Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, plan and naming
Public claim only
The Australian product page markets 'OpenText eDiscovery' with a 'how to buy' table listing OpenText eDiscovery Aviator, technology-assisted review, self-service data processing, predictive search and an integrated viewer with redaction inside the eDiscovery offering, plus OpenText Connectors for Private Cloud as an add-on, and three deployment options (public cloud, private cloud, managed service). The binding documents use different names for the same services: the SaaS Terms define 'OpenText Core eDiscovery Services' and separate storage, ingestion and analytics elements, and the Additional Terms have distinct clauses for OpenText Core Insight, OpenText Core eDiscovery and OpenText Core eDiscovery Aviator. Managed Document Review, Rapid Analytics Investigative Review and High Efficiency Managed Review are separate service lines in the Additional Terms with their own commercial terms.
Ask: Map the names on our Order to the clauses in the SaaS Terms and the Additional Terms, and confirm which storage, ingestion, analytics, Aviator and managed-review elements we are buying.
Deployment options and where data sits
Public claim only
The product page publishes public cloud, private cloud and managed service as the purchase options and says the platform can run in the cloud, on-premises or as a hybrid solution. The Aviator FAQ states that the AI job creates a session with the model 'directly from the customer's OpenText eDiscovery AWS environment', so the cloud service runs on Amazon Web Services. None of the four binding documents read (SaaS Terms, Additional Terms, DPA, Technical and Organizational Measures) names a hosting country or region, and the Technical and Organizational Measures describe data centre controls generically while directing the reader to request information about third-party cloud providers' controls.
Ask: Which AWS region will hold our environment, including backups and any disaster-recovery copy, and will an Australian region be written into the Order?
Which functions use a model and which do not
Public claim only
The product page distinguishes three kinds of automation. Technology-assisted review is 'powered by continuous active and machine learning', with predictive search and advanced data visualisation alongside it, and the vendor dates that lineage itself: '20+ years ... from technology-assisted review to GenAI human-assisted review'. The generative features are the two Aviator items in the feature list, 'Gen AI-powered OpenText eDiscovery Aviator Review' and 'AI-generated OpenText eDiscovery Aviator Document Summarization'. Personal-data protection is not a model at all on the vendor's own wording: detection and redaction are 'based on a pre-configured library of common patterns, custom RegEx scripts, and automated quality control processes'. Audio and video review works from both native and transcribed text, and the Additional Terms show the transcription is performed by Amazon Transcribe and translation by Amazon Translate.
Ask: For each feature we will use, state whether it calls a large language model, a trained classifier, or pattern matching, and what leaves our environment in each case.
Australian data residency
Not confirmed
Nothing in the four binding documents read states where customer data is hosted, and no Australian data-residency commitment was found. The Aviator FAQ's statement that Aviator is available 'to all OpenText eDiscovery cloud customers (single or multi-tenant) in all AWS regions, provided they have signed the appropriate legal paperwork' addresses availability, not residency. The Australian regional site carries a 'Sovereign cloud' deployment page in its navigation, which was not opened inside the credit budget, so nothing is recorded from it.
Ask: Can our environment, its backups and all Aviator processing be confined to an Australian AWS region, and will you state that in the Order rather than in a support answer?
Check for vendor content directing how AI describes the product
Not confirmed
A deliberate check for content addressed to AI models, assistants or crawlers found none for this vendor, checked 27 September 2026. Two site maps of opentext.com returned 40 and 41 URLs respectively and none was /llms.txt, /ai-info, /ai or /for-ai; neither product page read, nor any of the four binding documents read, contains a block instructing AI models how to describe the product. One map result was a PDF titled 'OpenText DevOps Aviator legal and security FAQ', which is a legal and security document for a different Aviator product rather than content directing AI. This is a negative result on the URLs returned and the documents read; opentext.com is large and both maps were search-filtered, so it is not proof of absence.
Ask: Do you publish anywhere on your sites or in your documentation guidance addressed to AI models, assistants or crawlers about how OpenText products should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and permitted use
Public claim only
The Additional Terms place responsibility for lawful and appropriate use on the customer. Clause 13.4(c) states that use of AI components 'does not replace decision-making and judgement by natural individuals', that the customer 'remains solely responsible for any decisions taken and judgements as a result of the Outputs', that OpenText 'shall have no liability resulting from (i) the creation and/or use of the Outputs, and/or (ii) any decisions resulting from the use of the Outputs', and that 'Unacceptable risk use (as defined in EU AI Act or per industry standards) is prohibited'. Clause 13.4(f) makes the customer solely responsible for identifying and complying with any additional legal requirements applicable to AI use in its processes. Clause 13.4(a) notes that the customer's choice of parameters and inputs may carry assumptions, biases and limitations affecting the outputs.
