Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
DPA: the Litera group company on the Customer Contract is Workshare Limited, Freedom Solutions Group, L.L.C. dba Litera, or DocsCorp Pty. Ltd. This profile covers Draft/Draft Pro (Litera AI+) and Foundation/Foundation Insights, not Kira. Optional Foundation Firm AI Search in ChatGPT (OpenAI for Law) is marketed site-wide. The published 'Litera Legacy Drafting Cloud Products' subprocessor list names Contract Companion, Compare-as-a-Service and Litera Create — not clearly current Litera Draft in One.
Ask: Name the contracting entity, which of Draft, Draft Pro, AI+, Foundation Cloud/Insights and OpenAI-for-Law search are on the Order, and which Product Schedule to the DPA applies.
Deployment model
Public claim only
Draft pages list Word, Outlook, Google Workspace, web, mobile and desktop. Separate subprocessor lists exist for drafting cloud (legacy) and drafting on-premises. Foundation Cloud is Azure in a customer-chosen Microsoft region. On-prem Draft exists with its own subprocessor list (still includes Azure for some Litera-hosted pieces).
Ask: Is our tenancy cloud or on-prem, which Azure region, and does Draft Pro/AI+ require cloud even if Draft is on-prem?
Product features in scope
Public claim only
Draft: approved templates, DMS clause search, numbering/styles/TOA, bulk document sets. Draft Pro: Litera AI+ for comparison summaries, bulk compare, Word assistant with cited sources. Foundation Insights: experience/deal-point insights, Lito agent for summaries, term benchmarking against firm experience. OpenAI for Law: ask ChatGPT against permitted Foundation records.
Ask: Which of template assembly, DMS clause pull, AI+, Lito, Insights and ChatGPT firm search will be enabled, and which are generally available in Australia?
Governing law and Australian coverage
Not confirmed
The March 2025 SaaS Terms PDF scrape did not yield a readable governing-law clause in this pass (same truncation issue noted on Kira). DPA allows DocsCorp Pty. Ltd as an Australian contracting entity. Support numbers list US and UK. No Australian Draft/Foundation customer was named.
Ask: Which entity and governing law apply to our Order, and will you use DocsCorp Pty. Ltd with Australian law if we require it?
Adoption and implementation
Record the practical work needed to introduce and maintain the software.
Licence, term and price
Not confirmed
No public dollar prices. Draft Pro is positioned as an upgrade inside Litera One. A vendor blog contrasts predictable versus consumption AI pricing without numbers. SaaS Terms PDF was not fully readable for term/auto-renewal in this pass.
Ask: Provide an itemised quote for Draft, Draft Pro/AI+, Foundation Cloud/Insights and OpenAI-for-Law search, including term, renewal and any consumption meters.
Word, DMS and identity integration
Public claim only
Draft: Microsoft 365, Google Workspace, iManage, NetDocuments, SharePoint, browser, mobile, desktop. Integrated-experiences page: common authentication and SSO on Litera Platform. Legacy drafting-cloud list: iManage/LiMES, NetDocuments, Google Workspace and Compare O365 APIs hosted in Azure in US, Canada, UK, EU, Germany, Singapore and Australia.
Ask: Demonstrate Word round-trip, our DMS connector and SSO (Entra) in an Australian-region tenancy if that is what we buy.
Support channels and hours
Public claim only
Site lists US and UK phone numbers. Subprocessor lists include Salesforce, Zoom Contact Center, Y Meadows and Forethought for ticket routing (US/AWS US). legal@litera.com is on the AI Principles PDF. No public AEST severity matrix for Draft was found.
Ask: State Draft/Foundation severity definitions, AEST/AEDT coverage, and whether Premier Support is required.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who is controller, and client-matter authority
Public claim only
Master DPA: Litera processes Personal Information as processor under the Customer Contract; contracting entity is one of three group companies. Product-schedule deletion rules apply. OpenAI for Law / ChatGPT firm search is a separate processing path into OpenAI if enabled.
Ask: Confirm the DPA Product Schedule for Draft and Foundation, that we remain controller, and that ChatGPT firm search is excluded unless we opt in.
