Legal-specific · Drafting assistants · Medium confidence
Open Legal Products (MikeOSS) · Self-hosted AGPL-3.0 deployment versus the hosted demo at app.mikeoss.com. The privacy notice covers only the hosted site/demo. Customer-chosen model keys apply in both modes.
Open-source legal AI platform for document chat, cited review, workflows and case research that a firm can self-host, inspect and fork.
Opens a private software assessment of Mike for one task, with this profile’s questions to hand.
| Deployment | Self-hosted, SaaS |
|---|---|
| Hosting regions | Unknown |
| Australian region | Unknown |
| Model providers | Anthropic, Google Gemini, OpenAI |
| Training on customer content | No |
| Retention summary | Self-host: maintainers do not collect documents or prompts. Hosted demo: retained as needed to operate the service; no numbered deletion schedule. Model-provider retention follows the provider the operator configures. |
| Integrations | Microsoft Word add-in, Slack, MCP servers, CourtListener |
| Pricing summary | Home page: zero licence cost; no per-seat vendor pricing; the operator pays only the model API costs it incurs. Hosted demo at app.mikeoss.com is a free evaluation service. |
| Legal content coverage | Home: case-law research; v0.3.0 notes CourtListener integration. Australian primary law is not described as a licensed corpus. |
| Australian presence | Unknown — Australian Financial Review is listed among press logos on the home page (May 2026 URL). No Australian hosting region or office was stated. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Home: start in the cloud or clone the repo. Privacy: the policy covers mikeoss.com and app.mikeoss.com only; self-hosted deployments are outside maintainer collection. GitHub: GNU AGPL v3.0. Hosted demo must not receive confidential or privileged material.
Ask: Will we self-host under AGPL, or is any paid hosted tenancy offered under a DPA?
Public claim only
Home: documents never leave your perimeter when self-hosted. README describes Next.js, Express, Supabase Auth/Postgres and Docker Compose with object storage. Hosted demo region is not stated.
Ask: If we self-host, which regions will our Supabase/storage/model endpoints use? If we use the demo, where is it hosted?
Public claim only
Home: chat over documents with citations, case research, spreadsheet-style tabular review, reusable workflows, matter-scoped projects. Blog notes MFA, MCP connectors, Word add-in in the repo, CourtListener in v0.3.0.
Ask: Which features are stable in the tagged release we would run, versus demo-only?
Public claim only
v0.3.0 article on the home page names CourtListener integration. No licensed Australian case-law or legislation corpus is described.
Ask: What jurisdictions does CourtListener cover in our build, and can we point the citation engine at Australian sources?
Record the practical work needed to introduce and maintain the software.
Public claim only
GitHub: GNU Affero General Public License v3.0. Home: zero licence cost; pay only API costs. Network-use copyleft may require sharing modifications if the firm offers the software to third parties over a network. No commercial licence was found.
Ask: Does AGPL-3.0 permit our internal self-host without publishing firm workflows, and is a commercial licence available?
Public claim only
Repository includes a word-addin directory. Home/changelog: Slack and any MCP server, two self-host setup pathways. DMS connectors are invited ('integrate your DMS') rather than named as shipping products.
Ask: Which connectors are in the release we would run, and do they honour source-system permissions?
Not confirmed
Privacy: contact via the site form. No published support hours, severity SLA or named vendor entity for a paid support contract. Press coverage is listed; that is not a support commitment.
Ask: Is paid support or a hosted enterprise tenancy offered, and by which legal entity?
Compare complete work at the required quality, including checking and correction.
Public claim only
Home: 22 June 2026 post describes an independent video review by three lawyers over two weeks. No Vals AI / Stanford RegLab score was found. Tabular review is marketed as cited to page and quote.
Ask: Share the review protocol and allow a scored trial on our documents.
Public claim only
Privacy: do not upload confidential, privileged, proprietary, client, regulated, personal or sensitive materials to the hosted demo. Self-host is the path if the firm wants perimeter control. Output still requires lawyer verification.
Ask: Confirm we will not put matter data in app.mikeoss.com, and who operates our self-host?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
No client-consent template. Self-host still sends prompts to whichever model provider the firm configures, unless a local model is used. Hosted demo is expressly unsuitable for client material.
Ask: Provide (or we will draft) a client-disclosure describing self-host, model provider and AGPL.
Public claim only
README: add an Anthropic, Gemini or OpenAI API key unless using another configured endpoint. Changelog: OpenAI-compatible registry for self-hosted or third-party endpoints. Privacy: inputs go to the provider selected for that deployment.
Ask: Which providers and regions will we configure, and will we use local models for matter data?
