---
title: "Onit (Unity ELM, OnitX ELM and CLM, and the AI Studio components ReviewAI, Spend Agent and Olava) (Onit, Inc.)"
url: "https://ailawframework.com/software/onit"
type: "software_profile"
site: "AI Law Framework"
id: "onit"
vendor: "Onit, Inc."
category: "Legal-specific"
segment: "Practice management"
confidence: "high"
last_reviewed: "2026-09-27"
---

# Onit (Unity ELM, OnitX ELM and CLM, and the AI Studio components ReviewAI, Spend Agent and Olava) (Onit, Inc.)

> Enterprise legal management and contract lifecycle management for corporate legal departments, with named generative-AI components for playbook-based contract review in Microsoft Word, legal-spend analysis and an…

Canonical page: https://ailawframework.com/software/onit  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The Onit-branded ELM and CLM platforms and their named AI components, on the published Subscription and Services Agreement and DPA. The consolidated brands (ContractWorks, SecureDocs, AXDRAFT, BusyLamp, SimpleLegal) need separate review.

Enterprise legal management and contract lifecycle management for corporate legal departments, with named generative-AI components for playbook-based contract review in Microsoft Word, legal-spend analysis and an assistant.

## Capabilities

- Matter management
- Contract review and redlining
- Clause libraries and playbooks
- Document summarisation
- Agentic workflows
- Legal spend management

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | United States, European Union / EEA |
| Australian region | No |
| Model providers | Anthropic, PBC — subprocessor list Table 6, “Generative AI Tool used in ReviewAI and Catalyst for Contracts”, country given as “United States & various”, Google Cloud (including Gemini) — subprocessor list Tables 3 and 4, “API to AI tool that generates natural language or code for Spend Agent feature and other Onit AI Agents and features”, United States, OpenAI — subprocessor list Table 2 (all platforms) and Table 3, “API to AI tool that generates natural language or code”, “United States & Worldwide” |
| Assurance | SOC 2 Type 2 (SSAE-18) — the security page states Onit audits to it, verified by an independent auditing firm; no report, date or auditor is published, SOC 1 Type 2 (SSAE-18) — same statement on the security page, HIPAA — the security page states Onit audits to the standard, ISO 27001 — DPA Annex 2 lists “Use of ISO 27001 certified hosting providers” as a physical-access measure, which is the hosting provider's certification and not Onit's |
| Training on customer content | Unknown |
| Retention | Subscription and Services Agreement cl 6.5: for 30 days after termination or expiry (the “Export Period”) the customer may use the built-in export functionality to take out Customer Data, after which “Company will delete the Customer Data in the Subscription Services in accordance with Company's then-current retention policy”; that retention policy is not published. Clause 12.2 states the vendor “has no obligation to retain or recreate Output unless the Subscription Services expressly provide retention, and it is enabled”. DPA Annex 1 gives the “Period of Data Retained” as “For the term of the Agreement”. DPA s 9 requires return or secure destruction of Personal Data at the customer's choice on written request, noting “excessive requests will incur reasonable fees”. No retention period is published for prompts, AI Feature inputs or logs held by the named model providers. |
| Integrations | Microsoft Word (ReviewAI add-in; “Microsoft Add-Ins” is also named as a platform in Table 6 of the subprocessor list), OnitX CLM (contracts initiated in OnitX CLM trigger a ReviewAI review; findings are logged as structured data in OnitX CLM), Third-Party Applications integrated on customer request under Subscription and Services Agreement cl 4.13, which excludes them from the Subscription Services and from the agreement |
| Pricing | No price is published and no public pricing page was found. Fees are set in an Order under the Subscription and Services Agreement (cl 3.1), are non-refundable once paid, are “subject to annual increase”, and are invoiced net 30 days in US dollars (cl 3.2). Clause 4.7 provides for usage-based subscriptions: exceeding a tier maximum in a Subscription Year moves the customer to the higher tier and is invoiced as the difference. For AI Features specifically, cl 12.6 allows the vendor to determine “fair and reasonable limits” where an Order sets no threshold, to throttle or temporarily suspend AI Features until usage is aligned or the customer upgrades, and to charge overage fees at then-current rates. |
| Australian presence | Unknown. No Australian contracting entity, ACN or ABN was found. The Subscription and Services Agreement states the Services are provided by “Onit, Inc. or its Affiliate identified on an Order”, and the subprocessor list updated 17 August 2026 names the group entities that provide implementation, integration, migration and support — Onit, Inc. and its US affiliates (AXDRAFT, Inc.; Bodhala Inc.; SecureDocs, Inc.; SimpleLegal, Inc.; LegalFiles Software, Inc.; Synaptec Software, LLC d/b/a LawBase), Onit Canada ULC, Onit Europe Ltd. (United Kingdom), Onit India Pvt. Limited, Onit New Zealand Limited, BusyLamp GmbH (Germany) and AXDRAFT, LLC (Ukraine) — none of them Australian. The agreement is governed by the internal laws of the State of Delaware (cl 13.5) and the DPA names the Belgian Data Protection Authority as competent supervisory authority. The only Australian party in the published documents is Affinda, listed as a PDF-conversion subprocessor for BillingPoint, CounselGo and Counsel Exchange users. The published hosting choices contain no Australian location. One Australian customer is published by the vendor; no Australian office, reseller or partner was found on the pages read. |
