Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Not confirmed
The Nitro AI page (checked 27 September 2026) says 'All Nitro AI tools are included in existing subscriptions at no added cost' and its FAQ says the AI features 'are not a separate add-on and do not require an additional purchase'. The same page carries the footnote '*Smart Redact requires a separate license' for Smart Redact and states Form Field Detection is 'Available in the Nitro Sign Plus plan'. The two statements are not reconciled anywhere on the page.
Ask: Which named Nitro AI tools are included in the subscription we are quoted, and which of Smart Redact and Form Field Detection carry a separate licence or plan requirement?
Deployment model
Public claim only
The AI tools are located in Nitro Workspace, a cloud hub reached from Nitro PDF and Nitro Sign on Windows, Mac and iOS. The AI page says Document Assistant 'is powered by Azure OpenAI and hosted in a secure environment controlled by Nitro'. No on-premises, private-cloud or self-hosted option for the AI features appears on any page read, and no hosting region is named.
Ask: For our tenant, in which cloud and which region does Nitro Workspace run, and is any deployment available where document content does not leave a named region?
AI features in scope
Public claim only
The vendor describes Document Assistant as answering questions about a PDF, summarising, explaining passages and translating; Knowledge Assistant as answering questions about how to use the product 'without accessing your documents or personal information'; Form Extract as using 'advanced AI and OCR' to extract named fields into one Excel file; Table Extract as using 'advanced machine learning' to pull tables into Excel; Form Create and Form Field Detection as detecting and placing fillable and signature fields; and Smart Redact as flagging sensitive data for review before permanent redaction.
Ask: Which of these features will be enabled for our users by default, and can each be switched off individually at tenant level?
Release stage
Public claim only
The trust-centre AI page states 'While in Beta, Document Assistant is enabled for individual purchasers; larger organizations must opt-in.' Site navigation labels the Knowledge Assistant 'Knowledge Assistant AI (BETA)'. No general-availability date is published for either.
Ask: What are the beta terms for Document Assistant and Knowledge Assistant, including any reduced warranty, support or data commitments while in beta, and when do they reach general availability?
Jurisdictions and legal content
Public claim only
This is a general-purpose document product with no legal-content library and no cited primary law. The trust-centre overview lists eSignature laws the product is said to meet - eIDAS (EU), UETA and ESIGN (US), ZertES (Switzerland), Singapore ETA and Hong Kong regulations. Australian electronic-transactions law is not named on the pages read.
Ask: Does Nitro Sign address the Australian Electronic Transactions Acts and state-based witnessing requirements, and is any Australian legal assessment available?
Vendor content directing how AI describes the product
Not confirmed
Checked on 27 September 2026. A search-filtered map of gonitro.com returned 40 URLs and none was /llms.txt, /ai-info, /ai or /for-ai; none of the five pages read (product page, trust-centre AI page, eCommerce Terms, privacy policy, DPA, trust-centre overview) contains a block addressed to AI models, assistants or crawlers. This is a negative result on the URLs returned and the pages read, not proof that no such page exists elsewhere on the site.
Ask: Does Nitro publish any page or block of content that instructs AI models, assistants or crawlers how to describe Nitro products?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Nothing read addresses legal professional privilege, client confidentiality or the authority needed before client documents are sent to a third-party model. The DPA makes the customer the controller who defines the purpose and instructions, and the eCommerce Terms require the buyer to warrant the licences are for its own business use. Document Assistant is stated to be enabled by default for individual purchasers during beta, with organisations required to opt in - so an individual practitioner's documents can reach the model without a firm-level decision.
Ask: For a law firm tenant, can Document Assistant be blocked for all users until the firm opts in, and what notice do you require us to give clients before their documents are processed by Azure OpenAI?
Foundation-model providers
Public claim only
The trust-centre AI page states 'Nitro does not train or create proprietary generative AI models. Instead, we rely on established AI models, such as Azure OpenAI LLMs' and that Document Assistant and Knowledge Assistant both 'use Azure OpenAI LLMs and Retrieval Augmented Generation (RAG)'. The product FAQ adds that Document Assistant is 'powered by ChatGPT and hosted on Microsoft Azure OpenAI'. No model name or version, no Azure region and no contract reference is published, and neither the DPA nor the eCommerce Terms names a model provider.
Ask: Name each model and version used by Document Assistant, Smart Redact and the extraction tools, the Azure region each call is served from, and what notice we receive before a model is changed.
Subprocessors
Not confirmed
The DPA gives Nitro a general written authorisation to engage subprocessors and says Nitro 'publishes a Sub-processor List' at the trust centre, which it 'may update from time to time as per the process set out in this Data Processing Addendum'. The clause text read sets out no notice period and no right to object. The subprocessor list itself was not opened within the evidence budget for this profile, so the processors behind the AI features are unverified.
Ask: Provide the current dated subprocessor register for Nitro Workspace and each AI feature, with entity, country, purpose, and our notice and objection rights before a new subprocessor is added.
