Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Not confirmed
The page title is 'Assistive Document Redaction' and the body names the product 'NEC Redact'; the two names are used for the same product without explanation. The same product appears twice in the site map, once under Government and Public Administration and once under Public Safety and Triple Zero (000). No plan, tier, module, seat count, volume limit or add-on is published anywhere on the page, and no separate cloud services agreement for it appears on the site.
Ask: Under which agreement is NEC Redact supplied to an Australian customer, what does a subscription include, and are the Government and Public Safety pages the same product with the same terms?
Deployment model
Public claim only
Cloud only, on the vendor's own description. The inter-agency use case describes 'a scalable, cloud-based solution that enables consistent, compliant redaction across departments' and says it 'processes large document volumes securely, allowing human validation while maintaining data integrity and auditability'. No on-premises, private-cloud, sovereign-cloud or air-gapped option is mentioned, and no cloud provider, region or data centre is named on any page read.
Ask: Which cloud and which region host the service for an Australian agency, is any on-premises or sovereign-cloud deployment offered, and does document content leave Australia at any point including for detection?
Published functions
Public claim only
Published functions, checked 2026-09-27, in the vendor's own words: 'AI-trained detection of personal identifiers'; automatic detection and suggestion of 'redactions for names, addresses, phone numbers, and other personal identifiers'; an interface that 'allows reviewers to validate changes before final release'; 'Multi-Format Support - Handles PDFs, images, scanned documents and more - even low-quality files - with intelligent content recognition'; 'All redaction processes are logged, encrypted and secure'; and use cases named as FOI and RTI requests, subpoena and intelligence-sharing requests, HR files, customer records, medical files, legal documents and audit reports. Whether redaction is destructive, whether text layers and metadata are removed, and what file size or page limits apply are not stated.
Ask: Is a suggested redaction applied destructively to the exported file including text layers, embedded objects and metadata, and what file types, file sizes and page counts are supported?
Australian framing and legal use
Public claim only
The page is written to Australian information-access work: FOI and RTI requests, subpoenas, intelligence sharing between agencies, and a statistic the page attributes to the Office of the Australian Information Commissioner. It states the product 'Helps meet Australian and international privacy and data protection obligations with audit-ready results' and that NEC has 'a commitment to Australian privacy and data protection standards', without citing the Privacy Act 1988 (Cth), any FOI or RTI statute, or any document. 'Legal documents' are named as a document type; no legal content set, legislation set or legal determination is described.
Ask: Which specific obligations under the Privacy Act 1988 (Cth) and the FOI and RTI statutes does NEC say this product supports, and will NEC confirm in writing that the product makes no determination about exemption, privilege or relevance?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 and not found. A site map run over nec.com.au returned 56 URLs and included no /llms.txt, /ai-info, /ai, /for-ai or equivalent address, and the product page contains no block addressed to AI models, assistants or crawlers and no instruction about how the product should be described. The evaluative language on the page ('advanced AI and machine learning', 'intelligent content recognition', 'global leadership in biometrics') is ordinary marketing copy addressed to readers, and is not recorded as fact in this profile. Not checked: the robots.txt file, the public-safety copy of the product page, and the downloadable brochure.
Ask: Does NEC publish any page, file or embedded block that instructs AI models, assistants or crawlers on how to describe NEC Redact, and if so at what address?
Adoption and implementation
Record the practical work needed to introduce and maintain the software.
Licence, warranty and fees
Public claim only
The Business Terms (effective 30 April 2026) govern quotation and sale. Where the Quotation does not state a warranty period, the Company gives 'one (1) year for hardware and ninety (90) days for software commencing from the date of delivery'. Statements about capability and performance are excluded from the contract: 'All images, drawings, measurements and weights calculations, statements regarding capabilities, results and/or performance expectations provided by the Company are provided for information only and are not binding upon the Company.' The Company may also substitute 'an equivalent product or material' if a specified item becomes unavailable before delivery. No software licence grant, subscription term, seat definition or acceptable-use clause for a cloud service appears in those terms.
Ask: Given that statements about capability and performance are not binding under the Business Terms, which performance or accuracy commitments for NEC Redact will NEC put in the Order Confirmation, and what is the warranty and service level for the cloud service?