Ask: Can Aviator be disabled per matter or per client so that a client who has not consented to generative AI is technically excluded, and what written description of the Anthropic and Bedrock path can we give that client?
Model provider and the right to change it
Public claim only
The Additional Terms name the provider in a binding document, not only in marketing: clause 13.1 states that 'Aviator leverages generative artificial intelligence (AI) with a Large Language Model (LLM) from Anthropic on Amazon Bedrock'. Clause 13.7 then reserves the right to change it: 'OT may use one or more LLMs to support the features ... OT reserves the right, at its sole discretion and without notice, to modify, update, replace, or discontinue any LLM, including by switching to different model architectures, vendors, or configurations, provided that such changes do not materially degrade the overall functionality of the Services', and 'Unless otherwise expressly agreed in writing, no specific model version, vendor, or output is guaranteed'. The Aviator FAQ adds that Bedrock hosts a deep copy of the model and that the provider has no read or write access and no internet access to the model within Bedrock, which is OpenText's account of a third party's platform on a product page.
Ask: Will you name the Anthropic model and version for our environment in the Order and agree not to change the model, version or vendor without prior written notice and a chance to test?
Sub-processors, notice and objection
Public claim only
The DPA section 2.3.1 takes a general authorisation to engage sub-processors, which 'may include: (i) OT's global Affiliate companies as exist from time to time (and their vendors); and/or (ii) any of the sub-contractors that OT engages in connection with the provision of certain Processing activities as at the date of this Agreement', and treats those two groups as the agreed list for the Standard Contractual Clauses. No named, dated sub-processor list was found on the documents read or in the site maps. Section 2.3.2 requires OpenText to inform the customer at least 14 days before appointing a new or replacement sub-processor, with objection in writing within 14 days, and expressly does not require that notice where the new sub-processor is an OpenText global affiliate. Section 2.3.3 limits objection to cases where the sub-processor 'demonstrably fails to offer the same or a reasonably comparable level of protection', and section 2.3.4 gives a 30-day window to terminate the affected part of the services, taking effect within 90 days; not terminating is deemed acceptance. The Additional Terms note that AI component use 'involves the processing of personal data by third parties such as Amazon Bedrock as sub-processor'.
Ask: Provide the dated list of sub-processors that will touch our data, including affiliates and their vendors, and agree that affiliate changes are notified to us as well.
Training on customer content
Public claim only
The no-training statement sits on a product page, not in a contract. The Aviator FAQ states 'OpenText does not train models. Models accessed by OpenText eDiscovery Aviator are pre-trained by the LLM provider. Customer data, input prompts, and outputs are never used to train the LLM model. LLM results are not shared across projects.' None of the three binding documents read contains a no-training covenant. What the Additional Terms do contain is clause 13.4(g): 'OT shall be entitled to use, develop or share its experience and knowledge (including processes, ideas, statistical and other information) acquired by it in connection with the Products ('Services Statistics')', provided the customer is not identified as a source and any data arising from the Services Statistics is anonymised.
Ask: Will you warrant in the Order that our documents, prompts and outputs are not used to train, fine-tune or evaluate any model, and define what falls inside Services Statistics under clause 13.4(g)?
Use of experience, statistics and feedback
Public claim only
Additional Terms clause 13.4(g) entitles OpenText to use, develop or share the experience and knowledge, including processes, ideas, statistical and other information, that it acquires in connection with the products, on condition that the customer is not identified as a source and that data arising from those Services Statistics is anonymised. No definition of the data classes that feed Services Statistics is published, and no opt-out appears in the documents read. The SaaS Terms also allow OpenText to audit the customer's compliance with the Services Form where there is a discrepancy between the parties' records.
Ask: Which data classes feed Services Statistics, how is anonymisation tested, and can we opt out of the use of our usage data for product development?