Training on customer content
Public claim only
The trust-centre AI page states 'Your inputs are never used to train OpenAI LLMs or other generative AI models' and 'We do not create proprietary generative AI models or share your data with third parties for model training'. The trust-centre overview repeats 'Nitro does not use customer documents, signatures, or metadata to train artificial intelligence models.' The default Data Processing Addendum read contains no training prohibition and no AI-specific clause, so the statement rests on trust-centre pages rather than on the contract.
Ask: Will you warrant in our order form or an addendum that no document content, prompt, output or metadata is used to train or fine-tune any model, by Nitro or by Microsoft or OpenAI?
Feedback and quality monitoring
Public claim only
The AI code of conduct lists 'Feedback channels: Mechanisms for users to report concerns or suggestions', and the FAQ says 'Nitro actively monitors user feedback, incorporates it into continuous improvement'. Nothing read states whether prompts, answers, ratings or reported issues are retained, who reads them, or for how long. The privacy policy records usage and telemetry data collected for performance and analytics under legitimate interest.
Ask: If a user reports a bad Document Assistant answer, what document content is retained with that report, who can read it, and can we disable in-product feedback collection?
Retention of prompts, outputs and indexes
Public claim only
The DPA (effective 1 April 2025) says Nitro will not keep personal information longer than required, that customers can request specific retention periods where technically feasible, and that where none is configured data is stored 'until deletion by the Customer or until termination of the Agreement between Nitro and the Customer (plus maximum 30 days), whichever of both situations comes first'. The AI page says documents are 'processed temporarily for the requested task and deleted once the task is complete'. No retention period is published for prompts, answers or extraction output, and the privacy policy contains no retention section.
Ask: State the retention period for Document Assistant prompts and answers, Knowledge Assistant chats, extraction output and any embeddings or indexes, and confirm which of these we can configure.
Deletion and certified erasure
Public claim only
The DPA says Nitro 'shall delete or return all Personal Information to the Customer after the end of the provisioning of Services and shall delete existing copies unless applicable law requires storage', and that where download functionality exists the customer must use it to extract or delete its data. The privacy policy describes a right to deletion for personal data exercised through a web form. No certified-deletion statement and no deletion commitment binding the model provider was found.
Ask: On exit, what exactly is deleted from Nitro Workspace and from the Azure OpenAI path, in what period, and will you certify deletion in writing?
Vendor and verifier access to content
Public claim only
The DPA says only employees, contractors or agents involved in the processing may be informed about personal information, only as reasonably necessary, and that those authorised are bound by contractual or statutory confidentiality. The trust-centre overview states 'We do not view or use personal data.' The privacy policy separately says data collected by the services, sites or software 'may be shared with internal entities in Nitro to support ancillary functions such as performance monitoring, improved service offerings, technical support, and marketing'. No ticketed-approval process or customer-visible access log is described.
Ask: Who at Nitro or its affiliates can read a document processed by Document Assistant, from which countries, under what approval, and can we obtain an access log?
Access control, SSO and audit
Public claim only
The trust-centre overview says Nitro 'offers enhanced security features for enterprise plans, such as single sign-on (SSO) and two-factor authentication (2FA)' and that document activity is tracked with downloadable audit trails - both stated as plan-dependent. The privacy policy records collection of SAML provider data with consent. During beta, Document Assistant is enabled for individual purchasers and requires opt-in for larger organisations. No admin control to disable individual AI tools per user is described on the pages read.
Ask: On the plan we are quoted, are SSO, SCIM and mandatory MFA included, and can an administrator turn each AI tool on or off per user and export an audit log of AI use?
Encryption in transit and at rest
Public claim only
The AI page says of Document Assistant 'Data is encrypted in transit and at rest, with controlled access', and the trust-centre overview refers to 'industry-standard encryption, role-based access controls, continuous monitoring'. No algorithm, protocol version or key-management detail is published, and customer-managed keys are not mentioned. The DPA points to technical and organisational measures held in a separate Information Security Policy PDF and a security page, neither of which was opened.
Ask: Confirm the encryption standards and key management for Nitro Workspace, the AI processing path and backups, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The trust-centre overview states Nitro 'meets internationally recognized standards and certifications ... including ISO 27001, SOC 2, HIPAA, QTSP accreditation, and the EU-U.S. Data Privacy Framework', and that annual third-party audits verify controls for Nitro Sign Enterprise Verified. No certificate number, auditor, scope statement or report date appears on the pages read, and no ISO/IEC 42001 claim was made. The DPA points to a separate compliance page listing certifications, which was not opened.
Ask: Provide the current ISO 27001 certificate and SOC 2 report with scope and exceptions, and confirm in writing whether Nitro Workspace and the AI features are inside that scope.
