Product and intended use
Define the configuration, people, information and tasks being assessed.
What Atlas does
Public claim only
The Atlas page, checked 2026-09-27, states 'Lawpath Atlas is the always-on AI operating system that monitors your legal, tax, accounting and compliance - then takes action before problems become expensive.' Four published limbs: legal documents, where Atlas 'monitors your legal documents in real time, flags missing clauses and risky terms, tracks legislation changes, and automatically drafts updates when laws or awards change'; tax, where it 'connects to your tax and accounting data to surface upcoming lodgements, flag missed deductions, pre-builds BAS checklists'; compliance, where it 'tracks your ASIC obligations, licences, registrations, permits and governance requirements'; and advisory, where it 'pre-compiles all context and books advisor calls automatically when risk signals spike'.
Ask: Which of the four Atlas limbs are generally available today, and which are described ahead of release?
Plan inclusion
Public claim only
The Atlas page states 'Atlas is included with every plan' and offers 'Try Atlas free' and 'Start your free trial' links to registration, checked 2026-09-27. No Atlas-specific price, seat charge or usage limit appears on that page. Lawpath's pricing page was not read within the operation budget, so which plan tiers exist and what they cost is not recorded here.
Ask: Is every Atlas limb included in every plan tier, or are the tax, compliance and advisory limbs gated by plan or by an add-on?
Release stage
Public claim only
Clause 50.9 of the Lawpath AI Supplementary Terms, headed 'Early Access', states 'You acknowledge and agree that the Lawpath Al is a beta feature. You are not required to use, test, or trial any of the Lawpath Al features, and you do so at your own discretion and risk. These Terms and your rights and access to the Lawpath Al are limited and may be terminated by Lawpath at any time for any reason or no reason upon written notice thereof.' The Atlas marketing page carries no beta or preview label. Clause 50.3 adds that Lawpath 'may disable or degrade the performance of such Lawpath AI features at its sole discretion.'
Ask: Is Atlas within the 'beta feature' characterisation in clause 50.9, and if so what would move it to general availability?
Deployment and hosting
Public claim only
A hosted web service. The published subprocessor list on Lawpath's trust centre (last updated 1 July 2026) records Amazon Web Services for 'Cloud hosting, storage, and infrastructure operations', processing 'Application data, account data, operational logs', with location given as 'AWS Asia Pacific (Sydney), Australia'. The data and security page states 'Our infrastructure is hosted on Amazon Web Services (AWS) in the Australian region'. No on-premises, private-cloud or self-hosted option appears on any page read.
Ask: Does the AWS Sydney statement cover every component that processes Atlas inputs and outputs, including any model inference?
Jurisdiction and coverage
Public claim only
Australian, on the pages read. The Atlas page names the obligation sources it monitors as 'your tax systems, legal activity, ASIC, ATO, Fair Work, IP Australia and your day-to-day platform usage', and refers to Australian awards and legislation. Clause 2566 of the terms provides that 'The Terms are governed by the laws of New South Wales, Australia.' No overseas jurisdiction is claimed for Atlas on any page read.
Ask: Which Australian obligation sources does Atlas actually connect to, as opposed to monitor indirectly, and how current is each feed?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 and not found. A map of lawpath.com.au searched for 'atlas ai llms compliance' returned no /llms.txt, /ai-info, /ai or /for-ai URL, and none of the pages read - the Atlas page, the terms and conditions, the data and security page and the trust centre - carries a block addressed to AI models, assistants, crawlers or LLMs, or any instruction on how to describe the product. Crawler allow and disallow directives were not examined; those are access control, not narrative control.
Ask: Does Lawpath publish any file or page that tells AI systems how to describe Atlas or the Lawpath platform?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
What may be put in, and on whose authority
Public claim only
Clause 50.6 states 'When you use Lawpath AI, Input and Output are your own data. You are solely responsible for the development, content, operation, maintenance, and use of your own data.' Clause 50.7 requires the user to instruct processing of any personal information in the input and to indemnify Lawpath for 'any consequences arising from your disclosure of confidential, proprietary, personal or sensitive information through Lawpath AI'. Clause 21A of the terms separately warrants that all persons whose personal information is provided have consented. Nothing read addresses legal professional privilege.
Ask: Where an adviser uses Atlas on a client's documents, what consent does Lawpath require to be in place, and does any term address privilege in the input or output?
Model and provider
Not confirmed
No model, model family or version is named for Atlas on any page read. The only provider named anywhere in connection with Lawpath AI is indirect: clause 50.10 states 'You may not use the Lawpath AI features in a manner that violates any OpenAI Policy', linking OpenAI's content, sharing and usage policies. Clause 50.3 states Lawpath AI 'may be developed by Lawpath and/or Lawpath's third-party providers'. No model provider appears on the published subprocessor list (last updated 1 July 2026), which names Amazon Web Services, Stripe, Google Workspace, Intercom, Salesforce and Twilio only.
