Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The privacy policy, read 2026-09-27, is the clearest published description of the product structure: it covers 'Our software the Neota Logic System, including all of the online tools accessed or run from the Website (which we refer to as "Workbench") (collectively, "NLS")', 'An instance of NLS deployed for us or a client ("NLS Site"), including all data stores attached to the NLS Site', and 'Applications created with NLS and deployed on an NLS Site by us or our clients'. No plan names, editions or modules are published on the pages read, and the policy adds that it 'does not apply to any NLS Site or Application that has a separate privacy policy'.
Ask: What is in the subscription - Workbench seats, an NLS Site, or a number of deployed Applications - and where an Application we build has its own privacy policy, which of your commitments still apply to us?
Deployment model and where the instance sits
Public claim only
The security page states that 'Neota's no-code development environment allows you to publish your applications to a URL with just a few clicks' and that 'Hosting is available via Amazon Web Services or Microsoft Azure, providing you with flexibility and choice when it comes to your deployment options.' The privacy policy describes 'An instance of NLS deployed for us or a client ("NLS Site")', which indicates a per-customer instance, and states application data is 'stored in the country or region directed by the owner of that NLS Site'. No on-premises or self-hosted option is described, and no list of available cloud regions is published (all read 2026-09-27).
Ask: Is our NLS Site a dedicated instance or a shared tenancy, which cloud and which regions can we choose, and can we require Australian hosting for the instance and its attached data stores?
What the platform does
Public claim only
The home page, read 2026-09-27, describes a three-stage flow: 'Legal request comes in - Contract, intake, advice request, any channel'; 'Neota orchestrates it - Classifies, routes, applies your legal rules, triggers AI, logs every action'; 'Governed outcome delivered - Resolved, escalated, or approved, with full audit trail'. Its three named pillars are Human Expertise ('Keep humans in control. Apply oversight, validate outputs'), Logic Engine ('Build the rules, conditions, and decision logic that drive every process, no code required') and AI Agnostic. Document automation is carried on the vendor's own navigation as a use case at https://www.neotalogic.com/document-automation; that page was not read, so the document-automation capability recorded here rests on the vendor's navigation label and on the privacy policy's description of Applications collecting entered data, not on a product page.
Ask: Describe the document assembly the platform performs - output formats, template authoring, clause conditionality - and say which parts use a model and which are deterministic rules.
Jurisdiction and legal content
Public claim only
No legal content library or jurisdiction coverage is claimed. The published design is that the customer encodes its own rules: 'Build the rules, conditions, and decision logic that drive every process, no code required.' The customer-logo strip on the home page carries no country statement. No Australian legal content, Australian statute coverage or Australian language handling is claimed on any page read (checked 2026-09-27).
Ask: Does any part of the platform carry legal content of your own, or is all substantive legal logic supplied by us, and who is responsible for keeping an Application current when the law changes?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for content telling AI models, assistants or large language models how to describe this product. Four vendor pages were read - the home page, the security page, the privacy policy and the terms of use - and none carries a heading or block addressed to AI models, assistants or crawlers, and none contains a 'describe as' instruction. No /llms.txt, /ai-info or /for-ai URL appeared in the navigation or footer links on any of those pages, and a site map of the vendor's domain returned no URLs at all, so no candidate file was identified to fetch. No crawler directive file was fetched. The check covered the four pages named, not the whole site.
Ask: Do you publish anywhere on your site, or in any file served to crawlers or AI assistants, content that instructs an AI model how to describe Neota?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Nothing read addresses client notice, consent or confidentiality where client information is entered into an Application and then sent to a model. The privacy policy places the consent burden partly on the operator of the Application: it relies on consent 'which consent may be given by you to us or to the owner of an NLS Site that is running an Application into which your personal information is input', and repeats that formula for sharing. It does not mention AI or model processing anywhere, so it does not address consent for that path at all (checked 2026-09-27).
Ask: Where an Application sends a client's information to OpenAI, Anthropic or Google, what consent do you consider we must hold from that client first, and is that allocated anywhere in the agreement?