Public claim only
Self-host: subprocessors are the firm's Supabase, storage and model providers. Hosted demo: privacy allows sharing with infrastructure, hosting, storage, auth, email, analytics or model providers; no named dated list.
Ask: For the hosted demo, name every processor and region. For self-host, we will inventory our own.
Public claim only
Privacy: MikeOSS does not train foundation models on prompts, documents, chats or outputs. Third-party model handling, retention, logging and training follow that provider's API terms and settings. Local models stay local unless telemetry is configured.
Ask: Confirm ZDR/no-train on every API key we will use, including the hosted demo if anyone evaluates it.
Public claim only
Privacy (hosted): information may be used to understand usage and improve the product. Self-host: maintainers do not collect usage data. No separate feedback-toggle was described.
Ask: Does hosted telemetry include prompt text, and can it be disabled?
Public claim only
Hosted: retain as long as needed to provide the service, maintain records, resolve disputes, enforce agreements and comply with law. Self-host: operator's own retention. Model-provider logs are outside MikeOSS control.
Ask: State hosted retention for chats, uploads and logs, or confirm we must self-host to control it.
Not confirmed
Privacy lists access, correction, deletion, restriction, portability depending on location. No 30-day certified deletion for the hosted demo was stated. Self-host deletion is the operator's.
Ask: How do we delete a hosted-demo account and provider logs, and will you certify?
Public claim only
Privacy: self-host means maintainers do not collect account data, documents, prompts, chats, search history or usage. Hosted: maintainers may use information to operate, secure and troubleshoot. No named access log for the demo.
Ask: Who can access hosted-demo content, and is that access logged?
Public claim only
Home: v0.3.0 adds MFA. GitHub history discusses organisation-admin deny overrides on matters. Hosted access-control documentation was not a separate admin guide in this pass.
Ask: Is SSO available on hosted, and how are ethical walls configured in self-host?
Not confirmed
Privacy: technical and organisational measures are used; no TLS/at-rest algorithm statement. Self-host encryption depends on the operator's Supabase/storage/TLS configuration.
Ask: Document TLS and at-rest encryption for the hosted demo, and the defaults in docker-compose.
Not confirmed
No SOC 2, ISO 27001 or ISO 42001 claim was found on the home page, privacy notice or GitHub README extract. SECURITY.md exists in the repo; this pass did not treat it as a certification.
Ask: Is any independent assurance offered for the hosted demo, or must we rely on self-host controls?
Not confirmed
No public terms of service or DPA for the hosted demo were found (privacy only). Self-host is AGPL-3.0. Contracting entity, governing law and liability cap are unpublished.
Ask: Name the contracting entity, provide Terms/DPA for any hosted use, and confirm AGPL obligations for internal self-host.
Public claim only
Self-host transfers are those of the firm's chosen providers. Hosted demo hosting country is not stated; model providers (OpenAI/Anthropic/Google) typically process outside Australia.
Ask: Where is app.mikeoss.com hosted, and which countries will our model traffic enter?
Not confirmed
Privacy does not state a customer-notification period for a personal-data breach. SECURITY.md exists in the repository.
Ask: What is the incident-notification period for the hosted demo, and who is the security contact?
Public claim only
Home lists version posts (v0.1.0 April 2026 through v0.4.0 July 2026). Privacy may be updated by posting. No contractual change-notice for a hosted service.
Ask: How do we pin a release for production self-host, and how is hosted-demo change communicated?
Public claim only
Self-host: data is in the firm's database/storage; exit is ordinary backup/export. Hosted: deletion/export process is not numbered beyond general privacy rights.
Ask: What export format exists for hosted-demo workspaces, and when is it purged after we leave?
Public claim only
Changelog on the home page and GitHub: Slack plus any MCP server, with two self-host setup pathways. Connectors can send matter text to third systems if configured.
Ask: Which connectors are enabled by default, and how do we require per-action approval?
Public claim only
CourtListener integration is named for legal research. Open-web browsing is not separately described. Self-host could add other tools.
Ask: Does the assistant browse the open web, or only CourtListener and uploaded documents?
Not confirmed
Reusable workflows and MCP connectors can run multi-step actions. Guardrails and human-approval defaults for consequential actions were not documented on the privacy page. Hosted demo should not be used for client actions.
Ask: Which actions can run unattended, and how do we require a human step before any external write?
Public claim only
Tabular review is described as every cell cited to a page and quote. No contractual requirement that a lawyer accept output before export. Professional responsibility remains with the firm.
Ask: Is there an in-product review acknowledgement, or do we rely on firm policy?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI drafting assistants tools Australia
