---
title: "Josef (Josef Legal Pty Ltd)"
url: "https://ailawframework.com/software/josef"
type: "software_profile"
site: "AI Law Framework"
id: "josef"
vendor: "Josef Legal Pty Ltd"
category: "Legal-specific"
segment: "Document automation"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# Josef (Josef Legal Pty Ltd)

> Australian no-code legal automation platform for in-house and firm teams: policy Q&A (Josef Q), self-service contracts and intake workflows.

Canonical page: https://ailawframework.com/software/josef  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Josef no-code platform including Josef Q (AI Q&A), contract automation and workflow/intake tools. Separate review for custom Professional Services builds and any later MSA that replaces the 14 August 2019 General Terms.

## Capabilities

- Document automation
- Intake and triage
- Knowledge search
- Agentic workflows
- Contract drafting

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA, United Kingdom |
| Australian region | Australian region available |
| Assurance | SOC 2 Type II |
| Training on customer content | Unknown |
| Retention | Privacy does not state a default retention window for Josef Q uploads, chats or embeddings. On termination, Confidential Information must be returned or destroyed on request. No published ZDR with model providers. |
| Integrations | Microsoft SharePoint, Microsoft Teams, Salesforce, Slack, DocuSign |
| Legal content coverage | Josef Q answers from customer-uploaded policies and playbooks after document pre-processing. No licensed primary-law library is claimed. |
| Pricing | Subscription billed in advance on a recurring cycle under the 2019 General Terms; list price is not published. Over-limit use may be charged pro rata. Demo or sales quote required. |
| Australian presence | Yes. Josef Legal Pty Ltd (ACN 619 557 452), Level 2, 520 Bourke Street, Melbourne. FAQ offers data residency in Australia among US, Europe and the UK. Checked 2026-10-10. Vendor page: “Josef provides data residency options in the US, Europe, the UK, and Australia.” (https://www.joseflegal.com/security). Recorded as Australian region available. |
| Website | https://joseflegal.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | Josef is sold as a no-code suite: Josef Q (AI Q&A on uploaded policies), contract automation, and workflow/intake tools. There is no public plan matrix. The public General Terms (14 August 2019) still describe a 'chatbot builder' and do not name Josef Q. | Confirm which modules (Q, contracts, workflows) are on our order form and whether a later MSA supersedes the 2019 General Terms. | [Josef — home](https://joseflegal.com/); [Josef Q](https://joseflegal.com/josef-q/); [Josef General Terms](https://joseflegal.com/general-terms/) |
| Deployment model | Public claim only | Josef is SaaS (dashboard.joseflegal.com and q.joseflegal.com) with optional embedding of chatbots on the customer's website. FAQ and security pages offer residency in the US, Europe, the UK and Australia. No on-premises option was found. Checked 2026-10-10. Vendor page: “Josef provides data residency options in the US, Europe, the UK, and Australia.” (https://www.joseflegal.com/security). Recorded as Australian region available. | Will our tenant be hosted only in Australia, including Josef Q indexes, backups and logs? | [Josef — Security](https://joseflegal.com/security/); [Josef — FAQ](https://joseflegal.com/faq/); [Josef hosting statement checked 2026-10-10](https://www.joseflegal.com/security) |
| AI features in scope | Public claim only | Josef Q turns uploaded policies and playbooks into Q&A tools after a document pre-processing engine. Staff can review and edit answers, select sources, and use human-in-the-loop moderation. Separate modules generate contracts and run intake/approval workflows. Chatbots can be launched to End Users. | Which Q collections, contract generators and intake bots will be live for which audiences (internal staff versus clients), and is pre-processing in scope? | [Josef Q](https://joseflegal.com/josef-q/); [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/); [Josef — Intake and triage](https://joseflegal.com/intake-and-triage/) |
| Jurisdictions and legal content | Public claim only | Josef Q is grounded in the customer's own uploads, not a published Australian case-law or legislation library. Accuracy depends on what the firm uploads and moderates. General Terms are Victorian law. | How does Josef Q refuse out-of-corpus Australian legal questions, and can we restrict a tool to nominated policy sets? | [Josef Q](https://joseflegal.com/josef-q/); [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/); [Josef General Terms](https://joseflegal.com/general-terms/) |
| Licence and pricing unit | Public claim only | 2019 General Terms: non-exclusive subscription billed in advance, auto-renewing unless cancelled before the cycle ends. Fees may vary on reasonable notice, applying next cycle. Over-limit use may be charged pro rata. List price is unpublished. | Provide an itemised quote (Q seats or bots, contract volume, term, auto-renewal) and any query or upload caps. | [Josef General Terms](https://joseflegal.com/general-terms/) |
| Word, Outlook and matter-system integration | Public claim only | Integrations page lists SharePoint (policy sync), DocuSign, Salesforce, Slack and Teams. No native Microsoft Word drafting add-in or PMS connector was described on the pages read. Chatbots embed via customer-placed code. | Demonstrate SharePoint-to-Q sync, permission-aware answers, and whether prompts are stored in Slack/Teams copies. | [Josef — Product integrations](https://joseflegal.com/product-integrations); [Josef General Terms](https://joseflegal.com/general-terms/) |
