Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
This profile covers the Seller Disclosure Solution as described on its own page, checked 2026-09-27, where the heading reads 'Seller Disclosure Solution' and the site navigation labels the same link 'Seller Disclosure Tool'. The FAQ states it 'is available to all InfoTrack clients under the Queensland services menu, with no separate sign-up required' and is 'built on the existing InfoTrack platform'. The vendor's own navigation groups it under Compliance Solutions, and lists Tilly AI, MCP and Contract Review separately under AI Solutions; the AI solutions page itself presents only those three plus Financial Disclosure.
Ask: Is the Seller Disclosure Solution enabled on our account by default, is it charged separately from the certificates it orders, and are Tilly AI, InfoTrack MCP or Contract Review enabled alongside it?
Deployment model and where the data sits
Public claim only
Cloud only, inside the InfoTrack Search Platform; no on-premises or self-hosted option appears on any page read. The privacy policy, read 2026-09-27, states that personal information collected is stored in a secured location in Australia on infrastructure managed by InfoTrack and that it is stored and retained in Australia. General Terms clause 7.2(a) separately reserves InfoTrack's right to 'store any and all data using cloud storage technology, at InfoTrack's discretion', without naming a region.
Ask: Will you contract to Australian storage and Australian processing for every component of the Seller Disclosure Solution - ordered certificates, the drafted Form 2, the compiled PDF pack, the share link and backups - rather than rely on the clause 7.2(a) discretion?
What the solution does and where AI is the stated mechanism
Public claim only
The product page, checked 2026-09-27, sets out four steps: verify property details by lot and plan or title reference; 'Generate and customise your certificate list', where 'Certificates are all related to specific sections in the Seller disclosure for your selection'; 'Complete the Seller Disclosure Statement', where 'AI-powered automations are built into your workflow, pre-populating your forms when results are returned'; and 'Combine all documents into a single PDF, rearrange the order, upload any additional files, and prepare the final version for sharing'. AI is named twice on the page and nowhere else on it, the other reference being 'harnessing AI technology for form drafting and document compilation'. Populating fields of a prescribed form from returned certificate and practice-management data is also what deterministic field mapping does, and nothing on the page distinguishes which is used.
Ask: In the Seller Disclosure Solution, which specific fields of the PLA Form 2 are populated by a model and which by deterministic field mapping, and what does the tool do with a field it cannot populate - leave it blank, flag it, or guess?
Jurisdictional scope
Public claim only
Queensland only. The product page, read 2026-09-27, addresses the seller disclosure obligations the vendor states arise under the Property Law Act 2023 for all residential property sales from 1 August 2025, names the PLA Form 2 Seller Disclosure Statement as the approved form, and lists the prescribed certificates that may accompany it. Access is described as being under the Queensland services menu. No other state or territory is addressed by this solution on any page read; InfoTrack's separate Contract Review tool is described as covering NSW contracts.
Ask: Is the Seller Disclosure Solution updated as the Queensland approved form and the prescribed certificate list change, who is accountable for the form version in use, and how quickly is a form change reflected?
Release stage and beta terms
Public claim only
The product page carries no general-availability date, version or beta label; it offers a demonstration booking, and a later section on the same page still reads 'We're building a custom workflow solution' and 'Our solution will combine certificate ordering with smart form drafting and compilation', alongside FAQ text describing the solution as already available. General Terms clause 6.5, described on the Legal page as new in the terms effective 1 September 2026, lets InfoTrack make pre-release, beta or preview versions available, disclaims all warranties including accuracy, provides them 'as is' and 'as available', puts their use entirely at the client's own risk, and allows discontinuation or suspension at any time without notice.
