Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, plan and what sits outside it
Public claim only
This profile covers Lext Playbooks on the two published self-service plans. Datasets, Compare instructions, bulk upload and the CoAuthor drafting tool are in the Professional plan only; Starter carries single-document review, unlimited Playbooks, extraction and testing against requirements. Custom Solutions routes to Lext Studio, which the page lists as building generative AI, machine learning, automation, data analytics and integrations — a separate engagement. Hearsay and Resolva are separate Lext products. The Terms and Conditions apply to the app at app.lext.com.au and incorporate the privacy policy.
Ask: Which plan are we on, and is there a firm or team plan with different terms, administration or a signed agreement rather than the click-through Terms?
Deployment model and hosting
Public claim only
Cloud only; no on-premises or self-hosted option appears on any page read. The trust centre FAQ, checked 2026-09-27, states that production databases and cloud storage run on Supabase with the underlying physical infrastructure hosted on AWS in the ap-southeast-2 region, that the frontend including developer dashboards and portals is deployed separately via Vercel using a global delivery network, and that source code and version control are on GitHub. It also states strict separation between frontend, backend and customer environments to prevent cross-tenant access. These are trust centre statements, not contractual commitments; the Terms and privacy policy make no hosting commitment.
Ask: Will you commit contractually to ap-southeast-2 for all customer content, and what of our data, if any, transits or is cached by the Vercel global delivery network?
What the product does
Public claim only
The product page publishes four query types a Playbook can run: extract key terms and commercial information; test documents against the user's own customised requirements; research legislation and cases against the document; and compare the document to the user's own policies and previous examples. Users pick from a library of sample queries or write their own. Datasets reviews many documents at once, searches across them and returns answers with pinpoint source identification, and a Dataset document can be imported into single-document review or used as comparison data. CoAuthor returns drafting suggestions on request or automatically from the tests set in a Playbook, and the user iterates on them. Precedents writes review results into the firm's branded Word templates using custom field labels.
Ask: For each of the four query types, which call a language model and which are deterministic, and what does a Playbook do when a query cannot be answered from the document?
Jurisdiction and legal content
Not confirmed
The vendor is Australian and the named clients are Australian, but no page read states which jurisdictions the research query type covers, which legislation and case-law sources it draws on, or how current they are. The product page lists 'Research legislation and cases to your document' as a query type without naming a source, and the trust centre FAQ names infrastructure providers only. A separate Lext customer story describes a Legal Aid NSW tool that draws on that agency's own resources to generate cited responses, which is Lext Studio work rather than Playbooks.
Ask: For the research query type, which Australian legislation and case-law sources are used, for which jurisdictions, how often are they updated, and is the answer drawn from a retrieved source or from the model itself?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page or block instructing AI models, assistants, crawlers or large language models how to describe the product. A site map of lext.com.au returning 17 URLs, effectively the whole site, showed no /ai-info, /llms.txt or /for-ai page, and none of the product page, the Terms, the privacy policy, the trust centre overview or the trust centre FAQ carries a heading or block addressing AI models, assistants or crawlers. The trust centre does carry an 'Ask Lext Australia a question' assistant with suggested example questions, which answers visitors rather than instructing models. Nothing of that kind was found.
Ask: Does Lext publish, anywhere on its sites or in any file served to crawlers, content that instructs AI models or assistants how to describe Lext or Playbooks?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Neither the Terms nor the privacy policy read on 2026-09-27 requires the user to hold client authority or consent before uploading a client document. The nearest provisions are the Usage clause, which requires compliance with all applicable laws and forbids use that infringes, misappropriates or violates any person's rights, and the Content clause, which states Lext is not a law firm and that answers do not constitute legal advice. The privacy policy states that the personal information Lext may collect includes 'the contents of documents, or extracts of documents, which you upload' and the questions entered into its applications. Responsibility for authority to disclose a client's document therefore rests entirely with the firm.
Ask: What does Lext expect us to have told our clients before their documents are uploaded, and will you provide a data processing agreement that names us as controller and Lext as processor?