| Support and security contact | Public claim only | Support page advertises around-the-clock customer support plus a Professional Services team for design and launch. General Terms define Business Hours as 9am–5pm weekdays in Victoria. Notices go to info@joseflegal.com. No public Sev-1 times were found. | Provide the support SLA for our tenant, including Australian-hours coverage and a security escalation path. | [Josef — Training, onboarding and support](https://joseflegal.com/training-onboarding-support/); [Josef General Terms](https://joseflegal.com/general-terms/) |
| Published quality evidence | Public claim only | Moderation pages claim that if Q does not know the answer it will say so, 'so they won't hallucinate'. No independent accuracy study was found. Customer stories (Bupa, adidas, Cityblock) are qualitative. | Share any evaluation of Josef Q on Australian policy sets, including unsupported-answer rates and citation miss rates after moderation. | [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/); [Josef Q](https://joseflegal.com/josef-q/) |
| Task fit and verification | Public claim only | Q is bounded to uploaded sources with page/paragraph citations and optional human moderation before or after launch. Contract and intake tools are rule/workflow based unless generative drafting is enabled in a given bot. Time saved after checking is not independently measured. | On our policy set, show where Q cites the clause, where it refuses, and how long Legal spends moderating a typical tool before business launch. | [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/); [Josef Q](https://joseflegal.com/josef-q/) |
| Client authority and professional use | Not confirmed | Josef Q is marketed for the business to self-serve legal answers. General Terms require End User Terms before chatbot use and put Licensee Content risk on the customer. Launching Q to staff or clients is the firm's authority decision. No court-practice-note template was found. | What end-user disclosure and matter-exclusion controls exist, and can we keep Q internal-only? | [Josef General Terms](https://joseflegal.com/general-terms/); [Josef Q](https://joseflegal.com/josef-q/) |
| Foundation-model providers | Not confirmed | No named foundation-model provider (OpenAI, Anthropic, Azure, Bedrock or other) appears on the security, FAQ, Q or General Terms pages read. | Name each model, legal entity, endpoint region and contract used for Josef Q and any generative contract features, and the notice period before a model is swapped. | [Josef — Security](https://joseflegal.com/security/); [Josef Q](https://joseflegal.com/josef-q/) |
| Subprocessors | Not confirmed | Privacy allows disclosure to agents, vendors and service providers who perform functions on Josef's behalf, and to Google reCAPTCHA on the website. No dated public subprocessor list or DPA URL was found. Cloud-database hosts are unnamed. | Provide the current dated subprocessor register for Josef Q, with entity, country, purpose and our notice and objection rights. | [Josef Privacy Policy](https://joseflegal.com/privacy/) |
| Training on customer content | Not confirmed | FAQ says customers own their data and Josef is custodian. Privacy allows use of personal information to 'improve our products and services' and aggregated (non-identifiable) disclosure for product improvement. General Terms licence Licensee Content only to meet Josef's obligations. No clause prohibits foundation-model training. The Q moderation page says 'the more you moderate, the smarter your tool gets', which is product improvement on customer Q&A, not a named LLM-training ban. | Does any signed document prohibit training of Josef or third-party models on uploads, prompts, outputs, embeddings and moderation labels? | [Josef — FAQ](https://joseflegal.com/faq/); [Josef Privacy Policy](https://joseflegal.com/privacy/); [Josef General Terms](https://joseflegal.com/general-terms/); [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/) |
| Feedback and quality monitoring | Public claim only | Human-in-the-loop moderation lets Legal edit answers and add/remove sources so 'your tool will know for next time'. Whether those labels leave the customer tenant or train a shared model is not stated. | Do moderation labels stay in our tenant only, and can we disable any shared-model improvement? | [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/) |
| Retention of prompts, outputs and matter indexes | Not confirmed | No published default for Q chats, embeddings, pre-processed document copies or moderation history. Privacy does not give a numbered retention schedule for product data. | State default and configurable retention for Q uploads, chats, embeddings and logs on an Australian tenant. | [Josef Privacy Policy](https://joseflegal.com/privacy/) |
| Deletion and certified erasure | Public claim only | On termination, each party must return or destroy the other's Confidential Information on request. The Licensee's right to use the Software ceases immediately. No certified-deletion SLA covering cloud hosts or model providers was found. | On exit, what is deleted (Q corpora, chats, embeddings, subprocessors), in what period, and will you certify deletion in writing? | [Josef General Terms](https://joseflegal.com/general-terms/) |
| Vendor and verifier access to content | Public claim only | Privacy allows disclosure to Josef employees. General Terms allow disclosure of Confidential Information to personnel or advisers as needed for the Agreement. Professional Services may help build tools. No ticketed-access log was described. | Who can read our Q corpus and chats, from which countries, under what approval, and can we see those access logs? | [Josef Privacy Policy](https://joseflegal.com/privacy/); [Josef General Terms](https://joseflegal.com/general-terms/); [Josef — Training, onboarding and support](https://joseflegal.com/training-onboarding-support/) |
