Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
This profile covers the Contract Review tool reached inside the InfoTrack Search Platform, as described on the product page checked 2026-09-27. InfoTrack's AI solutions page lists four separate items: AI-assisted Contract Review, Tilly AI (a conversational agent in the platform), MCP (at infotrack.ai) and Financial Disclosure. Those three are out of scope here and have their own pages and, for MCP and APIs, their own Integration Terms.
Ask: On our account, is Contract Review enabled on its own, and are Tilly AI, InfoTrack MCP or Financial Disclosure enabled or available by default?
Deployment model and where data sits
Public claim only
Cloud only, inside the InfoTrack Search Platform; no on-premises or self-hosted option appears on the pages read. The privacy policy (checked 2026-09-27) states that all personal information collected is stored in a secured location in Australia on infrastructure managed by InfoTrack, and that personal information is stored and retained in Australia. General Terms clause 7.2(a) separately reserves InfoTrack's right to store any and all data using cloud storage technology at its discretion.
Ask: Is every component of Contract Review — upload store, AI processing, results, exported reports and backups — inside Australia, and will you contract to that rather than rely on clause 7.2(a) discretion?
What the tool does and where AI is the stated mechanism
Public claim only
The product page names AI as the mechanism for the substantive checks: contracts load while 'AI scans in the background performing deep-dive checks of the agreement and conditions', 'AI is used to identify clauses and key information', and 'AI is used to check if any items in the 10.7 apply to the property'. Named special-condition checks are release of deposit, amendments to land tax, unauthorised work, owner/builder work, strata conditions, probate application, death/incapacity, office closure period, residential tenancy agreement and rent back. Title checks are date issued, title reference matching the contract, vendor names matching the contract, and registered caveats, easements or covenants. Document classification splits and bookmarks each document in a single PDF upload. The date calculator and the one-click push into a LEAP or Smokeball matter are described without reference to AI.
Ask: For each named check, which are model-generated and which are rule-based, and what happens to a check the model cannot complete — is it reported as not run, or silently omitted?
Jurisdictional scope
Public claim only
The product page and its FAQ describe the tool as covering NSW contracts, and the checks named are NSW-specific: section 10.7 planning certificates, NSW title searches and dealings, and NSW residential tenancy and rent-back conditions. No other state or territory is named on the pages read, and no date is published for wider coverage.
Ask: Which states and territories are in scope today, what is the roadmap for Queensland, Victoria and Western Australia, and what does the tool do if a non-NSW contract is uploaded?
Release stage and beta terms
Public claim only
The product page carries no general-availability date, version or beta label; it offers a demonstration booking. General Terms clause 6.5, described on the Legal page as a new clause in the terms effective 1 September 2026, lets InfoTrack make pre-release, beta or preview versions available, disclaims all warranties for them including accuracy, provides them 'as is' and 'as available', puts their use entirely at the client's own risk, and allows InfoTrack to discontinue or suspend them at any time without notice. Whether Contract Review is supplied as a Beta Service is not stated anywhere read.
Ask: Is the Contract Review tool a Beta Service under clause 6.5, and if so will you confirm in writing when it leaves beta and which warranties then apply?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page or block instructing AI models, assistants, crawlers or large language models how to describe the product. A site map of infotrack.com.au returned no /ai-info, /llms.txt or /for-ai page, and neither the cached Contract Review page, the AI solutions page, the Legal page, the privacy policy nor the Information Security page carries a heading or block addressing AI models, assistants or crawlers. The product page does carry a question-and-answer FAQ block restating the product description. The check was not exhaustive across the whole site.
Ask: Does InfoTrack publish, anywhere on its sites or in any file served to crawlers, content that instructs AI models or assistants how to describe InfoTrack or the Contract Review tool?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and consents for processing matter data
Public claim only
General Terms clause 9.3 states that documents, data and materials stored against a matter file in the client's InfoTrack account (Matter Data) may be processed by AI Services, and puts on the client the responsibility for holding all necessary rights and third-party privacy consents (Client Consents) to provide that Matter Data for the AI Services. Clause 9.4 is a client warranty to the same effect and clause 9.5 is a client indemnity for failure to obtain and maintain them, adding that 'InfoTrack has not advised you on what consents are required in your jurisdiction'.
Ask: What consent wording does InfoTrack expect us to hold before a contract pack containing a vendor's and a purchaser's personal information is processed by the AI Services, and does the requirement differ where we act for the purchaser only?
