Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, entity and Kira vs other Litera products
Public claim only
Kira is a Litera product. Contracting entity on the DPA is whichever of Freedom Solutions Group, L.L.C. dba Litera, Workshare Limited or DocsCorp Pty. Ltd signs the Customer Contract. Kira SaaS additional terms (from 14 May 2024) plus Master Terms (November 2025 version on the May 2025 PDF) plus SaaS Terms (March 2025). Shared or private cloud, or on-premises. Lito, Draft, Foundation and Transact have separate subprocessor lists and are out of this profile.
Ask: Confirm the contracting entity (including whether DocsCorp Pty Ltd can sign for Australia), cloud vs on-prem vs private cloud, Document Tier, and that Lito/You.com/Anthropic are not in our Kira tenancy.
Cloud, private cloud and on-premises
Public claim only
Kira DPA schedule covers on-premises (data on customer systems; Litera stores support tickets only) and cloud (data on Litera cloud applications). Additional terms: shared cloud within three business days; private cloud target two weeks. AWS jurisdiction chosen by the customer. No code is delivered for cloud.
Ask: Will we take shared cloud, private cloud or on-premises, in which AWS region, and is the tenancy single-tenant?
Product features in scope
Public claim only
Review page: 1,400+ pre-built smart fields plus customer-trained fields; natural-language queries over a contract set; collaborative review grids for M&A, real estate, banking and finance; summaries and export-ready reports. Predictive extraction is paired with generative AI. Additional terms: not intended as a virtual data room; customers should delete unused documents annually.
Ask: Which field packs, generative/Ask features, client End User collaboration and export formats will be enabled and billed?
Governing law and Australian coverage
Not confirmed
Master Terms PDF scrape did not capture a governing-law clause (document is paginated/truncated). DPA SCCs: Ireland (EU SCCs) and England and Wales (UK Addendum). Contracting entities include an Australian company (DocsCorp Pty Ltd). HQ listed as Chicago. No Australian-law option was found in the pages fully extracted.
Ask: Provide the full November 2025 Master Terms governing-law clause; will you accept Australian law and courts (or DocsCorp as counterparty with NSW/federal courts) and an APP addendum?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client-facing use and authority to process
Public claim only
End Users may include the customer's clients for collaboration on the customer's matter. Customer warrants it has all rights to use Documents without breaching confidentiality or law, and indemnifies Litera for Customer Data claims (SaaS Terms). Master Terms: Litera may use the customer's name and logo in customer lists and marketing. DPA: customer warrants it may transfer Personal Information to Litera and subprocessors worldwide.
Ask: Will clients be invited into our Kira projects; provide engagement-term wording covering AWS region, Azure OpenAI, US support tools and NewRelic logs; and opt us out of logo use?
Extraction and generative-model providers
Public claim only
Core extraction is Kira's predictive/smart-field models (vendor-trained). Kira subprocessor list: Azure OpenAI for hosting of generative models; Azure regions match the Kira hosting region where applicable, otherwise data is transferred to an Azure region with comparable privacy controls (exact mapping is an unread image dated Aug 2025). Trust Centre Bedrock/Anthropic/You.com rows are labelled for Litera Platform / Lito, not the Kira product list.
Ask: Name every model family and Azure region that will process our Kira content; produce Azure OpenAI ZDR/DPA artefacts; can we disable generative features; and confirm Lito/Anthropic/You.com are off.
Kira subprocessors
Public claim only
Kira list: AWS (jurisdiction chosen by customer); Office 365, Salesforce, Y Meadows, Mimecast, Zoom Contact Center, Intellek, Atlassian, Forethought (US); Pendo (EU analytics); NewRelic for Kira cloud logs (United States); Azure OpenAI. DPA: subscribe to be notified; five days to object on reasonable data-protection grounds or either party may terminate. Five days is short. Support/email tools in the US may see ticket content even if AWS is elsewhere.
Ask: Provide the dated list with legal entities and data types; 30-day notice; disable NewRelic/Pendo/Forethought if they receive document text; and confirm Azure OpenAI region for our AWS choice (unread table).
