Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Smart Redact is contracted separately, not as an included feature. The Product Specific Terms apply 'if you have signed up for Nitro Smart Redact ... as set out in the Order Form which also incorporates the Nitro Terms of Service', define it as 'a (standalone software) product with AI-Enabled Features', and make it subject to 'the parameters and Subscription Fees of the Nitro Smart Redact Subscription Plan the Customer has chosen in the Order Form'. The Nitro AI product page separately footnotes that 'Smart Redact requires a separate license'. Which plans exist, and what functionality each contains, is not published: the terms say only that a plan 'is subject to specific Subscription Fees, functionalities, scope, limitations and parameters'.
Ask: List the Nitro Smart Redact subscription plans with the functionality, Document Transaction allocation and limits of each, and confirm which plan is being quoted to us.
Deployment model
Public claim only
Cloud only. The Product Specific Terms define Nitro Smart Redact as 'made available by Nitro as Cloud Services' and state that for the purposes of the Terms of Service it 'is considered "Services"'. The published sub-processor list places the function inside Nitro Workspace and gives Amazon Web Services as the hosting sub-processor for 'Nitro Sign, Workspace, Smart Redact, and Automate APIs', with 'EU data centers' as the data centre location. No on-premises, private-cloud or self-hosted option for Smart Redact appears on any page read.
Ask: Confirm the hosting region for our Smart Redact tenancy, and whether any deployment exists in which uploaded files do not leave a region we nominate.
Published functions
Public claim only
The product page at https://www.gonitro.com/smart-redact could not be retrieved through the scraping tool on three attempts across both stages, so the function description here comes from other vendor documents. The Product Specific Terms define the product as having 'AI-Enabled Features ... and functionalities that (automatically) identify and redact sensitive or personal information from electronic documents', state that 'Nitro's role is limited to providing electronic redaction functionality ... including AI-enabled features that generate redaction suggestions', and limit supported use to 'the file types, sizes (up to maximum 1 gigabyte per Document Transaction), languages, and other technical parameters described in its respective Documentation'. The Documentation is not published at any URL read. The site navigation descriptor on every cached page reads 'Nitro Smart Redact - Instant, accurate redaction you control, powered by Nitro AI.' What the product detects, whether scanned files are supported, and whether redaction is destructive are not established.
Ask: Provide the Smart Redact Documentation, including the categories of information detected, the supported file types and languages, whether scanned images are handled, and whether redaction removes the underlying text and metadata.
Release stage
Public claim only
Smart Redact is published as a generally available product rather than a beta: it has its own entry in the product navigation on every cached page, its own Product Specific Terms, its own place in the contract family name 'Nitro PDF, Sign, Smart Redact, & Automate', and its own row in the sub-processor list. By contrast the same pages label Document Assistant as Beta and Knowledge Assistant as BETA. No release date or version is published.
Ask: Is Smart Redact generally available on the plan quoted to us, and are any of its detection features labelled beta or preview in the Documentation?
Australian framing and legal use
Not confirmed
Nothing read frames the product to Australian law. The privacy policy names the GDPR and the California Consumer Privacy Act; the Data Processing Addendum read is the default Global/US addendum and names the EU GDPR, UK GDPR, the Swiss FADP and the CCPA; the eCommerce Terms are governed by Irish law. Neither the Privacy Act 1988 (Cth) nor the Australian Privacy Principles nor any Australian disclosure or FOI regime is mentioned anywhere on the pages read, and no Australian legal content or guidance is published for the product.
Ask: Which of Nitro's published addenda applies to an Australian customer, and will Nitro accept Australian Privacy Principle obligations, including APP 8, in the contract for Smart Redact?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 and not found. None of the eight gonitro.com pages held for this product (Product Specific Terms for Smart Redact, the Product Specific Terms overview, the sub-processor list, the default Data Processing Addendum, the trust-centre overview, the trust-centre Artificial Intelligence page, the privacy policy and the eCommerce Terms) contains a block addressed to AI models, assistants or crawlers, or any instruction about how the product should be described, and no /llms.txt, /ai-info or equivalent address appeared in the site map held for gonitro.com. Separately, and not to be conflated with narrative direction, the vendor publishes a press item titled 'Nitro releases MCP connector for Claude AI' and lists 'Nitro MCP' in its navigation; those are product statements about machine access, not instructions about description. The product page that could not be retrieved was not available to check.
Ask: Does Nitro publish any file or embedded block that instructs AI models or assistants on how to describe Smart Redact, including on the product page that is not retrievable by automated tools?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Public claim only
The Product Specific Terms require the customer to hold its own legal basis: 'Customer warrants that Customer Data will not be illegal or unlawful, will not breach any third-party rights, and that Customer will obtain and maintain a valid legal basis (e.g., consent) to upload such documents to Nitro in accordance with applicable law', and 'Customer shall be transparent toward Data Subjects regarding how Personal Data is processed when using Nitro Smart Redact'. The Data Processing Addendum treats the customer as Controller and Nitro Software Inc. as Processor.