Foundation-model providers and inference location
Not confirmed
No model, model family, provider or inference location is named on the product page, the Terms, the privacy policy, the trust centre overview or the trust centre FAQ, all checked 2026-09-27. The product page names CoAuthor as an 'AI drafting tool' and lists 'CoAuthor - AI-assisted legal drafting' as a Professional plan item, and the trust centre FAQ answers on servers and data protection name only Supabase, AWS ap-southeast-2, Vercel, GitHub, Google Workspace and Azure. The privacy policy names 'cloud providers and software providers located outside of Australia' without identifying them. Whether inference runs in Australia is unestablished.
Ask: Name every model and provider used by extraction, testing, research, comparison, Datasets and CoAuthor, the region of each inference endpoint, and whether any inference occurs outside Australia.
Subprocessors and infrastructure providers
Public claim only
There is no subprocessor register. The trust centre FAQ names Supabase for production databases and cloud storage, AWS ap-southeast-2 as the underlying physical infrastructure, Vercel for the frontend, GitHub for source code, and Google Workspace and Azure as the environments across which audit logging runs, with Slack used for security alerting. The privacy policy names Stripe and refers generically to 'third-party service providers, such as cloud service providers' and to cloud and software providers located in the United Kingdom, Ireland, Singapore and the United States. The trust centre states Lext engages only vendors with ISO 27001 or SOC 2 certifications, reviews their security posture before onboarding, requires a signed contract covering security and privacy clauses before access, assigns each a risk rating and reviews annually.
Ask: Provide a dated subprocessor register with entity, country, purpose and data types for Playbooks, including any model provider, and tell us how we are notified when it changes.
Training on customer content
Not confirmed
No document read states whether uploaded documents, entered questions, Playbook definitions or generated outputs are used to train, fine-tune or evaluate a model. The privacy policy authorises collection and use of the information it lists — which expressly includes uploaded document contents and questions entered into Lext applications — to 'operate, protect, improve and optimise our applications, products, and services' and to 'optimise the experience of users, such as to perform analytics and conduct research'. The Terms and the trust centre are silent on training.
Ask: Will you warrant in writing that uploaded documents, questions, Playbook content and outputs are never used to train, fine-tune or evaluate any model, by Lext or by any provider, and that 'improve and optimise' in the privacy policy does not include model training?
Feedback, analytics and product improvement
Public claim only
The privacy policy, which the Terms incorporate, authorises use of collected information to operate, protect, improve and optimise the applications and services, to perform analytics and conduct research, and includes information provided through customer surveys among the categories collected. It does not distinguish product telemetry from the substance of uploaded documents, and no in-product rating or correction control is described on the product page. Whether a user's edits to a suggested draft or a corrected extraction are captured and reused is not stated anywhere read.
Ask: When a user rejects an extraction or edits a CoAuthor draft, is that captured, does it leave our tenant, and can we switch it off?
Retention of documents, prompts and results
Public claim only
The privacy policy states personal data is stored for up to 2 years after Lext has completed providing its services, after which it is kept only to the extent required by law or for compliance and risk management, and is deleted or de-identified when no longer necessary. IP addresses collected to detect attacks are kept for 30 days. The trust centre adds that databases are backed up daily on a 7-day rolling window. Because the privacy policy defines the contents of uploaded documents as personal information it collects, the 2-year period appears to reach uploaded matter documents, but no separate retention setting for documents, Playbooks, Datasets or results is published, and no customer-configurable retention is described.
Ask: State the default and configurable retention for uploaded documents, Datasets, review results and generated drafting, confirm whether the 2-year period applies to them, and say how long copies persist in backups after deletion.
Deletion and certified erasure
Public claim only
The privacy policy says Lext will delete or de-identify personal data when it is no longer necessary or required to be kept, and gives a right to access personal information through the Playbooks dashboard or by contacting support. The Terms contain no deletion obligation and no data-return obligation on termination, and allow Lext to terminate or suspend access without prior notice or liability for any reason. No deletion timeframe on request, no certificate of erasure and no statement about deletion from the 7-day backup window appear on any page read.
Ask: If we ask for deletion, within how many days are documents, Datasets, results and backups destroyed, and will you certify that in writing?