Training and secondary use
Not confirmed
Customer Provisions (custom extraction models trained in-product) are exclusive to the customer during the term and are deleted on expiry unless otherwise agreed. No Kira-specific contractual sentence was found that Azure OpenAI or Kira's predictive models will not train on Customer Data. Trust Centre no-training language is attached to Litera Platform Bedrock and Anthropic rows, not the Kira Azure OpenAI row. Responsible AI principles discuss vendor training data generally, not a customer opt-out.
Ask: Confirm in the Order that Documents, prompts, outputs, embeddings and Customer Provisions are not used to train any Azure, OpenAI or Litera foundation/extraction model used by other customers, and produce the Azure ZDR setting.
Feedback, ratings and product improvement
Public claim only
Pendo is listed for Kira as an analytics processor for how users interact with the application, in-app notification, training and user sentiment (EU). Responsible AI principles mention features for users to report errors and provide feedback. How that feedback is used to train models is not specified.
Ask: Can Pendo and in-product feedback be disabled or confined so that our matters never leave the tenant for product improvement?
Retention of documents, logs and LLM copies
Public claim only
Cloud DPA: customer-controlled deletion during the term; Litera deletes on Subscription Term expiry. SaaS Terms: retrieve before termination; then prompt deletion except backups until their cycle. Kira additional terms: 30 days' limited access after termination. NewRelic logs processed in the United States. Azure OpenAI retention is not stated on the Kira list. On-prem: Litera does not store documents except temporary support tickets.
Ask: For our tenancy, list retention for documents, Customer Provisions, Azure OpenAI, NewRelic, Pendo and backups, and whether generative features are zero-retention.
Deletion on instruction and on exit
Public claim only
Customer should delete unused documents annually. On termination, customer downloads/deletes; 30 days' limited access. Litera then deletes Customer Data except backups on their schedule. Customer Provisions deleted on expiry. No deletion certificate clause was found. On-prem support-ticket PI is 'deleted routinely'.
Ask: Contract a numbered deletion including backups, NewRelic, Azure OpenAI, Customer Provisions and a written certificate, with a 30–90 day retrieval window.
Vendor and contractor access to content
Public claim only
Kira DPA: Litera does not monitor cloud documents; limited access when the customer opens a support ticket. On-prem: telemetry (can be turned off in certain applications) plus support tickets. Forethought/Y Meadows triage support text. Security Addendum: Litera staff laptop encryption and ISO 27001 office controls. Customer-exportable vendor-access logs were not found.
Ask: Enumerate every human-access path; can we require per-ticket consent and disable telemetry; is access logged and exportable?
SSO, MFA, admin controls and audit logs
Not confirmed
Security Addendum describes Litera's own cloud AES-256/TLS 1.2+ and customer audit via ISO/SIG/pentest summaries. SSO, SAML, SCIM, MFA-for-users and exportable Kira audit logs were not documented on the Kira pages read.
Ask: On the plan we are buying, confirm SSO-only, MFA, SCIM, IP allow-listing, and an exportable audit log of uploads, queries, exports, admin changes and vendor access.
Encryption in transit and at rest
Public claim only
Security Addendum (2023): cloud customer data encrypted at rest AES-256; TLS 1.2+ in transit; certificates used to encrypt keys. Customer-managed keys were not offered. Whether Kira embeddings and Azure OpenAI links use the same KMS is not specified.
Ask: Name algorithms for every Kira store (including embeddings, NewRelic and Azure OpenAI), who holds keys, rotation, and whether customer-managed keys are available.
Independent security assurance
Public claim only
Trust Centre: ISO/IEC 27001:2022 (plus SoA), SOC 2 Type 2, SOC 3 — request-access, not inspected. Security Addendum: annual pentest summary, ISO certificate, SIG/CAIQ on written request at no extra cost. Cloud providers said to have SOC 2 Type II and ISO 27001. IRAP was not found. Scope of the SOC report (whether it includes Kira and Azure OpenAI) is unknown until the report is read.
Ask: Provide under NDA the current SOC 2 Type II (scope including Kira/Azure OpenAI, period, exceptions), ISO 27001:2022 certificate, latest pentest, and any Australian Essential Eight/IRAP mapping.
