Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
Contracting entity is Juro Online Limited (London EC1R 0DS; ICO ZB407649). Public DPA incorporates an unpublished MSA. Modules: create/approve/negotiate/sign/store plus AI Assistant, AI Review, AI Extract/Draft (pricing toggles), Operator. Optional MCP to ChatGPT and Claude; optional AI Managed Service using OpenAI custom GPT and/or Claude.
Ask: Confirm the MSA version, which AI modules and MCP connectors are on the Order, and whether AI Managed Service is in scope.
Deployment model
Public claim only
SaaS web app. Privacy lists AWS and MongoDB as platform hosting in the EEA. Offices in London and Riga. No on-premises option was found. Google authentication region follows the customer's Google account (US or EEA).
Ask: Name the AWS and MongoDB regions for our tenancy and whether an Australia or UK-only option exists.
Product features in scope
Public claim only
End-to-end CLM: templates, AI intake/review/redline, e-sign, repository Q&A (Operator), Word/Slack/CRM integrations. Homepage demo warns AI may be inaccurate and not to paste confidential info into the public demo.
Ask: Which of AI Review, AI Draft, AI Extract, Operator, e-sign and each connector will be enabled on our plan?
Governing law and Australian coverage
Not confirmed
The public Terms HTML scrape did not yield MSA governing-law text. DPA SCCs: if the Agreement is not EU-member-state law, SCCs are Irish law, or English law if the Agreement is UK law. UK GDPR trust page exists. No Australian law option or named AU customer was found.
Ask: Which law and courts apply to our MSA, and will you accept Australian law or at least a non-exclusive Australian forum?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who is controller, and client-matter authority
Public claim only
Privacy: Juro is controller of account/usage data and processor of data customers put in (users, counterparties, documents). DPA: Juro processes Customer Data only on Instructions (the Agreement). Customer remains responsible for data-subject rights using in-product tools.
Ask: Confirm the DPA is incorporated in our MSA and that we remain controller of contract content.
Foundation-model provider
Public claim only
Privacy: Google Cloud generative AI powers some newest AI features (auth US or EEA by Google account). Optional OpenAI MCP and Anthropic MCP (residency follows the customer's OpenAI/Claude policy). AI Managed Service: OpenAI custom GPT and/or Claude; Anthropic locations include US, UK, EEA plus other countries for safety/support. No customer model picker for the core Assistant was described.
Ask: Name every model that will see our contracts on our plan, their regions, and whether MCP and Managed Service are disabled.
Subprocessors and subprocessors list
Public claim only
Privacy is the DPA-referenced subprocessor list. Platform hosting: AWS and MongoDB in the EEA; Algolia also named on the trust footer. Optional MCP: OpenAI, Anthropic, Ory. DPA: New Subprocessor objection process (30 days then 14 days to terminate for a data-protection-law objection).
Ask: Provide the current full customer-data subprocessor table with regions and confirm 30-day objection applies to our Order.
Training and secondary use of customer content
Public claim only
Privacy (Improving Juro): if you use the AI Assistant, Juro does not — and does not allow its AI technology providers to — use your data to train any models, except models used only by your business. That exception is a customer-specific model, not a global training opt-in. MCP and Managed Service send data to OpenAI/Anthropic under those vendors' policies.
Ask: Confirm the no-training warranty applies to Operator, AI Review and Google Cloud gen-AI, and that no customer-only fine-tune will be built unless we order it.
Feedback and evaluation use
Public claim only
Privacy lists improving Juro via testing, feedback platforms, heat mapping and research, with the AI Assistant no-training carve-out above. Gong records sales/customer calls for training and monitoring. DPA personnel access Customer Data only as necessary to comply with Instructions.
Ask: Can product-analytics and Gong recording of our account be contracted off, and is contract text excluded from 'improving Juro' research?
Retention of prompts, documents and logs
Public claim only
DPA Term lasts until Juro deletes all Customer Data. In-term deletion via the product. After termination, up to 60 days' recovery then deletion as soon as reasonably practicable unless law requires storage. No public day-count for AI prompts or backups.
Ask: State retention for contracts, AI prompts/outputs, MCP logs, backups and Gong recordings.
Deletion and certified erasure
Public claim only
In-term: in-product delete is an Instruction; Juro complies as soon as reasonably practicable. End of Term: 60-day recovery then delete remaining copies unless law requires storage. DPA also requires export functionality during the Term. No certificate-of-deletion clause was found.
Ask: What is the maximum time to delete including backups, and will you issue a deletion certificate?