Ask: For client files subject to legal professional privilege, what is our legal basis for the upload under Nitro's warranty, and does Nitro accept that privilege is not waived by processing on its infrastructure?
Foundation-model and detection engine providers
Public claim only
The published sub-processor list names Amazon Comprehend as a sub-processor whose purpose includes 'Smart Redact (Nitro Workspace)', with data centre locations given as 'EU data centers / US data centers / Australian data centers'. In the same table, 'Microsoft Azure OpenAI' is listed against 'Nitro Document Assistant' only, and the trust-centre Artificial Intelligence page attributes Azure OpenAI large language models to Document Assistant and Knowledge Assistant, not to Smart Redact. No generative model, model family, model version or fine-tuning arrangement is published for Smart Redact, and the AI Product Specific Terms that the product terms say also apply were not opened.
Ask: Confirm that Amazon Comprehend performs the detection in Smart Redact, name any other model or service in the pipeline, and state the region in which each runs for an Australian customer.
Subprocessors
Public claim only
Nitro publishes a sub-processor list, referenced by the Data Processing Addendum, with a dedicated table for 'Nitro Sign, Workspace, Smart Redact, and Automate APIs'. That table names Amazon Web Services (hosting, EU data centers), Amazon Comprehend (including 'Smart Redact (Nitro Workspace)', EU, US and Australian data centers), Amazon Simple Notification Service, Amazon Simple Email Provider, Auth0 (EU), Snowflake (EU), Intercom (EU), Salesforce (EU), Stripe (EU), Cloudflare (Global), DataDog (EU), Microsoft Azure OpenAI (EU, for Document Assistant), Conga Composer (EU) and Google reCAPTCHA (US). The page carries no version number or last-updated date. Under the addendum the customer 'grants a general written authorization to Nitro to decide with which Sub-processor(s) Nitro cooperates', with notification to customers who signed the addendum when the list changes.
Ask: Which of the listed sub-processors touch a file uploaded to Smart Redact, in which country does each process it, and what notice period applies before a new sub-processor is added for this product?
Training on customer content
Public claim only
The trust-centre overview FAQ states: 'Does Nitro use customer data to train AI models? No. Nitro does not use customer documents, signatures, or metadata to train artificial intelligence models.' The trust-centre Artificial Intelligence page states 'We do not create proprietary generative AI models or share your data with third parties for model training' and, in its detailed data-handling section, addresses Document Assistant and Knowledge Assistant only. Both are marketing and trust pages rather than contract documents. No no-training commitment for Smart Redact was found in the Product Specific Terms or the Data Processing Addendum read, and the AI Product Specific Terms were not opened.
Ask: Will Nitro warrant in our agreement that files uploaded to Smart Redact, the detections made on them and any reviewer corrections are never used to train, tune or evaluate any model, including by Amazon Comprehend?
Feedback and quality monitoring
Not confirmed
Two published statements pull in different directions. The Product Specific Terms state that 'Nitro does not actively monitor the content of documents that are uploaded, processed, and redacted using Nitro Smart Redact', while clause 2.10 reserves the right to 'monitor Customer's and User's usage on an ongoing basis to identify any deviation from Reasonable Use'. The trust-centre Artificial Intelligence page adds that Nitro 'continuously monitor[s] feedback to promptly address issues and improve tool performance', and lists 'Feedback channels' among its code-of-conduct items, without saying what a feedback submission contains. Nothing states whether accepting or rejecting a suggested redaction is captured.
Ask: What exactly is captured when a user accepts or rejects a suggested redaction, does any document content leave our tenancy with a feedback report, and can feedback collection be disabled?
Retention of uploaded files and output
Public claim only
Clause 2.12 of the Product Specific Terms states that 'Nitro will retain files Customer or its Users uploads specifically for use with Nitro Smart Redact only for the period(s) described in Nitro's Trust Center'. The period itself is not on the two trust-centre pages read: the overview publishes none, and the Artificial Intelligence page's 'processed temporarily ... and deleted once the task is complete' statement is made about Document Assistant. The Data Processing Addendum's default is retention 'until deletion by the Customer or until termination of the Agreement ... (plus maximum 30 days)', with configurable periods on request where technically feasible, and points to a processing-of-personal-data page that was not opened.
Ask: State the exact retention period for Smart Redact uploads, redacted output and detection metadata, where in the Trust Center it is published, and whether it can be set to delete on completion.
