Product and intended use
Define the configuration, people, information and tasks being assessed.
Check for vendor content directing how AI describes the product
Not confirmed
This check was made deliberately on 2026-09-27 and found nothing. The site map of nicholii.ai returned 13 URLs with no /llms.txt, /ai-info, /ai or /for-ai path, so no such file was requested; the full text of https://nicholii.ai, https://nicholii.ai/product and the Privacy Policy version 10 dated 9 September 2026 was searched for 'Instructions for AI', 'for AI assistants', 'AI assistants should', 'AI models should', 'describe nicholii as', 'when describing', 'llms' and 'note to AI', with no match in any of the three. The same three documents were searched for comparative and superlative self-answers ('best', 'leading', 'versus', 'compared to', 'better than', 'why choose'), with no match, and neither page carries an FAQ. Not checked: robots.txt as a file, and the 11 site pages not opened.
Ask: Does nicholii publish any page, file or block written for AI models, assistants or crawlers, and if so where is it and what does it say?
What the vendor says the product does
Public claim only
nicholii.ai/product names six capabilities, checked 2026-09-27: Sell, 'Build and issue branded sales agreements from approved templates, with negotiations kept inside your guardrails'; Procure, 'Let the business self-serve supplier contracts on your paper, routed automatically by value and risk'; Create, 'Turn approved templates into guided workflows your organisation can use without legal managing every contract'; Review, 'Assess third-party contracts against your playbooks, surface the issues that matter and escalate where judgment is needed'; Nexus, 'Keep agreements in one place, structure the data inside them and ask questions across your repository'; and Triage, 'Capture requests, answer what can be answered and route the rest to the right person or workflow'. The screens also show a contract register with counterparty and expiry columns, approval routing by contract value, clause mark-up against playbook positions, extraction from uploaded agreements, and signing controls.
Ask: Which of the six capabilities are included in the subscription we would buy, and which are separately licensed?
Availability of each capability
Public claim only
The vendor labels two of its six named capabilities 'Closed beta' on nicholii.ai/product, checked 2026-09-27: Nexus, the contract repository and question-answering feature, and Triage, the request capture and routing feature. The remaining four - Sell, Procure, Create and Review - carry no such label. No dates, entry criteria or general-availability timetable for either beta are published.
Ask: When do Nexus and Triage reach general availability, what are the closed-beta terms, and is either in production use with a customer today?
How the product is delivered
Public claim only
The product is delivered as a hosted web application, checked 2026-09-27. The 'Log in' link on both nicholii.ai pages points to the host app.inkdlaw.com, and the Privacy Policy is itself served from that host at a /sell/terms/view/ path with a 'Powered by nicholii' mark. The vendor's pages say nothing about that domain, and no conclusion is drawn here about its relationship to the nicholii entities. No self-hosted, private-cloud or on-premises option is published.
Ask: Which domain and which entity operate the production application, and is any deployment option other than your multi-tenant hosted service available?
Plans and what each includes
Not confirmed
No plan, tier, module or seat structure is published, checked 2026-09-27. nicholii.ai has no pricing page; the site offers 'Request a product tour' and a 'Calculate your ROI' page described as 'The model, built on your volumes', which was not opened. The homepage instead segments buyers by whether they have 'No legal team?', a 'Lean legal team?' or an 'Established legal team?' without attaching any plan or price to those descriptions.
Ask: What are the plans, what is in each, how is the subscription counted - by seat, by contract volume or by entity - and is the legal-services limb priced separately from the software?
Governing law and regulatory framing
Public claim only
The Privacy Policy version 10 dated 9 September 2026 frames the vendor's obligations under Australian law, citing the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Office of the Australian Information Commissioner as the escalation point for complaints, and referring to professional rules and obligations to Courts that apply to its legal services. The footer of nicholii.ai states that legal services are provided by nicholii Legal Pty Ltd with 'Liability limited by a scheme approved under Professional Standards Legislation'. No governing-law or jurisdiction clause for the Platform itself is published, because no terms of service exists.
