---
title: "Neota (Neota Logic Inc.)"
url: "https://ailawframework.com/software/neota"
type: "software_profile"
site: "AI Law Framework"
id: "neota"
vendor: "Neota Logic Inc."
category: "Legal-specific"
segment: "Document automation"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Neota (Neota Logic Inc.)

> No-code platform for building governed legal workflows and applications: it applies the customer's own rules, calls third-party AI models, logs each action and escalates to a person, for corporate legal teams and law…

Canonical page: https://ailawframework.com/software/neota  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The Neota Logic System, its Workbench development environment and applications deployed on an NLS Site, on the vendor's published security page, privacy policy and terms of use. Pricing and platform-feature pages were not read.

No-code platform for building governed legal workflows and applications: it applies the customer's own rules, calls third-party AI models, logs each action and escalates to a person, for corporate legal teams and law firms.

## Capabilities

- Document automation
- Agentic workflows
- Intake and triage

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Model providers | OpenAI - logo displayed on the vendor's home page in the section headed 'Two Approaches, One Governed Core', which describes Neota calling models inside workflows and an AI tool calling Neota, Anthropic (Claude) - logo displayed in the same section of the vendor's home page, Google (Gemini) - logo displayed in the same section of the vendor's home page |
| Assurance | ISO 27001 - the security page states 'Neota is proud to be ISO 27001 certified'; no certificate, scope statement, certification body or expiry date is published, and the 'Learn more about our ISO certification' link goes to the vendor's contact form, Third-party penetration testing - the security page states 'Regular third-party penetration testing and ongoing monitoring find and close vulnerabilities before they become risks'; no report, scope or date is published, A security pack is offered on request from the security page; it was not obtained |
| Training on customer content | Unknown |
| Retention | The privacy policy states that 'For an Application to function, Application Data must be and is stored temporarily during the Session', that 'Application Data is encrypted at all times', and that 'When a Session ends, Application Data is either deleted automatically or, at the direction of the owner of the NLS Site, stored for some period of time'. Retention of application content is therefore configured by the owner of the NLS Site, and no default period or maximum is published. For personal information generally the policy states only that 'We generally discard personal information about you when we no longer need the personal information for the purposes for which we collect and use it ... and we are not legally required to continue to keep it'. |
| Integrations | DocuSign - named in the privacy policy as a third-party service an Application may use for e-signature, Stripe - named in the privacy policy for credit card payments, with the policy stating card numbers, expiry dates and CVC codes are not stored by Neota and are passed directly to Stripe, Single sign-on through an organisation's identity provider - named in the privacy policy, An Integrations page is linked from the vendor's own navigation at https://www.neotalogic.com/integrations and was not read |
| Legal content coverage | None is claimed. The platform is described as encoding the customer's own rules and decision logic - 'Build the rules, conditions, and decision logic that drive every process, no code required' - rather than supplying legal content. No Australian primary law, Australian precedent set or jurisdiction-specific content library is claimed on any page read. |
| Pricing | No price was read. The vendor links a Pricing page at https://www.neotalogic.com/pricing from its own footer, which was not opened in this pass. The terms of use state that Neota's aggregate liability 'is limited as set out in your agreement', so the commercial terms sit in a separate agreement that is not published. The published call to action is 'Book demo or scope your first project', which indicates a scoped engagement rather than published list pricing, but no licence unit, seat count or minimum is stated anywhere read. |
| Australian presence | Unknown. No Australian contracting entity, ACN or ABN was found. The privacy policy states that 'Neota Logic Inc. and its group companies act as data controllers in respect of the personal information we collect and use as described in this policy' and gives a registered address of 228 Park Ave S, New York, NY 10003, USA. The terms of use state they 'are governed by the laws of the State of New York, and the parties submit to the exclusive jurisdiction of its courts'. On residency, the privacy policy states that 'Information from an NLS Site and the Applications run on that NLS Site is stored in the country or region directed by the owner of that NLS Site' and the security page states 'Hosting is available via Amazon Web Services or Microsoft Azure' - but no list of available countries or regions is published, Australia is named nowhere, and no Australian office, Australian support arrangement or Australian customer appears on any page read. The home page displays a strip of customer logos without stating any customer's country, so no Australian customer is recorded. |