Foundation-model provider
Public claim only
Draft Pro is 'powered by Litera AI+' without a named foundation-model vendor on that page. Site-wide: Foundation Firm AI Search is part of OpenAI for Law, with answers grounded in permitted Foundation records inside ChatGPT. Foundation Insights mentions Lito, a legal AI agent. Legacy drafting-cloud subprocessors do not list OpenAI; they list Azure, Salesforce, Y Meadows (support email AI), Forethought.
Ask: Name every model behind Litera AI+ and Lito, their regions, and whether OpenAI for Law is in our Order.
Subprocessors and subprocessors list
Public claim only
Litera publishes per-product lists. Foundation Cloud: Azure (customer-chosen Microsoft region); Salesforce, Y Meadows, O365, Mimecast, Zoom, Atlassian, New Relic, Forethought (AWS US). Legacy Drafting Cloud: Azure (same region as the cloud product); Application Insights US; License Server UK/US/Australia; DMS APIs in Azure including Australia. Current Litera Draft-in-One list was not found under that name.
Ask: Provide the current subprocessor schedule for Draft/Draft Pro/AI+ (not only legacy Create/Compare) and Foundation Insights, with change-notice period.
Training and secondary use of customer content
Not confirmed
Responsible AI Principles discuss Litera's own training/testing data and impact assessments; they do not state a no-training warranty for customer documents. No Draft/Foundation DPA schedule clause on training was extracted in this pass. OpenAI for Law would be subject to OpenAI's terms if enabled.
Ask: Is Customer Data from Draft, Foundation or AI+ used to train Litera or third-party models, and what is OpenAI's retention for Firm AI Search?
Feedback and evaluation use
Public claim only
AI Principles: features to enable users to report errors and provide feedback. Microsoft Application Insights (US) is listed for drafting-cloud telemetry. New Relic (US) ingests application and infrastructure logs. Y Meadows/Forethought process support-email text.
Ask: Do Insights, New Relic or support-AI tools receive document text, and can feedback/evaluation use of live matter data be contracted off?
Retention of prompts, documents and logs
Public claim only
DPA: delete or return Personal Information promptly on termination per Product Schedule, except legal retention and copies transmitted by email under Litera's email retention policy. Security Addendum describes cloud encryption and backups at a controls level, not a numbered prompt-retention period for AI+.
Ask: State retention for Draft documents, AI+ prompts/outputs, Foundation indexes, ChatGPT firm-search prompts, logs and backups.
Deletion and certified erasure
Public claim only
DPA clause 4.2(g): permanently and securely delete or return all Personal Information promptly on termination per the Product Schedule, and delete copies except where law requires retention or email copies. Product-schedule detail for Draft/Foundation was not extracted as a separate readable schedule in this pass.
Ask: What is the Draft/Foundation Product Schedule deletion timetable, including backups, and will you issue a deletion certificate?
Vendor staff access to matter data
Public claim only
Support tooling (Salesforce, Zoom, Y Meadows, Forethought, O365, Mimecast) is listed as subprocessors, mostly United States. Intellek provides training videos (US) on the legacy drafting-cloud list. Security Addendum: Litera staff laptop disks encrypted; ISO 27001 covers corporate offices.
Ask: Is staff access to our Draft/Foundation data logged, MFA-gated, limited to ticketed support, and available as an audit export?
SSO, MFA, roles and audit logs
Public claim only
Integrated-experiences: common authentication, SSO, policy engine and threat detection on Litera Platform. Draft is Word-native. No public SCIM statement for Draft was found in this pass.
Ask: Does our Draft/Foundation tenancy support Entra SSO, mandatory MFA, ethical walls aligned to the DMS, and exportable audit logs?
Encryption in transit and at rest
Public claim only
Security Addendum (cloud): Customer Data encrypted at rest with AES-256; TLS 1.2 and above in transit over public networks. On-prem: customer is responsible for encryption of its computers.
Ask: Confirm AES-256/TLS 1.2+ apply to Draft Pro/AI+ and Foundation Cloud in our chosen region, and whether customer-managed keys are available.