Foundation-model providers and inference location
Not confirmed
No model, model family, provider, technique or inference location is named on the product page, the AI solutions page, the privacy policy, the Information Security page or clause 9 of the General Terms, all checked 2026-09-27. Clause 9.2 defines AI Services only as using 'artificial intelligence (AI) technologies, including generative AI'. Whether inference runs in Australia is therefore unestablished, and the privacy policy's Australian-storage statement addresses storage rather than processing by a model provider.
Ask: Name every model and provider used by Contract Review, the legal entity and country of each inference endpoint, whether any inference occurs outside Australia, and the notice we receive before a model is changed.
Subprocessors and onward disclosure
Public claim only
General Terms clause 8.3 has the client consent to InfoTrack sub-licensing and disclosing Client Data to Third Party Suppliers and subcontractors during the term for the limited purpose of providing the systems and products. The privacy policy names categories (technology providers including cloud, software and development services; customer-relations and marketing database providers; consultants) and names integration partners Sympli Pty Ltd, Practice Evolve, LEAP, PEXA, Smokeball, Actionstep and Adrant, plus resellers and suppliers such as state and territory land registries, ASIC, ACIC and NPCS. No dated subprocessor register naming AI or hosting processors for Contract Review was found on any page read.
Ask: Provide a dated subprocessor register for Contract Review with entity, country, purpose and data types, including any AI or hosting processor, and our notice and objection rights when it changes.
Training on customer content
Not confirmed
No document read states whether uploaded contracts, AI outputs or derived data are used to train or tune a model. General Terms clause 8.2 limits InfoTrack's licence to use Client Data to providing the systems and products and says InfoTrack 'must not use Client Data for any other purpose without Your prior written consent'; clause 9 on AI Services is silent on training. Clause 7.2(b) separately allows InfoTrack to gather analytics on activity, product use and Client Data for internal purposes subject to the confidentiality and privacy clauses. Clause 8.4 grants InfoTrack an irrevocable, perpetual, worldwide, royalty-free licence over any Property Attributes the client provides.
Ask: Will you warrant in writing that contract packs, AI check results and any embeddings are never used to train, fine-tune or evaluate a model, by InfoTrack or by any provider, and what is the scope of 'Property Attributes' under clause 8.4 when a contract pack is uploaded?
Feedback, ratings and quality telemetry
Public claim only
General Terms clause 6.5(g) provides that feedback or recommendations on Beta Services are assigned to InfoTrack in full, including all intellectual property rights, and that InfoTrack may use that feedback for any purpose without restriction or compensation. Clause 7.2(b) permits analytics on activity and product use for internal purposes such as billing, gauging interest and identifying usage patterns. No in-product rating control for Contract Review results is described on the pages read.
Ask: If a fee earner corrects or hides an AI check result, is that correction captured as feedback, does clause 6.5(g) assign it to InfoTrack, and can we disable that capture?
Retention of uploads, results and reports
Public claim only
The privacy policy commits to taking reasonable steps to destroy or de-identify personal information after it is no longer needed for business or legal purposes, and sets a specific 12-to-15-month window only for criminal history check data, which is a different service. General Terms clause 18 defines Retained Information that survives deletion, including material in archived backups and material required for accounting, corporate governance or regulatory purposes, and clause 23.1 requires the client to keep records auditable for at least 7 years after termination. No default or configurable retention period is published for an uploaded contract pack, the AI check results, the exported PDF report or any index.
Ask: State the default and configurable retention for uploaded contract packs, AI check results, exported reports and any index, and how long copies persist in archived backups after we delete a matter.
Deletion and certified erasure
Public claim only
General Terms clause 18.1(c) requires InfoTrack on termination to immediately cease using Client Data, and clause 18.1(d) requires each party promptly to securely and permanently delete or destroy the other's materials and confidential information, with the Retained Information carve-outs. Clause 18.2 requires Retained Information to be permanently deleted once no longer required. No obligation to certify deletion in writing, and no deletion timeframe, appears in the terms or privacy policy read.
Ask: On exit, what exactly is deleted and within what period, will you certify deletion in writing, and does the certification extend to any subcontractor or AI processor that held the data?