Ask: Which models serve each Atlas limb, who supplies them, in which region does inference run, and why does no model provider appear on the published subprocessor list?
Subprocessors
Public claim only
Lawpath publishes an active subprocessor list on its trust centre, last updated 1 July 2026: Amazon Web Services for cloud hosting, storage and infrastructure, processing application data, account data and operational logs, located at 'AWS Asia Pacific (Sydney), Australia'; Stripe for payments and billing; Google Workspace for business email, calendars, files and collaboration; Intercom for support messaging; Salesforce for customer relationship management; and Twilio for messaging and notifications. Each of the five non-AWS entries records its location as 'Global infrastructure'. The trust centre lists 'Published subprocessor list and notification process' among its control objectives. Clause 50.7 of the terms states 'You agree that Lawpath may use subprocessors to provide Lawpath AI to you.'
Ask: Is the published list complete for Atlas specifically, given that clause 50.7 permits subprocessors for Lawpath AI and no AI or model provider is listed?
Training on customer content
Not confirmed
Clause 50.4 of the Lawpath AI Supplementary Terms states 'Lawpath does not use your data or permit others to use your data to train machine learning models used to provide the Lawpath AI or other large language models.' The Atlas marketing page describes a component named Cortex as a dataset of 'legal documents, tax records, compliance history, advisor transcripts and platform behaviour from 650,000+ businesses', with '1B+ Data points in the cortex', '1000,000+ Hours of advisor transcripts' and '500,000+ Contracts & statements analysed', and states Atlas 'reads signals across your entire business' and 'Benchmarks your tax position against similar businesses'. The two statements are not reconciled anywhere read: the term forecloses training on customer data, while the page describes an aggregate dataset built from platform activity and benchmarking against other businesses.
Ask: How is the Cortex dataset built and used if clause 50.4 forecloses training on customer data, and is our own material in it?
Feedback and derived data
Public claim only
Clause 50.4 addresses model training only. The document-storage clause grants Lawpath 'a non-exclusive, worldwide, royalty-free right and license to collect, use, copy, store, transmit, modify, and create derivative works of the Vault Documents to the extent necessary to provide the Services'. Clause 50A.2 states that in providing the services Lawpath 'may use software, cloud-based platforms and artificial intelligence (AI) tools, including tools supplied by third parties, to assist with tasks such as analysis, classification, research, transcription, drafting and preparation'. Nothing read states whether corrections a user makes to an Atlas output are retained or used to adjust behaviour.
Ask: Are user corrections to Atlas output retained, and if so are they confined to our account and can they be deleted?
Retention
Not confirmed
No retention period for Atlas inputs, outputs, signals or monitoring records appears on any page read. The document-storage clause states 'The storage service is intended to provide a record of, and not to serve as a repository for, original documents created or uploaded to the Lawpath Platform (the "Vault Documents"). Lawpath accepts no liability or responsibility for the preservation of Vault Documents. Lawpath reserves the right to store Vault Documents in any format, whether digitally or otherwise.' The trust centre (last updated 1 July 2026) lists 'Secure data retention and disposal' and 'Data classification and handling' among its 130 control objectives without publishing a period.
Ask: What retention periods apply to Atlas inputs, outputs, monitoring history and audit records, and can they be configured?
Deletion
Public claim only
The data and security page states 'If you'd like to see what data we have about you, just reach out and we'll happily provide a copy, in line with the Privacy Act 1988 (Cth) EU GDPR', and 'Think something's out of date or not quite right? Let us know and we'll fix or remove it. You can contact us anytime at support@lawpath.com.au.' Deletion is therefore by request to support. The trust centre lists 'Secure data deletion' among its control objectives. No deletion timeframe, no self-service deletion, no end-of-subscription deletion commitment and no backup purge period appears on any page read.
Ask: On cancellation, within what period is our content and any derived data deleted from production and backups, and will Lawpath confirm deletion in writing?
Who can read customer content
Not confirmed
Not published for Atlas. The data and security page states Lawpath implements 'different physical, electronic and managerial procedures' and 'Strict access controls and authentication protocols', and the trust centre lists control objectives including 'Just-in-time privileged access', 'Automated access reviews' and 'Audit logging and privileged access monitoring'. Nothing read states whether Lawpath staff or its advisers can read a customer's documents, on what basis, with what approval or logging. The terms note that where a Regulated Service is involved, information may be shared between Lawpath Operations, Lawpath Legal, Lawpath Tax & Advisory and any related body corporate.
Ask: Which Lawpath personnel and related entities can read our documents and Atlas outputs, is that access logged, and can we see the log?
