Product and intended use
Define the configuration, people, information and tasks being assessed.
Neo Legal versus Discover SaaS
Public claim only
Nuix Neo for Legal and Nuix Discover are the eDiscovery products. Deploy-it-your-way states Nuix SaaS with continuous updates is currently only available with Nuix Neo Discover. Workstation, Investigate and Data Privacy are separate products.
Ask: Which SKU and deployment (Discover SaaS, Neo Legal on-prem, partner-hosted) will we buy, and which AI Review / BYO AI features are included?
SaaS, on-premises, hybrid, air-gap
Public claim only
Discover marketing: SaaS, on-premises or hybrid including air-gapped, described as one architecture. Deploy page: Nuix SaaS; customer private/public/hybrid cloud; on-premises; partner managed service or appliance. AI Review is described for Discover SaaS specifically on the what's-new page.
Ask: Will we run Discover SaaS, our own Azure/AWS tenancy, or on-premises, and which AI features work in each mode?
AI Review, BYO AI and search
Public claim only
What's-new: AI Review on Discover SaaS applies preliminary coding, highlights issues and flags documents for human review, with relevancy scores, natural-language explanations and citations in the document. BYO AI integrates proprietary or third-party models, including local LLMs. Semantic Search and transcription are also listed. Neo Legal describes no-code customer-trained models.
Ask: Is AI Review available only on Discover SaaS for our licence, and which BYO models can we attach on-premises?
Australian company; SaaS region unnamed
Public claim only
Nuix Limited is ASX-listed with a Sydney address in the privacy notice for Australia/NZ/Asia customers. On-premises and air-gapped options can keep ESI in Australia. The SaaS hosting region for Discover was not published on the pages reviewed.
Ask: If we take Discover SaaS, which country stores and infers on our data? If on-premises, confirm AI Review/BYO AI never send ESI offshore.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
On-premises versus SaaS client constraints
Not confirmed
On-premises and air-gapped options address clients who prohibit cloud AI. Discover SaaS AI Review sends documents through whatever model Nuix uses (unnamed). BYO AI can keep models local. No OCG exclusion control was documented.
Ask: Can we disable SaaS AI Review per matter and keep BYO AI local-only for clients who require onshore processing?
Unnamed SaaS models; BYO AI
Not confirmed
AI Review on Discover SaaS uses generative AI but the foundation-model provider is not named on the what's-new or Discover pages. BYO AI lets the customer bring proprietary or third-party models, including local LLMs. No public subprocessor list of model providers was found.
Ask: Name the model providers and regions used for Discover SaaS AI Review, and the contract terms of each, or confirm we will only use BYO local models.
No public subprocessor list
Not confirmed
No dated subprocessor schedule was found on nuix.com. SaaS Discover necessarily involves a cloud host and, for AI Review, a model provider. On-premises deployments may still use support or update channels.
Ask: Provide the current subprocessor list for our deployment, with countries, notice period and objection rights.
Customer-trained models and SaaS genAI
Not confirmed
Neo Legal says customers can train and tune no-code models specific to their needs. BYO AI uses the customer's models. Whether Discover SaaS AI Review uses customer documents to train Nuix or a foundation-model provider is not stated on the pages reviewed.
Ask: Do you or any model provider train on our ESI, prompts or AI Review outputs in SaaS or BYO modes? Point to the signed clause.
Feedback and model tuning
Not confirmed
Customer tuning of no-code models is marketed. Whether SaaS telemetry or reviewer corrections improve shared Nuix models was not found.
Ask: Are coding corrections and usage telemetry used to improve Nuix or provider models across customers?
Retention not published for case data
Not confirmed
The privacy notice describes retention of website personal data, not ESI in Discover. On-premises retention is the customer's. SaaS prompt/output retention at any LLM is unnamed.
Ask: For Discover SaaS, list retention of documents, prompts, AI Review outputs, embeddings, logs and backups, including the model provider.
Deletion terms not public
Not confirmed
No public deletion schedule, certified destruction or SaaS offboarding window was found. Website privacy deletion rights do not govern case databases.
Ask: On termination or matter close, what is deleted from SaaS hosts and any model provider, within how many days, with what certificate?