| Website | https://www.onit.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Products and plans covered | Public claim only | Onit publishes several product families rather than one product: Enterprise Legal Management (Unity ELM, OnitX ELM, SimpleLegal, BusyLamp, Legal Files), Contract Lifecycle Management (ContractWorks, SecureDocs, OnitX CLM, ReadySign, AXDRAFT), App Studio (Apptitude, LSR, Legal Holds, Unity RFP) and AI Studio (Spend Agent, ReviewAI, Olava). Under the Subscription and Services Agreement each purchase is defined by an Order (cl 2.1–2.2) and may be subject to separate Product Specific Terms at https://www.onit.com/product-terms/, which were not read. “AI Features” is defined in the agreement as “any functionality within the Subscription Services that uses artificial intelligence or machine learning, such as contract extraction, review, invoice processing, chat, and other generative AI features”, so the AI terms attach to whichever modules an Order includes. The subprocessor list groups the platforms differently again, with ReviewAI, ExtractAI, Automate NDA, OnitX CLM, AuthorDocs and Microsoft Add-Ins in one table. | Which Onit entity, platform table and Product Specific Terms apply to each module on our Order, and which AI Features are switched on by default? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit — Wesfarmers case study (Australian customer, ReviewAI), including the full product navigation; cached scrape read from disk](https://www.onit.com/resources/wesfarmers-case-study/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| What the AI components do | Public claim only | Per the ReviewAI page (checked 2026-09-27), ReviewAI applies the customer's legal playbook to a contract inside Microsoft Word: playbook-guided review with fallback language and approved clauses, a built-in chat about clauses and risks, checklists that turn identified risks into trackable tasks with suggested edits and ownership, and a review that ends with a risk profile and recommendations; findings are flagged in Word and logged as structured data in OnitX CLM, and a contract initiated in OnitX CLM can trigger a review. The Olava page (checked 2026-09-27) publishes one sentence, “Olava brings trusted intelligence into the systems, workflows, and data that power legal operations”, behind a lead-capture form, with no functional description. Spend Agent is named in the product navigation and in the subprocessor list, where the Google Cloud entry describes generation “for Spend Agent feature and other Onit AI Agents and features”; the vendor's earlier material also names InvoiceAI for analysing legal invoices against billing rules and Catalyst for natural-language extraction and reporting. | Which AI Features are generally available today, which are in preview under cl 4.12 Trials and Betas, and what does Olava actually do? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit — Olava product page (positioning sentence and lead-capture form)](https://www.onit.com/products/ai-studio/olava/); [Onit — home page and product extracts; cached search-result extracts read from disk](https://www.onit.com/); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Deployment and hosting location | Public claim only | Cloud only; no on-premises or customer-hosted option was found on the pages read. The subprocessor list updated 17 August 2026 names Amazon Web Services as the cloud provider and states the hosting choices per platform. For the Onit platforms (ELM, CLM, Legal Holds, Apptitude, InvoiceAI, BillingPoint, Counsel Exchange): “Except for BillingPoint and Counsel Exchange, Customer can choose hosting location: United States or Germany (with back-ups in Ireland). BillingPoint and Counsel Exchange are hosted in the United States.” For the contract-related generative-AI platforms in Table 6 (ReviewAI, ExtractAI, Automate NDA, OnitX CLM, AuthorDocs, Microsoft Add-Ins): “Customer can choose hosting location: United States or Germany (with back-ups in Ireland).” Other tables give the United States for SimpleLegal, Bodhala and Legal Files, the European Union, Canada or the United States for AXDRAFT, the United States or Ireland for SecureDocs, and the United Kingdom or Germany for BusyLamp. CrowdStrike is listed for “Hosting Managed Services and Security Services” across all platforms. | For the modules on our Order, confirm in writing the hosting region we are assigned, where backups sit, and whether the choice can be changed later. | [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Subscription, renewal and fees | Public claim only | Subscription and Services Agreement: each Order runs for the Subscription Term stated in it and, if the Order is silent, “automatically renew” for successive one-year periods unless either party gives notice of non-renewal at least 45 days before the end of the current term (cl 6.2). Fees are non-refundable once paid except as expressly provided and are “subject to annual increase” (cl 3.1). Clause 4.8 gives the vendor an annual audit right over the customer's use on 15 days' notice, with the customer reimbursing audit costs if unauthorised use exceeds 5% of the fees that would have applied. A Suspension Event allows suspension where an undisputed payment is 30 days overdue, a required purchase order is not issued, or the usage rules in cl 4.3 are breached, in each case uncured 10 days after written notice. | What is the annual increase cap, and will you extend the non-renewal notice period and remove the cl 4.8 audit cost-shifting for our subscription? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Governing law and disputes | Public claim only | Subscription and Services Agreement cl 13.5: “This Agreement is governed by the internal laws of the State of Delaware, without regard to its conflicts of law rules.” Clause 13.6 requires the parties first to attempt resolution through good-faith negotiations between senior leadership, and if the dispute is unresolved 30 days after an “invitation to negotiate” each party may seek all remedies available at law; no forum is nominated. The agreement names no Australian law and the DPA's “Data Privacy Laws” definition lists the California Consumer Privacy Act, the GDPR and the UK Data Protection Act 2018 without naming the Privacy Act 1988 (Cth), relying instead on the general words “all applicable laws … in the jurisdictions in which Company and Customer operate”. The DPA names the Belgian Data Protection Authority as the competent supervisory authority for the Standard Contractual Clauses. | Will you agree to Australian governing law and jurisdiction, and confirm in the DPA that the Privacy Act 1988 (Cth) and the Australian Privacy Principles are Data Privacy Laws for our contract? