Legal-specific · Document automation · Medium confidence
Josef Legal Pty Ltd · Josef no-code platform including Josef Q (AI Q&A), contract automation and workflow/intake tools. Separate review for custom Professional Services builds and any later MSA that replaces the 14 August 2019 General Terms.
Australian no-code legal automation platform for in-house and firm teams: policy Q&A (Josef Q), self-service contracts and intake workflows.
Opens a private software assessment of Josef for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | Australia, United States, European Union / EEA, United KingdomHosting regions source, checked 2026-10-10 (opens in a new tab) |
| Australian region | Australian region available |
| Assurance | SOC 2 Type II |
| Training on customer content | Unknown |
| Retention summary | Privacy does not state a default retention window for Josef Q uploads, chats or embeddings. On termination, Confidential Information must be returned or destroyed on request. No published ZDR with model providers. |
| Integrations | Microsoft SharePoint, Microsoft Teams, Salesforce, Slack, DocuSign |
| Pricing summary | Subscription billed in advance on a recurring cycle under the 2019 General Terms; list price is not published. Over-limit use may be charged pro rata. Demo or sales quote required. |
| Legal content coverage | Josef Q answers from customer-uploaded policies and playbooks after document pre-processing. No licensed primary-law library is claimed. |
| Australian presence | Yes — Josef Legal Pty Ltd (ACN 619 557 452), Level 2, 520 Bourke Street, Melbourne. FAQ offers data residency in Australia among US, Europe and the UK. Checked 2026-10-10. Vendor page: “Josef provides data residency options in the US, Europe, the UK, and Australia.” (https://www.joseflegal.com/security). Recorded as Australian region available. |
A later research check disagrees with a value already on this profile. The published value is unchanged.
Define the configuration, people, information and tasks being assessed.
Public claim only
Josef is sold as a no-code suite: Josef Q (AI Q&A on uploaded policies), contract automation, and workflow/intake tools. There is no public plan matrix. The public General Terms (14 August 2019) still describe a 'chatbot builder' and do not name Josef Q.
Ask: Confirm which modules (Q, contracts, workflows) are on our order form and whether a later MSA supersedes the 2019 General Terms.
Public claim only
Josef is SaaS (dashboard.joseflegal.com and q.joseflegal.com) with optional embedding of chatbots on the customer's website. FAQ and security pages offer residency in the US, Europe, the UK and Australia. No on-premises option was found. Checked 2026-10-10. Vendor page: “Josef provides data residency options in the US, Europe, the UK, and Australia.” (https://www.joseflegal.com/security). Recorded as Australian region available.
Ask: Will our tenant be hosted only in Australia, including Josef Q indexes, backups and logs?
Public claim only
Josef Q turns uploaded policies and playbooks into Q&A tools after a document pre-processing engine. Staff can review and edit answers, select sources, and use human-in-the-loop moderation. Separate modules generate contracts and run intake/approval workflows. Chatbots can be launched to End Users.
Ask: Which Q collections, contract generators and intake bots will be live for which audiences (internal staff versus clients), and is pre-processing in scope?
Public claim only
Josef Q is grounded in the customer's own uploads, not a published Australian case-law or legislation library. Accuracy depends on what the firm uploads and moderates. General Terms are Victorian law.
Ask: How does Josef Q refuse out-of-corpus Australian legal questions, and can we restrict a tool to nominated policy sets?
Record the practical work needed to introduce and maintain the software.
Public claim only
2019 General Terms: non-exclusive subscription billed in advance, auto-renewing unless cancelled before the cycle ends. Fees may vary on reasonable notice, applying next cycle. Over-limit use may be charged pro rata. List price is unpublished.
Ask: Provide an itemised quote (Q seats or bots, contract volume, term, auto-renewal) and any query or upload caps.
Public claim only
Integrations page lists SharePoint (policy sync), DocuSign, Salesforce, Slack and Teams. No native Microsoft Word drafting add-in or PMS connector was described on the pages read. Chatbots embed via customer-placed code.
Ask: Demonstrate SharePoint-to-Q sync, permission-aware answers, and whether prompts are stored in Slack/Teams copies.
Public claim only
Support page advertises around-the-clock customer support plus a Professional Services team for design and launch. General Terms define Business Hours as 9am–5pm weekdays in Victoria. Notices go to info@joseflegal.com. No public Sev-1 times were found.
Ask: Provide the support SLA for our tenant, including Australian-hours coverage and a security escalation path.
Compare complete work at the required quality, including checking and correction.
Public claim only
Moderation pages claim that if Q does not know the answer it will say so, 'so they won't hallucinate'. No independent accuracy study was found. Customer stories (Bupa, adidas, Cityblock) are qualitative.
Ask: Share any evaluation of Josef Q on Australian policy sets, including unsupported-answer rates and citation miss rates after moderation.
Public claim only
Q is bounded to uploaded sources with page/paragraph citations and optional human moderation before or after launch. Contract and intake tools are rule/workflow based unless generative drafting is enabled in a given bot. Time saved after checking is not independently measured.
Ask: On our policy set, show where Q cites the clause, where it refuses, and how long Legal spends moderating a typical tool before business launch.
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Josef Q is marketed for the business to self-serve legal answers. General Terms require End User Terms before chatbot use and put Licensee Content risk on the customer. Launching Q to staff or clients is the firm's authority decision. No court-practice-note template was found.
Ask: What end-user disclosure and matter-exclusion controls exist, and can we keep Q internal-only?
Not confirmed
No named foundation-model provider (OpenAI, Anthropic, Azure, Bedrock or other) appears on the security, FAQ, Q or General Terms pages read.
Ask: Name each model, legal entity, endpoint region and contract used for Josef Q and any generative contract features, and the notice period before a model is swapped.