Contract, DPA, liability and forum
Public claim only
Purchases through the online store are made from Nitro Software Ecomm Limited (Dublin, Ireland) as authorised reseller to Nitro Software Inc, governed by the laws of Ireland with exclusive jurisdiction in the Irish courts subject to mandatory consumer law. The default Data Processing Addendum (effective 1 April 2025) names Nitro Software Inc. as processor, prevails over the Terms of Service where they conflict on data protection, and applies unless the EU GDPR, UK GDPR or Swiss FADP applies. Audits require one month's notice, a Nitro-issued non-disclosure agreement and reimbursement at USD 295 per hour beyond four hours. The Terms of Service itself was not opened.
Ask: Which entity will contract with our Australian firm, under which governing law, and can we have an Australian order form with an AI addendum and an uncapped audit right?
Cross-border transfers and APP 8
Not confirmed
Nothing read names the country or region where Nitro Workspace stores documents or where the Azure OpenAI inference call is served. The privacy policy addresses transfers out of the European Economic Area and records certification to the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks, with standard contractual clauses as an alternative; Australia and the Privacy Act 1988 (Cth) are not mentioned anywhere in it. The DPA contains no transfer annex for non-EU customers beyond a CCPA exhibit.
Ask: For an Australian customer, list every country in which document content is stored, processed for inference, backed up, logged and supported, and state whether Australian-only processing is available.
Incident notification and history
Public claim only
The DPA says that on becoming aware of a data breach Nitro shall notify the customer 'to the extent required by applicable law or an Exhibit to this Data Processing Addendum ... without undue delay', by contacting the person named in the order form or the notification email address, with privacy@gonitro.com as the data-protection contact. No fixed notification clock is stated, the definition of data breach applies where no data-protection law applies, and no reference to the Australian notifiable data breaches scheme appears. No incident history is published on the pages read.
Ask: State a contractual notification period in hours from discovery for our tenant, confirm cooperation with the Australian notifiable data breaches scheme, and disclose any incident in the last 24 months affecting Nitro Workspace or the AI features.
Change notice for models, terms and processors
Public claim only
The DPA allows Nitro to update the subprocessor list from time to time and to update its technical and organisational measures provided overall security is not downgraded at the point of execution. The eCommerce Terms allow prices, discounts and promotions to change without notice and impose an automatic five percent annual fee increase. The AI page says Nitro relies on 'established AI models, such as Azure OpenAI LLMs', which leaves model substitution open. No published objection right or notice period for a new model or subprocessor was found in the documents read.
Ask: What written notice will we receive before a model, model version or subprocessor behind the AI features changes, and can we pause AI features instead of accepting the change?
Export and exit
Public claim only
The DPA says Nitro will delete or return personal information after the end of the services and that the customer should use available download functionality to extract or delete its data. The eCommerce Terms say that on expiry, cancellation or termination the right to access the services ceases, Nitro may disable access, and accrued fees remain payable. No export format list, no transition assistance and no certified-deletion commitment was found.
Ask: What export formats and time window apply to documents, extraction output and AI history on exit, and will you certify deletion including at any subprocessor?
Connectors and third-party AI tools
Public claim only
Site navigation on pages read publishes Nitro Automate, described as 'Intelligent document processing across the AI agents, workflows, and systems you already use', a 'Nitro MCP with Claude' page, a developer portal, an integrations and API page and Nitro Identity for identity verification. None of those pages was opened, so the data each connector carries, and whether any is enabled by default, is unverified. The eCommerce Terms name Stripe Payments Europe, Ltd. as the payment processor.
Ask: List every connector, API and MCP capability that would be enabled on our tenant by default, what content each sends outside Nitro Workspace, and how we disable them.
Open-web search
Not confirmed
Document Assistant is described as answering questions about the document in front of the user using Azure OpenAI models with retrieval-augmented generation, and Knowledge Assistant as answering product questions 'without accessing your documents or personal information'. Neither the product page nor the trust-centre AI page states whether either tool can retrieve content from the open web, and no setting to disable web retrieval is described.
Ask: Can Document Assistant or Knowledge Assistant retrieve anything from the open web, and if so can that be disabled at tenant level?
Agent actions and confirmation
Public claim only
The features described act on a document the user has open and present output for the user to accept: Smart Redact suggestions are reviewed before permanent redaction is published, extraction writes to an Excel file, and Form Create and Form Field Detection place fields the user then uses. Nitro Automate is marketed as document processing 'across the AI agents, workflows, and systems you already use', and a Nitro MCP connector is published; neither page was opened, so whether anything can execute without user confirmation is unverified.
Ask: Does any Nitro AI capability, including Nitro Automate and the MCP connector, send, sign, share or delete a document without a user confirming that step?
Human review before use
Public claim only
The Smart Redact description places a review step before publication: users 'can quickly review the AI's suggestions, make any necessary adjustments, and publish your secure documents'. The AI code of conduct lists 'Human oversight: Ensuring all AI development is reviewed by humans', which is about development rather than output. Neither the eCommerce Terms nor the DPA read contains any clause requiring or addressing human review of AI output.
Ask: What product control, if any, prevents an unreviewed Document Assistant summary or Smart Redact result being relied on or sent externally, and can that control be enforced for all users?