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Third-party applications | Public claim only | Subscription and Services Agreement cl 4.13: on customer request the vendor may integrate with Third Party Applications the customer licenses separately; those applications “are not part of the Subscription Services, and this Agreement does not apply to such Third Party Applications”, each is made available under its own end-user licence, and the vendor “has no liability whatsoever with respect to Third Party Applications or any transfers of data to such Third Party Applications”. Published integrations within the vendor's own estate are the Microsoft Word add-in for ReviewAI and the link between ReviewAI and OnitX CLM in both directions (intake triggers review; findings are written back as structured data). | Which integrations for our Order are Subscription Services and which are Third Party Applications under cl 4.13, and what data crosses to each? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Support and service levels | Public claim only | The Subscription and Services Agreement incorporates Maintenance and Support at https://www.onit.com/maintenance-and-support/ and a Service Level Agreement “if applicable” at https://www.onit.com/service-level-agreement/; neither document was read in this pass, so their contents are not recorded here. Clause 12.8 carves AI Features out of them: “Unless an Order expressly states otherwise, no service level agreements or uptime commitments apply to AI Features, including add-ins or Company's third-party integrations.” Clause 9.5 disclaims any warranty that the Subscription Services will be error-free or free of downtime, and cl 4.12 gives Trials and Betas no warranty, indemnity, SLA or support with liability capped at US$1,000. | Will the Order state an uptime and response commitment for the AI Features, given that cl 12.8 otherwise excludes them from the SLA? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Published evidence about output quality | Public claim only | The ReviewAI page publishes three figures under the heading “Proven results with ReviewAI”, checked 2026-09-27: “Boost Contract Review Productivity by 60–70%”, “51.5% boost in productivity per lawyer (2+ hours saved per day)” and “Two minutes to review and return NDAs”. No method, sample, date or study is published on that page. The vendor's Australian case study describes one customer's process change and outcome; it is the vendor's own publication about its customer. Against this, the Subscription and Services Agreement cl 12.3 states the vendor “cannot guarantee that Outputs will be 100% accurate and/or free from hallucinations or will accurately or completely reflect facts”, and cl 12.5 provides the AI Features and Output “as is” and “as available” with all warranties of accuracy disclaimed. | What measurement produced the 60–70% and 51.5% figures — sample, baseline, contract types and date — and will you run a measured pilot on our own contracts? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit — Wesfarmers case study (Australian customer, ReviewAI), including the full product navigation; cached scrape read from disk](https://www.onit.com/resources/wesfarmers-case-study/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Tasks the product is published for | Public claim only | Published solution areas are legal spend and matter management, contract management and automation, legal operations and workflow automation, sales and revenue, and compliance and risk; published roles are legal operations, general counsel and contract managers. The AI components are aimed at pre-signature third-party contract review against a playbook (ReviewAI), legal-spend and invoice analysis (Spend Agent, and InvoiceAI in earlier material) and an assistant across legal-operations data (Olava). The Subscription and Services Agreement cl 4.14 states in capitals that “ONIT IS NOT A LAW FIRM AND DOES NOT OFFER LEGAL ADVICE” and that the vendor “does not bear any liability in respect of quality or compliance of Customer Data uploaded, automated or generated by Customer”. Clause 12.7(d) prohibits use that would make the AI Features high-risk under applicable law, including use that is a substantial factor in a decision with a material legal or similarly significant effect on an individual. | For an Australian in-house team, which named tasks do you support the AI Features being used for, and how does cl 12.7(d) apply to a contract decision affecting an individual? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit — Wesfarmers case study (Australian customer, ReviewAI), including the full product navigation; cached scrape read from disk](https://www.onit.com/resources/wesfarmers-case-study/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27: https://www.onit.com/llms.txt returns the site's 404 page (“Oops! This is unexpected.”), and a URL map of onit.com searched for “ai” surfaced no /ai-info, /for-ai or equivalent page. Nothing directing AI models, assistants or crawlers how to describe the product was found on the nine pages read. This is recorded as not found rather than absent: a URL map does not reliably discover an unlinked file, and only part of the site was read. The vendor does apply the phrase “AI-native” to itself and to ReviewAI on its marketing pages; that is ordinary marketing language and is recorded in this profile as a claim, not as evidence about the mechanism. | Do you publish any page or embedded block instructing AI systems, assistants or crawlers how to describe Onit or its products? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit — home page and product extracts; cached search-result extracts read from disk](https://www.onit.com/) |
