Product and intended use
Define the configuration, people, information and tasks being assessed.
Standalone vs partner
Public claim only
Pricing separates standalone all-in-one ($89/user/month plus tax, month-to-month, no lock-in advertised) from research-only access with any LawY integration partner. Standalone lists Drive/OneDrive/Dropbox, document analysis, drafting, 200+ prompts, contract review/redlining and Word add-ins. LEAP AU markets LawY as included research — confirm whether the partner build includes standalone connectors.
Ask: Which capabilities, integration permissions, usage limits, research jurisdictions and verification turnaround are on our exact plan?
Hosting
Public claim only
Privacy: service hosted and operated in Australia, Canada, the United States, the United Kingdom and New Zealand through LawY and service providers. No contractually selectable AU-only region was found.
Ask: Can we pin storage and inference to Australia, including backups?
Research and drafting
Public claim only
Fast and deep legal research, optional lawyer-in-the-loop verification, document upload as context, first drafts, contract review, Word add-ins. Instant answers vs Deep Research + Human Verification.
Ask: Which of Instant, Deep Research, verification, drafting and connectors will be on?
Coverage
Public claim only
Homepage: available for all areas of law in Australia, the United Kingdom, the United States and Ireland. Accuracy pages for Australia and the UK. Currency and authorised-report status still need librarian confirmation.
Ask: Which collections and currency controls apply to our practice areas?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Uploads and verification
Not confirmed
Uploading documents or sending a question for verification discloses matter facts to LawY and, if verified, to a masked verifier. Identity masking does not remove identifying facts the user pastes. Standalone connectors can pull from firm drives.
Ask: What is disclosed to verifiers and operations staff, and what client consent is required?
OpenAI and Gemini
Public claim only
Security: LLMs via corporate arrangements with OpenAI and Google Gemini. Prompts sent in real time; responses returned without being logged or reused for model training (vendor). Anthropic is on some LEAP/Corto lists but was not named on the LawY security extract.
Ask: Named models, regions and whether the customer can choose the provider.
Subprocessors
Not confirmed
OpenAI and Google Gemini named. Trust Centre links OpenAI's trust page. Privacy: affiliates in US, Canada, UK, Ireland, Poland, Australia and New Zealand; personnel and service providers worldwide. No dated product-specific list with countries and objection rights was obtained.
Ask: Provide the current dated list, purposes, countries and change process.
No-training vs cl 7.1
Not confirmed
Security and homepage: LawY does not use conversations or documents to train AI models; ZDR at foundation-model APIs. Pricing FAQ: conversations are never used to train any AI models. Terms cl 7.1 authorises LawY and third-party providers to store and use Input and Output to develop and improve services and products, including as part of the design, training and development process for machine-learning models. Cl 18.3 grants a related licence. These public documents are not reconciled.
Ask: Which signed term prevails, and does it prohibit training on prompts, outputs, uploads, embeddings, feedback and verifier knowledge-base copies?
Verified answers
Public claim only
Security: operations team monitors verified answers for quality. LEAP sibling: only verified answers with placeholders may be added to a knowledge base. Terms cl 7.1 also allows analytics, usage patterns and abuse review.
Ask: Are verified answers added to a shared knowledge base, and can we opt out?
ZDR vs platform
Not confirmed
Provider ZDR is advertised for API calls. That is not a numbered retention period for LawY platform copies, backups or verifier records. Privacy retains information while a purpose exists.
Ask: Default and configurable retention for conversations, uploads, embeddings, logs, backups and verifier copies.
Deletion
Public claim only
Privacy describes erasure rights. Terms: after termination the customer has no right to use or access Output. No public certified-deletion SLA covering model-provider stores.
Ask: On exit or matter close, what is deleted, in what period, with written certification?
Staff and verifiers
Public claim only
Security: limited engineer access for debugging/search relevance/feature development; operations monitor verified answers; double-masked lawyer verification by qualified lawyers. Privacy: queries on a firm LEAP account may be visible to other members of that LEAP account. Pricing FAQ: each user only sees their own conversations except the verifier on a submitted item. Unresolved across plans.
Ask: Who can read our content (LawY staff, verifiers, same-firm users, admins), from which countries, and is it logged?
Visibility
Not confirmed
Privacy: name and queries visible to other members associated with a firm LEAP account. Pricing FAQ: each user only sees their own conversations. These may be plan differences or stale wording. SSO/SAML was not described on the standalone pages.
Ask: Current visibility model for our standalone or partner account, including ethical walls and admin view.
Encryption
Public claim only
TLS 1.2 or higher in transit; AES-256 at rest. Customer-managed keys were not offered on the pages read.
Ask: Confirm encryption of logs, verifier copies and the path to each model provider, and whether CMK is available.
Trust Centre
Public claim only
trust.lawy.ai lists SOC 2 Type 1 and Type 2 materials and an EXA ZDR addendum. Report dates, exceptions and scope were not inspected. Security also points at the Corto trust centre for infrastructure.
Ask: Provide current SOC 2 Type II (and ISO if any) scoped to LawY standalone, with exceptions.
NSW terms
Public claim only
Terms governed by NSW law; exclusive NSW courts. Customer indemnifies LawY. Aggregate liability cap: fees paid in the 6 months before the event. Outputs not warranted. No public DPA. Training licence in cl 7.1/18.3 is the main contract risk versus the security page.
Ask: Signed terms, DPA, and a written override of cl 7.1/18.3 if we rely on no-training/ZDR.
Multi-country hosting
Public claim only
Privacy: hosted/operated in Australia, Canada, US, UK and New Zealand; personnel and providers worldwide. Model providers OpenAI and Gemini are typically US inference unless a regional API is contracted (not stated here).
Ask: Per-feature storage, inference, support and backup countries, with an enforceable region setting.
Incidents
Not confirmed
No numbered breach-notice clock on the security or terms extracts.
Ask: Notification period from discovery, NDB/OAIC cooperation, and incidents in the last 24 months.
Changes
Public claim only
Terms allow LawY to change features and terms by website or email notice. Convenience termination 30 days (fees still payable). Model providers can change under cl 7.1.
Ask: Notice before model, hosting-region or training-clause changes?
Exit
Public claim only
Month-to-month advertised. Terms: after termination, no right to use or access Output. Export path for conversation history was not specified on the pricing page.
Ask: Self-service export formats and certified deletion after the last invoice?
Drive connectors
Public claim only
Standalone all-in-one includes Google Drive, OneDrive and Dropbox. Security limits research use of connected storage to matter names and practice area, not client details — verify in a demo. Partner research-only plans may omit connectors.
Ask: Which connectors are in our SKU, and what scopes are granted?
Sources
Not confirmed
Product retrieves legal sources with citations. Whether Instant/Deep Research can call the open web, and whether that can be disabled, was not specified on the pages read.
Ask: Which sources are searched, can web retrieval be turned off, and how are non-authoritative sources labelled?
Actions
Not confirmed
Word add-in can insert review/chat into documents. No public statement that high-impact actions require a second person. Verification is optional, not a mandatory gate.
Ask: Can any feature send mail or write to a DMS without a lawyer confirming?
Lawyer verification
Public claim only
Optional verification: user submits a rephrased question and AI answer plus approved matter facts; verifier does not see the full user conversation (pricing FAQ). Double-masked; qualified lawyers. Instant answers have no such gate. Terms require solicitor review of all output.
Ask: When is verification mandatory, what exactly is disclosed, and what remains the instructing lawyer's responsibility?