Vendor and overseas staff access to content
Public claim only
The privacy policy states that people located overseas may access personal information on a read-only basis in order to provide development services, that such access is strictly limited and under secure protocols, that the information remains under the supervision and control of Australian-based teams, and that the overseas service providers are located in Vietnam. It also states that staff accessing the system must pass appropriate security clearance requirements and that access is centrally restricted and monitored. No published access-approval or ticketing process, and no customer-visible access log, was found.
Ask: Who can read our uploaded contract packs and AI results, from which countries, under what approval, and can we receive an access log or exclude Vietnam-based read access for our account?
Access control, authentication and audit
Public claim only
General Terms clause 6.3 has InfoTrack issue User Credentials and clause 22.3 makes the client solely responsible for all use of those credentials, including by unauthorised users, and allows InfoTrack to rely on any order placed with them. Clause 22.2 forbids the client allowing access by an unauthorised person. The privacy policy refers to suitable password protection measures and centrally restricted, monitored access. Single sign-on, enforced multi-factor authentication and an exportable audit trail of who ran or edited a contract review are not described on any page read.
Ask: Does the platform support single sign-on and enforced multi-factor authentication for our users, and can we export an audit trail of every Contract Review run, edit, hide and export?
Encryption in transit and at rest
Public claim only
The privacy policy states that data is encrypted during transit using current TLS protocol and stored encrypted at rest using AES-256 encryption. General Terms clause 22.1 requires each party to maintain security controls that meet or exceed ISO 27001:2022 or an equivalent or successor standard and that protect Client Data from accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access. Customer-managed keys are not offered on any page read.
Ask: Confirm the encryption applied to uploads, AI processing, results and backups for Contract Review, the key-management arrangement, and whether customer-managed keys are available.
Independent security assurance
Not confirmed
Three sources checked 2026-09-27 do not agree. The Information Security page and site footer carry a single badge image captioned 'SOC 2 Type II and ISO' with no certificate, scope, auditor or date, and offer a security pack and a trust centre at trust.infotrack.com on request. The privacy policy says InfoTrack 'operates an Information Security Management System (ISMS) with full consideration of the ISO27001:2013 standard', which is a statement about design against the 2013 version rather than a certification. General Terms clause 22.1 requires controls that meet or exceed ISO 27001:2022. The trust centre was not read.
Ask: Provide the current SOC 2 Type II report and any ISO 27001 certificate with its version, scope statement, certification body and expiry, and confirm whether the Contract Review tool and its AI processing are inside that scope.
Contract stack, entity, liability and forum
Public claim only
The contract is General Terms plus Product Terms plus Third Party Terms, with Integration Terms for APIs and the MCP server; later documents prevail on inconsistency (clause 1.2). General Terms are current from 1 August 2026 for new clients and 1 September 2026 for existing clients, accepted by continuing to use the account. Schedule 1 (Australia) names InfoTrack Pty Limited, ABN 36 092 724 251, Tower 2, Level 21/200 Barangaroo Avenue, Sydney NSW 2000, New South Wales law and non-exclusive jurisdiction of its courts. The liability cap is service fees actually paid in the 12 months immediately preceding the claim; a super cap of AUD$1,000,000 applies to the clause 14.1(a) and (b) indemnities and to breaches of clauses 5 or 19. The Legal page states that clients holding an MSA are unaffected and the General Terms do not apply to them. No data processing addendum is published.
Ask: Confirm whether we contract on the General Terms or an MSA, and provide a data processing addendum covering the AI Services, the contracting entity's ACN, and any negotiated change to the 12-month cap.
Cross-border transfers and APP 8
Not confirmed
The privacy policy states that InfoTrack stores and retains personal information in Australia and does not presently disclose personal information to any organisation located overseas, while noting disclosure in Australia to multinational organisations also located in the United Kingdom, the United States and New Zealand, and read-only overseas access from Vietnam for development services under enforceable contractual arrangements. General Terms clause 7.2(a) reserves InfoTrack's right to store any and all data using cloud storage technology at its discretion, without naming a region, and clause 8.3 permits disclosure to unnamed Third Party Suppliers and subcontractors. The two documents therefore differ: the privacy policy commits to Australian storage while the terms reserve discretion.
Ask: Will you contract to Australia-only storage and Australia-only inference for Contract Review, and if not, list every country where uploads, prompts, model processing, results, logs and backups may be located.
