Legal-specific · Due diligence and data rooms · Medium confidence
Imprima · Imprima virtual data room and optional Smart Review / Smart Redaction / Summaries / Index / Compliance AI under DPA v2.3 (10 August 2026). Service Agreement law/forum sit outside the DPA.
European VDR with machine-learning due-diligence review. DPA allows training on aggregated anonymised data and requires opt-out before any broader training. Standard hosting is Azure Netherlands/Ireland, not Australia.
Opens a private software assessment of Imprima (Smart Review) for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | European Union / EEA |
| Australian region | No |
| Assurance | ISO/IEC 27001 |
| Training on customer content | Plan-dependent |
| Retention summary | On termination, Client chooses return or deletion of processor-held personal data, subject to lawful retention and backup cycles. Numeric active-deletion target is in DPA clause 14. |
| Pricing summary | No public list prices. Demo-led. Smart Compliance has a pricing popup that was not captured. |
| Legal content coverage | Room documents only. Not a licensed Australian primary-law collection. |
| Australian presence | Unknown — No Australian hosting region in DPA v2.3. Standard Azure NL/IE. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Imprima VDR plus optional AI-assisted features (Smart Review, Smart Summaries, Smart Redaction, Smart Index, Smart Compliance). DPA v2.3 dated 10 August 2026 is incorporated into the service agreement with Imprima or an affiliate. Feature-specific training uses must be described before they begin.
Ask: Which AI features are on our order, and are we on DPA v2.3?
Public claim only
DPA: Client Personal Data hosted in the EEA. Standard: Microsoft Azure Netherlands primary, Ireland disaster recovery. Security page: Azure storage AES-256 and TLS 1.2.
Ask: Can we obtain an Australian region, or is EEA-only acceptable?
Public claim only
Smart Review: ML-assisted DD so users review ~10% of documents to find ~95% of issues (vendor). Marketing: the more you use it, the better it becomes. Smart Redaction, Summaries, Index, Compliance also advertised.
Ask: Which Smart features will be enabled?
Not confirmed
No AU hosting in the DPA (EEA Azure). No named AU customers on pages reviewed.
Ask: Is Imprima offered to Australian deals with EEA hosting only?
Record the practical work needed to introduce and maintain the software.
Not confirmed
Book a demo. A Smart Compliance pricing popup exists; amounts not captured.
Ask: Itemised quote including AI features.
Public claim only
Client controls who may access the room (DPA). SSO not specified on security/DPA extracts.
Ask: SSO/MFA and permission inheritance into Smart Review?
Public claim only
DPA includes operational support response targets that are not SLAs or credits. Staff receive security training.
Ask: What are the numeric Sev-1 targets and Australian-hours coverage?
Compare complete work at the required quality, including checking and correction.
Public claim only
Smart Review 10%/95% claim is marketing, not an independent study.
Ask: Accuracy on our contract types, including Australian-style agreements?
Not confirmed
Fit for VDR DD and assisted contract review inside the room. Not a citator. AI outputs remain subject to authorised user review (DPA).
Ask: Must a lawyer accept every Smart Review hit before reliance?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
VDR guests are Client-controlled. No AU AI-disclosure template.
Ask: Bidder-side AI off by default?
Not confirmed
DPA discusses proprietary models and AI features; it does not name OpenAI or another LLM vendor. Azure is the host.
Ask: Name every model provider used by Smart Review/Summaries.
Not confirmed
Azure is named as host. A full published subprocessor list was not found in this review. DPA contemplates subprocessors with flow-down.
Ask: Provide the current dated subprocessor list with notice/objection rights.
Public claim only
DPA: may use aggregated or irreversibly anonymised information to train proprietary models used solely to provide or improve Imprima services, if it is no longer personal data and cannot reasonably identify the Client. Any AI feature that would use Client Content or Personal Data for training beyond that must be described first, with a chance to object, opt out or disable. Client Personal Data will not be given to a third party to train a public/shared model unless separately agreed in writing.
Ask: Confirm Smart Review will not train on our identifiable deal documents, and opt out of any feature-level training beyond anonymised aggregates.
Not confirmed
Not separately specified beyond DPA training rules.
Ask: Are in-app ratings used to train models?
Public claim only
Return or delete on termination at Client choice, subject to lawful retention (billing, CRM, legal). Backups until normal cycle. Ordinary deletion target described in clause 14 (not extracted as a number here).
Ask: Numeric retention for rooms, AI indexes and backups after close.
Public claim only
Client-chosen return or delete. Client must export first. Backups overwritten on cycle. Controller-side CRM records excluded.
Ask: Certified deletion of deal files and AI artifacts from active systems and backups.
Public claim only
Authorised persons under confidentiality. BYOK/CMK where separately agreed.
Ask: When can Imprima staff read room content, and is it logged?
Public claim only
Client determines End User access. CMK/BYOK optional. SSO not documented here.
Ask: SSO-only and a Smart Review permission-wall test.
Public claim only
Azure AES-256 at rest, TLS 1.2; Azure key management; CMK/BYOK where agreed.
Ask: Will we enable customer-managed keys?
Public claim only
ISO/IEC 27001 certification covering the whole business (not only the datacentre), half-yearly independent audits (security page). DPA: ISMS aligned with ISO 27001. SOC 2 not claimed on these pages. Reports not inspected.
Ask: Current ISO 27001 certificate scoped to the VDR and Smart Review.
Public claim only
DPA v2.3 (10 Aug 2026) plus service agreement. Liability follows the Service Agreement (not restated in the DPA extract). EEA hosting. Governing law of the Service Agreement not in the DPA extract.
Ask: Provide the Service Agreement (law, forum, liability cap) and confirm DPA v2.3.
Public claim only
Standard hosting EEA only (NL/IE). No AU region. Subprocessors not fully listed.
Ask: APP 8 assessment for EEA hosting of an Australian deal.
Public claim only
Personal Data Breach defined. Support response targets are not breach-notice clocks. Exact notice period not extracted as 48/72 hours from the DPA grep.
Ask: What is the contractual breach-notice deadline, and will it support NDB?
Public claim only
AI training beyond anonymised aggregates requires prior description and opt-out. Feature terms may change.
Ask: Notice before a new AI feature trains on Client Content?
Public claim only
Return or delete at Client choice; export first.
Ask: Export format for documents, Q&A and Smart Review marks, then certified deletion.
Not confirmed
VDR-centric. Marketplace not reviewed.
Ask: Any outbound integrations?
Not confirmed
Product is room-based review. Confirm no open web.
Ask: Does Smart Review call the open web?
Not confirmed
Smart Redaction can alter documents. DPA: AI outputs subject to authorised user review.
Ask: Require human confirm before redactions are applied or answers sent to bidders.
Public claim only
DPA: AI-generated outputs remain subject to authorised user review and Client-controlled access.
Ask: Audit log of Smart Review use exportable?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI due diligence and data rooms tools Australia