Ask: Is the Seller Disclosure Solution supplied as a Beta Service under clause 6.5, and if so what warranties apply to a PLA Form 2 drafted with it while it remains in beta?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for content telling AI models, assistants or large language models how to describe this product. Seven InfoTrack pages were read - the product page, the AI solutions page, the 'How InfoTrack Uses Artificial Intelligence' page, the Legal page, the privacy policy, the Information Security page and the Product Terms - and none carries a heading or block addressed to AI models, assistants or crawlers, and none contains a 'describe as' instruction. A site map of infotrack.com.au on file returned no /llms.txt, /ai-info or /for-ai URL. The product page does carry a question-and-answer FAQ block restating the product description. The check covered the pages named, not the whole site, and no crawler directive file was fetched.
Ask: Does InfoTrack publish anywhere on its sites, or in any file served to crawlers or AI assistants, content that instructs an AI model how to describe InfoTrack or the Seller Disclosure Solution?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and consents for processing matter data
Public claim only
General Terms clause 9.3, read 2026-09-27, has the client agree that 'documents, data, materials stored against a matter file within Your InfoTrack Account (Matter Data) may be processed by AI Services', and makes the client responsible for having all necessary rights and third party privacy consents (Client Consents) to provide that Matter Data. Clause 9.4 is a client warranty to the same effect, and clause 9.5 is a client indemnity for failure to obtain and maintain them, adding that 'InfoTrack has not advised you on what consents are required in your jurisdiction'.
Ask: A seller disclosure pack carries the seller's details and is given to a buyer. What consent does InfoTrack expect us to hold from the seller before that matter data is processed by the AI Services, and does the requirement differ where the buyer is not our client?
Foundation-model providers and inference location
Not confirmed
No model, model family, provider, technique or inference location is named for this solution on the product page, the AI solutions page, the 'How InfoTrack Uses Artificial Intelligence' page, the privacy policy, the Information Security page or clause 9 of the General Terms, all checked 2026-09-27. Clause 9.2 defines AI Services only as using 'artificial intelligence (AI) technologies, including generative AI'. The AI page names one technique for a different product - 'Textract use within SettleIT Discharge mortgage authority' - and does not list the Seller Disclosure Solution among the products built with InfoTrack AI. Whether any inference for this solution runs in Australia is therefore unestablished; the privacy policy's Australian-storage statement addresses storage, not model processing.
Ask: Name every model and provider used by the Seller Disclosure Solution, the legal entity and country of each inference endpoint, and confirm in writing whether any prompt containing Queensland seller or property data leaves Australia.
Subprocessors and onward disclosure
Public claim only
General Terms clause 8.3 has the client consent to InfoTrack sub-licensing and disclosing Client Data to Third Party Suppliers and subcontractors during the term 'for the limited purpose of providing the InfoTrack Systems and InfoTrack Products'. The privacy policy names categories (technology providers including cloud, software and development services; customer-relations and marketing database providers; consultants) and names integration partners and suppliers including state and territory land registries, ASIC, ACIC and NPCS. No dated subprocessor register naming an AI, hosting or form-drafting processor for this solution was found on any page read on 2026-09-27.
Ask: Provide a dated subprocessor register for the Seller Disclosure Solution with entity, country, purpose and data types, including any AI or hosting processor, and set out our notice and objection rights when it changes.
Training on customer content
Not confirmed
No document read states whether the certificates, drafted forms or compiled packs are used to train or tune a model. General Terms clause 8.2 limits InfoTrack's licence over Client Data to providing the systems and products and says InfoTrack 'must not use Client Data for any other purpose without Your prior written consent'; clause 9 on AI Services is silent on training. Clause 7.2(b) allows InfoTrack to gather analytics on activity, product use and Client Data for internal purposes subject to the confidentiality and privacy clauses. Clause 8.4 grants InfoTrack 'an irrevocable, perpetual, worldwide, royalty-free licence to use, reproduce, modify, adapt, publish, create derivative works from and sub-licence any Property Attributes you provide'.
Ask: Will you warrant that seller disclosure packs, drafted Form 2 statements and any embeddings are never used to train, fine-tune or evaluate a model, and define exactly what 'Property Attributes' under clause 8.4 captures when we lodge a lot and plan or upload a certificate?