Not confirmed
Privacy allows disclosure to agents, vendors and service providers who perform functions on Josef's behalf, and to Google reCAPTCHA on the website. No dated public subprocessor list or DPA URL was found. Cloud-database hosts are unnamed.
Ask: Provide the current dated subprocessor register for Josef Q, with entity, country, purpose and our notice and objection rights.
Not confirmed
FAQ says customers own their data and Josef is custodian. Privacy allows use of personal information to 'improve our products and services' and aggregated (non-identifiable) disclosure for product improvement. General Terms licence Licensee Content only to meet Josef's obligations. No clause prohibits foundation-model training. The Q moderation page says 'the more you moderate, the smarter your tool gets', which is product improvement on customer Q&A, not a named LLM-training ban.
Ask: Does any signed document prohibit training of Josef or third-party models on uploads, prompts, outputs, embeddings and moderation labels?
Public claim only
Human-in-the-loop moderation lets Legal edit answers and add/remove sources so 'your tool will know for next time'. Whether those labels leave the customer tenant or train a shared model is not stated.
Ask: Do moderation labels stay in our tenant only, and can we disable any shared-model improvement?
Not confirmed
No published default for Q chats, embeddings, pre-processed document copies or moderation history. Privacy does not give a numbered retention schedule for product data.
Ask: State default and configurable retention for Q uploads, chats, embeddings and logs on an Australian tenant.
Public claim only
On termination, each party must return or destroy the other's Confidential Information on request. The Licensee's right to use the Software ceases immediately. No certified-deletion SLA covering cloud hosts or model providers was found.
Ask: On exit, what is deleted (Q corpora, chats, embeddings, subprocessors), in what period, and will you certify deletion in writing?
Public claim only
Privacy allows disclosure to Josef employees. General Terms allow disclosure of Confidential Information to personnel or advisers as needed for the Agreement. Professional Services may help build tools. No ticketed-access log was described.
Ask: Who can read our Q corpus and chats, from which countries, under what approval, and can we see those access logs?
Public claim only
Q offers a Moderation tab to audit sources and answers. SSO/SCIM and mandatory MFA were not described on the FAQ or security pages read. Embedding a chatbot on a public site is an access-control choice for the firm.
Ask: Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete Q prompt/answer audit log.
Public claim only
Security page claims AES-256 at rest, TLS 1.3 in transit, and that Josef holds server-side encryption keys with regular access audits. Customer-managed keys were not offered.
Ask: Confirm encryption of Q indexes and the path to any model provider, and whether customer-managed keys are available for an Australian tenant.
Public claim only
FAQ and security pages claim SOC 2 Type II and GDPR. Privacy also says SOC 2 Type I and II. Security claims 'ISO certification' without naming ISO 27001 or a certificate number, plus OWASP/ASD secure coding and annual third-party penetration testing. Reports were not inspected.
Ask: Provide the current SOC 2 Type II (and ISO if issued) reports covering Josef Q, with scope, exceptions and the latest penetration-test summary.
Public claim only
Public General Terms (14 August 2019, Victorian law) exclude most liability, require the Licensee to indemnify Josef for Licensee Content, and describe a chatbot product. Website terms of use separately limit website liability to resupply. No public DPA URL. Privacy references SCCs for EEA transfers. The 2019 MSA may not match Josef Q.
Ask: Provide the current MSA/DPA for Josef Q, any AI schedule, and negotiated liability and training terms.
Public claim only
Privacy says information may be stored, processed or transferred outside the customer's country, including the USA, with SCCs for EEA/UK. FAQ offers Australian residency as an option, not a default. Consent to overseas disclosure is requested in the privacy notice.
Ask: For Josef Q, list every country for storage, inference, backups and support, and confirm whether Australia-only inference is configured for us.
Not confirmed
Privacy points Australian residents to the OAIC. No contractual 72-hour Security Breach clause was found in the 2019 General Terms. Privacy states Josef has received zero government requests for information since founding.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months affecting Josef Q.
Public claim only
General Terms allow website-posted amendments; material amendments (Josef's reasonable discretion) get at least 30 days' notice, with a 30-day termination right if the change has a material adverse impact. No model-list freeze. Subprocessor change notice is unpublished.
Ask: What written notice will we get before a new model or subprocessor is added, and can we object?
Public claim only
Either party may terminate without cause on one month's written notice. Use of the Software ceases immediately. Confidential Information is returned or destroyed on request. Export formats for Q corpora and chat logs are not specified.
Ask: What export we receive for Q sources, chats and workflow definitions, and will you certify deletion within 30 days including subprocessors?
Not confirmed
SharePoint, Salesforce, Slack, Teams and DocuSign are marketed. Enabling a connector is the firm's choice. Privacy says if a third party processes data, that party's privacy policy applies.
Ask: List every connector that will be on for our tenant and the data each receives.
Public claim only
Josef Q is described as answering from uploaded content and selected sources. No open-web browsing toggle was found on the Q or moderation pages.
Ask: Does Josef Q browse the open web, and can we disable any such retrieval?
Not confirmed
Workflow automation can run intake and approvals. Q itself answers questions rather than writing to a PMS. Contract generators can produce documents for signing via DocuSign. Confirmation gates per workflow are configured by the customer.
Ask: Which workflows can send email, create Salesforce records or send DocuSign packets without a second Legal confirmation?
Public claim only
Q marketing emphasises review, edit and source selection, and human-in-the-loop training/moderation. Nothing in the 2019 General Terms requires a lawyer to approve an answer before an End User sees it. Unmoderated launch is possible if the firm chooses.
Ask: Can we require every new Q answer to be approved by a named lawyer before it is visible to the business?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI document automation tools Australia