Vendor staff access to customer content
Public claim only
The trust centre FAQ states access follows a least-privilege, role-based model so employees get the minimum permissions needed for their role, that multi-factor authentication and single sign-on are enforced globally, that default and root accounts are disabled or tightly restricted to authorised administrators, that segregation of duties applies so the person granting access is never the person approving it, that system administrators cannot edit audit logs involving their own actions, and that management conducts comprehensive access reviews at least annually with inappropriate access revoked. It does not say whether any Lext employee can read the contents of a customer's uploaded documents, under what approval, or whether a customer can see such access.
Ask: Can any Lext employee or contractor read the contents of our uploaded documents or Playbooks, under what approval and logging, and can we obtain that access log?
Customer-side access control and audit
Public claim only
The Terms make the account holder responsible for all activity under the account and forbid sharing credentials. The trust centre FAQ describes Lext's own internal controls — role-based least privilege, globally enforced MFA and/or SSO, continuous audit logging across Google Workspace and Azure tracking admin actions, failed logins and changes to sensitive data, and real-time intrusion detection. Whether a customer firm can enforce single sign-on or MFA for its own users, set roles inside a shared workspace, or export an audit log of who ran which Playbook over which document is not described on any page read.
Ask: Can we enforce SSO and MFA for our users, apply roles within a team workspace, and export an audit log of every document upload, Playbook run and export?
Encryption in transit and at rest
Public claim only
The trust centre FAQ states all data is encrypted in transit using TLS and at rest using AES-256, continuously verified through automated checks; that Lext is committed to storing all production data at rest on encrypted volumes using protected encryption keys; and that Supabase database backups are encrypted at rest and in transit using approved cryptographic standards. The Terms say only that Lext has implemented security measures and, to the maximum extent permitted by law, disclaim all liability for loss or damage from unauthorised or malicious third-party access to the app. Customer-managed keys are not offered on any page read.
Ask: Who controls the encryption keys for our data, are they customer-managed or Lext-managed, and does the same encryption apply to data in transit to any model provider?
Independent security assurance
Public claim only
The trust centre publishes ISO 27001:2022 under Compliance and lists an 'ISO27001:2022 Certification' certificate plus 17 policies (including asset management, backup, change management and code of conduct) available on request. The FAQ states the last external audit ran from 12 to 20 January 2026 and that the surveillance audit is expected in February 2027. No SOC 2 report is offered. The trust centre and the product page footer are branded Lext Australia Pty Ltd, while the Playbooks contract is with Lext Playbooks Pty Ltd, so the certified entity and the contracting entity are named differently and the certificate scope was not read.
Ask: Provide the ISO 27001:2022 certificate and its scope statement, and confirm whether the certified entity covers Lext Playbooks Pty Ltd and the Playbooks application specifically.
Contract, entity, liability and forum
Public claim only
The Terms and Conditions, effective 10 September 2024, are a contract with Lext Playbooks Pty Ltd ACN 669 759 693, ABN 76 669 759 693, trading as Lext Playbooks, at Level 11 Suite 2, 92 Pitt St, Sydney NSW 2000, and incorporate the privacy policy. Governing law is New South Wales and the Commonwealth, with exclusive NSW jurisdiction; disputes go first to written notice then to mediation, with the Resolution Institute selecting a mediator if the parties cannot agree. Liability is capped at the Subscription Fee paid in the 12 months immediately preceding the event, excludes consequential loss including loss or corruption of data, and is reduced proportionately for the customer's contribution. There is no published data processing addendum, no service level agreement and no confidentiality clause in the Terms read.
Ask: Will you enter a signed agreement with a data processing addendum, a confidentiality clause and a liability cap above one year of subscription fees, and confirm which company we contract with given the two Lext names in use?
Cross-border transfers and APP 8
Public claim only
The privacy policy states Lext may disclose personal information outside Australia to cloud providers and software providers located outside Australia, including the United Kingdom, Ireland, Singapore and the United States; that by providing personal information the individual consents to that disclosure and acknowledges that Lext 'is not required to ensure that overseas recipients handle that personal information in compliance with the Privacy Act'; and that Lext will nonetheless take reasonable steps towards handling consistent with the Australian Privacy Principles. That is reliance on consent rather than on an APP 8.1 accountability arrangement. Separately, the trust centre states production databases and cloud storage default to AWS ap-southeast-2, with the frontend on Vercel's global delivery network.
Ask: Which named providers in the United Kingdom, Ireland, Singapore and the United States receive our data and for what purpose, and will you replace the consent mechanism with a contractual APP 8 arrangement for our account?