| Authority to put client and regulated data in | Public claim only | Subscription and Services Agreement cl 5.1 puts the warranties on the customer: it must have all rights, permissions and consents necessary to collect, store and process all Customer Data including Personal Data in the Subscription Services, to grant the vendor its licence, and for any transfer or disclosure. “Sensitive Data” is defined as “regulated categories of data such as protected health information, payment card data, or government-classified information, unless expressly agreed in writing”, and cl 12.7(f) prohibits inputting Sensitive Data into AI Features “without prior written approval”. Where an individual asks for access to, correction or deletion of their Personal Data, cl 5.1 makes the customer responsible for responding, with vendor assistance available “at its standard billing rates, subject to execution of an SOW”. | Do you require prior written approval before we put privileged or client-confidential material into the AI Features, and does “Sensitive Data” in cl 12.7(f) capture sensitive information as defined in the Privacy Act 1988 (Cth)? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Model providers | Public claim only | Named in the subprocessor list updated 17 August 2026 rather than on the product pages. Anthropic, PBC is listed for the contract generative-AI platforms as “Generative AI Tool used in ReviewAI and Catalyst for Contracts”, country “United States & various”. Google Cloud “(including Gemini)” is listed for the Onit platforms and for Spend Agent and Unity as “API to AI tool that generates natural language or code for Spend Agent feature and other Onit AI Agents and features”, United States. OpenAI is listed for all platforms and for Spend Agent and Unity as “API to AI tool that generates natural language or code”, “United States & Worldwide”, and separately for BusyLamp to convert invoices into LEDES files. No model name or version is published, and no inference region is stated beyond those country entries. Subscription and Services Agreement cl 12.9 states the vendor “may use third-party model providers or infrastructure” and cl 12.4 that it “may improve, replace, or deprecate models or prompts without material reduction of core functionality”. | For each AI Feature on our Order, which model provider, model and region performs the inference, and will you notify us before a model is replaced under cl 12.4? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Subprocessors | Public claim only | A named subprocessor list is published at https://www.onit.com/sub-processors, updated 17 August 2026, organised into eleven tables by platform and giving each entry's activity and country; it is Annex 3 to the DPA. Subscription and Services Agreement cl 4.5 requires the customer to subscribe to the list's email update service, and gives 15 days from a Sub-processor Update to object in writing to legal@onit.com; the parties then “work together without unreasonable delay to recommend an alternative arrangement”, and if none is agreed the customer may terminate the affected Services without penalty, which is “Customer's sole and exclusive remedy”. DPA s 6.3 gives a parallel right to terminate on 30 days' notice where an objection cannot be accommodated. Entries relevant to the AI components include Anthropic, Google Cloud (including Gemini), OpenAI, Adobe's PDF API, Maven AGI for support chat, Affinda (Australia) for PDF conversion, AWS as cloud provider and CrowdStrike for hosting managed services. Table 1 also lists “Anthropic & CoWork” and “ChatGPT (OpenAI)” as internal productivity tools for all platforms. | Which entries in the eleven tables apply to the modules on our Order, and what do the Table 1 internal productivity tools have access to? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Use of customer content and inputs for training | Public claim only | The Subscription and Services Agreement restricts third-party training but does not say the vendor will not train on customer content. Clause 12.1: “Company may use Usage Data in de-identified and aggregated form to operate, maintain, improve and enhance AI Services” and “In connection with the AI Features, Company will not permit third-party model providers to use Input to train their models for the benefit of others, except in de-identified or aggregated form necessary to operate the Subscription Services.” Clause 5.2 separately allows the vendor to use Customer Data “for product improvement, analysis, benchmarking, and similar purposes” provided it “has been aggregated with other data and anonymized such that neither Customer nor any individual can be identified as the source of the data to external third parties”. “Usage Data” is defined as technical logs and learnings about use, and Customer Data excludes Usage Data. There is no clause stating that Onit itself will not train or fine-tune models on Input or Output; the customer, by contrast, is prohibited by cl 12.7(a) from using the AI Features to train other AI systems. Recorded as conditional because the restriction is bounded by the de-identified and aggregated carve-outs and by who is doing the training. | Will you state in the Order that neither Onit nor any model provider trains, fine-tunes or evaluates models on our Input or Output in any form, including de-identified or aggregated form? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Feedback, usage data and telemetry | Public claim only | Subscription and Services Agreement cl 4.9: any feedback the customer gives about improving or operating the Services may be used by the vendor “without restriction or obligation”, is not treated as the customer's Confidential Information or intellectual property, and nothing restricts the vendor's right to “use, profit from, disclose, publish, keep secret or otherwise exploit Feedback, without compensating or crediting Customer”; the customer will not be publicly identified as the source without permission. Clause 4.6: Usage Data — defined to include the number of reports run, frequency and location of user logins, types of searches run and features used — may be collected and used “to operate, improve, secure, and support the Subscription Services and for other lawful business purposes”, and will not be disclosed externally unless de-identified. Pendo is listed in the subprocessor list for “Logging and Analytics” and Google Analytics for several platforms. | Does Usage Data include the text of prompts, search terms or AI Feature inputs, and can telemetry and product analytics be disabled for our tenancy? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Retention | Public claim only | Subscription and Services Agreement cl 6.5 gives a 30-day Export Period after termination or expiry during which the customer may export Customer Data using built-in functionality; after it, “Company will delete the Customer Data in the Subscription Services in accordance with Company's then-current retention policy”. That retention policy is not published, so the period after the Export Period is not established. Clause 12.2 states there is no obligation to retain or recreate Output “unless the Subscription Services expressly provide retention, and it is enabled”. DPA Annex 1 states the “Period of Data Retained” is “For the term of the Agreement”, with the same terms applying to transfers to sub-processors. Nothing published states how long prompts, AI Feature inputs or outputs are held, by Onit or by the named model providers. | Provide the current retention policy referred to in cl 6.5, and state the retention period for AI Feature prompts, inputs and outputs at Onit and at each model provider. | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Deletion and return of data | Public claim only | DPA s 9: “Except to the extent required otherwise by Data Privacy Laws, Company will, at the choice of Customer, return to Customer and/or securely destroy all Personal Data upon (a) written request of Customer (excessive requests will incur reasonable fees for the administrative costs to comply with such request); or (b) in accordance with the terms of the applicable Agreement”, and the vendor will inform the customer if it cannot return or delete. The Standard Contractual Clauses in Annex 4 add, for transfers they cover, that on the end of processing the data importer will delete all personal data and “certify to the data exporter that it has done so”, or return it and delete existing copies. Under the Subscription and Services Agreement cl 6.4(e) each party destroys the other's Confidential Information on termination, except as required by law or by “reasonable internal record-keeping or information technology policies”, and Customer Data is the customer's Confidential Information. No deletion timeframe is stated anywhere in the documents read, and Customer Data that is not Personal Data is covered only by the retention policy referred to in cl 6.5. | Within how many days of termination will all of our data — including backups, logs and any AI Feature inputs — be deleted, and will you certify the deletion in writing without charging a fee? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Vendor personnel access to customer data | Public claim only | The security page states, under system security, “By policy, employees are prohibited from accessing private data; Onit claims no ownership of your data”, and that systems access is “logged and tracked for auditing purposes”; it also states that physical access uses biometric scanning and 24/7 video monitoring at an SSAE-18 Type II SOC II datacenter. The DPA requires that persons authorised to process Personal Data are “subject to appropriate confidentiality obligations or are under an appropriate statutory obligation of confidentiality” (s 3.1), and Annex 2 lists access rights defined by duties, differentiated access rights and automated logs of user access. The Subscription and Services Agreement adds only that support and professional-services personnel act under the agreement, and permits disclosure of Confidential Information to employees, agents, contractors and sub-processors “having a legitimate need to know” (cl 8.2). No customer-side approval gate or access-notification commitment was found. Group entities in India, Ukraine, the United Kingdom, Canada, New Zealand and Germany are listed as providing implementation, integration, data migration and support services for all platforms. | Which teams and countries can access our tenancy for support, migration or troubleshooting, is that access logged and shown to us, and can it be restricted to named regions? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/); [Onit — Customer Security page](https://www.onit.com/security/) |
| Authentication and permissions | Public claim only | The security page states that all users must be verified by email, that there is “no access for guest users or anonymous accounts” in the DPA's terms, and that “all data within Onit remains the property of the project owner and cannot be accessed by any other user”. DPA Annex 2 s 2 requires password procedures, central management of system access, approval from HR management and IT administrators before access is granted, and “Multi-Factor Authentication wherever available”, and s 3 requires access rights defined according to duties with differentiated rights and automated logging of user access. Under the Subscription and Services Agreement cl 4.1 the customer designates Users, each credential set may be used by only one individual, and the customer is responsible for all use and misuse under its Users' credentials and must promptly notify the vendor of any unauthorised access. Single sign-on is listed as a subprocessor only for the SimpleLegal platforms (Auth0, purchased by Okta); no SSO or multi-factor commitment specific to the Onit-branded platforms was found. | Does our tenancy support enforced SSO and multi-factor authentication for every user including administrators, and can permissions restrict which users may invoke the AI Features? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/); [Onit — Customer Security page](https://www.onit.com/security/) |