Access control and administration
Public claim only
The trust centre (last updated 1 July 2026) publishes an access-control category of eight control objectives, including 'Multi-factor authentication for all systems', 'Role-based access control', 'Single sign-on integration', 'Just-in-time privileged access', 'Biannual access reviews' and 'Account lockout and session timeout'. These are published as control objectives in a 130-item catalogue across fourteen categories, not as product features; no page read states which of them a customer can configure in the Lawpath platform, and the trust centre also lists 'Administrator control over AI features' and 'AI activity audit logging' under an AI governance category.
Ask: Which of the trust centre's access-control and AI-governance items are customer-configurable in the product today, in particular administrator control over Atlas and access to the AI activity audit log?
Encryption
Public claim only
The data and security page states the AI contract review system uses 'End-to-end encryption of all data, both in transit using TLS 1.2+ and at rest using AES-256 encryption', with 'Secure cloud-based deployment with multi-zone redundancy'. The trust centre lists 'Encryption at rest', 'Encryption in transit', 'Backup encryption and replication' and 'Customer-controlled encryption keys' among its control objectives. The named algorithms are published for the AI contract review system rather than for Atlas, and nothing read says whether customer-managed keys are actually available to a customer.
Ask: Do the TLS 1.2+ and AES-256 statements apply to Atlas as well as to AI contract review, and are customer-controlled encryption keys available in practice?
Independent assurance
Not confirmed
Lawpath's trust centre (last updated 1 July 2026) states in its programme status that SOC 2 is at 'Readiness and evidence collection underway - In progress' and ISO 27001:2022 at 'ISMS alignment and control ownership underway - In progress', and says Lawpath 'is building toward independent assurance'. The same page's 130-item control catalogue nevertheless lists 'SOC 2 Type II certification', 'ISO / IEC 27001:2022 certification', 'SOC 2 Type II and SOC 3 attestation' and 'Cyber Essentials certification' as control objectives, and lists 'AI governance aligned to ISO/IEC 42001' and 'ISO/IEC 42001-aligned AI risk management'. The data and security page separately states documents are stored in 'ISO-27001 certified data centres', which is a statement about the data centre rather than about Lawpath, and that Lawpath 'conducts regular penetration testing'. No certificate, audit report or attestation letter is published; the policy library offers documents on a 'Request access' basis.
Ask: Does Lawpath currently hold any SOC 2 report or ISO certification, given the programme status marks both in progress while the control catalogue lists them as objectives, and what are the target dates?
Contract documents and the contracting entity
Public claim only
The terms define 'Lawpath, we, and our' as 'Lawpath Operations Pty Limited (ACN 163 055 954)', and separately name 'Lawpath Legal Pty Ltd (ACN 647 966 783), a law practice holding an Australian legal practitioner's certificate' and 'Lawpath Tax & Advisory Pty Ltd (ACN 676 942 206)'. Clause 2566 provides the terms are governed by the laws of New South Wales, Australia. Clause 50 contains the Lawpath AI Supplementary Terms, which 'form a part of the Lawpath Terms and Conditions' and apply to 'any feature(s) or functionality made available by Lawpath and labelled as Lawpath AI that utilise artificial intelligence, machine learning, or similar technologies'. Liability is capped: clause 31 limits total liability to fees paid, or where no fee has been paid to resupply 'capped at a maximum amount of $5,000.00'. No separate data processing agreement is published, and no effective or last-updated date appears on the terms page as retrieved.
Ask: Is Atlas a feature 'labelled as Lawpath AI' for the purposes of clause 50, and will Lawpath provide a dated version of the terms and a data processing agreement?
Cross-border processing
Not confirmed
The two sources differ. The data and security page states 'Your documents are stored locally and stay within Australian borders ... ensuring data stays within Australian borders and complies with Australian privacy laws', and 'we ensure all data processing occurs within Australian jurisdiction ... never leaves Australian territory'. Clause 50A.3 of the terms states 'You acknowledge and consent that, where Lawpath does so, your information (including personal information) may be input into and processed by those tools, including where those tools are provided or hosted outside Australia', referring to the software, cloud platforms and AI tools described in clause 50A.2. The published subprocessor list places AWS in Sydney but records Stripe, Google Workspace, Intercom, Salesforce and Twilio as 'Global infrastructure'.
Ask: How do the 'never leaves Australian territory' statement and clause 50A.3 sit together, and specifically is any Atlas input processed by an AI tool hosted outside Australia?
Incident and breach notification
Not confirmed
No incident or breach notification commitment to customers appears on any page read. The trust centre (last updated 1 July 2026) lists 'Incident response plan', 'Incident response procedures' and 'Post-incident root cause analysis' among its control objectives, and its policy library lists a 'Data Breach Notification Policy' and a 'PHI Data breach Notification Procedure' available on request rather than published. The terms and the data and security page are silent on notification, and no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) appears on any page read.