Feedback, corrections and quality telemetry
Public claim only
General Terms clause 6.5(g) provides that where the client gives feedback or recommendations on Beta Services it assigns all rights, title and interest, including all intellectual property rights, in that feedback to InfoTrack, which may use it for any purpose without restriction or compensation. Clause 7.2(b) permits analytics on activity and product use for internal purposes such as billing, gauging interest and identifying usage patterns. No in-product rating or correction-capture control is described for this solution on any page read.
Ask: When a practitioner corrects a pre-populated Form 2 field on screen, is that correction captured as feedback or training signal, does clause 6.5(g) assign it to InfoTrack, and can the capture be disabled for our account?
Retention of certificates, drafted forms and compiled packs
Public claim only
The privacy policy commits to taking reasonable steps to destroy or de-identify personal information once it is no longer needed for business or legal purposes, and publishes a specific window only for criminal history check data, a different service. General Terms clause 18 defines Retained Information surviving deletion, including material in archived backups and material required for accounting, corporate governance or regulatory purposes, and clause 23.1 requires the client to keep records of its use auditable for at least seven years after termination. No default or configurable retention period is published for an ordered certificate, a drafted PLA Form 2, the compiled PDF pack or a generated share link.
Ask: State the default and configurable retention for ordered certificates, drafted Form 2 statements, compiled packs and share links, how long a generated secure link stays live, and how long copies persist in archived backups after we delete the matter.
Deletion and certified erasure
Public claim only
General Terms clause 18.1(c) requires InfoTrack on termination immediately to cease using any Client Data, and clause 18.1(d) requires each party promptly to securely and permanently delete or destroy the other party's materials and confidential information, subject to the Retained Information carve-outs in (i) to (iv). Clause 18.2 requires Retained Information to be permanently deleted once no longer required. No deletion timeframe, and no obligation to certify deletion in writing, appears in the terms or the privacy policy read on 2026-09-27.
Ask: On exit or on request, what is deleted from the Seller Disclosure Solution and within what period, will you certify it in writing, and does the certification extend to any AI or hosting subcontractor that held a disclosure pack?
Vendor and overseas staff access to content
Public claim only
The privacy policy, read 2026-09-27, states that people located overseas may access personal information on a read-only basis in order to provide development services, that such access is strictly limited and under secure protocols, that the information remains under the supervision and control of Australian-based teams, and that those overseas service providers are located in Vietnam. It also states that staff accessing the system must pass appropriate security clearance requirements and that access is centrally restricted and monitored. No access-approval process, ticketing requirement or customer-visible access log is published.
Ask: Who at InfoTrack can read our drafted Form 2 statements and compiled disclosure packs, from which countries, under what approval, can we receive those access logs, and can Vietnam-based read access be excluded for our account?
Access control, authentication and audit
Public claim only
General Terms clause 6.3 has InfoTrack issue User Credentials; clause 22.3 requires the client and each Permitted User to protect them and not allow their use by anyone else, and makes the client solely responsible for all use of those credentials, including by unauthorised users, with InfoTrack entitled to rely on any order placed with them. Clause 22.2 requires the client to ensure no Unauthorised Person can access or use the systems for a Non-Permitted Purpose. The privacy policy refers to suitable password protection and centrally restricted, monitored access. Single sign-on, enforced multi-factor authentication and an exportable audit trail are not described on any page read.
Ask: Does the platform support single sign-on and enforced multi-factor authentication for our users, and can we export an audit trail showing who ordered each certificate, who edited each Form 2 field and who generated each share link?
Encryption in transit and at rest
Public claim only
The privacy policy states that data is encrypted during transit using the current TLS protocol and stored encrypted at rest using AES-256 encryption. General Terms clause 22.1 requires each party to maintain security controls that 'meet or exceed ISO 27001:2022 (or any equivalent or successor standard)' and that protect Client Data from accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access. No key-management detail and no customer-managed key option appears on any page read on 2026-09-27.