| Encryption | Public claim only | The security page states “Our data is secured using bank-grade 256-bit Secure Sockets Layer (SSL) encryption and is stored in an enterprise-class, secured hosting environment that is backed up daily”, and under operational security lists “Encryption for all administrative traffic (HTTPS, SFTP, SSH). Encryption for all customer traffic (HTTPS)”. DPA Annex 2 s 4 lists “Compulsory use of encrypted connections for all data transfers” and multi-factor authentication for remote access. Both statements describe encryption in transit. No statement of encryption at rest, of the cipher used at rest, or of key management or customer-managed keys was found in the security page, the Subscription and Services Agreement or the DPA; the agreement's own security clause (cl 4.10) commits only to “commercially reasonable administrative, technical and procedural safeguards”. | Is Customer Data encrypted at rest, with which algorithm and key management, and are customer-managed or customer-held keys available? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/); [Onit — Customer Security page](https://www.onit.com/security/) |
| Independent assurance | Public claim only | The security page (checked 2026-09-27) states “Onit audits to SSAE-18 SOC 2 Type 2, SOC 1 Type 2 and HIPAA standards, verified by an independent auditing firm”, that physical security is audited by an independent firm at an “SSAE-18 Type II SOC II datacenter”, and that disaster recovery and business continuity plans are independently audited. No report, certificate, auditor name, scope statement or date is published, there is no trust centre, and the site does not offer the reports on request. The DPA's audit clause (s 8) allows the customer to request information once per calendar year on 15 business days' notice and provides that where the scope has been addressed “in a SSAE 18 Type 1 or Type 2 or similar audit report performed by a qualified third party auditor within the prior twelve (12) months” the customer agrees to accept that report in lieu of its own audit. ISO 27001 appears only as a property of the hosting provider in DPA Annex 2, and Vanta is listed in the subprocessor list as a “SOC 2 Compliance and Automation Tool” for the AXDRAFT platforms. | Provide the current SOC 2 Type 2 report with its scope and period, and confirm whether the AI Features and the modules on our Order are inside that scope. | [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/); [Onit — Customer Security page](https://www.onit.com/security/) |
| Contract structure and liability | Public claim only | The published Subscription and Services Agreement takes effect on signature of an Order and is supplemented by Product Specific Terms, a Maintenance and Support document, an SLA “if applicable” and the DPA “to the extent applicable” (cl 4.11). Clause 13.12(b) sets the order of precedence as any amendment, then the DPA, then the rest. Clause 10.1 excludes incidental, consequential, special, indirect and punitive damages for both parties, and cl 10.2 caps each party's aggregate liability at “the fees paid or payable by Customer to Company under the applicable Order during the 12 months preceding the event giving rise to the claim”, with no carve-out for confidentiality, privacy or data-breach claims; the DPA separately limits the processor's liability under the DPA to “one times the amount of fees paid by Customer to Company in the previous year”. Clause 11.1 gives an intellectual-property indemnity for the Subscription Services; no indemnity for AI output infringement is stated. Clause 9.2 warrants only that the Services will operate substantially as documented and that material functionality will not be materially decreased during a Subscription Term, and cl 9.4 makes cure, then termination with a pro-rata refund, the exclusive remedy. | Will you lift the cl 10.2 cap for breach of confidentiality or privacy obligations, and give an indemnity for third-party claims arising from AI Feature output? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Offshore transfer | Public claim only | For a firm hosted in the United States or Germany, data is offshore from Australia by design, and the subprocessor list shows onward flows: model providers in the United States and “United States & Worldwide”, group support entities in India, Ukraine, Canada, the United Kingdom, New Zealand and Germany, and an Australian PDF-conversion provider for certain user groups. The DPA's transfer mechanism is European rather than Australian: s 7 binds the parties to the Standard Contractual Clauses in Annex 4 “to the extent that Company Processes Personal Data of Data Subjects to processors established in third countries which do not ensure an adequate level of data protection”, applies the UK Addendum for UK data, and completes Module Two (transfer controller to processor) with the Belgian Data Protection Authority as competent supervisory authority. Nothing in the documents read addresses cross-border disclosure under Australian Privacy Principle 8 or accountability for an overseas recipient. | Which countries will our data and our AI Feature prompts be processed in, and will you accept an APP 8 cross-border clause with Onit remaining accountable for each overseas recipient? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Incident notification | Public claim only | The DPA carries the obligation, and the Subscription and Services Agreement has no security-incident clause. DPA s 1.08 defines a “Security Breach” as “any unauthorized and/or accidental destruction, loss, alteration, disclosure of, access to, or unlawful acquisition of Personal Data caused by Company”. DPA s 5 states “Company will notify Customer promptly of any Security Breach”, will comply with processor obligations under Data Privacy Laws and will assist the customer, including by providing details to the extent known — nature, circumstances, and categories and approximate number of data subjects and records — and by addressing and mitigating the breach at its own expense, subject to the liability limit of one times the previous year's fees. No notification deadline in hours or days is stated, the definition is limited to Personal Data and to breaches caused by Onit, and the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) is not mentioned. | Will you commit to a fixed notification deadline for any incident affecting our data, extend it beyond Personal Data to all Customer Data, and support our Notifiable Data Breaches assessment? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) |