Foundation-model providers and inference location
Public claim only
The vendor's home page, read 2026-09-27, displays OpenAI, Anthropic Claude and Google Gemini logos in a section headed 'Two Approaches, One Governed Core', describing 'Neota orchestrates AI - Neota calls the models inside workflows, takes action on the outputs, and keeps every decision on the record' and 'AI calls Neota - The user works inside their AI tool. The AI reaches up to Neota for a governed answer'. No model name, version, provider entity or inference region is stated, and the privacy policy and security page do not mention AI, models or model providers at all, so the only published naming of a provider is a logo on a marketing page.
Ask: Name each model and provider entity the platform calls, the inference region for each, whether any inference can be pinned to Australia, and the notice we receive before a model changes.
Subprocessors
Not confirmed
No subprocessor list, register or DPA schedule was found anywhere on the vendor's site. The privacy policy names processors only in passing and mostly for the website: 'We use Google Analytics, Google Adwords, Clearview Social, and Hubspot to track pages visited', 'Userflow (userflow.com) provides user onboarding and in-context guidance within our platform', and DocuSign and Stripe as services an Application may call. It then relies on a general permission to share with 'third-party vendors who need to know personal information about you in order to provide their services to us', requiring them 'to agree to privacy commitments'. No model provider, hosting entity or country appears in any published list (checked 2026-09-27).
Ask: Will you publish or provide a dated subprocessor register for the platform - entity, country, purpose and data types, including every model provider and the hosting entity - with notice and objection rights when it changes?
Training on customer content
Not confirmed
No document read states whether entered application data, documents or prompts are used to train or tune any model. The privacy policy's stated purposes are 'To provide our Services - to set up, operate, secure, and back up your NLS Site and Applications', 'To analyze how users interact with our Services in order improve our Services', and website marketing measurement; it relies in part on a legitimate interest 'to improve our Services', and does not define what improvement covers or exclude model training. The words training, model and AI do not appear in it. The terms of use are silent (checked 2026-09-27).
Ask: Will you warrant that application data, documents and prompts are never used to train, fine-tune or evaluate a model, by Neota or by any model provider you call, and does 'improve our Services' in the privacy policy include any model training?
Feedback, analytics and telemetry
Public claim only
The privacy policy states that for an NLS Site the vendor collects 'information about your usage of NLS Sites - when you log in, which Applications you use or edit, how long your Application Sessions are, and so on', and that 'Userflow (userflow.com) provides user onboarding and in-context guidance within our platform, as well as general metrics and tracking within our products'. For Applications it states 'we collect the information that users enter while using an Application ("Application Data")'. No in-product rating control, and no option to disable telemetry, is described (read 2026-09-27).
Ask: Can Userflow tracking and usage telemetry be disabled for our NLS Site, and is any Application Data, prompt or output included in what Userflow or any analytics provider receives?
Retention of application data
Public claim only
The privacy policy, read 2026-09-27, states that 'For an Application to function, Application Data must be and is stored temporarily during the Session', that 'Application Data is encrypted at all times', and that 'When a Session ends, Application Data is either deleted automatically or, at the direction of the owner of the NLS Site, stored for some period of time'. Retention of application content is therefore a setting the site owner chooses, and no default, maximum or backup period is published. For personal information generally the policy commits only to discarding it when no longer needed and not legally required.
Ask: What is the default retention for Application Data on a new NLS Site, what maximum can be configured, and how long do copies persist in backups after a session record is deleted?
Deletion and certified erasure
Public claim only
The privacy policy states that depending on location a person may 'request deletion of your information', exercised by contacting the vendor's privacy team, with a stated aim 'to respond to all requests within 30 days'. That addresses personal information rather than the customer's Applications, logic and data stores. The automatic path published is session-based: Application Data 'is either deleted automatically or, at the direction of the owner of the NLS Site, stored for some period of time'. No obligation to certify deletion in writing, and no deletion timeframe on termination, was found (checked 2026-09-27).
Ask: On request and on termination, what is deleted from the NLS Site, its attached data stores and your backups, within what period, and will you certify it in writing?