Ask: Confirm the encryption applied to ordered certificates, the drafted Form 2, the compiled pack, the secure share link and backups, the key-management arrangement, and whether the share link is authenticated or guessable.
Independent security assurance
Not confirmed
Three sources read on 2026-09-27 do not agree. The Information Security page carries a single badge image whose file name is 'SOC-2-Type-II-and-ISO.svg', with no certificate, scope, auditor or date, and offers a security pack and a trust centre at trust.infotrack.com on request. The privacy policy states that InfoTrack 'operates an Information Security Management System (ISMS) with full consideration of the ISO27001:2013 standard', which describes design against the 2013 version rather than a certification. General Terms clause 22.1 requires controls that meet or exceed ISO 27001:2022. The trust centre was not read.
Ask: Provide the current SOC 2 Type II report and any ISO 27001 certificate with its version, scope statement, certification body and expiry, and confirm whether the Seller Disclosure Solution and its AI pre-population are inside that scope.
Contract stack, entity, liability and forum
Public claim only
The contract is General Terms plus Product Terms plus Third Party Terms, with Integration Terms for APIs and the MCP server, and later documents prevailing on inconsistency (clause 1.2). The General Terms are current from 1 August 2026 for new clients and 1 September 2026 for existing clients, accepted by continuing to use the account. Schedule 1 (Australia) names InfoTrack Pty Limited, ABN 36 092 724 251, Tower 2, Level 21/200 Barangaroo Avenue, Sydney NSW 2000, with New South Wales law and the non-exclusive jurisdiction of its courts. The liability cap is service fees actually paid in the 12 months immediately preceding the claim, with an AUD$1,000,000 super cap for the clause 14.1(a) and (b) indemnities and breaches of clauses 5 or 19. The Legal page states clients holding an MSA are unaffected. The Product Terms v4 contain no Seller Disclosure part, and no data processing addendum is published.
Ask: Confirm whether we contract on the General Terms or an MSA, provide the contracting entity's ACN, provide a data processing addendum covering the AI Services, and state which product terms govern the Seller Disclosure Solution.
Cross-border transfers and APP 8
Not confirmed
The privacy policy states that InfoTrack stores and retains personal information in Australia and does not presently disclose personal information to any organisation located overseas, while describing disclosure in Australia to multinational organisations also located in the United Kingdom, the United States and New Zealand, and read-only overseas access from Vietnam for development services under enforceable contractual arrangements. General Terms clause 7.2(a) reserves InfoTrack's right to store any and all data using cloud storage technology at its discretion without naming a region, and clause 8.3 permits disclosure of Client Data to unnamed Third Party Suppliers and subcontractors. The two documents therefore differ: the privacy policy commits to Australian storage while the terms reserve discretion, and neither addresses where model inference occurs.
Ask: Will you contract to Australia-only storage and Australia-only inference for the Seller Disclosure Solution, and if not, list every country where a certificate, a prompt, a drafted Form 2, a compiled pack, a log or a backup may be located.
Incident and data-breach notification
Public claim only
General Terms clause 21.4 requires the recipient of personal information to notify the discloser in writing 'without undue delay and within no more than 72 hours after becoming aware' of a regulator compliance notice or request, or a breach of clause 21 or any applicable privacy law. The data-breach provision in the same clause requires a party with reasonable grounds to suspect a Notifiable Data Breach to notify the other in writing with all relevant details within the same 72 hours and to co-operate on investigation and mitigation. Clause 21 survives termination. No incident history is published on any page read.
Ask: Confirm the 72-hour clock runs from InfoTrack becoming aware rather than from confirmation, that it covers an incident at an AI or hosting subcontractor, and whether any material incident has affected the platform in the last 24 months.