| Changes to the service and the terms | Public claim only | Subscription and Services Agreement cl 13.12(c): “Company may update this Agreement from time to time by posting amended terms that become applicable to the parties on the first day of the next Subscription Year”; an Order may only be changed by a signed amendment. Clause 12.4 governs AI changes: “Company may improve, replace, or deprecate models or prompts without material reduction of core functionality”, with no notice obligation. Clause 9.2 warrants that material functionality will not be materially decreased during a Subscription Term. The subprocessor list is expressly “as may be updated from time to time” and carries a dated change log, with notification only through an email subscription the customer must opt into (cl 4.5), and a 15-day objection window whose sole remedy is termination of the affected Services. | Will you give us advance written notice of a model or prompt change under cl 12.4 and of any posted amendment under cl 13.12(c), rather than requiring us to monitor the website? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Exit and data portability | Public claim only | Subscription and Services Agreement cl 6.5: for 30 days after termination or expiry the customer is granted access “for the purpose of exporting Customer Data from the Subscription Services using the built-in functionality”, and the agreement's terms continue to apply during that period. On termination all Orders terminate together (cl 6.4(a)), the right to use the Services ends, and no fees are refunded unless the customer terminated for cause or under the warranty remedies (cl 6.4(d)). Either party may terminate for an uncured material breach on 30 days' notice (cl 6.3). Clause 12.2 confirms the vendor makes no ownership claim to Output but has no obligation to retain or recreate it. What the built-in export produces — formats, whether playbooks, clause libraries, AI checklists, risk profiles and structured findings in OnitX CLM are included — is not described in the documents read. | What exactly does the built-in export in cl 6.5 produce, in which formats, and will you extend the 30-day Export Period and include playbooks, clause libraries and AI findings? | [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |
| Connections into firm systems | Public claim only | The published connection points are the Microsoft Word add-in for ReviewAI, the two-way link between ReviewAI and OnitX CLM, and Third Party Applications integrated on request under cl 4.13, which sit outside the Subscription Services and outside the agreement. “Microsoft Add-Ins” is itself listed as a platform in Table 6 of the subprocessor list, alongside AWS as its cloud provider and Anthropic as the generative-AI tool. Clause 12.8 excludes add-ins and the vendor's third-party integrations from any service level or uptime commitment. Nothing published describes what permissions the Word add-in requires in a Microsoft 365 tenancy, or whether any connector reads a document store, mailbox or matter system other than the document the reviewer has open. | What Microsoft 365 permissions does the ReviewAI add-in request, is any document content stored outside the tenancy while it is reviewed, and can the add-in be restricted to named users? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| External retrieval | Not confirmed | Nothing on the pages read states whether any AI Feature retrieves material from the internet or from sources outside the customer's own tenancy. The ReviewAI page describes review against “your chosen playbook”, the governing law and “market practice and basic drafting standards”, and a chat that answers about “clauses, risks, or best practices”, without saying where that standards and practice material comes from. The subprocessor list shows inference performed by external model providers, which is not the same question as whether the features perform live external retrieval. The Subscription and Services Agreement does not address external retrieval. | When ReviewAI cites market practice or drafting standards, and when the chat answers about best practices, what corpus is consulted, and does any AI Feature make a live internet request? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Control over automated action | Public claim only | The published AI behaviour is advisory inside the reviewer's document plus automated triggering between systems: findings are “flagged in Word and logged as structured data in OnitX CLM”, checklists become “interactive, trackable tasks directly in Word” with suggested edits, and “Contracts initiated in OnitX CLM trigger ReviewAI for instant review”. The vendor also names Spend Agent and “other Onit AI Agents” in the subprocessor list without describing what those agents are permitted to do. The Subscription and Services Agreement puts responsibility on the customer: cl 12.3 states the vendor is not liable for “decisions or actions taken by Customer based on Output, Customer's prompts or configuration”, and cl 12.7 requires use only “for legitimate internal business purposes within the scope of the Subscription Services”. The vendor may also throttle or temporarily suspend AI Features under cl 12.6 where it determines use is excessive. | Can any AI Feature or agent change a record, send a communication or approve a step without a person confirming it, and how is that configured for our tenancy? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement); [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) |