Ask: Will Lawpath commit in writing to notifying us of a security incident affecting our data within a fixed period, and will it release the Data Breach Notification Policy?
Change notice
Public claim only
Clause 50.12 states 'We may, in our sole discretion, modify, or update these Terms and Supplementary Terms from time to time ... so you should review such terms periodically. Your continued use of the Services and/or Lawpath Al after any such change constitutes your acceptance of any modifications.' Clause 50.3 states Lawpath 'may disable or degrade the performance of such Lawpath AI features at its sole discretion'. The trust centre lists 'Formal change management policy' and 'Continuous configuration reviews' among its control objectives. No advance notice period, product change log or model version identifier appears on any page read, and the terms page as retrieved carries no date.
Ask: What notice will we receive before an Atlas model, rule or threshold change that could alter its outputs, and is a version identifier available to record against work done on an output?
Export and exit
Public claim only
The terms allow either party to end the arrangement - 'Either you or us may terminate the Terms or close the Member Account at any time for any reason by email' - with fourteen days' notice from the customer, and state 'Lawpath may, at any time, for any reasons, terminate your access to all or any part of the Website or Services, with or without notice.' On the documents themselves the storage clause states the service 'is intended to provide a record of, and not to serve as a repository for, original documents' and that 'Lawpath accepts no liability or responsibility for the preservation of Vault Documents'. No export format, data-return obligation or post-termination access window is published for Atlas outputs, monitoring history or compliance records.
Ask: On termination, how do we extract our documents, Atlas outputs, compliance history and audit records, in what format, and for how long is access retained?
Connectors and signals
Public claim only
The Atlas page publishes a four-stage design - Cortex, Signals, Interpretation, Action - and describes the Signals stage as 'Real-time data from your tax systems, legal activity, ASIC, ATO, Fair Work, IP Australia and your day-to-day platform usage'. It states the compliance limb performs 'ASIC, ATO, Fair Work and IP Australia monitoring'. No named connector, no API, no credential model and no refresh frequency appears on any page read, and nothing read states whether Atlas holds credentials to government portals or reads only Lawpath-held records.
Ask: For each source named on the Atlas page, does Atlas connect directly with our credentials, read Lawpath-held records, or monitor public data, and how often?
Open-web and live retrieval
Not confirmed
The two sources pull in different directions. Clause 50.1 states in capitals 'LAWPATH AI CANNOT DYNAMICALLY RETRIEVE INFORMATION, AND OUTPUTS MAY NOT ACCOUNT FOR EVENTS OR CHANGES TO UNDERLYING FACTS OCCURRING AFTER THE AI MODEL WAS TRAINED.' The Atlas page states Atlas is 'always-on', takes 'Real-time data' from ASIC, the ATO, Fair Work and IP Australia, 'monitors your legal documents in real time' and 'Tracks award and legislation changes'. The two statements may describe different layers - a model that does not retrieve, fed by separate data feeds - but nothing read reconciles them.
Ask: How is the clause 50.1 statement that Lawpath AI cannot dynamically retrieve information reconciled with the real-time monitoring the Atlas page describes?
Actions Atlas can take
Public claim only
The Atlas page states Atlas 'takes action before problems become expensive' and that it 'Drafts contracts, builds compliance checklists, prepares tax summaries, books advisor calls - with human experts in the loop for complex matters', 'automatically drafts updates when laws or awards change', 'Auto-creates compliance tasks and deadline reminders', 'schedules lodgements' and 'Auto-books calls when risk signals require expert input'. No page read states which of these require confirmation, which can be disabled, or whether any lodgement or filing can be submitted without a human step. The terms contain no clause governing actions taken by a Lawpath AI feature on a user's behalf.
Ask: Which Atlas actions execute without a human confirmation step - in particular scheduling or submitting a lodgement or an ASIC form - and how are they switched off?
Human review before reliance
Public claim only
Clause 50.1 requires it: 'YOU SHOULD NOT RELY ON FACTUAL ASSERTIONS IN OUTPUT WITHOUT INDEPENDENTLY FACT CHECKING THEIR ACCURACY', alongside the statement that Lawpath AI cannot provide legal advice and is not a substitute for a lawyer. Clause 6 of the general terms states 'You acknowledge that the Information on the Website and Legal Documents created may contain mistakes, inaccuracies and/or errors' and that independent legal advice should be sought on enforceability. The Atlas page states 'AI handles standard work, humans review edge cases' and that Atlas 'knows when something needs a real lawyer or accountant', without publishing the criteria by which it decides.
Ask: What criteria does Atlas use to decide a matter needs a human adviser, and are they published or configurable?