| Website | https://www.neotalogic.com |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | The privacy policy, read 2026-09-27, is the clearest published description of the product structure: it covers 'Our software the Neota Logic System, including all of the online tools accessed or run from the Website (which we refer to as "Workbench") (collectively, "NLS")', 'An instance of NLS deployed for us or a client ("NLS Site"), including all data stores attached to the NLS Site', and 'Applications created with NLS and deployed on an NLS Site by us or our clients'. No plan names, editions or modules are published on the pages read, and the policy adds that it 'does not apply to any NLS Site or Application that has a separate privacy policy'. | What is in the subscription - Workbench seats, an NLS Site, or a number of deployed Applications - and where an Application we build has its own privacy policy, which of your commitments still apply to us? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Deployment model and where the instance sits | Public claim only | The security page states that 'Neota's no-code development environment allows you to publish your applications to a URL with just a few clicks' and that 'Hosting is available via Amazon Web Services or Microsoft Azure, providing you with flexibility and choice when it comes to your deployment options.' The privacy policy describes 'An instance of NLS deployed for us or a client ("NLS Site")', which indicates a per-customer instance, and states application data is 'stored in the country or region directed by the owner of that NLS Site'. No on-premises or self-hosted option is described, and no list of available cloud regions is published (all read 2026-09-27). | Is our NLS Site a dedicated instance or a shared tenancy, which cloud and which regions can we choose, and can we require Australian hosting for the instance and its attached data stores? | [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| What the platform does | Public claim only | The home page, read 2026-09-27, describes a three-stage flow: 'Legal request comes in - Contract, intake, advice request, any channel'; 'Neota orchestrates it - Classifies, routes, applies your legal rules, triggers AI, logs every action'; 'Governed outcome delivered - Resolved, escalated, or approved, with full audit trail'. Its three named pillars are Human Expertise ('Keep humans in control. Apply oversight, validate outputs'), Logic Engine ('Build the rules, conditions, and decision logic that drive every process, no code required') and AI Agnostic. Document automation is carried on the vendor's own navigation as a use case at https://www.neotalogic.com/document-automation; that page was not read, so the document-automation capability recorded here rests on the vendor's navigation label and on the privacy policy's description of Applications collecting entered data, not on a product page. | Describe the document assembly the platform performs - output formats, template authoring, clause conditionality - and say which parts use a model and which are deterministic rules. | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Jurisdiction and legal content | Public claim only | No legal content library or jurisdiction coverage is claimed. The published design is that the customer encodes its own rules: 'Build the rules, conditions, and decision logic that drive every process, no code required.' The customer-logo strip on the home page carries no country statement. No Australian legal content, Australian statute coverage or Australian language handling is claimed on any page read (checked 2026-09-27). | Does any part of the platform carry legal content of your own, or is all substantive legal logic supplied by us, and who is responsible for keeping an Application current when the law changes? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/) |
| Licence terms and intellectual property in what we build | Public claim only | The terms of use, read 2026-09-27, state that 'The platform, including its software, design, and documentation, is owned by Neota and protected by intellectual property laws. You retain ownership of the content and solutions you create using the platform, subject to the license granted to operate the services.' The scope of that licence back to Neota is not set out in the published terms. Permitted use is limited to 'lawful business purposes and in accordance with these terms', and 'Account holders are responsible for activity under their credentials'. The commercial terms are not published: liability is 'limited as set out in your agreement'. | Set out the exact licence we grant you over the Applications and logic we build, whether it survives termination, and whether you may reuse any of it for other customers. | [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Integration with other systems | Public claim only | The privacy policy names two third-party services an Application may call: 'If an Application uses a third-party service such as DocuSign for e-signature or Stripe for credit card payments, we collect the information required for those services', with card data passed directly to Stripe and not stored by Neota. It also describes accounts managed by 'an organization's Identity Provider (i.e., via Single Sign On)'. An Integrations page is linked from the vendor's navigation and was not read. No document management system, practice management system or Microsoft integration is named on the pages read (checked 2026-09-27). | List every integration available, and for each say what data leaves the NLS Site, to which country, and whether it is enabled only when we configure it. | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Support arrangements | Not confirmed | No support hours, service levels, severity matrix or support contact for customers was found on any page read on 2026-09-27. The privacy policy refers to Support Requests ('If you submit Support Requests, we will also collect the personal information you provide about the problem requiring support'), which confirms a support channel exists without describing it. The terms of use state the services are provided 'on an "as is" and "as available" basis' and that 'Neota does not warrant that the services will be uninterrupted or error-free'. Contacts published are dpo@neotalogic.com for privacy and legal@neotalogic.com for the terms. | What support hours, response times and availability commitment apply to an Australian customer, and are they in the agreement or only in practice? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Published evidence of output quality | Not confirmed | The figures published on the home page are unsourced and undefined: '8M+ Annual sessions', '100+ Law firms & legal teams', '10,000+ Global users', '$100M+ Verified value driven' and '15+ years of experience'. No methodology, definition or verification is given for the value figure despite the word 'verified', and no accuracy measurement, benchmark or independent evaluation of any AI-assisted step is published. The security page offers a security pack on request but no quality or evaluation document (all checked 2026-09-27). | How is the '$100M+ verified value' figure calculated and by whom, and do you publish or share any measurement of the accuracy of a model-assisted step inside a governed workflow? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security) |
| Task fit and the checking the customer must do | Public claim only | The stated design puts the person after the machine: the home page states 'Keep humans in control. Apply oversight, validate outputs, and ensure every decision meets legal and professional standards' and describes outcomes as 'Resolved, escalated, or approved, with full audit trail'. The terms of use state that 'outputs should be reviewed by a qualified person before reliance'. Nothing published says which decisions the platform routes to a person by default, how an escalation rule is written, or what a reviewer is shown (read 2026-09-27). | In a shipped Application, what triggers an escalation to a person by default, can that default be removed by a builder, and what does the reviewer see when they are asked to validate an output? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27 for content telling AI models, assistants or large language models how to describe this product. Four vendor pages were read - the home page, the security page, the privacy policy and the terms of use - and none carries a heading or block addressed to AI models, assistants or crawlers, and none contains a 'describe as' instruction. No /llms.txt, /ai-info or /for-ai URL appeared in the navigation or footer links on any of those pages, and a site map of the vendor's domain returned no URLs at all, so no candidate file was identified to fetch. No crawler directive file was fetched. The check covered the four pages named, not the whole site. | Do you publish anywhere on your site, or in any file served to crawlers or AI assistants, content that instructs an AI model how to describe Neota? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Client authority and professional use | Not confirmed | Nothing read addresses client notice, consent or confidentiality where client information is entered into an Application and then sent to a model. The privacy policy places the consent burden partly on the operator of the Application: it relies on consent 'which consent may be given by you to us or to the owner of an NLS Site that is running an Application into which your personal information is input', and repeats that formula for sharing. It does not mention AI or model processing anywhere, so it does not address consent for that path at all (checked 2026-09-27). | Where an Application sends a client's information to OpenAI, Anthropic or Google, what consent do you consider we must hold from that client first, and is that allocated anywhere in the agreement? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Foundation-model providers and inference location | Public claim only | The vendor's home page, read 2026-09-27, displays OpenAI, Anthropic Claude and Google Gemini logos in a section headed 'Two Approaches, One Governed Core', describing 'Neota orchestrates AI - Neota calls the models inside workflows, takes action on the outputs, and keeps every decision on the record' and 'AI calls Neota - The user works inside their AI tool. The AI reaches up to Neota for a governed answer'. No model name, version, provider entity or inference region is stated, and the privacy policy and security page do not mention AI, models or model providers at all, so the only published naming of a provider is a logo on a marketing page. | Name each model and provider entity the platform calls, the inference region for each, whether any inference can be pinned to Australia, and the notice we receive before a model changes. | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Subprocessors | Not confirmed | No subprocessor list, register or DPA schedule was found anywhere on the vendor's site. The privacy policy names processors only in passing and mostly for the website: 'We use Google Analytics, Google Adwords, Clearview Social, and Hubspot to track pages visited', 'Userflow (userflow.com) provides user onboarding and in-context guidance within our platform', and DocuSign and Stripe as services an Application may call. It then relies on a general permission to share with 'third-party vendors who need to know personal information about you in order to provide their services to us', requiring them 'to agree to privacy commitments'. No model provider, hosting entity or country appears in any published list (checked 2026-09-27). | Will you publish or provide a dated subprocessor register for the platform - entity, country, purpose and data types, including every model provider and the hosting entity - with notice and objection rights when it changes? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Training on customer content | Not confirmed | No document read states whether entered application data, documents or prompts are used to train or tune any model. The privacy policy's stated purposes are 'To provide our Services - to set up, operate, secure, and back up your NLS Site and Applications', 'To analyze how users interact with our Services in order improve our Services', and website marketing measurement; it relies in part on a legitimate interest 'to improve our Services', and does not define what improvement covers or exclude model training. The words training, model and AI do not appear in it. The terms of use are silent (checked 2026-09-27). | Will you warrant that application data, documents and prompts are never used to train, fine-tune or evaluate a model, by Neota or by any model provider you call, and does 'improve our Services' in the privacy policy include any model training? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Feedback, analytics and telemetry | Public claim only | The privacy policy states that for an NLS Site the vendor collects 'information about your usage of NLS Sites - when you log in, which Applications you use or edit, how long your Application Sessions are, and so on', and that 'Userflow (userflow.com) provides user onboarding and in-context guidance within our platform, as well as general metrics and tracking within our products'. For Applications it states 'we collect the information that users enter while using an Application ("Application Data")'. No in-product rating control, and no option to disable telemetry, is described (read 2026-09-27). | Can Userflow tracking and usage telemetry be disabled for our NLS Site, and is any Application Data, prompt or output included in what Userflow or any analytics provider receives? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Retention of application data | Public claim only | The privacy policy, read 2026-09-27, states that 'For an Application to function, Application Data must be and is stored temporarily during the Session', that 'Application Data is encrypted at all times', and that 'When a Session ends, Application Data is either deleted automatically or, at the direction of the owner of the NLS Site, stored for some period of time'. Retention of application content is therefore a setting the site owner chooses, and no default, maximum or backup period is published. For personal information generally the policy commits only to discarding it when no longer needed and not legally required. | What is the default retention for Application Data on a new NLS Site, what maximum can be configured, and how long do copies persist in backups after a session record is deleted? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Deletion and certified erasure | Public claim only | The privacy policy states that depending on location a person may 'request deletion of your information', exercised by contacting the vendor's privacy team, with a stated aim 'to respond to all requests within 30 days'. That addresses personal information rather than the customer's Applications, logic and data stores. The automatic path published is session-based: Application Data 'is either deleted automatically or, at the direction of the owner of the NLS Site, stored for some period of time'. No obligation to certify deletion in writing, and no deletion timeframe on termination, was found (checked 2026-09-27). | On request and on termination, what is deleted from the NLS Site, its attached data stores and your backups, within what period, and will you certify it in writing? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Vendor access to content | Public claim only | The privacy policy states that the vendor 'may disclose personal information about you to our subsidiaries, our employees, and individuals who are our independent contractors that need to know the personal information in order to help us provide our Services or to process the personal information on our behalf', and requires them to follow the policy. It also states an NLS Site may be 'deployed for us or a client', which means Neota may operate a site itself. No country restriction on staff or contractor access, no approval or ticketing process, and no customer-visible access log is published (checked 2026-09-27). | Who at Neota and which contractors can read our Application Data and Applications, from which countries, under what approval, and can we obtain an access log? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Access control and audit | Public claim only | The security page states that 'Role-based access control (RBAC) lets you define specific permissions for different user roles' and that 'Single sign-on (SSO)' is offered for authentication, and the page headline states 'Your data is encrypted, access is controlled, and every action is logged.' The privacy policy adds that where an account is not managed by an organisation's identity provider the vendor stores an encrypted password, and that multi-factor authentication is optional per account: 'If Multi Factor Authentication (MFA) is enabled for your account, you have the option of providing your phone number'. Whether MFA can be enforced for all users, and whether the audit log is exportable, is not published. | Can multi-factor authentication be enforced for every user on our NLS Site, and can an administrator export the audit log of every action, including each model call an Application makes? | [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Encryption in transit and at rest | Public claim only | The security page states 'Data is encrypted in transit and rest to current standards (AES-256), so sensitive information remains protected at every stage', and displays AES-256 as one of three badges captioned 'Encryption in transit and at rest'. The privacy policy states that 'Application Data is encrypted at all times' and that a stored password is held 'in an encrypted form. We have no means to unencrypt your password.' No transport protocol version, key-management model or customer-managed key option is published, and nothing addresses the path to a model provider (read 2026-09-27). | State the transport protocol and key-management model for the NLS Site, whether customer-managed keys are available, and what encryption applies to a prompt sent from an Application to a model provider. | [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Independent security assurance | Public claim only | The security page, read 2026-09-27, displays three badges - ISO 27001 'Certified information security management', GDPR 'Data protection & privacy compliant' and AES-256 - under the heading 'Independently Certified and Audited', and states 'Neota is proud to be ISO 27001 certified' and that 'Regular third-party penetration testing and ongoing monitoring find and close vulnerabilities before they become risks'. No certificate, scope statement, certification body, expiry date or penetration-test report is published; the link offered to learn more about the ISO certification goes to the vendor's contact form. A security pack is offered on request. No SOC 2 report, no ISO/IEC 42001 and no IRAP assessment appears anywhere read. | Provide the ISO 27001 certificate with its scope statement, certification body and expiry, confirm whether the NLS Sites and Applications are inside that scope, and say whether a SOC 2 report or an IRAP assessment exists. | [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security) |
| Contract, entity, DPA and forum | Public claim only | The terms of use, read 2026-09-27, state they 'are governed by the laws of the State of New York, and the parties submit to the exclusive jurisdiction of its courts', and that liability 'is limited as set out in your agreement' - so the published terms are not the operative contract. The privacy policy states 'Neota Logic Inc. and its group companies act as data controllers in respect of the personal information we collect and use as described in this policy' and gives a registered address of 228 Park Ave S, New York, NY 10003, USA. No data processing addendum, and no Australian contracting entity, ACN or ABN, was found anywhere on the vendor's site. | Which Neota entity will contract with us, is there an Australian entity with an ACN or ABN, will you accept Australian law and forum, and will you provide a data processing addendum naming Neota as processor? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Cross-border transfers and APP 8 | Public claim only | The privacy policy states that 'Information from an NLS Site and the Applications run on that NLS Site is stored in the country or region directed by the owner of that NLS Site, except that information provided to third-party services such as DocuSign and Stripe is stored wherever those services determine', and that website information 'is stored wherever our hosting provider or Google Analytics determines'. On transfers it states 'Neota operates globally. When we transfer personal information outside the country in which it was collected, including from the European Economic Area (EEA) to other countries, we use appropriate safeguards such as standard contractual clauses approved by the European Commission'. No list of available countries or regions is published, Australia is named nowhere, and nothing addresses where model inference occurs (read 2026-09-27). | Which countries and regions can we direct our NLS Site to, is Australia one of them, and in which country does inference run when an Application calls a model? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security) |
| Incident notification and history | Not confirmed | No incident notification period, cooperation commitment, breach process or incident history was found on any page read on 2026-09-27. The security page describes 'ongoing monitoring' and a dedicated security team conducting 'thorough audits and continuous monitoring to identify and address any potential vulnerabilities or threats', which is a monitoring statement rather than a notification obligation. Neither the privacy policy nor the terms of use contains a breach notification clause. | State the contractual notification period from discovery for a security incident affecting our NLS Site, including one at a model provider or hosting provider, and confirm cooperation with the Notifiable Data Breaches scheme. | [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Change notice for models, terms and processors | Public claim only | The only published change mechanism is for the privacy policy itself: 'We may update this privacy policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email.' The terms of use contain no change or notice clause. No advance notice, objection right or change log covers a model change, a subprocessor change or a platform change, and the privacy policy page read carried no visible effective date (checked 2026-09-27). | What written notice will we receive before a model provider, a subprocessor or the hosting arrangement changes, and can we pause the AI-calling parts of our Applications while we assess a change? | [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy); [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) |
| Export and exit | Not confirmed | No export format, export window or exit assistance was found. The terms of use state 'You retain ownership of the content and solutions you create using the platform', which is an ownership statement rather than an export right, and give no mechanism for taking an Application or its data out. The privacy policy offers a data portability right for personal information only. Nothing addresses what happens to a deployed Application, its logic or its data stores on termination (checked 2026-09-27). | On termination, in what format and within what period will you return our Applications, their logic and their data stores, can an Application keep running anywhere else, and is there a charge? | [Neota Terms of Use](https://www.neotalogic.com/terms-of-use); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Connectors and third-party services | Not confirmed | Three connector paths are published and each is a decision for the customer. The privacy policy names DocuSign for e-signature and Stripe for payments as services an Application may call, and single sign-on through an organisation's identity provider. The home page describes a second, inbound path: 'AI calls Neota - The user works inside their AI tool. The AI reaches up to Neota for a governed answer, and the user never leaves their interface', which means an external AI client can reach the platform. How that inbound connection is authenticated and scoped is not described anywhere read (checked 2026-09-27). | How is the inbound path authenticated and scoped when an external AI tool calls Neota, which AI clients are supported, what can such a caller reach, and is it off until we enable it? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Open-web search | Not confirmed | Nothing read describes open-web retrieval by the platform or by an Application. The inputs described are the information users enter into an Application, the customer's own rules and logic, and calls out to models. No web-search component, no search provider and no administrative control over web access appears on the home page, the security page, the privacy policy or the terms of use (checked 2026-09-27). | Can an Application or a model call it makes retrieve anything from the open web, which provider performs that retrieval, and can it be blocked for our NLS Site? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/); [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) |
| Actions taken and confirmation | Public claim only | The home page describes the platform acting on model output: 'Neota calls the models inside workflows, takes action on the outputs, and keeps every decision on the record', and describes orchestration that 'Classifies, routes, applies your legal rules, triggers AI, logs every action' before an outcome that is 'Resolved, escalated, or approved'. So actions are taken by the workflow, with escalation and approval available as configured steps. No per-action confirmation requirement, and no list of the actions the platform can take, is published (read 2026-09-27). | What actions can a workflow take without a person confirming - sending a document, executing a signature, writing to another system - and can confirmation be made mandatory for each of them? | [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/) |
| Human review before use | Public claim only | Two sources address it. The terms of use state that 'outputs should be reviewed by a qualified person before reliance', which is a contractual-style disclaimer placing review on the customer. The home page states 'Keep humans in control. Apply oversight, validate outputs, and ensure every decision meets legal and professional standards' and describes escalation to humans 'when it matters', with a full audit trail. Whether human review is an enforced product control or a step a builder may omit is not stated on any page read (checked 2026-09-27). | Is human review an enforceable control we can require across every Application on our NLS Site, or can a builder publish an Application with no review step, and is each approval recorded against a named person in the audit trail? | [Neota Terms of Use](https://www.neotalogic.com/terms-of-use); [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/) |

## Notes

Five firecrawl operations spent on this product across both stages, which is the cap: in stage 1, one scrape of the home page and one map of neota.com that returned zero URLs; in stage 2, the security page, the privacy policy and the terms of use. The URL list used was derived at no cost from the navigation and footer links on the home page, because the map returned nothing. No further page could be fetched. Not reached and left unverified: the pricing page, the platform, platform-features, how-it-works, integrations, AI-solutions and document-automation pages, all linked from the vendor's own navigation, and the security pack offered on request. The document-automation capability recorded here therefore rests on the vendor's own navigation label and on the privacy policy's description of Applications collecting entered data, not on a product page that was read. The most material absences, each recorded plainly rather than padded: there is no data processing addendum, no subprocessor list and no trust centre anywhere on the vendor's site; the privacy policy does not mention AI, models or model providers at any point, even though the home page displays three model-provider logos; no hosting region or country list is published, so hostingRegions and australianRegion are recorded as unknown even though the privacy policy states the region is directed by the owner of the NLS Site; there is no breach notification clause in either published document; and the terms of use state that liability is limited by a separate agreement that is not published, so the operative contract was never seen. The ISO 27001 statement is a vendor claim with no certificate, scope, body or expiry, and the link offered to learn more goes to a contact form. customerModelChoice is recorded as true on one published sentence - 'Use the AI models you trust. Neota works across providers, so you're never locked into a single vendor' - with no supported-model list, configuration documentation or contractual commitment read; the modelProvider consideration records it as a vendor claim. The batch entry for this product came from a third-party Australian legal software directory listing. That listing is not vendor material and is cited nowhere in this profile; existence is established from the vendor's own current site, which carries the product. No Australian presence is recorded, because none was published. No capability vocabulary gap arose for this product.

## Sources

- [Neota home page - 'The Control Layer for Legal AI' (served at neota.com; every link on the page points to www.neotalogic.com)](https://neota.com/) (checked 2026-09-27)
- [Enterprise-grade security by default - Neota security page](https://www.neotalogic.com/security) (checked 2026-09-27)
- [Neota Logic Privacy Policy, covering the Website, the Neota Logic System, an NLS Site and Applications](https://www.neotalogic.com/privacy) (checked 2026-09-27)
- [Neota Terms of Use](https://www.neotalogic.com/terms-of-use) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.