SOC, ISO and other audits
Public claim only
Trust Center lists ISO/IEC 27001:2022, ISO 27001 SoA, SOC 2 Type 2 and SOC 3 (request-access). Security Addendum: cloud providers have SOC 2 Type II and ISO 27001; Litera will provide ISO 27001, whitepaper, SIG/CAIQ and pentest summary on request. Certificates were not inspected in this pass.
Ask: Provide current ISO 27001 and SOC 2 Type 2 reports whose scope includes Draft, AI+ and Foundation Cloud.
Contract, DPA, liability and indemnity
Not confirmed
Public artefacts: Master DPA, Security Addendum, March 2025 SaaS Terms PDF (governing-law/liability text not extracted here), Responsible AI Principles. SaaS Agreement HTML stub exists at /terms/saas-agreement. Liability cap and IP indemnity were not read from the PDF in this pass.
Ask: Provide the Order, SaaS Terms liability cap, and confirmation the Master DPA plus the correct Product Schedule apply to Draft/Foundation/AI+.
Cross-border transfers and residency
Public claim only
Foundation Cloud: Azure in any Microsoft region the customer chooses. Legacy drafting cloud: Azure in the customer's chosen region; DMS APIs also in Australia; License Server includes Australia; several support tools are United States. OpenAI for Law would send Foundation-grounded queries to OpenAI. DPA includes SCCs modules.
Ask: Pin Draft and Foundation to named Azure regions (including Australia if required) and list every US support-tool and OpenAI flow of matter text.
Breach notification
Public claim only
Security Addendum: notify without undue delay and in any case within 72 hours after determining a Security Incident has impacted or will impact Customer Data. DPA: notify without undue delay and in any event within 72 hours after becoming aware of a Personal Information Breach.
Ask: Confirm the 72-hour clock (awareness vs determination) for Draft/Foundation, and the notification email on our Order.
Unilateral term and product changes
Not confirmed
Subprocessor pages mark some vendors as NEW without a stated notice period on the scrape. SaaS Terms change mechanism was not extracted from the PDF. OpenAI for Law appeared as a site-wide banner in 2026 scrapes.
Ask: Will material model-provider, OpenAI-for-Law, hosting-region or liability changes require 30 days' written notice and a right to terminate without penalty?
Export, termination and lock-in
Public claim only
DPA: delete or return Personal Information promptly on termination per Product Schedule. Word documents remain in the customer's DMS. No Draft/Foundation-specific export of clause libraries or Foundation indexes was found in this pass.
Ask: On termination, in what formats and within how many days can we export Draft templates, clause banks and Foundation records, and is deletion certified?
PMS, DMS and agent connectors
Public claim only
iManage, NetDocuments, SharePoint and Google Workspace are listed for Draft. Foundation Firm AI Search connects permitted Foundation records to ChatGPT. Lito is described as a legal AI agent on the desktop. Legacy Compare-as-a-Service uses Azure-hosted DMS APIs.
Ask: Which DMS connectors are in our Order, and is ChatGPT/OpenAI-for-Law or Lito in or out of scope?
Open-web search and browsing
Public claim only
Foundation Firm AI Search is ChatGPT asking the firm's Foundation records, not a general web search, but it runs inside OpenAI's ChatGPT product. Litera AI+ Draft Pro claims verified sources backing answers without naming whether those sources include the open web.
Ask: Does AI+ or Lito browse the open web with matter text, and can ChatGPT firm search be disabled?
What the tool may do without a click
Public claim only
Draft assembly and AI+ queries are user-initiated in Word. Bulk generation of document sets is marketed. Lito and ChatGPT firm search are additional agent/chat surfaces. No unsupervised send-to-client action was found.
Ask: Which bulk-generate, AI+ insert and ChatGPT actions require confirmation, and can bulk generation be limited by role?
Required lawyer review before client use
Public claim only
Responsible AI Principles: UX and educational materials inform users of AI use and the importance of checking any output. No Draft term requiring lawyer review before client send was extracted. Draft Pro still presents AI+ as an assistant inside Word.
Ask: Will you contract that AI+, Lito and ChatGPT firm-search output is not legal advice and must be lawyer-reviewed before client send?