| Access control, SSO and audit | Public claim only | Q offers a Moderation tab to audit sources and answers. SSO/SCIM and mandatory MFA were not described on the FAQ or security pages read. Embedding a chatbot on a public site is an access-control choice for the firm. | Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete Q prompt/answer audit log. | [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/); [Josef — Security](https://joseflegal.com/security/) |
| Encryption in transit and at rest | Public claim only | Security page claims AES-256 at rest, TLS 1.3 in transit, and that Josef holds server-side encryption keys with regular access audits. Customer-managed keys were not offered. | Confirm encryption of Q indexes and the path to any model provider, and whether customer-managed keys are available for an Australian tenant. | [Josef — Security](https://joseflegal.com/security/) |
| Independent security assurance | Public claim only | FAQ and security pages claim SOC 2 Type II and GDPR. Privacy also says SOC 2 Type I and II. Security claims 'ISO certification' without naming ISO 27001 or a certificate number, plus OWASP/ASD secure coding and annual third-party penetration testing. Reports were not inspected. | Provide the current SOC 2 Type II (and ISO if issued) reports covering Josef Q, with scope, exceptions and the latest penetration-test summary. | [Josef — Security](https://joseflegal.com/security/); [Josef — FAQ](https://joseflegal.com/faq/); [Josef Privacy Policy](https://joseflegal.com/privacy/) |
| Contract, DPA, liability and forum | Public claim only | Public General Terms (14 August 2019, Victorian law) exclude most liability, require the Licensee to indemnify Josef for Licensee Content, and describe a chatbot product. Website terms of use separately limit website liability to resupply. No public DPA URL. Privacy references SCCs for EEA transfers. The 2019 MSA may not match Josef Q. | Provide the current MSA/DPA for Josef Q, any AI schedule, and negotiated liability and training terms. | [Josef General Terms](https://joseflegal.com/general-terms/); [Josef website terms](https://joseflegal.com/terms/); [Josef Privacy Policy](https://joseflegal.com/privacy/) |
| Cross-border transfers and APP 8 | Public claim only | Privacy says information may be stored, processed or transferred outside the customer's country, including the USA, with SCCs for EEA/UK. FAQ offers Australian residency as an option, not a default. Consent to overseas disclosure is requested in the privacy notice. | For Josef Q, list every country for storage, inference, backups and support, and confirm whether Australia-only inference is configured for us. | [Josef Privacy Policy](https://joseflegal.com/privacy/); [Josef — FAQ](https://joseflegal.com/faq/) |
| Incident notification and history | Not confirmed | Privacy points Australian residents to the OAIC. No contractual 72-hour Security Breach clause was found in the 2019 General Terms. Privacy states Josef has received zero government requests for information since founding. | State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months affecting Josef Q. | [Josef Privacy Policy](https://joseflegal.com/privacy/); [Josef General Terms](https://joseflegal.com/general-terms/) |
| Change notice for models, terms and processors | Public claim only | General Terms allow website-posted amendments; material amendments (Josef's reasonable discretion) get at least 30 days' notice, with a 30-day termination right if the change has a material adverse impact. No model-list freeze. Subprocessor change notice is unpublished. | What written notice will we get before a new model or subprocessor is added, and can we object? | [Josef General Terms](https://joseflegal.com/general-terms/) |
| Export and exit | Public claim only | Either party may terminate without cause on one month's written notice. Use of the Software ceases immediately. Confidential Information is returned or destroyed on request. Export formats for Q corpora and chat logs are not specified. | What export we receive for Q sources, chats and workflow definitions, and will you certify deletion within 30 days including subprocessors? | [Josef General Terms](https://joseflegal.com/general-terms/) |
| Connectors and third-party AI tools | Not confirmed | SharePoint, Salesforce, Slack, Teams and DocuSign are marketed. Enabling a connector is the firm's choice. Privacy says if a third party processes data, that party's privacy policy applies. | List every connector that will be on for our tenant and the data each receives. | [Josef — Product integrations](https://joseflegal.com/product-integrations); [Josef Privacy Policy](https://joseflegal.com/privacy/) |
| Open-web search | Public claim only | Josef Q is described as answering from uploaded content and selected sources. No open-web browsing toggle was found on the Q or moderation pages. | Does Josef Q browse the open web, and can we disable any such retrieval? | [Josef Q](https://joseflegal.com/josef-q/); [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/) |
| Agent actions and confirmation | Not confirmed | Workflow automation can run intake and approvals. Q itself answers questions rather than writing to a PMS. Contract generators can produce documents for signing via DocuSign. Confirmation gates per workflow are configured by the customer. | Which workflows can send email, create Salesforce records or send DocuSign packets without a second Legal confirmation? | [Josef — Intake and triage](https://joseflegal.com/intake-and-triage/); [Josef — Product integrations](https://joseflegal.com/product-integrations) |
| Human review before use | Public claim only | Q marketing emphasises review, edit and source selection, and human-in-the-loop training/moderation. Nothing in the 2019 General Terms requires a lawyer to approve an answer before an End User sees it. Unmoderated launch is possible if the firm chooses. | Can we require every new Q answer to be approved by a named lawyer before it is visible to the business? | [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/); [Josef General Terms](https://joseflegal.com/general-terms/) |