Integration with firm and agency systems
Not confirmed
No integration, connector, API, plug-in or supported records, case or document management system is named on the product page, the Business Terms, the Privacy Notice or the Compliance page. The vendor separately publishes a government case management product in the same navigation, but no link between the two is stated on the page read.
Ask: Is there a published API or a supported integration with our document, records or case management system, and does an integration mean documents are copied into NEC's environment?
Support and contact
Public claim only
The Business Terms require the Customer to give written notice of faults or defects during the warranty period, and to notify damage or shortage in writing within five calendar days of arrival. The published contact route for warranty and maintenance enquiries is the nec.com.au business-terms page, and the privacy contact is 13 16 32 between 9.00am and 5.00pm Monday to Friday, Locked Bag 38003, Docklands VIC 8012, or contactus@nec.com.au. The footer of the product page links a product support page, which was not opened. No service level, response time or availability target for the cloud service is published.
Ask: What are the availability target, support hours, escalation path and credit regime for NEC Redact, and are they in the Order Confirmation or a separate service level agreement?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Nothing on the pages read addresses whether a customer needs a client's or a data subject's authority before uploading material, beyond the general position in the Global Privacy Notice that the customer's contract controls processor activities. The Business Terms contain no acceptable-use, personal-information or authority clause. The product page names medical files, HR files and legal documents as inputs without addressing consent or authority.
Ask: Does NEC require any customer warranty about authority to disclose the documents uploaded, and is that warranty in the Order Confirmation or in a separate data processing agreement?
Foundation-model and detection engine providers
Not confirmed
No model, model family, model provider, hosting provider or underlying engine is named anywhere on the product page, the Business Terms, the Privacy Notice or the Compliance page. The vendor attributes detection to 'advanced AI and machine learning' and to 'AI-trained detection of personal identifiers' without saying what performs it. Whether any third-party model service is called, and whether it is a large language model, a trained classifier or optical character recognition with named-entity and pattern matching, is unestablished.
Ask: Name every model and model provider used for detection, say whether any third-party inference service is called, and state the region in which inference runs.
Subprocessors
Not confirmed
No subprocessor list, subcontractor list or hosting provider list is published. The Global Privacy Notice says only that NEC 'engage with third-party service providers who may process your Personal Data on our behalf' and that data may be shared 'within NEC Group', without naming any provider or country for this product. The site map returned no trust centre or data protection page.
Ask: Provide the subprocessor list for NEC Redact, with each provider's role and country, and the notice process for adding one.
Training on customer content
Not confirmed
Nothing published states whether documents uploaded for redaction, or the detections made on them, are used to train, tune or evaluate any model. The product page says detection is 'AI-trained' without saying on what. The Global Privacy Notice says NEC 'may aggregate your Personal Data to a non-identifiable format and use such data to improve and develop our services and solutions', but that notice expressly excludes processing carried out as processor on behalf of customers, which is what redaction of a customer's documents would be.
Ask: Will NEC warrant in the contract that documents, extracted identifiers and reviewer corrections are never used to train, tune or evaluate any model, including in de-identified or aggregated form?
Feedback and quality monitoring
Not confirmed
Nothing is published about what happens to reviewer corrections. The product page says users 'review and adjust redactions' and that 'Accuracy improves', without saying whether an adjustment is retained, used to tune detection, or visible to NEC. No telemetry, quality-monitoring or human-review-of-output statement appears on any page read.
Ask: When a reviewer corrects or adds a redaction, is that correction stored, sent to NEC, or used to improve detection for other customers?
Retention of documents, detections and logs
Not confirmed
No retention period is published for uploaded documents, redacted output, detected identifiers or audit logs. The product page states redaction processes are 'logged, encrypted and secure' without saying for how long the logs are kept or where. The Global Privacy Notice's retention section is written for NEC as controller and expressly does not apply to processing on behalf of customers. The Business Terms contain no retention clause.
Ask: State the retention period for uploaded files, redacted output, detection metadata and audit logs, whether it is configurable, and where those artefacts are stored.