Deletion and certified erasure
Public claim only
The Data Processing Addendum requires that 'Nitro shall delete or return all Personal Information to the Customer after the end of the provisioning of Services and shall delete existing copies unless applicable law requires storage', and puts the onus on the customer to use available download or delete functions: 'the Customer shall use such functionalities to extract or delete its data'. It also ends automatically on termination of the agreement. No deletion timeframe for backups, no self-service deletion control for Smart Redact files and no erasure certificate is published.
Ask: Can a user delete a Smart Redact upload and its output on demand, within what period does deletion reach backups, and will Nitro issue written confirmation of erasure on exit?
Vendor and subcontractor access to content
Public claim only
The Data Processing Addendum limits access by contract rather than by architecture: 'only those employees, contractors or agents of Nitro who are involved in the processing of Personal Information may be informed about the Personal Information and only to the extent as reasonably necessary for the performance of the Agreement', with confidentiality obligations imposed. The Product Specific Terms state that Nitro 'does not actively monitor the content of documents'. The trust-centre overview states 'We do not view or use personal data'. Nothing published states whether support staff can open an uploaded file, whether such access is logged, or whether the customer is notified.
Ask: Can Nitro support staff or a sub-processor open a file we uploaded to Smart Redact, is that access logged and available to us, and is our approval required first?
Access control, single sign-on and audit
Public claim only
The trust-centre overview states that Nitro 'offers enhanced security features for enterprise plans, such as single sign-on (SSO) and two-factor authentication (2FA)', which makes those controls plan-dependent rather than standard. It also states that 'all document activity is tracked with downloadable audit trails'; that statement is made about Nitro's document products generally and not specifically about Smart Redact. The Product Specific Terms describe a Document Transaction Pool shared across users without individual restrictions, except through the API: 'The Document Transaction Pool can be used by any Users without individual restrictions'. No role model for Smart Redact is published.
Ask: Does the plan quoted to us include single sign-on and multi-factor authentication for Smart Redact, what roles exist, and can we export an audit trail showing who redacted and released each document?
Encryption in transit and at rest
Public claim only
The trust-centre overview states that Nitro's systems 'are built with industry-standard encryption, role-based access controls, continuous monitoring, and secure development practices', and the Artificial Intelligence page states that data is 'encrypted in transit and at rest, with controlled access' in respect of Document Assistant. No algorithm, key length, key ownership or customer-managed key option is published for Smart Redact. The Data Processing Addendum does not set out the technical measures itself: it says they 'are as set out in the Data Processing Details and may be updated by Nitro from time to time' and points to a security page and an Information Security Policy PDF, neither of which was opened.
Ask: Provide the Information Security Policy and the technical measures that apply to Smart Redact, including encryption standards, key management and whether customer-managed keys are available.
Independent security assurance
Public claim only
The trust-centre overview states that 'Nitro meets internationally recognized standards and certifications to protect your data and documents, including ISO 27001, SOC 2, HIPAA, QTSP accreditation, and the EU-U.S. Data Privacy Framework', and that 'independent auditors annually evaluate our privacy controls'. No certificate, report, scope statement or auditor is published or linked on the pages read, no product or entity scope is given, and Smart Redact is not named. The sub-processor list does publish certifications per provider, but only for the eSignature and identity sub-processors; the Amazon Web Services and Amazon Comprehend rows that cover Smart Redact carry no certification entry.
Ask: Provide the ISO 27001 certificate and SOC 2 report with scope statements, and confirm in writing whether Smart Redact and Nitro Workspace are inside that scope.
Contract, DPA and document hierarchy
Public claim only
The contract for Smart Redact is assembled from several documents: an Order Form incorporating the Nitro Terms of Service, the Smart Redact Product Specific Terms, the AI Product Specific Terms ('and to the extent there is a conflict the more protective terms for Nitro shall apply'), the Automation Platform Product Specific Terms where the API is used, a Service Level Agreement and a Data Processing Addendum. The Product Specific Terms exclude Nitro's liability for output in capital letters: 'Nitro shall not be held responsible or have any liability whatsoever for, and expressly disclaims any and all liability for, any use of or reliance on any redacted documents, redaction output, or redaction suggestions'. The Data Processing Addendum adds that Nitro may charge USD 295 per hour for assistance under it, including audit support beyond four hours, and adopts the Terms of Service liability cap and governing law. The Terms of Service itself was not opened.
Ask: Provide the full document set that will govern our Smart Redact subscription, including the Terms of Service and the AI Product Specific Terms, and identify the governing law, liability cap and the entity that will sign.
Cross-border transfers and APP 8
Public claim only
The published sub-processor list gives 'EU data centers' as the data centre location for the Amazon Web Services hosting of 'Nitro Sign, Workspace, Smart Redact, and Automate APIs', while the Amazon Comprehend row covering 'Smart Redact (Nitro Workspace)' lists 'EU data centers / US data centers / Australian data centers' without saying which applies to a given customer. Other sub-processors in the same table are located in the EU, the United States and 'Global' (Cloudflare). The Data Processing Addendum read is the default Global/US addendum; it names the EU GDPR, UK GDPR, FADP and CCPA and contains no Australian transfer mechanism, and separate EU and UK addenda exist that were not opened.
