Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, entity and modules
Public claim only
Enterprise customers contract with Luminance Technologies Ltd (Nine Hills Road, Cambridge, CB2 1GE). Master Hosted Agreement (3 July 2024) plus Product Order Form. Demo form lists Diligence, Discovery and In-House. Lumi Go / Put-it-on-Luminance is a separate self-serve tool with its own Terms of Use; those Terms do not apply if a master hosted agreement is in place. Support affiliates include Luminance, Inc. (US) and, on Lumi Go terms, Singapore and Australian companies.
Ask: Confirm the contracting entity, which of Diligence/Discovery/In-House/Negotiate/Ask Lumi/Lumi Go are on our Order, and whether we are on the 3 July 2024 MSA or a later negotiated form.
Deployment and tenancy
Public claim only
Hosted single-tenant AWS instance; Customer Data in the hosted location specified on the Order Form. Nightly backup to a secondary AWS data centre in the same region. Security page: dedicated instance with no co-mingling. No on-premises option found.
Ask: Name the AWS region (and AZ) for our tenancy and backups, and confirm it is single-tenant with no shared databases.
Product features in scope
Public claim only
Site modules: Draft (templating, non-legal generation), Negotiate (Word checklists and review), Analyse, Comply, Investigate (early case assessment / large datasets), Collaborate. Ask Lumi is an optional generative interface. Additional Generative Models are opt-in and can be disabled by a support ticket.
Ask: Which modules and Ask Lumi (Azure, AWS-hosted models, Google Cloud, direct OpenAI) will be enabled on our tenancy?
Governing law and Australian coverage
Public claim only
Master Hosted Agreement: English law and exclusive courts of England and Wales, except EU customers go to ICC arbitration in London. No Australian-law option in the published MSA. Bulla Dairy Foods is a named Australian customer. An Australian support affiliate appears on Lumi Go terms, not on the July 2024 MSA Appendix 2.
Ask: Will you accept Australian law and courts (or a non-exclusive Australian forum) and an APP addendum, or is English law/E&W courts mandatory?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client-facing use and authority to process
Public claim only
Lawyer/business-user facing. Customer must ensure it may grant Luminance a worldwide licence to access Customer Data to provide Support, Product improvements, learnings and Outputs, and indemnifies Luminance for cross-border upload breaches. Lumi Go may be made available by a Luminance customer to counterparties ('Put it on Luminance') under separate Terms. No Australian engagement-letter template found.
Ask: Confirm whether any client or counterparty will use Lumi Go; provide engagement-term wording covering AWS region, Ask Lumi/OpenAI, US support access, 30-day exit retention and Output disclaimer; and list publicity/logo rights on our Order.
Foundation-model providers
Not confirmed
Core product: vendor proprietary and fine-tuned open-source models (mixture of experts). Additional Generative Models (including Ask Lumi): July 2024 MSA lists Microsoft Azure (dedicated/segregated; default UK/EU matching AWS, switchable at Luminance's discretion; US if AWS is outside UK/EU or on request) and optional direct OpenAI (United States), with a claim that Azure path does not pass data to OpenAI. Lumi Go Terms also list AWS-hosted additional generative models and Google Cloud EMEA Limited, with Google/OpenAI locations that may be 'any international location' when AWS is outside UK/EU. Model names/versions are not published.
Ask: For our Order, name every model family, version and route (proprietary, Azure, AWS-hosted LLM, Google Cloud, openai.com); produce ZDR/DPA artefacts; pin versions; and disable any route we do not accept.
Subprocessors
Not confirmed
July 2024 MSA Appendix 2: Luminance, Inc. (US support); AWS (hosting, location per Order Form); Microsoft Azure and OpenAI for additional generative features. DPA: no further subprocessors without prior written consent, except as expressed in the Agreement. Lumi Go Appendix 2 adds Luminance Technologies Pte. Ltd (Singapore), Luminance Technologies Australia Pty Limited, AWS-hosted generative models and Google Cloud EMEA. Azure UK/EU may be switched at Luminance's discretion. There is no standalone live Trust Centre list.
Ask: Provide the dated list that will apply to our tenancy (entities, countries, data types), 30-day notice, consent before Google/OpenAI/US Azure, and written confirmation that Lumi Go subprocessors are out of scope.