| Human review of output | Public claim only | Subscription and Services Agreement cl 12.3: “Output is machine-generated and may be incomplete, inaccurate, biased, or unsuited to Customer's purpose. Customer is solely responsible for review and reliance, including obtaining legal or other professional advice as appropriate”, and the vendor “cannot guarantee that Outputs will be 100% accurate and/or free from hallucinations” and notes that “Outputs may not be unique, and others may receive similar Outputs”. Clause 12.5 provides the AI Features and Output “as is” and “as available” with accuracy warranties disclaimed, and cl 4.14 states the vendor is not a law firm and offers no legal advice. In the product itself, ReviewAI's published design keeps a person in the loop — suggested edits and checklists in Word with assigned ownership, and a closing risk profile with recommendations — but no mandatory approval step or audit record of who accepted a suggestion is published. | Does the product record which suggested edits a reviewer accepted or rejected, and is that record exportable for a file note? | [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/); [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) |

## Notes

Four firecrawl operations spent, all on binding or published documents: the Subscription and Services Agreement, the subprocessor list, the Data Processing Addendum and the security page. The ReviewAI page, the Olava page, the Wesfarmers case study, the home-page extracts and the brand-consolidation blog post were read from the existing cache at no cost, carrying forward the Phase 2 record of what the product does. Not reached within the cap, and each matters: the privacy and cookies notice (https://www.onit.com/privacy-cookies/, linked in the footer of every page read, not read here — the URL is recorded as a locator only); the Product Specific Terms (https://www.onit.com/product-terms/), which the agreement makes part of each Order and which may change the AI terms per module; the Maintenance and Support document and the Service Level Agreement (https://www.onit.com/maintenance-and-support/ and https://www.onit.com/service-level-agreement/), both incorporated by the agreement; and the legal centre hub (https://www.onit.com/legal-center/). Australian facts are the weakest part of this profile and the gap is a finding, not an omission: no Australian contracting entity, ACN or ABN exists in any document read; the agreement is with “Onit, Inc. or its Affiliate identified on an Order” and is governed by Delaware law; the group entity list in the subprocessor list contains no Australian company; and the published hosting choices for every platform are the United States, Germany, Ireland, the United Kingdom, Canada or the European Union, with no Australian option — so australianRegion is recorded as no on the basis of that published list. Australian presence is left unknown rather than no: one Australian customer is published by the vendor, but no Australian office, entity, reseller or partner was found, and only nine pages were read. Model providers are now established from the vendor's own subprocessor list (Anthropic, Google Cloud including Gemini, and OpenAI) but no model name, version or inference region beyond a country column is published, and the agreement permits models to be replaced without notice. trainingOnCustomerContent is recorded as unknown: clause 12.1 restricts third-party model providers from training on Input for the benefit of others except in de-identified or aggregated form, and clause 5.2 permits the vendor's own use of aggregated and anonymised Customer Data for product improvement and benchmarking, but no document read states that Onit itself does not train or fine-tune on customer content. Assurance rests on a marketing page: the security page states Onit audits to SOC 2 Type 2, SOC 1 Type 2 and HIPAA, but no report, scope, period or auditor is published and none is offered on request, so it is recorded as vendor_claim. Encryption at rest is not addressed in any document read. Two of the twenty critical controls end not_verified: webSearch (no statement about external retrieval by any AI Feature) and information (no AI-directing content found; https://www.onit.com/llms.txt returns a 404 page). Scope question carried forward for the Maestro: this profile covers the Onit-branded ELM and CLM platforms and their AI components. ReviewAI, Spend Agent, Olava, ContractWorks, SecureDocs, AXDRAFT, ReadySign, BusyLamp, SimpleLegal, Bodhala and Legal Files are separately named products, several with their own hosting locations and subprocessors in the published list, and may each warrant their own register row. Former names to keep searchable: SimpleLegal, ContractWorks, SecureDocs, AXDRAFT, ReadySign, BusyLamp, Legal Files, Bodhala, LawBase (Synaptec Software), InvoiceAI and Onit Catalyst. Ownership type is recorded as unknown because no document read establishes it. Capability list updated 2026-09-27 when the controlled vocabulary was extended from 19 to 38 values: added legal-spend-management. Values already present were kept, because they remain true descriptions of what the product does.

## Sources

- [Onit — ReviewAI product page](https://www.onit.com/products/clm/reviewai/) (checked 2026-09-27)
- [Onit — Olava product page (positioning sentence and lead-capture form)](https://www.onit.com/products/ai-studio/olava/) (checked 2026-09-27)
- [Onit — Wesfarmers case study (Australian customer, ReviewAI), including the full product navigation; cached scrape read from disk](https://www.onit.com/resources/wesfarmers-case-study/) (checked 2026-09-27)
- [Onit — home page and product extracts; cached search-result extracts read from disk](https://www.onit.com/) (checked 2026-09-27)
- [Onit blog — Unified Legal Operations: All Onit Solutions in One Place (brand consolidation); cached extract read from disk](https://www.onit.com/blog/unified-legal-operations-onit/) (checked 2026-09-27)
- [Onit Subscription and Services Agreement, including section 12 Artificial Intelligence Terms](https://www.onit.com/services-agreement) (checked 2026-09-27)
- [Onit Group of Companies Subcontractors / Sub-processors list, updated 17 August 2026](https://www.onit.com/sub-processors) (checked 2026-09-27)
- [Data Processing Addendum for the Onit Companies, including Annex 2 Security Measures and Annex 4 Standard Contractual Clauses](https://www.onit.com/data-processing-addendum-for-the-onit-companies/) (checked 2026-09-27)
- [Onit — Customer Security page](https://www.onit.com/security/) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.