Vendor access to content
Public claim only
The privacy policy states that the vendor 'may disclose personal information about you to our subsidiaries, our employees, and individuals who are our independent contractors that need to know the personal information in order to help us provide our Services or to process the personal information on our behalf', and requires them to follow the policy. It also states an NLS Site may be 'deployed for us or a client', which means Neota may operate a site itself. No country restriction on staff or contractor access, no approval or ticketing process, and no customer-visible access log is published (checked 2026-09-27).
Ask: Who at Neota and which contractors can read our Application Data and Applications, from which countries, under what approval, and can we obtain an access log?
Access control and audit
Public claim only
The security page states that 'Role-based access control (RBAC) lets you define specific permissions for different user roles' and that 'Single sign-on (SSO)' is offered for authentication, and the page headline states 'Your data is encrypted, access is controlled, and every action is logged.' The privacy policy adds that where an account is not managed by an organisation's identity provider the vendor stores an encrypted password, and that multi-factor authentication is optional per account: 'If Multi Factor Authentication (MFA) is enabled for your account, you have the option of providing your phone number'. Whether MFA can be enforced for all users, and whether the audit log is exportable, is not published.
Ask: Can multi-factor authentication be enforced for every user on our NLS Site, and can an administrator export the audit log of every action, including each model call an Application makes?
Encryption in transit and at rest
Public claim only
The security page states 'Data is encrypted in transit and rest to current standards (AES-256), so sensitive information remains protected at every stage', and displays AES-256 as one of three badges captioned 'Encryption in transit and at rest'. The privacy policy states that 'Application Data is encrypted at all times' and that a stored password is held 'in an encrypted form. We have no means to unencrypt your password.' No transport protocol version, key-management model or customer-managed key option is published, and nothing addresses the path to a model provider (read 2026-09-27).
Ask: State the transport protocol and key-management model for the NLS Site, whether customer-managed keys are available, and what encryption applies to a prompt sent from an Application to a model provider.
Independent security assurance
Public claim only
The security page, read 2026-09-27, displays three badges - ISO 27001 'Certified information security management', GDPR 'Data protection & privacy compliant' and AES-256 - under the heading 'Independently Certified and Audited', and states 'Neota is proud to be ISO 27001 certified' and that 'Regular third-party penetration testing and ongoing monitoring find and close vulnerabilities before they become risks'. No certificate, scope statement, certification body, expiry date or penetration-test report is published; the link offered to learn more about the ISO certification goes to the vendor's contact form. A security pack is offered on request. No SOC 2 report, no ISO/IEC 42001 and no IRAP assessment appears anywhere read.
Ask: Provide the ISO 27001 certificate with its scope statement, certification body and expiry, confirm whether the NLS Sites and Applications are inside that scope, and say whether a SOC 2 report or an IRAP assessment exists.
Contract, entity, DPA and forum
Public claim only
The terms of use, read 2026-09-27, state they 'are governed by the laws of the State of New York, and the parties submit to the exclusive jurisdiction of its courts', and that liability 'is limited as set out in your agreement' - so the published terms are not the operative contract. The privacy policy states 'Neota Logic Inc. and its group companies act as data controllers in respect of the personal information we collect and use as described in this policy' and gives a registered address of 228 Park Ave S, New York, NY 10003, USA. No data processing addendum, and no Australian contracting entity, ACN or ABN, was found anywhere on the vendor's site.
Ask: Which Neota entity will contract with us, is there an Australian entity with an ACN or ABN, will you accept Australian law and forum, and will you provide a data processing addendum naming Neota as processor?
Cross-border transfers and APP 8
Public claim only
The privacy policy states that 'Information from an NLS Site and the Applications run on that NLS Site is stored in the country or region directed by the owner of that NLS Site, except that information provided to third-party services such as DocuSign and Stripe is stored wherever those services determine', and that website information 'is stored wherever our hosting provider or Google Analytics determines'. On transfers it states 'Neota operates globally. When we transfer personal information outside the country in which it was collected, including from the European Economic Area (EEA) to other countries, we use appropriate safeguards such as standard contractual clauses approved by the European Commission'. No list of available countries or regions is published, Australia is named nowhere, and nothing addresses where model inference occurs (read 2026-09-27).