Ask: For an Australian customer, in which country is a Smart Redact upload stored and in which country does detection run, and what mechanism does Nitro rely on for APP 8 purposes?
Incident notification and history
Public claim only
The Data Processing Addendum states that 'Upon becoming aware of a Data Breach, Nitro shall, to the extent required by applicable law or an Exhibit to this Data Processing Addendum, notify the Customer thereof without undue delay', by contacting the person named in the agreement or the customer's notification email address, with privacy@gonitro.com as Nitro's contact. No fixed hour-count is committed, the obligation is qualified by 'to the extent required by applicable law', and no incident history, status page or post-incident report practice appears on the pages read.
Ask: Will Nitro commit to a fixed notification period in hours for a breach affecting Smart Redact files, and will it provide the information we need for a Notifiable Data Breaches assessment?
Change notice for terms, models and subprocessors
Public claim only
For sub-processors the addendum provides that 'Customers who signed Nitro's Data Processing Addendum will be notified by Nitro in case the sub-processor list, as published on this website, is being updated and aligned with the process set out in the relevant Data Processing Addendum', under a general written authorisation to appoint sub-processors. For technical measures the addendum permits updates provided Nitro 'will ensure not to downgrade the overall security it has implemented'. The Product Specific Terms allow Nitro to update the Documentation that defines supported file types and parameters 'from time to time', and the Reasonable Use definition is reserved to Nitro's sole discretion. No notice commitment for a change of detection model or hosting region is published, and the sub-processor list itself carries no date or version.
Ask: What notice will we receive before the Smart Redact detection engine, hosting region or supported file types change, and will the sub-processor list be dated and versioned so we can evidence what changed?
Export and exit
Public claim only
The Data Processing Addendum requires deletion or return of personal information after the end of the services and notes that 'the Services might include download functionalities at the disposal of the Customer', which the customer is expected to use to extract its data. The Product Specific Terms make the commercial exit position clear in the other direction: Document Transactions expire on each anniversary, downgrades are not permitted during a term, and pre-purchased Buckets continue by default for the remainder of the term. No export format, bulk export or transition assistance for Smart Redact output is described.
Ask: On exit, how do we bulk export redacted output and the associated audit records, in what format, and do unused pre-purchased Document Transactions carry any refund?
Connectors and third-party tools
Public claim only
The Product Specific Terms publish one connector route for this product, the Nitro Smart Redact API, which is licensed as a Nitro API under the Automation Platform Product Specific Terms, is separately metered and priced, and is expressly outside the Document Transaction Pool. The vendor separately lists 'Nitro MCP' in its site navigation and publishes a press item titled 'Nitro releases MCP connector for Claude AI'; neither was opened and neither states whether Smart Redact is reachable through it.
Ask: Can Smart Redact be invoked from the Nitro MCP connector or any other automation surface, and can we disable every route other than manual upload by a named user?
Open-web access
Not confirmed
Nothing read states whether any part of the Smart Redact pipeline makes an outbound call to the internet or to a search index while processing a file. The published sub-processor list shows the processing path as Nitro Workspace on Amazon Web Services with Amazon Comprehend, and Cloudflare as a web application firewall, none of which implies open-web retrieval; but no statement either way is published, and the product page and Documentation could not be read.
Ask: Does Smart Redact make any outbound call to an external service or index while processing a document, and can outbound access be restricted for our tenancy?
Automated action and confirmation
Not confirmed
The terms describe the product both as generating suggestions and as acting automatically. Nitro's role is 'limited to providing electronic redaction functionality ... including AI-Enabled Features that generate redaction suggestions', and the customer must verify 'that all necessary redactions have been properly applied before using or relying on any content, redaction suggestions, or redaction output'; but the definition of the product describes functionalities 'that (automatically) identify and redact sensitive or personal information from electronic documents', and a Document Transaction completes 'once a redacted output is made available for download'. Whether a person must approve before the redacted output is produced is not resolved by anything read.
Ask: Does Smart Redact produce a redacted output file before any person approves the suggestions, and can an administrator require per-document approval before output is generated?
Human review before use
Public claim only
Human review is a contractual obligation on the customer rather than a vendor control. The Product Specific Terms require the customer to verify 'by human review that all necessary redactions have been properly applied before using or relying on any content, redaction suggestions, or redaction output', warn that outputs 'may contain errors, omissions, or fail to fully remove all personal information', and state that the product 'is not a substitute for professional judgment, legal review, or compliance processes'. Nothing published describes a workflow, approval step or record that evidences the review having been done.
Ask: Does the product record who reviewed and approved each redaction before release, and can that record be exported as evidence of our verification step?
