Product and intended use
Define the configuration, people, information and tasks being assessed.
Trial, Professional, Student versus Enterprise
Public claim only
Pricing: Trial, Professional (USD 100/month), Law Student (USD 25/month). DPA distinguishes Website Terms subscribers from Enterprise/Content License Agreement customers (fuller audit reports). Plugins for Claude, ChatGPT and Perplexity. API is a separate SKU.
Ask: Are we buying Professional seats, an Enterprise agreement, plugins only, or the data API?
US SaaS plus plugins
Public claim only
Legal page: Midpage AI Inc., 190 Bowery, New York, NY 10012. Subprocessors: Vercel hosts the web app (US); NeonDB/PlanetScale store application data (US); Mistral (EU) and Cohere (Canada) for AI/search. Privacy: information may be processed in the United States or other countries.
Ask: Where are our prompts stored, and do plugin queries leave the same environment as the web app?
US research, citator, plugins
Public claim only
Home: search US case law/statutes/regulations, draft briefs/memos, cite-check, fetch dockets, AI citator with treatment signals. Professional adds agentic PACER access. 300+ law firms claimed.
Ask: Which plugin scopes are enabled, and does PACER access send our PACER credentials to Midpage?
US-only corpus
Public claim only
16M+ US opinions; all federal including unpublished; 50 states plus D.C.; statutes and regulations. Australian law is not described.
Ask: Confirm there is no Australian corpus we might mistakenly rely on.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Plugin context disclosure
Not confirmed
Plugins sit inside Claude/ChatGPT/Perplexity. Those hosts determine what context is sent. No Australian client-consent template. DPA treats Customer as controller.
Ask: What does each plugin transmit, and what do we tell clients when US matter text is queried?
OpenAI, Anthropic, Google, Mistral
Public claim only
Subprocessors 10 June 2026: OpenAI (US), Anthropic (US), Google (US), Mistral (EU) as AI service providers for Web + Plugins. Customer model choice is not described.
Ask: Which models process our queries, and can we disable any provider?
Dated public list
Public claim only
List dated 10 June 2026 includes OpenAI, Anthropic, Google, Mistral, Cohere, Elastic, Pinecone, NeonDB, PlanetScale, Prefect, Vercel, Clerk, Stripe, Langfuse, Mixpanel, Sentry, Datadog, Intercom. DPA: general authorisation; reasonable advance notice via list or email; 90-day objection then terminate with pro-rata refund.
Ask: Do Langfuse/Mixpanel receive prompt text, and will we get email notice of changes?
No training; flow-down required
Public claim only
DPA 4.4 and Terms A.4.i: Midpage shall not, and shall require subprocessors not to, use Customer Data / Your Content to train or fine-tune any generalised ML/AI model. DPA Schedule 1 also allows processing to 'provide, maintain, and improve the Services' as a processor instruction — improvement is not defined as training.
Ask: Confirm in writing that 'improve the Services' excludes training or fine-tuning on our prompts.
Langfuse and Mixpanel
Public claim only
Langfuse tracks AI and chat usage; Mixpanel tracks usage (US). Privacy describes service provision, security and legal uses. Separate product-feedback licence was not extracted beyond those tools.
Ask: Can we disable Langfuse/Mixpanel for matter workspaces?
Live period not numbered
Public claim only
Privacy: retain as long as necessary to provide the Services, then 60 days after account cancellation for Personal Information, plus backups. DPA 6.2 is the post-term rule. Live chat/document default is not numbered.
Ask: State default live retention for queries, uploads and plugin logs.
60 days from active systems
Public claim only
DPA 6.2: after expiry or termination, delete all Customer Data from active systems within 60 days; legal holds and backups excepted, with backup deletion as soon as reasonably practicable. In-term deletion via features, APIs or legal@midpage.ai.
Ask: Will you certify deletion of production, backups and subprocessor copies?
RBAC and MFA for production
Public claim only
DPA Schedule 3: role-based access, MFA for production systems containing Customer Data, access reviewed at least bi-annually, background checks where permitted. Customer-facing support access protocol is not separately numbered.
Ask: When may Midpage staff read our queries, and is that access logged and ticket-scoped?
SSO on Professional
Public claim only
Professional pricing lists SSO and team billing. Clerk is the authentication subprocessor (US). MFA for Midpage's own production is in the DPA; customer-user MFA is not separately documented.
Ask: Is SSO/MFA mandatory on our seats, and are student/trial accounts isolated from firm workspaces?
AES-256 and TLS 1.2+
Public claim only
DPA Schedule 3: encryption at rest (AES-256) and in transit (TLS 1.2 or higher). No customer-managed key option is described.
Ask: Is BYOK available on Enterprise, and where are keys stored?
Annual SOC 2 Type II
Public claim only
DPA Schedule 3: independent third-party SOC 2 Type II at least annually; reports to Enterprise/Content License customers under NDA, summaries to others. Annual independent audits also in DPA s.7.
Ask: Provide the current SOC 2 Type II report under NDA.
Published DPA; NY AAA terms
Public claim only
DPA 28 April 2026 supplements Website Terms or Enterprise/CLA. Terms: AAA arbitration in New York; Midpage not a law firm. EU SCCs (Ireland) and UK Addendum are incorporated for restricted transfers. Legal page contact: legal@midpage.ai.
Ask: Will you sign our DPA addendum for APP 8, or is the public DPA the contract?
US processing; SCCs in DPA
Public claim only
Privacy: may be transferred to and processed in the United States or other countries. Subprocessors include US, EU (Mistral) and Canada (Cohere). DPA Schedule 2: EU SCCs Module 2/3, Irish law, UK Addendum, Swiss modifications.
Ask: List every country for our Professional + plugin traffic, including PACER.
72-hour DPA notice
Public claim only
DPA 3.2: notify without undue delay and, where feasible, no later than 72 hours after becoming aware of a Security Incident, then reasonably identify cause, mitigate and remediate.
Ask: Who is notified, and does 72 hours apply to plugin customers on Website Terms?
Subprocessor notice; DPA updates
Public claim only
DPA: Security Measures may be updated if overall security is not materially decreased. New subprocessors: reasonable advance notice; 90-day good-faith objection then terminate with pro-rata refund. List last updated 10 June 2026.
Ask: Will material DPA or model-provider changes be emailed, not only posted?
60-day active deletion
Public claim only
In-term access/retrieve/delete via features, APIs or legal@midpage.ai. Post-term: 60-day active-system deletion. Backup exception as above. Export format is not specified beyond 'available features or APIs'.
Ask: What export formats exist, and will you certify deletion including plugin logs?
Plugins and PACER
Public claim only
Claude, ChatGPT and Perplexity plugins; Professional adds agentic PACER. Those hosts and PACER are additional processors relative to a web-only seat.
Ask: List every connector on our account and how we disable PACER and plugins.
Legal corpus versus open web
Not confirmed
Product is retrieval against Midpage's US legal corpus. Whether the assistant also performs open-web search was not stated in the DPA or home page.
Ask: Can Midpage or its plugins browse the open web with our prompts, and can we disable that?
Agentic PACER and research tools
Not confirmed
Professional includes agentic PACER access and agentic research tools. Guardrails for unattended filings or paid PACER actions were not extracted from the public Terms.
Ask: Which agent actions can run without a human click, especially PACER fetches that incur fees?
Outputs may contain errors
Public claim only
Terms D.3.i: outputs generated by ML models may contain errors, omissions or inaccuracies and may not reflect the most recent law; not legal advice. Home says work product is hyperlinked to real cases.
Ask: Will we require a lawyer to open every cited opinion before relying on a Midpage draft?