Vendor access to on-prem versus SaaS
Not confirmed
On-premises and air-gapped deployments reduce vendor access if support is not granted. SaaS and partner-managed options imply Nuix or partner access. No lockbox procedure was published.
Ask: When can Nuix or a partner open our cases, is access logged to us, and will you notify us of legal process?
SSO and audit trails claimed
Public claim only
Discover pages claim full audit trails and multi-jurisdictional production controls. SSO/MFA/SCIM details were not in the public security FAQ equivalent. Permission-aware AI Review was not demonstrated.
Ask: Demonstrate SSO, MFA, matter permissions on AI Review retrieval, and exportable audit logs for our deployment.
Encryption not specified
Not confirmed
ISO 27001 and SOC 2 are claimed. TLS/AES details, CMK and coverage of AI artefacts were not published on the Discover or deploy pages reviewed.
Ask: Confirm encryption in transit and at rest (algorithms, key management, CMK) for documents, AI prompts and backups in our deployment.
ISO 27001 and SOC 2 claimed
Public claim only
Discover pages state ISO 27001 and SOC 2 certified, 99.9% uptime in SaaS and zero-downtime upgrades. Report dates, Type II versus Type I, scope (SaaS AI Review, BYO AI) and ISO 42001 were not inspected. No public trust portal was found.
Ask: Provide current SOC 2 Type II and ISO 27001 artefacts under NDA with Discover SaaS AI Review in scope.
Product MSA not public
Not confirmed
Website terms of service and a website privacy notice are public. They do not appear to be the software MSA or DPA. No public liability cap, output ownership or Australian forum clause for the product was found.
Ask: Provide the software MSA and DPA for our deployment, including APP alignment, confidentiality of prompts/outputs and Australian law/forum.
Group entities and SaaS location
Public claim only
Privacy notice: Nuix Limited group includes Ireland, UK and North America entities for website data. Software transfers depend on deployment. On-premises can stay in Australia. Discover SaaS location is unpublished. DPF is mentioned for website/US transfers.
Ask: For Discover SaaS, list every country of storage and inference. For on-premises, confirm no ESI leaves Australia without our instruction.
Website breach section; product SLA unknown
Not confirmed
The privacy notice has a data-breach notification heading for personal data Nuix controls. Product incident timelines for customer ESI were not found. Discover claims 99.9% SaaS uptime.
Ask: What contractual hours apply from discovery of a suspected incident affecting our ESI, including any SaaS model provider?
Continuous SaaS updates
Public claim only
Deploy page: Nuix SaaS uses a continuous-improvement model so customers always have current technology (Discover SaaS). What's-new describes AI Review and BYO AI. No contractual model-change notice was found.
Ask: Will you notify us before changing the SaaS AI Review model or region, and can on-premises pin versions?
Exit not documented publicly
Not confirmed
On-premises customers hold the data. SaaS export/deletion on termination was not found. A Canadian partner migration case study describes moving cases onto Discover SaaS, not off it.
Ask: On SaaS termination, how do we export natives, work product, AI outputs and logs, and when is remaining data deleted?
BYO AI as the main connector
Not confirmed
BYO AI attaches customer or third-party models, including local LLMs, into Nuix workflows. That is a connector that can send ESI to another processor unless the model is local. Collection/DMS connectors were not listed on the pages reviewed.
Ask: List every connector and BYO endpoint we would enable, what ESI they receive, and how we disable them.
Search over customer data
Public claim only
Semantic Search and AI Review are described as operating on case data in Nuix. Open-web search as a product feature was not found. BYO models might themselves browse the web if the customer so configures.
Ask: Confirm AI Review and Semantic Search cannot call the open web, and how BYO models are prevented from doing so.
AI Review writes preliminary codes
Not confirmed
AI Review applies preliminary coding decisions and flags documents for human review. Whether those codes can be published or produced without a person accepting them is not specified. BYO AI orchestration could take further actions depending on the attached model.
Ask: Can AI Review codes be applied to the database without a reviewer accepting each batch, and how do we disable AI Review and BYO AI immediately?
AI Review flags for human review
Public claim only
What's-new states AI Review flags documents for human review and provides relevancy scores, natural-language explanations and citations. Explainable AI is listed among Discover claims. No contractual duty to keep a human in the loop was found.
Ask: Can we require named sign-off before AI Review codes or summaries are produced, with an exportable verification record?