). Ask-specific inference location is still not stated.
Ask: Is our tenant in the Australian iManage region, including Ask inference?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client-facing
Not confirmed
Internal DMS assistant. Not a client chatbot. The ChatGPT Enterprise plugin would expose governed iManage content inside ChatGPT if enabled.
Ask: Confirm Ask is not exposed to clients or portals, and whether the ChatGPT plugin will be on.
Model provider
Not confirmed
The Ask page does not name the foundation-model provider. AI Enrichment is described as a purpose-built in-region model (separate product). ChatGPT Enterprise is a separate optional plugin that uses OpenAI models on iManage content. Microsoft Copilot plugin is described as in development.
Ask: Name every model provider and hosting route used by Ask iManage for our tenant.
Subprocessors
Public claim only
Published list at compliance.imanage.com/subprocessors (17 entries scraped). Data centres: NEXTDC (Australia), Centersquare (US), Digital Realty UK, AWS for Closing Folders only (AU/CA/EU/UK/US). Support affiliates in US, UK, Canada, Australia, Singapore, Spain, India. Also Beamer, MessageBird, Microsoft (customer-selected region), Mixpanel (EU processing claimed), MongoDB Atlas (customer-selected region, including MCP and Insight+), Twilio Segment/SendGrid, Zendesk (US). Ask-specific model host is not named on this list.
Ask: Which of these apply to Ask iManage, and what notice is given on changes?
Training
Public claim only
Ask FAQ: data processed by iManage AI stays on the iManage platform. AI Enrichment (separate): no data leaves to train a shared model; processing in-region. Website privacy notice says iManage may process publicly available documents to train machine-learning models. No Ask-specific contractual no-training clause was found.
Ask: Contractual confirmation that Ask prompts, documents and outputs are not used to train any model, including the model provider.
Feedback
Public claim only
Mixpanel and Twilio Segment are listed for user analytics. Privacy notice: product insights and improvements; in-product feedback may prompt follow-up. Ask-specific rating-to-train behaviour is not described.
Ask: Is any Ask rating or telemetry used to improve models?
Retention
Public claim only
Trust Centre controls: formal retention and disposal procedures for company and customer data. FAQ titles cover how long support-ticket data is stored. Prompt/index retention for Ask is not stated on the Ask page.
Ask: Retention of Ask prompts, answers, indexes and logs?
Deletion
Public claim only
FAQ title: how iManage handles data destruction and sanitization when a customer exits the cloud. Answers were not extracted from the collapsed FAQ. Ask-artifact deletion is not described on the Ask page.
Ask: Matter-level deletion of Ask artifacts and certified deletion on exit?
Vendor access
Public claim only
Support and operational services are performed by iManage affiliates in the United States, United Kingdom, Canada, Australia, Singapore, Spain and India. FAQ titles cover who has administrative access to the iManage Cloud. Zendesk holds support tickets in the United States.
Ask: When can iManage staff read Ask prompts, from which countries, and is it logged?
Permissions
Public claim only
Answers are drawn from the iManage repository the user can search; permission-aware behaviour is the vendor's claim and must be tested, including ethical walls. The ChatGPT Enterprise plugin is described as keeping existing permissions, ethical walls and audit trails.
Ask: Demonstrate a user cannot retrieve a walled matter via Ask or the ChatGPT plugin.
Encryption
Public claim only
Trust Centre FAQ titles cover encryption at rest in Azure Blob Storage (Cloudimanage), encryption in transit between customers and the iManage Cloud, and key-management/rotation policies. Algorithms were not in the extracted FAQ bodies.
Ask: Encryption in transit/at rest for Ask stores and the model path, including CMK?
Assurance
Public claim only
Trust Centre badges: SOC 2, ISO 27001:2022, ISO 27701, ISO 27017, ISO 27018, CSA STAR Level 2, EU-US / UK / Swiss Data Privacy Framework. Resources include a 2026 Type 2 SOC 2+ report and SOC 3 Type 2 2026 (request access), plus an Ask iManage 2026 pen-test summary. Vendor blog: IRAP assessed to PROTECTED for Work, Insight+, Share, Security Policy Manager, Threat Manager and Records Manager — Ask iManage is not named in that list. Reports were not inspected.
Ask: Current SOC 2/ISO reports scoped to Ask iManage / Work AI, and whether IRAP covers Ask.
Contract
Public claim only
Website terms of service (for non-customers) are with iManage LLC except EMEA (iManage EMEA Limited); commercial-use liability capped at USD 1,000. The page says the Cloud Services Agreement governs iManage customers. That CSA/DPA was not on the public pages reviewed.
Ask: DPA, liability cap, law/forum for Ask iManage under the Cloud Services Agreement?
Transfers
Public claim only
Privacy notice: HQ United States; presence in Canada, EEA, UK, Australia and India; personal information primarily processed in the US, UK and EEA; DPF self-certification does not apply to processing in Australia or India. Subprocessors include US Zendesk/Beamer/Centersquare and Indian, Singaporean and Spanish affiliates. AU storage via NEXTDC is listed. Ask model-path location is unnamed.
Ask: Data-flow diagram for storage, Ask inference and support for our AU tenant.
Incidents
Public claim only
Trust Centre update 3 June 2026: no identified exposure to reported Claude Mythos attack vectors; monitoring, pen-testing and a private bug-bounty are described. No numbered breach-notice clock was found on the public pages.
Ask: Breach notice timeline and NDB cooperation?
Changes
Not confirmed
Trust Centre has an Updates feed (subscribe). No contractual notice period for model or index behaviour changes was extracted.
Ask: Notice before model or index behaviour changes?
Exit
Public claim only
FAQ title covers data destruction and sanitization when a customer exits the cloud. Answers not extracted. DMS content remains in iManage; Ask logs/indexes need a deletion path.
Ask: What Ask-derived data is deleted on termination, with certification?
Connectors
Public claim only
Ask operates on iManage content. Separate connectors: MCP Server; ChatGPT Enterprise plugin (announced 17 September 2026) that can search, read, organise and save documents back to iManage; Microsoft Copilot plugin described as in development. MongoDB Atlas is listed against MCP Server and Insight+ curation.
Ask: Does Ask itself call any service outside iManage, and will MCP/ChatGPT plugins be enabled?
Web search
Public claim only
Ask comparison table: draws only from real documents; contrasted with tools that may generate plausible but incorrect content. Product is described as searching the iManage repository.
Ask: Confirm Ask cannot answer from the open web.
Actions
Not confirmed
Playbook and redline analysis are described for Ask. The ChatGPT Enterprise plugin can organise documents in iManage and save new or updated work as a new version from ChatGPT. Agentic writes inside Ask itself were not clearly specified.
Ask: Can Ask or the ChatGPT plugin edit or move documents without a lawyer confirming?
Oversight
Public claim only
Cited answers support verification. No forced review gate described. ChatGPT plugin is said to keep audit trails.
Ask: Audit log of who asked Ask what, exportable?