Incident and data-breach notification
Public claim only
The trust centre FAQ describes internal handling: all staff must report suspected incidents immediately, confirmed incidents are handled under internal service levels of 4 hours for high severity, 24 hours for medium and 48 hours for low, and Slack-based alerting to the development team carries a 2-hour triage service level with management escalation for emergencies. Neither the Terms nor the privacy policy read on 2026-09-27 contains any obligation to notify a customer of a data breach, any notification period, or any reference to the notifiable data breaches scheme. The Terms instead disclaim liability for unauthorised or malicious third-party access to the app to the maximum extent permitted by law.
Ask: Will you commit contractually to notifying us within a stated period of any breach affecting our documents, and to co-operating on an assessment under the notifiable data breaches scheme?
Change notice for terms, price, features and models
Public claim only
The Terms state Lext may change the Subscription Fee from time to time and set no notice period for changes to the Terms themselves. The privacy policy states it may change from time to time by publishing changes on the website and encourages users to check the website periodically. No notice or objection right attaches to a change of model, provider, subprocessor or hosting region, and the trust centre lists a change management policy only behind an access request.
Ask: What written notice will we receive before the Terms, the price, the hosting region, the model or a subprocessor changes, and can we object?
Export and exit
Public claim only
The Terms let Lext terminate or suspend access without prior notice or liability for any reason, including a breach of the Terms, and impose no obligation to return or export customer content on exit. Annual subscriptions renew automatically unless cancelled at least 14 days before the anniversary, and payments are final absent fraud or mistake. The privacy policy gives access to personal information through the dashboard. No export format or bulk export of Playbooks, Datasets, review results or generated drafting is published, and the Terms forbid automated extraction of output including scraping and unauthorised API calls.
Ask: How do we export our Playbooks, Datasets and review history in bulk on exit, in what format, and does the prohibition on automated extraction prevent us using an API to do it?
Connectors and where data flows
Public claim only
The product page describes two outward flows: Precedents writes review results into the firm's own branded Word templates using custom field labels, and Datasets documents can be imported into the single-document review view or used as comparison data inside the product. No connector to a practice-management system, document-management system, email or cloud storage is described, and no public API is documented on any page read; the Terms forbid unauthorised API calls. Stripe processes payments. Uploads are manual.
Ask: Is there a documented API or any connector to a practice-management or document-management system, and if we build one, what authorisation do the Terms require?
Open-web retrieval
Not confirmed
One of the four published query types is to research legislation and cases against the document, and a published testimonial refers to using the product to find relevant cases and procedural references. Nothing on the product page, the Terms, the privacy policy or the trust centre states whether that research retrieves from the open web, from a licensed database, from a Lext-curated corpus or from the model's own parameters, and no control to disable retrieval is described.
Ask: When a Playbook runs a research query, what is retrieved and from where, is the open web reached, and can retrieval be disabled for matters where it is not appropriate?
Actions the product takes without a separate instruction
Public claim only
The described flow is user-initiated throughout: the user builds a Playbook, uploads one or more documents, runs the review and reads the results. The one automatic step published is drafting: CoAuthor returns drafting suggestions 'on request, or automatically based on the tests you set for documents in your Playbooks', and the user then iterates on the suggested drafting. Precedents generation is described as extracting results into the firm's templates. Nothing is described as sending, filing or writing to any system outside the product.
Ask: When CoAuthor generates drafting automatically from a Playbook's tests, is anything written into the document or template before a user accepts it, and can automatic generation be turned off?
Human review before reliance
Public claim only
The Terms state that the app provides general legal information and assistance, that Lext is not a law firm, that the information and answers do not constitute legal advice and are not a substitute for it, that answers do not take account of the user's specific needs, objectives or circumstances, that 'the nature and the quality of the instructions provided by the user may influence the accuracy or reliability of answers produced by the App', that Lext makes no representation or warranty regarding accuracy to the extent permitted by law, and that 'You should always check the references that accompany answers produced by the App to independently verify the answer'. The product supports that check through pinpoint source identification in Datasets. No product control forces a named reviewer.
Ask: Is there any setting that requires a second user to approve a Playbook result or a CoAuthor draft before it can be exported into a precedent or sent out?