Training and secondary use
Public claim only
Private Learning (customer-trained clauses/types in the private instance, excluding Standard Clauses) vests with the customer. Luminance may retain and use on a perpetual basis usage/learnings to develop or improve the Product provided no Customer Confidential Information or Personal Data is in them and the customer is not identified (cl 10.1.3). Cl 10.1.1 still grants a licence to use Customer Data for Support, Product improvements, learnings and Outputs. Website privacy: retention of results, learning and tagging data with no personal data, to improve tools. Azure row: no data passed to OpenAI on that path. Direct OpenAI/Google: data deconstructed and redacted, but the customer agrees redaction may be impossible for the actual query/redraft words and Luminance is not liable for confidentiality/IP issues from that opt-in.
Ask: Confirm in the Order that prompts, uploads, outputs and embeddings are not used to train any OpenAI, Google or Azure foundation model; that 10.1.1 cannot be used to improve models with our CII; and that Ask Lumi is off unless we opt in.
Feedback, ratings and product improvement
Public claim only
Website privacy lists asking users to leave a review, provide feedback or take a survey, and retaining learning/tagging data without personal data to improve the product. MSA 10.1.3 is the contractual hook for perpetual de-identified learnings. In-product thumbs-up/thumbs-down terms were not separately documented.
Ask: Can in-product ratings and 10.1.3 learnings derived from our matters be disabled or confined to our tenant?
Retention of prompts, documents and logs
Public claim only
During the Term, Customer Data is in the Order Form region. After the Term, a 30-day Retention Period (or 30 days from termination notice if longer) then deletion. Backups 14–28 days in-region. Administrator-configurable prompt/log retention was not documented. Azure is claimed not to pass data to OpenAI; direct OpenAI retention is not stated in the MSA beyond 'limited data as needed'.
Ask: For our tenancy, list retention for documents, Ask Lumi prompts, Azure/OpenAI/Google copies, application logs and backups, and confirm Ask Lumi is zero-retention at each LLM.
Deletion on instruction and on exit
Public claim only
After the Retention Period Luminance deletes Customer Data including Outputs without further notice; it cannot be recovered. Expedited deletion is on request using 'reasonable endeavours'. DPA: delete or return Personal Data in Luminance's and subprocessors' possession on termination per customer written instructions. No deletion certificate clause was found.
Ask: Contract a numbered deletion and return period including backups, embeddings, Azure/OpenAI/Google copies, Private Learning, and a written certificate.
Vendor and contractor access to content
Public claim only
Security page: Luminance staff cannot view documents without the customer's explicit authorisation through the user interface; access is tracked and audited; MFA for staff. MSA: DPA confidentiality for persons authorised to process Personal Data; US (and on Lumi Go terms Singapore and Australian) support entities process limited data for 24/7 support. Customer-exportable vendor-access logs were not found in the MSA.
Ask: Enumerate every human-access path (support, engineering, Azure, OpenAI, Google); can we require per-ticket UI consent; is the audit log exportable?
SSO, MFA, admin controls and audit logs
Not confirmed
Customer configures application-level permissions. Security page describes MFA for Luminance employees. SSO, SAML, SCIM and customer-exportable prompt/admin logs were not documented on the pages read. Customer is contractually responsible for its own access-control practices (cl 10.2).
Ask: On the plan we are buying, confirm SSO-only, MFA, SCIM, IP allow-listing, and an exportable audit log of prompts, exports, admin changes and vendor access.
Encryption in transit and at rest
Public claim only
Security page: AWS KMS for S3 and EC2 using AES-256; TLS 1.2 or higher in transit with AES-128 or higher; master keys rotated regularly. MSA: backups signed and encrypted in the isolated installation. Customer-managed keys were not offered in the public materials.
Ask: Name algorithms for every store (including embeddings, Ask Lumi links and backups), who holds keys, rotation, and whether customer-managed keys are available.
Independent security assurance
Not confirmed
Security page: ISO 27001:2022 and a SOC 2 Type 2 examination covering security, availability and confidentiality; regular independent pentests. MSA cl 16.1 still commits to ISO/IEC 27001:2013. DPA: on request, current ISO 27001 certificate and reasonably requested processing information; customer audits start with that pack. SOC 2 is not a contractual maintain-for-term obligation in the MSA. Reports were not inspected. IRAP was not found.
Ask: Provide under NDA the current SOC 2 Type II (scope, period, exceptions), ISO 27001:2022 certificate (not only 2013), latest pentest covering Ask Lumi/LLMs, and any Australian Essential Eight/IRAP mapping; and update cl 16.1 to 2022.
Contract, DPA, confidentiality, IP and liability
Public claim only
Published MSA + Appendix 1 DPA (SCCs/UK instruments, DPF). Customer Data is Confidential Information. Private Learning is customer-owned. Cap: 12 months' fees generally; 3× for breach of 10.1.3, 10.3 or the DPA. Confidentiality and IP ownership are excluded from the cap. Output errors are disclaimed (10.3). IP indemnity is limited to European or US patent/copyright/trade mark. OpenAI opt-in: Luminance disclaims confidentiality/IP issues where redaction of the actual query is impossible. No APP-specific addendum. Modifications in writing or click-through.