Deletion and certified erasure
Not confirmed
No deletion mechanism, deletion timeframe or erasure certificate is published for customer documents. The Global Privacy Notice describes a right to erasure for individuals in respect of NEC as controller, subject to legal-retention and legitimate-interest exceptions, which is a different question from deletion of a customer's uploaded matter files. The Business Terms are silent on data return or destruction at the end of a contract.
Ask: Can we delete an uploaded document and its detections on demand, within what period is deletion effected in backups, and will NEC certify erasure on termination?
Vendor and subcontractor access to content
Not confirmed
Nothing published states whether NEC personnel or its providers can view documents uploaded for redaction. The Global Privacy Notice says 'Your Personal Data will be accessed by NEC personnel on a need-to-know basis', but that notice excludes processor activities carried out for customers. The product page says only that processes are logged, encrypted and secure. No support-access, break-glass or administrator-access statement appears on any page read.
Ask: Can NEC staff or any subcontractor view the contents of documents we upload, under what authorisation, and is that access logged and reportable to us?
Access control, single sign-on and audit
Not confirmed
The product page states that 'All redaction processes are logged' and refers to 'a clear audit trail of every action taken' in the HR use case, but no role model, permission model, single sign-on, multi-factor authentication or audit-export capability is published, and no administration documentation was found on the site.
Ask: Does the product support single sign-on and multi-factor authentication, what roles exist, and can we export the audit trail in full?
Encryption in transit and at rest
Public claim only
The product page's Secure by Design item states 'All redaction processes are logged, encrypted and secure, ensuring end-to-end integrity and traceability'. No algorithm, key length, key management arrangement or separation of encryption keys is published, no distinction is drawn between transit and rest, and no security page for the product was found. The Business Terms contain no security schedule.
Ask: Specify the encryption standards in transit and at rest for NEC Redact, who holds the keys, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The Compliance page (checked 2026-09-27) states that NEC Australia's information security management system 'has been certified to ISO27001:2022 by Sustainable Certifications for selected sites and operations', and that its quality, environmental and occupational health and safety systems are certified to ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 by SAI Global 'for its nationwide operations coordinated at Docklands, Melbourne'. The page links certification registers for each. It does not state which sites or operations fall inside the ISO 27001 scope, and does not mention this product. No IRAP assessment, SOC 2 report, penetration test summary or ISO/IEC 42001 certification appears anywhere on the pages read. Unverified, not applied (2026-10-10): security claim GDPR (https://www.venn.com/learn/soc2-compliance/). not the vendor's domain. Unverified, not applied (2026-10-10): security claim HIPAA (https://www.venn.com/learn/soc2-compliance/). not the vendor's domain. Unverified, not applied (2026-10-10): security claim ISO 27001 (https://www.necsws.com/sectors/local-government/document-redaction/). not the vendor's domain. Unverified, not applied (2026-10-10): security claim SOC 2 (https://www.venn.com/learn/soc2-compliance/). not the vendor's domain.
Ask: Is NEC Redact inside the ISO/IEC 27001:2022 certification scope, and can NEC provide the certificate with its scope statement, an IRAP assessment if one exists, and the most recent penetration test summary?
Contract, liability and forum
Public claim only
The Business Terms (effective 30 April 2026) are entered into by NEC Australia Pty Ltd and apply 'to all products, services and support supplied by' it, except as expressly agreed in writing by a duly authorised officer, and they reject the applicability of any customer terms unless expressly agreed. Liability is capped at 'the amount paid to the Company for the provision of products and/or services in the twelve (12) month period prior to the date the liability arose', with loss of profit, revenue, goodwill and business opportunity excluded and an indemnity from the Customer for third-party claims for those excluded losses. Governing law is Victoria with exclusive jurisdiction in the Victorian courts. No data processing addendum, security schedule or service level agreement is published.
Ask: Will NEC contract for NEC Redact on a services agreement with a data processing addendum and a security schedule, and is the twelve-month liability cap negotiable for a privacy breach caused by a missed redaction?