Retention of data, prompts and logs
Public claim only
The SaaS Terms tie retention to storage states rather than to a schedule. Data ingested but not published 'will be included in Storage until a specific request to delete this content is received'. Culled data moves to Nearline Storage unless the customer gives written notice that it wants the data permanently removed or selects Archived Storage, and a project returns to active status one business day after a written request. Archive Storage is defined as a database in a turned-off state for a whole calendar month. The Technical and Organizational Measures say centralised security logs are retained for 'a commercially reasonable period'. For Aviator, the FAQ says session data is deleted from Amazon Bedrock when the session closes, which is a statement about the third-party service and not about records held inside the platform; no retention period is published for prompts, outputs or AI job history in the platform.
Ask: State the retention period for Aviator prompts, outputs and job records inside the platform, for audit logs, and for Nearline and Archive copies, and confirm the fees that apply to each state.
Deletion and return of data
Public claim only
SaaS Terms section 6.5 requires the customer to advise its return-or-destroy preference for Customer Data before the end of the Term. Provided the customer is not in material breach and is current with payments, OpenText 'will provide a one-time data return service to Customer as described in a separate statement of work, if Customer requests the data return service prior to termination of the Agreement; and Customer pays OT the applicable fee'. Section 6.4 requires the customer to confirm in writing within 30 days after termination that it has destroyed or returned the Documentation and all copies. Section 6.6 says OpenText will not delete Customer Data residing within the service during a suspension, except in the stated circumstances. In-term deletion of unpublished ingested data happens only on a specific request. No deletion deadline, no backup-purge period and no certificate of deletion appear in the documents read.
Ask: State the maximum days to delete our data, backups and any AI job records after a destroy instruction, the cost and format of the one-time data return, and whether you will certify deletion.
Vendor personnel access to content
Public claim only
The Technical and Organizational Measures, incorporated into the DPA, state that employee access rights are granted on least privilege, on a need-to-know basis and with a legitimate business need, that all access requests are validated by information security personnel and approved, that access to production environments goes through secure logical access gates requiring multi-factor authentication with activity recorded through logging on those gates, and that access privileges are validated regularly. Personnel receive recurring security and data-protection training, and access is reviewed and revoked on role change or departure. The same document repeatedly directs the reader to request information about controls applied by third-party cloud providers, rather than publishing them. Managed review staff work under the customer's and its counsel's supervision under the Additional Terms. Nothing read makes vendor access to a specific matter subject to the customer's per-ticket approval or supplies the customer with access logs.
Ask: Can we require per-matter, time-boxed and customer-approved support access, receive the access log for our environment, and know which countries OpenText personnel read our data from?
User identification and access controls
Public claim only
SaaS Terms section 1.1 requires each Authorized User to be a single individual employee or contractor of the customer, identified to OpenText and assigned a unique login name and password before access is provided. The Technical and Organizational Measures describe least-privilege access, multi-factor authentication for production environments, periodic access reviews, disabling of unused accounts, network segregation of production from corporate and public networks, and input controls that allow verification of when, where and by whom data was entered, edited or deleted. Customer-side single sign-on, enforced multi-factor authentication for end users, and provisioning standards such as SCIM are not addressed in any document read.
Ask: Does the platform support single sign-on and enforced multi-factor authentication for our users, automated deprovisioning, and matter-level permissions that also bind Aviator queries?
Encryption in transit and at rest
Public claim only
The Technical and Organizational Measures list 'Encryption of data in transit and data at rest (as set out in the Agreement)' among the measures, say that encryption in transit is applied inherently based on the transmission protocol and that end-user sessions from the browser to portal applications are encrypted with HTTPS by policy, and refer the reader to the agreement for the detail. No algorithm, key length, TLS version or key-management arrangement is named in any document read, and customer-managed keys are not mentioned. The Additional Terms say documents sent to Amazon Translate, Amazon Transcribe, AWS Elemental MediaConvert and Anthropic on Amazon Bedrock are sent with encryption and returned encrypted.
Ask: Name the encryption algorithms, key lengths and TLS versions used at rest and in transit for our environment and each third-party path, and say whether customer-managed keys are available.