Ask: Will you sign an APP-aligned DPA, Australian law, no OpenAI liability carve-out, Output IP indemnity, and a cap that still covers confidentiality (already uncapped) plus LLM subprocessors?
Cross-border processing and Australian residency
Public claim only
AWS region is on the Order Form. DPA: UK/EEA origin data is not transferred outside UK/EEA without prior written consent and a transfer instrument, except as expressed in the Agreement. Azure may move between UK and EU at Luminance's discretion; US Azure if AWS is outside UK/EU. Direct OpenAI is United States. Lumi Go Google Cloud may use 'any international location' when AWS is outside UK/EU unless excluded in writing. US (and on Lumi Go, Singapore and Australian) support entities. No public confirmation of an Australian AWS region. DPF is relied on for some US transfers.
Ask: Is an Australian AWS region available and will you lock it (and Azure to that geography) on the Order, excluding OpenAI, Google 'any location', and US Azure unless we consent?
Breach notification and incident history
Public claim only
DPA: inform the controller within 24 hours of becoming aware of a Personal Data Breach and take reasonable steps to mitigate. Security page describes Darktrace detection, Juniper firewalls and an incident-management process. No public incident register. Public statements about confidentiality incidents need the other party's consent (cl 13.6).
Ask: Contract 24-hour notice for any suspected incident affecting Customer Data (not only GDPR Personal Data Breach), NDB cooperation, Australian-hours security contact, and disclose material incidents in the last 24 months.
Change of terms, models and control
Public claim only
MSA modifications require writing signed by both parties or customer click-through. Material product/function discontinuation: at least 12 months' notice unless security/IP risk, technically burdensome, or illegal. Azure UK/EU location may be switched at Luminance's discretion. Technology page: new commercial models are internally benchmarked and may be adopted. Additional generative models can be opted out via support ticket. Assignment terms were not fully extracted in this review.
Ask: Lock the Order against Azure region switching and against new LLM routes without written consent and a testing window; and give termination and data-return rights on assignment, change of control or discontinuance.
Export, transition and shutdown
Public claim only
During the 30-day Retention Period the customer may download and delete Customer Data and Outputs. Then Luminance deletes remaining copies. Expedited deletion uses reasonable endeavours. Clause 15.2.3: at customer's expense, facilitate transition to an alternative provider or in-house if a regulator requires it. No bulk-export API or escrow found. 12-month discontinuation notice as above.
Ask: Demonstrate a full tenancy export (documents, Private Learning, templates, logs) in open formats, a 30–90 day retrieval window, deletion including LLM copies with a certificate, and transition assistance rates.
Word and other connectors
Not confirmed
Word is the documented negotiation client. DMS connectors were not specified on vendor pages read. Ask Lumi / Additional Generative Models are third-party model connectors that leave the single-tenant AWS instance. Lumi Go can be given to counterparties.
Ask: For each connector we would enable (Word, any DMS, Ask Lumi, Lumi Go), show identity, scopes, whether documents are copied, how we disconnect, and how copies are purged.
Open-web retrieval
Not confirmed
No published description of Bing, Google or similar open-web search inside the hosted product was found. Investigate is marketed as search/filter across uploaded datasets. Ask Lumi is generative Q&A over (redacted) prompts, not documented as a web browser.
Ask: Confirm web retrieval is off for our tenancy; if any agent can fetch the open web, what payload leaves the tenant and can we disable it?
Agent actions and confirmation gates
Not confirmed
Draft allows non-legal teams to generate contracts from templates. Negotiate automates/augments review in Word. Comply is described as a team-specific module automating workflows. No public list of send/share/delete/write-back gates or prompt-injection testing was found. MSA 10.3 puts Output risk on the customer.
Ask: List every action Draft, Negotiate, Investigate and Ask Lumi can take; which require explicit per-action approval; how untrusted document text is isolated; and provide the latest injection/red-team summary.
Human review of outputs
Public claim only
Marketing describes checklists and colour-coded analysis to focus lawyer attention, not a mandatory supervisor gate. MSA: customer and any third-party user assume sole responsibility for results and conclusions; Luminance disclaims errors in Outputs. No exportable per-output review log with model version was found.
Ask: Can we require supervisor sign-off before redlines leave the firm, export a per-document record of model route and reviewer, and keep Ask Lumi off for unsupervised users?