## Notes

Public General Terms dated 2019 still describe chatbots, not Josef Q. No named model providers or subprocessor list. ISO claimed without standard or certificate. foundedYear 2017 from Legaltech Hub/Legal Technology press, not the About page. Avoid citing podcast URLs that contain people's names in findings.

## Sources

- [Josef — home](https://joseflegal.com/) (checked 2026-09-20)
- [Josef Q — Training and moderation](https://joseflegal.com/josef-q/training-moderation/) (checked 2026-09-20)
- [Josef — Training, onboarding and support](https://joseflegal.com/training-onboarding-support/) (checked 2026-09-20)
- [Josef website terms](https://joseflegal.com/terms/) (checked 2026-09-20)
- [Josef hosting statement checked 2026-10-10](https://www.joseflegal.com/security) (checked 2026-10-10)
- [Josef — Security](https://joseflegal.com/security/) (checked 2026-09-20)
- [Josef — FAQ](https://joseflegal.com/faq/) (checked 2026-09-20)
- [Josef General Terms](https://joseflegal.com/general-terms/) (checked 2026-09-20)
- [Josef Q](https://joseflegal.com/josef-q/) (checked 2026-09-20)
- [Josef Privacy Policy](https://joseflegal.com/privacy/) (checked 2026-09-20)
- [Josef — Intake and triage](https://joseflegal.com/intake-and-triage/) (checked 2026-09-20)
- [Josef — Product integrations](https://joseflegal.com/product-integrations) (checked 2026-09-20)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.