Vendor staff access to matter data
Public claim only
DPA: personnel and subprocessors access Customer Data only as necessary to comply with Instructions; confidentiality obligations; security training. Offices in London and Riga. AI Managed Service uses OpenAI/Claude to extract smartfields at the customer's request.
Ask: Is staff access logged, MFA-gated, limited to ticketed support, and available as an audit export? Which Riga roles can see contracts?
SSO, MFA, roles and audit logs
Not confirmed
Google authentication is described. Trust/application-security pages exist but the scrape did not yield SSO/SCIM/MFA detail. DPA mentions Additional Security Controls without naming them in the extracted appendix beyond TLS/AES-256.
Ask: Does our plan include Entra/Okta SSO, mandatory MFA, RBAC and exportable audit logs?
Encryption in transit and at rest
Public claim only
DPA Appendix 2: TLS for data in transit; AES-256 at rest.
Ask: Confirm TLS version in production, key custody in AWS/MongoDB, and whether customer-managed keys are available.
SOC, ISO and other audits
Public claim only
DPA: Juro will maintain Cyber Essentials certification and an annual SOC 2 Type II report for Audited Services. Trust pages market SOC 2. ISO 27001 was not found in the DPA. Reports were not inspected in this pass.
Ask: Provide the current SOC 2 Type II and Cyber Essentials artefacts whose scope includes AI Assistant, Operator and MCP.
Contract, DPA, liability and indemnity
Not confirmed
Public DPA is detailed (Instructions, SCCs, subprocessors via privacy policy, 60-day exit). The MSA/Terms page scrape did not return liability cap, IP indemnity or governing law. Evaluation terms exist separately for trials.
Ask: Provide the MSA liability cap, IP indemnity and confirmation the public DPA is incorporated without carve-outs for AI/MCP.
Cross-border transfers and residency
Public claim only
AWS and MongoDB listed as EEA for contract data. Privacy: some facilities are outside the UK/EEA; SCCs in the DPA. Google gen-AI and Google auth: US or EEA. MCP follows the customer's OpenAI/Claude residency. Anthropic enterprise use lists US, UK, EEA plus other countries for safety/support. No Australian region.
Ask: Map every flow of our contract text (AWS region, Google gen-AI, MCP, Managed Service) and confirm APP 8 wording if we proceed from Australia.
Breach notification
Public claim only
DPA 6.2: notify Customer without undue delay after becoming aware of a Data Incident; initial notice plus further detail as available; not an admission of fault. No 72-hour customer-notice number in that clause.
Ask: Write a 72-hour (or faster) customer-notice SLA into the Order, including the notification email.
Unilateral term and product changes
Public claim only
DPA: Security Measures may be updated if not a material reduction. New Subprocessors: objection and possible termination as above. MSA change mechanism was not in the Terms scrape.
Ask: Will material AI-provider, MCP, hosting-region or liability changes require 30 days' written notice and a right to terminate without penalty?
Export, termination and lock-in
Public claim only
DPA: export during the Term; after termination instruct return under the MSA; remaining data deleted after up to 60 days' recovery. Word/PDF originals remain wherever the customer stored them.
Ask: On termination, in what formats and within how many days can we export the repository and smartfields, and is deletion certified including backups?
PMS, DMS and agent connectors
Public claim only
CRM, Slack, Word, Drive, DocuSign, Zapier, API. ChatGPT and Claude MCP let those assistants call Juro data (beta for ChatGPT). Operator takes actions and answers questions in-product. No iManage connector found.
Ask: Which connectors are in our Order, is MCP in or out, and which Operator actions are enabled?
Open-web search and browsing
Not confirmed
No Juro page in this pass described the core Assistant browsing the open web. MCP uses ChatGPT/Claude, which may have their own web tools outside Juro's DPA.
Ask: Does Operator or AI Review send matter text to an open-web search index, and can ChatGPT/Claude web search be disabled when MCP is on?
What the tool may do without a click
Public claim only
Homepage: Operator 'takes actions for you'. AI agents for review/redline. E-sign sends to counterparties when a user triggers send. MCP lets an external LLM query Juro when the user prompts in ChatGPT/Claude.
Ask: Which Operator/MCP actions require in-product confirmation, and is MCP disabled by default?
Required lawyer review before client use
Public claim only
Public demo: AI may produce inaccurate information. No MSA clause requiring lawyer review was extracted (MSA unread). DPA does not itself impose human-in-the-loop on AI output.
Ask: Will you contract that AI Review/Operator output is not legal advice and must be lawyer-reviewed before counterparties receive a contract?
