Legal-specific · Practice management · Medium confidence
Lupl, Inc. (Elevate) · Lupl SaaS as documented in the EULA/DPA and trust centre. Elevate announced acquisition on 19 August 2026. Confirm contracting entity post-acquisition.
Legal project/matter workspace that assigns tasks, automates workflows and connects lawyers with AI teammates (Claude, Harvey, Copilot).
Opens a private software assessment of Lupl for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | European Union / EEA, United States |
| Australian region | No |
| Model providers | OpenAI, Anthropic |
| Assurance | SOC 2 Type II, ISO 27001:2022 |
| Training on customer content | No |
| Retention summary | Controller privacy: no longer than necessary, then delete or anonymise. DPA/SCCs: delete or return after end of processing, with certification. Live numbered schedule not public. |
| Integrations | Claude, Harvey, Microsoft Copilot, Auth0, DocuSign, Slack, Microsoft Azure |
| Pricing summary | No public price list. Claude page offers a two-week trial for event attendees. |
| Legal content coverage | Matter/task platform, not a licensed primary-law corpus. Claude/Harvey/Copilot supply the generative layer. |
| Australian presence | Unknown — Platform hosted in the EEA (Netherlands) on Azure. DPA transfer list includes Australia as a permitted processing country. No AU region or named AU customer found. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Lupl, Inc., Reston VA. Elevate announced acquisition 19 August 2026. Home: lawyers and AI teammates in one workspace; Claude, Harvey and Copilot named. Confirm who signs the order post-close.
Ask: Is the contracting entity still Lupl, Inc., and which AI integrations are in the SKU?
Public claim only
Privacy: Lupl Platform hosted in the EEA (the Netherlands) on Microsoft Azure. Trust centre lists Azure infrastructure.
Ask: Confirm the Azure region on our tenant and whether AU hosting is available.
Public claim only
Home: tasks, matter dashboards, templates, automations, AI to draft updates and summarise work. Agents feature and Claude MCP trial are marketed. Acquisition: native in Claude, Harvey and Copilot.
Ask: Which agent tools are enabled by default?
Public claim only
Purpose-built for law-firm workflows. No licensed Australian primary-law database is described.
Ask: Confirm we will not treat Lupl as a research corpus.
Record the practical work needed to introduce and maintain the software.
Not confirmed
No public price list. Claude page: two-week trial for event attendees. EULA/DPA on lupl.com/eula.
Ask: Confirm fees, seats and the signed agreement entity after the Elevate deal.
Public claim only
Privacy: bring-your-own third-party systems. Trust: Auth0, DocuSign, Microsoft, OpenAI. Acquisition and home: Claude, Harvey, Copilot.
Ask: Which integrations will receive matter text?
Public claim only
EULA subprocessors: Zendesk (EU) for support. Privacy: privacy@lupl.com. No published severity SLA.
Ask: What are support hours and the security contact post-Elevate?
Compare complete work at the required quality, including checking and correction.
Not confirmed
No Vals AI or Stanford RegLab result found. Quality of Claude/Harvey/Copilot outputs is those vendors’ problem as well as Lupl’s orchestration.
Ask: May we trial on our matters with a scored error log?
Public claim only
Fit is matter/task management and AI teammate orchestration. Generative drafting still requires lawyer review.
Ask: Which workflows will require a human approval step?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Public claim only
Privacy: organisation may control, monitor and access user data. DPA treats Customer as controller. No Australian client-disclosure template.
Ask: Provide a client-disclosure for NL/US processing and OpenAI/Claude.
Public claim only
EULA Annex III (1 Sep 2025): OpenAI, Inc. for Lupl AI features, USA, with footnote that data is not retained or used to train the model. Home/Claude page market Anthropic Claude via MCP. Harvey/Copilot are additional model paths if connected.
Ask: Name every model provider and region on our tenant, including Claude/Harvey.
Public claim only
Annex III as at 1 September 2025: Airtable, Auth0, DocuSign, Expel, Fireflies.AI, HubSpot, Microsoft, OpenAI, Pendo, Slack, Stripe, Twilio, Zendesk, Zoho, Zoom. Trust centre repeats OpenAI, DocuSign, Auth0, Airtable, Microsoft.