Cross-border transfers and APP 8
Not confirmed
No hosting or processing location is published for this product. The Global Privacy Notice states that 'we may transfer your Personal Data outside of the country where you are located', including to NEC Group companies and third-party providers, and that 'the countries to which your Personal Data may be transferred may not have data protection laws similar to those of your country'. It also states it does not apply to processing NEC performs as data processor for customers. The Business Terms say only that 'The Company complies with the Australian Privacy Laws and Privacy Principles' and contain no transfer clause. The position for documents uploaded to NEC Redact is therefore for the contract, not for the published notice.
Ask: Will NEC warrant that documents uploaded to NEC Redact, and any inference on them, remain in Australia, and if not, which countries are involved and on what APP 8 basis?
Incident notification and history
Not confirmed
No breach notification commitment, notification timeframe or incident contact for this product is published. The Business Terms contain no incident clause. The Global Privacy Notice's security section states only that NEC implements 'appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing', and says nothing about notifying a customer of a data breach or about the Notifiable Data Breaches scheme. No security page or status page was found in the site map.
Ask: Within what period will NEC notify us of a data breach affecting documents we uploaded, who is the named contact, and how does NEC support our own Notifiable Data Breaches assessment?
Change notice for terms, product and models
Public claim only
The Business Terms reserve broad unilateral change rights: 'The Company may modify these Terms and Conditions at any time. Any changes will take effect from the time they are communicated by the Company to the Customer or uploaded to the Company website at whichever is the earlier', and the Company 'may at any time vary or alter these Terms and Conditions'. Where a specified product becomes unavailable before delivery the Company 'in its absolute discretion may substitute an equivalent product or material'. Nothing is published about notice of a change to the detection model, the hosting arrangement or the feature set, and the Global Privacy Notice may be amended 'from time to time'.
Ask: Will NEC give us written notice before changing the detection model, the hosting region or the terms that apply to NEC Redact, and can the unilateral variation right be replaced with a notice period?
Export and exit
Public claim only
The Business Terms address exit commercially but not in terms of data. Cancellation less than two weeks but more than a week before the start of a Contract is charged at '60% of the Order amount', and cancellation less than a week before at '90% of the Order amount', and the Customer must reimburse the Company for costs, damages or losses resulting from termination. Title in products remains with the Company until paid in full. There is no clause requiring return, export or destruction of customer data on termination, and no export format or bulk download is described for the product.
Ask: On termination, how do we extract our redacted output and audit trail, in what format, and within what period will NEC delete the remainder and confirm it?
Connectors and third-party tools
Not confirmed
No connector, marketplace, plug-in, extension or third-party AI tool is described for this product on any page read, and no API is published. Whether the service can be invoked from, or can reach into, another system is unestablished.
Ask: Does NEC Redact expose or consume any connector or API, and can it be restricted to documents uploaded manually by a named reviewer?
Open-web access
Not confirmed
Nothing on the pages read states whether the service makes any outbound call to the internet, to a search index or to an external lookup while processing a document. The described function, detection of personal identifiers within a supplied file, does not require one, but no statement either way is published.
Ask: Does any part of the redaction pipeline call an external service, search index or lookup while processing a document, and can outbound calls be disabled for our tenancy?
Automated action and confirmation
Not confirmed
The product page describes a two-step design in which the system 'automatically detects and suggests redactions' and a reviewer validates 'changes before final release'. The HR use case is worded more strongly: 'AI-powered redaction automatically identifies and removes personal data from HR files, scanned images, and PDFs'. The page does not say whether the removal step can be run without a reviewer approving it, whether batch release is possible, or whether an administrator can require approval. The two descriptions sit on the same page and are not reconciled.
Ask: Can a document be redacted and released without a person approving each suggested redaction, and can approval be enforced at tenancy level?
Human review before use
Public claim only
The vendor states human review as a design feature: 'Human Oversight - While AI manages the heavy lifting, users remain in control to review and adjust redactions'; 'Supports manual review with AI-trained detection of personal identifiers'; and, in the inter-agency use case, processing 'allowing human validation while maintaining data integrity and auditability'. These are statements on a marketing page. Nothing contractual was found requiring human review, and the Business Terms state that statements about capabilities and results 'are provided for information only and are not binding upon the Company'.
Ask: Is the human validation step a control we can enforce and evidence, and will NEC record it in the Order Confirmation rather than leaving it as a page description?