Independent assurance and audit rights
Public claim only
The Technical and Organizational Measures state that 'OpenText maintains an Information Security Management System designed to comply with recognized industry standards such as ISO/IEC 27001 and undergoes periodic audits, including SOC 2 Type II assessments for applicable services', and that on written request and subject to confidentiality it 'may provide summaries of relevant certifications or audit reports where available or a standard security questionnaire'. That wording is about design and assessment; no certificate is published and no scope is stated, so whether the eDiscovery service and the Aviator features are inside a current report is unresolved on the documents read. DPA section 2.11.2 requires OpenText, on written request, to provide a copy of the latest SOC audit report 'where available'; section 2.11.4 allows an on-site inspection only where those documents have failed to verify compliance or a supervisory authority formally requires it; section 2.11.6 requires 30 days' notice, limits an audit to two consecutive business days and to once per contract year.
Ask: Provide the current SOC 2 Type II report and any ISO/IEC 27001 certificate, with a scope statement that names the eDiscovery service, the Aviator features and the region hosting our environment.
Contracting entity, governing law and liability
Public claim only
The document structure is an Order plus the eDiscovery SaaS Terms and Conditions (the Standard Terms) plus the Legal Tech eDiscovery Additional Terms, with the DPA and its Technical and Organizational Measures appendix attaching where personal data is processed. The SaaS Terms are headed 'Open Text Corporation', section 8.1 applies the law of the Province of Ontario and gives the Ontario courts exclusive jurisdiction apart from OpenText's requests for injunctive relief, and section 7.4 excludes indirect and consequential damages and loss of data, caps OpenText's aggregate per-Order liability at 50 per cent of the service fees invoiced under that Order in each 12-month period, and caps total liability for all claims across the whole term at the fees invoiced in the 12 months before the most recent event giving rise to liability. Section 7.1 states the infringement indemnity and calls itself OpenText's entire liability for infringement. Additional Terms clause 13.4(c) excludes liability for outputs and decisions made from them, and clause 13.6 passes through the Amazon Bedrock third-party models end-user licence for Anthropic functionality and makes the customer indemnify OpenText for any breach of it.
Ask: Which Open Text entity, with its ACN or ABN, will sign our Order, and will you agree to Australian law and forum, a higher cap for confidentiality and data breach, and remove the 50 per cent per-period limb?
Cross-border transfers
Not confirmed
The DPA read is built for European transfer law. It defines Restricted Transfers by reference to the GDPR, UK data protection law and the Swiss regime, incorporates OpenText's EEA controller-to-processor and processor-to-processor Standard Contractual Clauses and the UK International Data Transfer Addendum by reference to separate published PDFs, and appoints a data protection officer contactable at a published address. Nothing in the DPA addresses Australian privacy law or Australian Privacy Principle 8, and no document read states the country in which customer data is stored or in which Aviator inference occurs. The Aviator FAQ places the model call inside the customer's own OpenText eDiscovery AWS environment but names no region.
Ask: For an Australian customer, list every country from which our data may be accessed or in which it may be processed, including for support and for Aviator, and what contractual steps you take for Australian Privacy Principle 8 purposes.
Incident notification
Public claim only
The Technical and Organizational Measures define a 'Security Incident' as 'a confirmed security breach leading to an unauthorized access, use, destruction, loss or alteration of customer data', say the process follows the NIST Computer Security Incident Handling Guide or equivalent practices, and state that OpenText 'will notify the customer without undue delay of any Security Incident that impacts the customer data' and will provide reasonably requested information. For third-party providers the same document says notification reaches the customer 'by OpenText without undue delay upon confirmation of impact to customer data'. DPA section 2.6.1 requires notification of a Personal Data Breach without undue delay after OpenText becomes aware, with the documentation needed for the customer to notify regulators or data subjects, and section 2.6.4 makes the customer responsible for notifying the supervisory authority and data subjects. SaaS Terms section 5.3 says that in the event of a breach OpenText will comply with its legal requirements and promptly notify the customer. No hour figure is committed anywhere, and the trigger is a confirmed breach with impact confirmed.
Ask: Will you commit to notice within 72 hours of becoming aware of a suspected incident affecting our data, including at a sub-processor, with enough detail for a Notifiable Data Breaches assessment?
Change notice for models, sub-processors and controls
Public claim only
The Additional Terms reserve broad unilateral change rights over the AI layer. Clause 13.7 lets OpenText 'modify, update, replace, or discontinue any LLM, including by switching to different model architectures, vendors, or configurations' at its sole discretion and without notice, subject only to not materially degrading overall functionality, and states that no specific model version, vendor or output is guaranteed unless expressly agreed in writing. For sub-processors the DPA requires 14 days' notice, except where the new sub-processor is an OpenText global affiliate, in which case the notice mechanism is expressly not required. The DPA's definitions also state that the Standard Contractual Clauses and the Technical and Organizational Measures are incorporated 'as may be amended, updated or replaced from time to time'.