Ask: Which countries and regions can we direct our NLS Site to, is Australia one of them, and in which country does inference run when an Application calls a model?
Incident notification and history
Not confirmed
No incident notification period, cooperation commitment, breach process or incident history was found on any page read on 2026-09-27. The security page describes 'ongoing monitoring' and a dedicated security team conducting 'thorough audits and continuous monitoring to identify and address any potential vulnerabilities or threats', which is a monitoring statement rather than a notification obligation. Neither the privacy policy nor the terms of use contains a breach notification clause.
Ask: State the contractual notification period from discovery for a security incident affecting our NLS Site, including one at a model provider or hosting provider, and confirm cooperation with the Notifiable Data Breaches scheme.
Change notice for models, terms and processors
Public claim only
The only published change mechanism is for the privacy policy itself: 'We may update this privacy policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email.' The terms of use contain no change or notice clause. No advance notice, objection right or change log covers a model change, a subprocessor change or a platform change, and the privacy policy page read carried no visible effective date (checked 2026-09-27).
Ask: What written notice will we receive before a model provider, a subprocessor or the hosting arrangement changes, and can we pause the AI-calling parts of our Applications while we assess a change?
Export and exit
Not confirmed
No export format, export window or exit assistance was found. The terms of use state 'You retain ownership of the content and solutions you create using the platform', which is an ownership statement rather than an export right, and give no mechanism for taking an Application or its data out. The privacy policy offers a data portability right for personal information only. Nothing addresses what happens to a deployed Application, its logic or its data stores on termination (checked 2026-09-27).
Ask: On termination, in what format and within what period will you return our Applications, their logic and their data stores, can an Application keep running anywhere else, and is there a charge?
Connectors and third-party services
Not confirmed
Three connector paths are published and each is a decision for the customer. The privacy policy names DocuSign for e-signature and Stripe for payments as services an Application may call, and single sign-on through an organisation's identity provider. The home page describes a second, inbound path: 'AI calls Neota - The user works inside their AI tool. The AI reaches up to Neota for a governed answer, and the user never leaves their interface', which means an external AI client can reach the platform. How that inbound connection is authenticated and scoped is not described anywhere read (checked 2026-09-27).
Ask: How is the inbound path authenticated and scoped when an external AI tool calls Neota, which AI clients are supported, what can such a caller reach, and is it off until we enable it?
Open-web search
Not confirmed
Nothing read describes open-web retrieval by the platform or by an Application. The inputs described are the information users enter into an Application, the customer's own rules and logic, and calls out to models. No web-search component, no search provider and no administrative control over web access appears on the home page, the security page, the privacy policy or the terms of use (checked 2026-09-27).
Ask: Can an Application or a model call it makes retrieve anything from the open web, which provider performs that retrieval, and can it be blocked for our NLS Site?
Actions taken and confirmation
Public claim only
The home page describes the platform acting on model output: 'Neota calls the models inside workflows, takes action on the outputs, and keeps every decision on the record', and describes orchestration that 'Classifies, routes, applies your legal rules, triggers AI, logs every action' before an outcome that is 'Resolved, escalated, or approved'. So actions are taken by the workflow, with escalation and approval available as configured steps. No per-action confirmation requirement, and no list of the actions the platform can take, is published (read 2026-09-27).
Ask: What actions can a workflow take without a person confirming - sending a document, executing a signature, writing to another system - and can confirmation be made mandatory for each of them?
Human review before use
Public claim only
Two sources address it. The terms of use state that 'outputs should be reviewed by a qualified person before reliance', which is a contractual-style disclaimer placing review on the customer. The home page states 'Keep humans in control. Apply oversight, validate outputs, and ensure every decision meets legal and professional standards' and describes escalation to humans 'when it matters', with a full audit trail. Whether human review is an enforced product control or a step a builder may omit is not stated on any page read (checked 2026-09-27).
Ask: Is human review an enforceable control we can require across every Application on our NLS Site, or can a builder publish an Application with no review step, and is each approval recorded against a named person in the audit trail?