Contract, DPA, confidentiality, IP and liability
Public claim only
Master Terms (Nov 2025) + SaaS Terms + Kira additional terms + DPA. Direct-damages cap: fees in the prior 12 months on the applicable Ordering Document; cap does not apply to Litera's IP indemnity (s 7.4). Consequential damages excluded except indemnities. DPA liability is subject to the same Customer Contract caps. Logo use permitted. No APP-specific addendum. Amendments in writing signed by the party to be charged. Customer may not assign without consent; Litera may subcontract freely.
Ask: Will you sign an APP-aligned DPA, Australian law, no logo use, a cap that is not eroded for confidentiality/privacy, and flow-down to Azure OpenAI/NewRelic?
Cross-border processing and Australian residency
Public claim only
DPA 6.1: Litera is highly likely to process Personal Information in a number of jurisdictions around the world; restricted transfers use SCCs. AWS region is customer-chosen. Azure OpenAI may leave that region if no matching Azure region exists. NewRelic logs for Kira cloud are processed in the United States. Several support tools are US-hosted. Trust Centre Azure row (platform) names US, Canada or EU. An Australian Kira AWS region is not confirmed (mapping image unread). DocsCorp Pty Ltd exists as a possible contracting entity.
Ask: Is an Australian AWS region available and will you lock AWS plus matching Azure OpenAI there, excluding US NewRelic/support tools from document content?
Breach notification and incident history
Public claim only
DPA: notify the customer without undue delay and in any event within 72 hours after becoming aware of a Personal Information Breach. No public incident register. Security Addendum describes an incident program at a high level only.
Ask: Contract 72-hour notice for any suspected incident affecting Customer Data (not only GDPR Personal Information), NDB cooperation, Australian-hours security contact, and disclose material incidents in the last 24 months.
Change of terms, models and control
Public claim only
Amendments must be in writing and signed by the party against whom they are asserted. Subprocessor changes: subscribe then five days to object. Azure OpenAI region fallback when no matching region exists is at Litera's mapping (unread table, Aug 2025). End-of-life clause exists in Master Terms but was truncated in the scrape. Litera may subcontract freely.
Ask: Lock Azure OpenAI region and model version on the Order; require 30-day notice and a testing window before generative-model changes; and give termination and data-return rights on assignment, change of control or discontinuance.
Export, transition and shutdown
Public claim only
Thirty days' limited access after termination to download Documents, Reports and Customer Data. SaaS Terms: Litera then has no obligation to maintain data and deletes promptly except backups. Customer Provisions deleted. No bulk-export API or escrow found. Product is not a VDR, so long-term archive is on the customer.
Ask: Demonstrate a full project export (documents, annotations, Customer Provisions, reports, logs) in open formats, a 30–90 day retrieval window, deletion including Azure/NewRelic with a certificate, and transition assistance rates.
DMS and generative connectors
Not confirmed
Azure OpenAI is the documented generative connector for Kira. Support/analytics connectors (Salesforce, Pendo, NewRelic, Forethought) may see tickets or usage data. DMS connectors were not found on Kira primary pages. Client End Users are a collaboration connector of sorts.
Ask: For each connector we would enable, show identity, scopes, whether documents are copied, how we disconnect, and how copies are purged.
Open-web retrieval
Not confirmed
You.com is listed on the Trust Centre as web search applicable to Lito, not on the Kira subprocessor page. No Kira open-web search was documented.
Ask: Confirm Kira cannot call You.com or any other web retrieval for our tenancy.
Actions, exports and confirmation gates
Not confirmed
Users upload documents, train custom fields, query in natural language and export reports. Client End Users can be granted access. No public list of send/share/delete gates or prompt-injection testing for generative features was found.
Ask: List every action (including client End User actions and generative redrafts); which require explicit approval; how untrusted contract text is isolated; and provide the latest injection/red-team summary.
Human review of outputs
Public claim only
Marketing emphasises validating findings in context and linking answers to the source contract. Responsible AI principles say UX and educational materials should tell users to check AI output. No mandatory supervisor gate or exportable per-output review log with model version was found. Master Terms restrict publishing evaluations.
Ask: Can we require supervisor sign-off before reports leave the firm, export a per-document record of field pack/model route and reviewer, and keep generative features off for unsupervised users?