Ask: What law governs the Platform agreement, which courts have jurisdiction, and in which Australian jurisdiction is nicholii Legal Pty Ltd admitted to practise?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client or counterparty material through the platform
Public claim only
The Privacy Policy version 10 dated 9 September 2026 states the vendor collects personal information 'From third parties' including 'our clients', 'their counterparties' and 'each of their authorised representatives', and that those third parties 'are still responsible for their own reasons for engaging with you and for collecting and using your personal information'. The same policy says 'We must collect your full name and address to provide legal services to you - this is our obligation to Courts and under professional rules that apply to us', and the footer of nicholii.ai states legal services are provided by nicholii Legal Pty Ltd with 'Liability limited by a scheme approved under Professional Standards Legislation'.
Ask: Where a law firm uses the Platform, which nicholii entity holds our client material, and how does nicholii Legal Pty Ltd, itself an incorporated legal practice, handle confidentiality and conflicts between its own legal practice and our matters?
Which models and AI infrastructure the platform uses
Public claim only
The Privacy Policy version 10 dated 9 September 2026 states that some Platform features 'use artificial intelligence (AI), such as generative models powered by large language models' and that 'These AI features are provided using third-party AI infrastructure', and clause 8 refers to 'providers of AI features used within the Platform'. No provider, model family or inference location is named in that policy or on either nicholii.ai page read on 2026-09-27; the interface shows an unnamed assistant and a 'nicholii-thinking' icon, and Nexus is a vendor feature name rather than a model.
Ask: Which third-party AI infrastructure providers and which models serve each feature, in which country does inference run, and will nicholii notify us before a provider or model is changed?
Named subprocessors
Public claim only
The Privacy Policy version 10 dated 9 September 2026, clause 8, states 'We use third party providers to support our operations, deliver our services and host our Platform - for example, cloud hosting and IT infrastructure providers and providers of AI features used within the Platform', and clause 7 permits sharing with the vendor's related companies, suppliers, payment systems operators, insurers, professional advisors and consultants. Categories are published but no subprocessor is named; no subprocessor list or page exists on nicholii.ai, whose site map returned 13 URLs on 2026-09-27.
Ask: Will nicholii give us a named subprocessor list covering hosting, AI infrastructure and payments, with the country of each, and notice before a subprocessor is added?
Whether customer content trains models
Public claim only
The homepage carries an unsourced statistic block reading 'Public AI models trained on your data' above the figure '0', checked 2026-09-27. That figure addresses public models only and is silent on training by the vendor or on private or fine-tuned models. The Privacy Policy version 10 dated 9 September 2026 permits use of personal information to 'improve our Platform and other products and services and/or develop new features or services. This includes research, planning, marketing, and development', and does not say whether that improvement purpose includes training or fine-tuning any model.
Ask: Will nicholii warrant in our agreement that neither nicholii nor its AI infrastructure providers use our documents, prompts or outputs to train, fine-tune or evaluate any model, public or private, and how does that sit with the improvement purpose in clause 6 of the Privacy Policy?
Use of feedback and support material
Public claim only
The Privacy Policy version 10 dated 9 September 2026 records that the information collected 'may include information you provide when using our services and/or communicating with us (including providing us with any feedback or asking us for support)', and clause 6 permits use of that information to improve the Platform and develop new features, including 'research, planning, marketing, and development'. The policy does not say whether feedback on an AI output, or the document the feedback relates to, is retained or used differently from other material.
Ask: When a user flags an AI output as wrong, what is captured, how long is it kept, and is the underlying document or prompt retained outside our tenancy for that purpose?
How long data is kept
Public claim only
The Privacy Policy version 10 dated 9 September 2026, clause 10, states personal information is kept 'for as long as necessary for the purposes we collected it for', which 'as a general rule' means 'for as long as the matter or Platform subscription it relates to remains active', plus 'a further period afterwards to meet our legal, professional and regulatory obligations and/or for the purposes of audit trails and reliable records'. No period is stated in days, months or years, and no separate retention term is published for uploaded documents, playbooks or AI prompts and outputs.
Ask: What is the stated retention period after a subscription ends for our documents, playbooks, audit trail and any AI prompts and outputs, and can it be set shorter by agreement?
Deletion and return of data
Not confirmed
Nothing published addresses deletion. The Privacy Policy version 10 dated 9 September 2026, clause 11, gives only access and correction rights - 'You can contact us to access or ask us to correct the personal information we hold about you' - with no deletion or erasure right, no deletion timeframe and no statement about deletion from backups. Checked on 2026-09-27 against that policy and both nicholii.ai pages read; no terms of service, DPA or security page is published.