Ask: Is Fireflies transcription in our SKU, and what is the objection period?
Public claim only
EULA OpenAI row: data is not retained or used to train the model; contact privacy@lupl.com. Trust centre has an ‘AI Training Data and Bias’ document (requestable). Claude/Harvey training terms are those vendors’.
Ask: Confirm in the DPA that neither Lupl nor any AI provider trains on our matter data, including Claude.
Public claim only
Pendo and Zoho listed for usage analytics (EU/USA). Privacy: ISO certification and quality-control processing of support contacts.
Ask: Can matter text appear in Pendo/Zoho, and can we disable them?
Public claim only
Privacy: retain no longer than necessary, then delete or anonymise. Different periods apply; not numbered for matter data.
Ask: State default retention for tasks, files, chat and embeddings.
Public claim only
DPA/SCCs: after end of processing, delete or return and certify. In-product commands that delete data are customer instructions; Lupl need not restore.
Ask: Will you certify deletion of production, backups and OpenAI copies?
Public claim only
Expel.io listed as Security Operations Center (US). Zendesk for support. Trust: data access and access-log items exist (requestable).
Ask: When may Lupl or Elevate staff read our matters, and is access ticket-scoped?
Public claim only
Auth0, Inc. (USA) for authentication. Trust lists access-control policy and access log management. SSO details not on the public home page.
Ask: Is SSO/MFA/SCIM available, and how are ethical walls set?
Public claim only
EULA Annex II lists encryption of personal data, protection during transmission and storage. Algorithms and BYOK are not specified on the public pages.
Ask: Confirm TLS/at-rest algorithms and whether BYOK is offered.
Public claim only
Trust centre: ISO/IEC 27001:2022 and SOC 2 Type 2 badges; SOC 2 report and pentest requestable. EU-US DPF and GDPR listed. Reports not inspected.
Ask: Provide current ISO 27001 and SOC 2 Type II reports under NDA.
Public claim only
EULA page includes a Data Protection Addendum forming part of the Terms of Use/MSA. Transfers permitted to EU, UK, US, Singapore, Australia, Hong Kong and locations in the privacy policy. Confirm Elevate novation.
Ask: Will Elevate sign our DPA addendum, or is the published EULA the contract?
Public claim only
Hosted in the Netherlands. DPA 7.3: Protected Data may be processed in the EU, UK, US, Singapore, Australia, Hong Kong and privacy-policy locations. Subprocessors include US OpenAI and US Auth0.
Ask: Map every country of storage and inference on our tenant.
Not confirmed
Trust centre lists a Data Breach Notifications document (requestable). Public EULA extract reviewed did not number a 72-hour customer SLA in the portion scraped for this pass.
Ask: State the contractual notification period for a personal-data breach.
Public claim only
Annex III will be updated from time to time in accordance with the Agreement. Elevate ownership may change contracting notices.
Ask: What notice and objection period apply to new subprocessors after the Elevate deal?
Public claim only
DPA: delete or return after end of processing and certify. Export format not specified beyond SCC language.
Ask: What export formats are available, and how long do backups last?
Public claim only
Claude MCP trial; trust centre has an MCP Connector document. Privacy: BYO third-party systems. Fireflies.AI transcription is on the subprocessor list.
Ask: List every connector on our order and how we disable Fireflies/Slack/WhatsApp.
Not confirmed
Lupl AI is described as drafting updates and summarising work. Open-web search was not stated. Connected tools (Claude/Copilot) may search the web under their own terms.
Ask: Can Lupl or connected agents browse the open web with our matter context?
Not confirmed
Automations assign tasks and send updates. AI teammates in Claude/Harvey/Copilot can take actions in those hosts. Default human-approval gates were not extracted from the public EULA.
Ask: Which automations can email clients or write to DMS without a human click?
Public claim only
Home: stay aligned and in control at every step. No contractual mandatory review gate found in the EULA extract.
Ask: Is there an in-product accept step before an AI-drafted update is sent?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI practice management tools Australia