Change notice for terms, features and models
Public claim only
General Terms clause 7.1 lets InfoTrack modify the method of supply, change or discontinue any feature or functionality, and amend the agreement from time to time, with at least 14 days' written notice where a change materially and adversely affects the client's rights; clause 7.3 then allows the client to terminate by written notice within 60 days of the change taking effect. The Legal page publishes dated current and previous versions of the General, Product and Third Party Terms. No notice or objection right attaches to a change of AI model, technique or subprocessor, and nothing published addresses notice when the Queensland approved form or prescribed certificate list changes.
Ask: What written notice will we receive before the model or technique behind Form 2 pre-population changes, and what is your committed timeframe for updating the tool when the Queensland approved form or prescribed certificate list changes?
Export and exit
Public claim only
General Terms clause 18.1 requires the client on termination to cease use and pay outstanding fees, and requires deletion of each party's materials subject to Retained Information; clause 23.1 requires the client to keep records of its use auditable for at least seven years after termination. No obligation on InfoTrack to return or export client data, and no export format or timeframe, appears in the terms read on 2026-09-27. In use, the product page states the compiled pack can be exported as a single PDF and shared by a secure link.
Ask: On termination, in what format and within what period will you return ordered certificates, drafted Form 2 statements and compiled packs, is there a charge, and do existing share links stop working?
Connectors, certificate ordering and data pushed to a practice management system
Not confirmed
Two data paths exist and the firm must decide on both. The product page states the Seller Disclosure Statement carries 'pre-filled data from your Practice Management System', and that certificates relevant to the statement are ordered in one place inside the platform from land registries, councils and other authorities. General Terms clause 4 makes Third Party Products subject to Third Party Terms and clause 8.3 permits disclosure of Client Data to Third Party Suppliers; Product Terms Part B subjects any LRS Product to the Third Party Terms and limits use to the Permitted Purpose. The privacy policy names the integration partners with whom information may be shared with the client's consent. The Third Party Terms were not read.
Ask: Which integrations will be live on our account, what data does each receive when the Form 2 is pre-filled, whose consent does InfoTrack treat as authorising that sharing, and which Third Party Terms apply to each certificate the workflow orders?
Open-web retrieval
Not confirmed
Nothing on the product page, the AI solutions page, the 'How InfoTrack Uses Artificial Intelligence' page, the privacy policy or the General Terms read on 2026-09-27 says whether the solution retrieves anything from the open web. The inputs described are the property identifiers entered, the certificates returned from land registries, councils and other authorities, data drawn from the firm's practice management system, and files the user uploads. No web-search control or toggle is described.
Ask: Does the Seller Disclosure Solution or its AI component retrieve anything from the open web or from any source outside our entered details, the ordered certificates and our practice management system, and can that be disabled?
Actions the tool takes without a second step
Public claim only
The described flow is user-initiated at each step: the user verifies property details, generates and customises the certificate list, completes the Seller Disclosure Statement with on-screen editing, then combines documents into a single PDF, rearranges the order, uploads additional files and prepares the final version for sharing, with a secure link generated to share the pack. Pre-population is described as happening automatically 'when results are returned', which is the one step the page describes as occurring without a user action. No autonomous ordering, sending or scheduled action is described.
Ask: Can the solution order a certificate, populate a Form 2 field or generate a share link without a user pressing a button, and is a pre-populated field presented as a draft the user must accept, or as a completed entry?
Human review before reliance
Public claim only
General Terms clause 9.6 states that AI Services 'may not have been developed, or approved by legal practitioners and carry no legal or professional endorsement', may not reflect applicable laws, suit the client's circumstances or be current, 'do not constitute legal advice and must not be relied on as legal advice', that 'A qualified lawyer should review any AI Services output before it is relied upon', and that the client is responsible for validating output using its own professional skill, judgment and experience. The product page describes on-screen editing of the statement and a review step before compiling, but no product control requires a nominated reviewer to sign off before the pack is compiled or shared.
Ask: Is there a configurable control that requires a nominated supervisor to approve the PLA Form 2 and the compiled pack before a share link can be generated, and is that approval logged?