Ask: On written request, and on termination, within how many days will nicholii delete our documents, playbooks, audit trail and AI prompts and outputs from production and from backups, and will it certify that deletion?
Vendor personnel access to customer content
Public claim only
The Privacy Policy version 10 dated 9 September 2026, clause 7, permits sharing personal information with 'our employees, officers, agents and other representatives' and 'our related companies and their employees, officers, agents and other representatives', and clause 6 includes 'providing you or our clients with legal advice' among the purposes. The product design puts vendor lawyers inside the workflow: nicholii.ai/product states 'Every workflow keeps a lawyer in the loop where judgment matters' and that the vendor's Australian legal team 'sits inside the product'. No published document limits which personnel may open customer documents, or requires customer approval or logging of such access.
Ask: Which nicholii personnel can open our documents without our request, is that access logged and visible to us, and is it restricted to the specific matter escalated?
Identity and permissions
Not confirmed
No access-control documentation is published. The Privacy Policy version 10 dated 9 September 2026 records that the Platform collects 'your username and authentication details, records of your activity on the Platform, such as sign-in times, IP address, device and browser information, an audit trail of actions you take on documents (for example, creating, viewing, editing, or signing)', which evidences authentication and an audit trail but not the controls around them. Nothing on single sign-on, multi-factor authentication, role-based permissions or administrator roles was found in that policy or on either nicholii.ai page read on 2026-09-27; the approvals shown on the product screens route by contract value rather than govern identity.
Ask: Does the Platform support single sign-on and enforced multi-factor authentication, what roles and permissions can an administrator set, and can we export the document audit trail ourselves?
Encryption in transit and at rest
Not confirmed
Encryption is not addressed anywhere published. The Privacy Policy version 10 dated 9 September 2026, clause 5, says only 'We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. We use a combination of physical, technical and administrative security measures to protect your data', without naming any control. Checked on 2026-09-27; nicholii.ai publishes no security page or trust centre, and its site map returned 13 URLs with no security or trust path.
Ask: Is customer content encrypted in transit and at rest, with which algorithms and key management, and who holds the keys?
Independent certification and audit
Not confirmed
No certification, audit report or penetration-test summary was found. Searched on 2026-09-27 across the Privacy Policy version 10 dated 9 September 2026 and both nicholii.ai pages read for SOC 2, ISO 27001, ISO/IEC 42001, IRAP and penetration testing, with no result; nicholii.ai publishes no security page or trust centre. The three award badges displayed on the homepage are third-party marketing recognition, not security or management-system certification, and are not recorded as assurance.
Ask: Does nicholii hold or intend to obtain SOC 2 Type II, ISO 27001 or ISO/IEC 42001, and will it share a current penetration-test summary and its AI governance controls under non-disclosure?
Customer contract and data processing terms
Not confirmed
No customer contract is published. The only legal document linked from nicholii.ai is the Privacy Policy, and its own clause states 'You agree to this Privacy Policy when you visit our website or use our products and services (including the Platform)'; there is no terms of service, master services agreement, service-level commitment or data processing agreement on the site, whose map returned 13 URLs on 2026-09-27. The phrase 'This agreement incorporates the General Terms' appears only inside illustrative product mock-ups belonging to a fictional customer and is not nicholii's own terms.
Ask: Which nicholii entity contracts for the Platform, and will you provide the master agreement, data processing terms, service levels and liability position for review before any trial?
Hosting location and offshore disclosure
Not confirmed
The two published statements differ in scope. The homepage carries an unsourced statistic block reading 'Where your data is hosted and processed' above the figure 'AU', with no qualification, checked 2026-09-27. The Privacy Policy version 10 dated 9 September 2026, clause 9, instead states 'We generally host and store personal information within Australia. However, some of our third party service providers may use servers or infrastructure located outside Australia in providing their services to us. Where this happens, personal information may be stored, processed or otherwise handled outside Australia', naming 'United States; United Kingdom; and/or Europe' as possible overseas locations. Read together with clause 12, which says AI features 'are provided using third-party AI infrastructure' without stating its location, the country in which inference runs is not established.
Ask: Which components sit in Australia and which may sit offshore, in which country does model inference actually run, and will nicholii commit contractually to Australian-only storage and processing including for AI features?