Incident and data-breach notification
Public claim only
General Terms clause 21.4(d) requires the recipient of personal information to notify the discloser in writing without undue delay and no later than 72 hours after becoming aware of a regulator compliance notice or a breach of clause 21 or any privacy law. The data-breach provision requires a party with reasonable grounds to suspect a notifiable data breach to notify the other in writing with all relevant details within the same 72 hours, co-operate on investigation and mitigation, and co-operate in preparing and submitting notifications to the regulator and affected individuals. Clause 21 survives termination. No incident history is published on the pages read.
Ask: Confirm the 72-hour clock runs from InfoTrack becoming aware rather than from confirmation, that it covers incidents at a subcontractor or AI processor, and whether any material incident has affected the platform in the last 24 months.
Change notice for terms, features and models
Public claim only
General Terms clause 7.1 lets InfoTrack modify the method of supply, change or discontinue any feature or functionality for any reason, and amend the agreement from time to time, with at least 14 days' written notice where a change materially and adversely affects the client's rights; clause 7.3 then allows termination by written notice within 60 days of the change taking effect. The Legal page publishes dated current and previous versions of the General, Product and Third Party Terms. No notice or objection right attaches to a change of AI model, technique or subprocessor.
Ask: What written notice will we receive before the model, technique or AI subcontractor behind Contract Review changes, and does a model change count as a material adverse change for clause 7.1(c) purposes?
Export and exit
Public claim only
General Terms clause 18.1 requires the client on termination to cease use and pay outstanding fees, and requires deletion of each party's materials subject to Retained Information. Clause 23.1 requires the client to keep records of its use auditable for at least 7 years after termination. No obligation on InfoTrack to return or export client data, and no export format or timeframe, appears in the terms read. Reports can be exported as a branded PDF during use, per the product page.
Ask: On termination, in what format and within what period will you return uploaded contract packs, AI check results and exported reports, and is there a charge?
Connectors and data pushed to a practice-management system
Not confirmed
The product page states that extracted data can be populated directly into a matter in LEAP or Smokeball with a single click and that standard practice-management-system integration applies. The privacy policy names LEAP, Smokeball, Sympli Pty Ltd, Practice Evolve, PEXA, Actionstep and Adrant as integration partners with whom InfoTrack and the ATI Group may share information with the client's consent. General Terms clause 4 makes Third Party Products subject to Third Party Terms, and clause 8.3 permits disclosure of Client Data to Third Party Suppliers. The firm must decide which integrations to enable and on whose consent.
Ask: Which integrations will be live on our account, what data does each receive when we push extracted contract data, and whose consent does InfoTrack treat as authorising that sharing?
Open-web retrieval
Not confirmed
Nothing on the product page, the AI solutions page, the privacy policy or the General Terms read on 2026-09-27 says whether the tool retrieves anything from the open web. The inputs described are the uploaded PDF contract pack and InfoTrack's own search and certificate data from land registries, councils and other authorities. No web-search control or toggle is described.
Ask: Does Contract Review or its AI component retrieve anything from the open web or from any source outside our upload and InfoTrack's own search data, and can that be disabled?
Actions the tool can take without a second step
Public claim only
The product page describes a review-then-act flow: results appear beside the document, the user clicks to edit or hide text in the report, and then exports a branded PDF, and the push of extracted data into a LEAP or Smokeball matter is a one-click user action. The date calculator computes a settlement date from the contract conditions without a described confirmation step. No autonomous or scheduled action is described. The separate Tilly AI product is described as completing actions 'with your explicit approval each step of the way'; that statement is about Tilly, not Contract Review.
Ask: Can Contract Review write to a matter, send a report or calculate a date that is relied on without a user pressing a button, and is the computed settlement date presented as a draft or as a matter field?
Human review before reliance
Public claim only
General Terms clause 9.6 states that AI Services may not have been developed or approved by legal practitioners and carry no legal or professional endorsement, may not reflect applicable laws, suit the client's circumstances or be current, do not constitute legal advice and must not be relied on as legal advice, that 'A qualified lawyer should review any AI Services output before it is relied upon', and that the client is responsible for validating outputs using its own professional skill, judgment and experience. The product page makes the same point in marketing terms and says the final legal advice and risk assessment remain the responsibility of the solicitor or conveyancer. No product control forces a named reviewer before a report is exported to a client.
Ask: Is there any configurable control that requires a nominated supervisor to sign off a Contract Review report before it can be exported or sent to a client?
