Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Lawcadia is an end-to-end legal operations platform (intake, matters, spend, FOI/privacy workflows). There is no public plan matrix. LawcadiaAI is labelled coming soon. Public Terms & Conditions for Law Firms are not a corporate customer MSA.
Ask: Confirm our modules, whether LawcadiaAI is on the order form, and attach the corporate MSA/DPA.
Deployment model
Public claim only
SaaS on AWS. Security page: data stored in Sydney, London or Oregon depending on the organisation, with in-region redundancy. Home claims AI data hosting and processing managed in-region. No on-premises option was found.
Ask: Will our tenant, backups, logs and any LawcadiaAI indexes sit only in AWS Sydney?
AI features in scope
Public claim only
LawcadiaAI is in development: planned assistance for document review, matter-history summaries and intake classification, embedded in existing workflows. It is not described as generally available. Current platform is workflow and integration based.
Ask: Is any LawcadiaAI feature live on our tenant today, and which tasks will it be permitted to run?
Jurisdictions and legal content
Public claim only
Platform holds the customer's matters and documents, not a licensed case-law library. Firm terms for Australia/New Zealand users: New South Wales law. Privacy policy for AU/US/rest-of-world (EEA/UK have a separate policy).
Ask: Confirm NSW (or other) law for our corporate MSA, and that LawcadiaAI will not browse open-web Australian law.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
The platform is used by corporate/government legal and by law firms briefing into clients. Firm terms put confidentiality of user content on the parties and let the client restrict firm access. Launching LawcadiaAI to the business is a future authority decision; specific data-handling for AI is deferred.
Ask: What end-user disclosure will LawcadiaAI require, and can we keep it internal-only?
Foundation-model providers
Not confirmed
No named foundation-model provider appears on the AI, security or privacy pages. LawcadiaAI is not generally available.
Ask: Before go-live, name each model, legal entity, region and contract, and the notice period before a model is swapped.
Subprocessors
Public claim only
Privacy names Amazon Web Services in Australia and the United States as the hosting provider. No dated public subprocessor register or DPA URL was found.
Ask: Provide the current dated subprocessor register, including any AI processor, with entity, country, purpose and objection rights.
Training on customer content
Not confirmed
AI FAQ: specific data-handling arrangements will be set out before AI features are made available; no present training ban. Privacy allows use of personal information to maintain and improve Lawcadia.com and for internal training and analysis.
Ask: Will the LawcadiaAI terms prohibit training of Lawcadia or third-party models on matters, prompts and outputs?
Feedback and quality monitoring
Not confirmed
Privacy uses feedback and usage patterns to improve the service. No description of LawcadiaAI labels was found because the product is not live.
Ask: Will AI feedback labels stay in our tenant only?
Retention of prompts, outputs and matter indexes
Public claim only
Security FAQ: backups throughout the day, retained six months. No numbered retention schedule for live matter data or forthcoming AI indexes.
Ask: State default and configurable retention for matters, emails, backups and any LawcadiaAI logs on a Sydney tenant.
Deletion and certified erasure
Public claim only
Firm terms: a law firm must ask its client, not Lawcadia, to delete or return user content. Privacy offers deletion rights for Lawcadia-controlled personal information. No certified-deletion SLA covering AWS was found for corporate customers.
Ask: On exit, what is deleted (matters, files, backups, AWS copies), in what period, and will you certify deletion in writing?
Vendor and verifier access to content
Public claim only
Firm terms: Lawcadia may disclose user content to officers, employees, contractors or advisers on a need-to-know basis to operate the platform, bound by confidence. Privacy allows overseas disclosure where necessary to provide the service.
Ask: Who can read our matters, from which countries, under what approval, and can we see those access logs?
Access control, SSO and audit
Public claim only
Security: SAML SSO (Okta, Auth0, OneLogin, Entra ID, Google), SCIM, MFA for administrator roles and recommended generally, RBAC, matter-level information barriers, audit trails.
Ask: Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete access and (future) AI audit log.
Encryption in transit and at rest
Public claim only
Security: AES-256 at rest at application and cloud level; TLS 1.2/1.3 in transit; described as end-to-end encrypted. Customer-managed keys were not offered.
Ask: Confirm encryption of matter files and any future AI path, and whether customer-managed keys are available for Sydney.
Independent security assurance
Public claim only
ISO 27001:2022 ISMS claimed, with third-party assessment, audits and penetration testing. SOC 2 was not claimed on the security page read. Certificates were not inspected.
Ask: Provide the current ISO 27001:2022 certificate and latest penetration-test summary covering the Sydney environment.
Contract, DPA, liability and forum
Not confirmed
Public artefacts are website terms, a privacy policy and Terms & Conditions for Law Firms (NSW law for AU/NZ). Those firm terms exclude indirect loss and disclaim security of customer networks. No public corporate MSA, DPA or AI schedule.
Ask: Provide the corporate MSA/DPA for our tenant, with liability, training and AI terms, before LawcadiaAI is enabled.
Cross-border transfers and APP 8
Not confirmed
Security: organisation data in Sydney, London or Oregon. Privacy 6.1: AWS in Australia and the United States; 7.1 says the platform is hosted in Australia. Home claims in-region AI processing. Those statements need reconciling for a Sydney tenant.
Ask: List every country for storage, backups, support and any LawcadiaAI inference, and confirm Australia-only processing is configured for us.
Incident notification and history
Not confirmed
No contractual 72-hour Security Breach clause was found in the firm terms. Privacy points Australians to the OAIC. Built-in FOI and data-breach workflows are a product feature, not a vendor NDB SLA.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months.
Change notice for models, terms and processors
Public claim only
Privacy: changes published on the site and, where appropriate, by email or in-platform; consent for material changes where required. Firm terms restrict adverse confidentiality/security changes. No model-list freeze because AI is not live.
Ask: What written notice will we get before LawcadiaAI or a new subprocessor is added, and can we object?
Export and exit
Not confirmed
Firm terms do not specify export formats for a departing corporate customer. Law-firm content is controlled by the client. No certified-deletion SLA.
Ask: What export we receive for matters, files and workflow definitions, and will you certify deletion within 30 days including AWS?
Connectors and third-party AI tools
Not confirmed
SharePoint, iManage, Outlook, Word, OpenText and webhooks are marketed. Enabling a connector is the firm's choice. Privacy: third-party sites have their own policies.
Ask: List every connector that will be on for our tenant and the data each receives.
Open-web search
Public claim only
LawcadiaAI is described as operating on data already in matters, documents, workflows and spend, contrasted with general AI tools. It is not live. No open-web toggle was found.
Ask: When LawcadiaAI ships, will it browse the open web, and can we disable any such retrieval?
Agent actions and confirmation
Not confirmed
Current workflows can run intake and approvals without generative AI. Planned AI is assistance inside those workflows. Confirmation gates are configured by the customer.
Ask: Which workflows can send email or create records without a second Legal confirmation, today and once LawcadiaAI ships?
Human review before use
Not confirmed
No live LawcadiaAI review UI. FAQ emphasises customer controls over how AI is used once released. Current platform does not require lawyer approval of a generative answer because none is generally available.
Ask: When LawcadiaAI ships, can we require every output to be approved by a named lawyer before the business sees it?