Ask: Will you agree in writing to notify us before any change of model, model version or vendor for Aviator, and to extend sub-processor notice to affiliate changes?
Termination and getting data out
Public claim only
The two documents differ in emphasis and should be read together. SaaS Terms section 6.2 lets the customer terminate the Services Order without refund, subject to paying fees incurred, on five business days' written notice before the end of a month. The Additional Terms then say, for several service lines, 'Notwithstanding the Termination section in the Standard Terms, there is no termination for convenience during the Initial Term', with 60 days' notice of non-renewal and automatic renewal on the same provisions otherwise. On exit, section 6.5 provides a one-time data return service only if the customer asks before termination, is not in material breach, is current on payments, and pays the applicable fee, and the service is scoped by a separate statement of work. No export format, no time limit and no escrow are published.
Ask: Confirm whether termination for convenience applies to our Order, and quote the one-time data return service now, with formats, media, timing and price.
Connectors and onward data flows
Public claim only
Collection reaches 45-plus data sources according to the product page, with OpenText Connectors for Private Cloud offered as an add-on. Outbound flows are itemised in the Additional Terms: documents to Amazon Translate, audio tracks to Amazon Transcribe, video natives to AWS Elemental MediaConvert 'or related Amazon entity', and documents and prompts to Anthropic on Amazon Bedrock, each triggered by an in-app batch job request and each priced in the Order and invoiced monthly in arrears. The same clauses authorise OpenText to enter the feature activation token and to send the material on the customer's behalf as part of project management activities. The Additional Terms also restrict the customer from engaging another document review company or consultant in connection with the services without OpenText's prior written consent in the clause read at that point.
Ask: List every connector and outbound service that will be enabled for us, who can trigger each one, and how we block Translate, Transcribe, MediaConvert and Bedrock traffic at the tenant level.
Open-web access from the model
Public claim only
The Aviator FAQ answers the question directly: asked whether the model references the internet or has an internet plug-in, it says 'No. Amazon Bedrock performs a deep copy of the LLM and hosts it. The LLM provider (Anthropic) has no read/write access and no internet access to the model within Amazon Bedrock.' Predictive search and technology-assisted review operate on the loaded data set. These statements appear on a product page and describe a third party's platform; nothing equivalent appears in the SaaS Terms, the Additional Terms or the DPA.
Ask: Will you warrant that no feature can retrieve from the open web on our matters, and evidence how that is enforced in the Bedrock configuration used for our environment?
What runs without a person initiating it
Not confirmed
The Additional Terms describe the third-party feature paths as in-app batch job requests, which are user-initiated, but they also authorise OpenText to enter a feature activation token and to send documents on the customer's behalf as part of project management activities. The Aviator FAQ describes Aviator Agents, where a user states a goal in natural language and 'an agent can plan and execute the multi-step search, review, analysis and summarization tasks required to complete it', managed from a dashboard with pre-configured templates and custom agents. Clause 13.4(c) places responsibility for decisions on the customer. No per-action confirmation requirement, no boundary configuration and no tenant kill switch are described in the documents read.
Ask: Which agent actions can run without a person confirming each one, what can an agent change or export, and how do we disable agents while keeping the rest of the platform?
Human review before output is used
Public claim only
Human review is addressed both contractually and in the interface. Additional Terms clause 13.3 records the wording that must appear in the product: when Aviator is enabled users see an Aviator icon whose mouseover text reads 'Aviator leverages generative artificial intelligence (AI) with a Large Language Model (LLM), to generate content and respond to your input. OpenText does not guarantee the accuracy of AI-generated responses and/or rights to use them. It is OpenText's customer's responsibility to apply judgement and consider multiple sources before making any decisions.' Clause 13.4(c) states that use of AI components does not replace decision-making and judgement by natural individuals and that the customer remains solely responsible for decisions taken. Clause 13.4(d) states that OpenText does not guarantee the protection of privacy, rights to use, or accuracy of outputs from large-language-model components. No product control forces a named reviewer to approve an output before it is used.
Ask: Can the platform require named reviewer sign-off before an Aviator coding decision or summary is relied on, produced or exported, and can that be evidenced in an audit export?