Breach notification
Not confirmed
No incident or breach-notification commitment was found. The Privacy Policy version 10 dated 9 September 2026 addresses complaints rather than incidents: clause 13 directs a person who believes the Privacy Act 1988 (Cth) or the Australian Privacy Principles has been breached to contact the vendor, then the Office of the Australian Information Commissioner. No notification trigger, timeframe, channel or reporting undertaking appears in that policy or on either nicholii.ai page read on 2026-09-27.
Ask: Within how many hours of becoming aware of a security incident affecting our data will nicholii notify us, who is notified, and what information does that notice contain?
Notice of changes
Public claim only
The Privacy Policy version 10 dated 9 September 2026 is self-versioned and carries 'V10-Published September 9, 2026'. Its clause 15 states 'We may update this Privacy Policy occasionally, so please check our website periodically to stay informed about any changes', and that 'If we make changes that materially affect your rights or how we handle your personal information, we will provide a clear and prominent notice of the change'. That undertaking covers the Privacy Policy only; no change or release process is published for the Platform, its AI features or its AI infrastructure providers.
Ask: How will we be told when an AI feature, a model or an AI infrastructure provider changes, and can we decline a change that moves processing offshore?
Exit and data portability
Not confirmed
Nothing published addresses exit. No export format, export tool, transition assistance or post-termination access period was found in the Privacy Policy version 10 dated 9 September 2026 or on either nicholii.ai page read on 2026-09-27, and there is no terms of service to set them out. The only adjacent statement is clause 10 of the policy, which ties retention to the Platform subscription remaining active. A 'Download' control appears beside a single agreement on a product screen, which is an illustrative mock-up rather than a documented export path.
Ask: On termination, in what formats can we export our agreements, extracted data, playbooks and audit trail, over what period do we keep access, and what does nicholii charge for a bulk export?
Connections to other systems
Not confirmed
No integration is named. Neither nicholii.ai page read on 2026-09-27 nor the Privacy Policy version 10 dated 9 September 2026 names a document management system, practice management system, e-signature provider, identity provider or API, and no developer or integration documentation exists on the site, whose map returned 13 URLs. A calendar invitation appears in the Triage mock-up ('Invite sent to your calendar'), which is illustrative and is not recorded as a calendar integration.
Ask: Which systems does nicholii connect to today, is there a documented API, and how would it read from and write to our existing document store and identity provider?
Whether the AI reaches outside the tenancy
Not confirmed
Nothing published states whether any AI feature retrieves material from the internet. The vendor describes its AI as working against customer-supplied material - Nexus is described as letting a user 'ask questions across your repository' and Review as assessing contracts 'against your playbooks' - but neither page read on 2026-09-27 nor the Privacy Policy version 10 dated 9 September 2026 says whether web search, external legal content or any other outside source is available to the assistant, or whether it can be disabled.
Ask: Can any AI feature fetch material from the internet or from sources outside our tenancy, and can that be switched off for our account?
What the system does without a person approving it
Not confirmed
The vendor publishes that the platform acts on its own once rules are set: 'Once the rules are set, routine work moves on its own. Documents are assembled, approvals triggered, signatures collected and key dates captured, without the legal team managing every step', and 'Legal stays in control of what gets automated, what AI can handle and when a lawyer steps in', checked 2026-09-27. The one AI action shown in sequence is confirmed by the user first - the assistant states 'I can update the governing law and jurisdiction provisions in the contract automatically... Would you like me to make that change?' and acts after 'Yes, please' - but that sequence appears in an illustrative mock-up, so which actions require confirmation by default is a design the firm must establish and accept.
Ask: Which actions can the system take without a human approving them at the point of action - issuing a document, applying a redline, triggering an approval, sending for signature - and which of those defaults can we change?
Human decision over AI output
Public claim only
The Privacy Policy version 10 dated 9 September 2026, clause 12, states that AI features such as 'drafting contract terms or flagging issues in a document' 'work from the content and instructions provided, which may include personal information - but the relevant users make the actual decisions, not the AI'. The vendor's own pages describe the same boundary: 'Judgment stays human. When something falls outside the rules, your in-house team or one of our experienced lawyers can step in', and on the Review screens '12 clauses checked against your playbook' with '2 issues outside your approved position' escalated. Nothing published says which steps enforce review as a system control rather than leaving it to the user.
Ask: Which steps in the workflow cannot complete without a named human approving them, and can we require lawyer review of every AI redline before a document is issued?
