Product and intended use
Define the configuration, people, information and tasks being assessed.
Platform versus LEX, Counsel, hearings and AI Features
Public claim only
This profile covers Opus 2 software (excluding Chambers (LEX) and Opus 2 Counsel unless ordered) with optional Ingenuity AI Features. The subprocessor schedule splits Opus 2 software, LEX, Counsel and Hearing Services. Customer-hosted (non-Lex) deployments are carved out of the End User Privacy Statement. Labs/evaluation agreements are not Customer Agreements.
Ask: Confirm the Customer Agreement SKUs (platform, Ingenuity AI, hearings, LEX, Counsel), AWS hosting region, and whether a signed DPA is incorporated.
AWS SaaS; region on the Customer Agreement
Public claim only
AWS is the hosting provider. Location is 'as stated in the Customer Agreement'. Microsoft and Google LLM locations follow that region (US if US; UK and EU if UK or EU). Security: geographical location that best fits the customer's needs; far safer than on-premises (on-prem is not the default). Customer-hosted software (other than LEX) is mentioned as out of the End User Privacy Statement.
Ask: Which AWS region will hold our Content, backups and AI inference, and is an Australia region available?
Cases, hearings, transcripts, Ingenuity agents
Public claim only
Product lines: hearings, cases, transcripts, Chambers (LEX), arbitral institutions. Ingenuity is described as an agentic AI framework running on matter intelligence generated as teams collaborate in the platform, used even inside the courtroom. AI Features apply only if purchased and enabled (AWS Bedrock note on the subprocessor list).
Ask: Which Ingenuity agents and hearing/transcript features will be enabled, and which remain Labs or off?
UK group; AU companies; hosting US/UK/EU
Public claim only
Opus 2 International Limited (England). Australian group companies and an APAC site exist. Security page lists the Australian Privacy Act among regimes the services meet. AWS hosting regions called out for LLM routing are US, UK or EU — not Australia. Support/professional services may involve the Australian Pty company.
Ask: Will our Content stay in an Australian or only UK/EU/US AWS region, and which group companies will access it for support?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Customer Data; optional AI Features and hearing contractors
Not confirmed
Opus 2 processes Content as the customer's processor. Enabling AI Features sends Inputs/Outputs to AWS Bedrock, Microsoft, Google and/or Anthropic (UK, EU, US). Hearing services add reporters, Zoom, transcription vendors. Pendo (USA) processes some End User identifiers. No per-client AI exclusion was documented on the public pages.
Ask: Can we keep Ingenuity, Pendo and hearing vendors off per matter, and what region/subprocessor description can we give clients?
Anthropic, Microsoft, Google, AWS Bedrock
Public claim only
If AI Features are purchased: AWS Bedrock; Microsoft Corporation as LLM provider (location follows AWS hosting region); Google LLC similarly; Anthropic, PBC (UK, EU, US) added 8 September 2026. Specific model names were not listed. Customer model choice is not described as self-serve.
Ask: Which of Bedrock, Microsoft, Google and Anthropic will process our tenancy, in which countries, and can we exclude US Anthropic?
Published list dated 8 September 2026
Public claim only
Public list last updated 8 September 2026. Besides LLMs and AWS: Zahoree (Mexico support), FreshDesk (Germany), MongoDB (multi-tenant DB), Pendo (USA analytics), Grafana (USA observability), Eastern Enterprise (Netherlands and India engineering), Uncover Legal B.V. (Netherlands), Linear (EU). Hearing SKU adds Zoom (US), Dacast (US), Cantab, Google speech, stenograph vendors. Group companies include Australia. Notice/objection period is not stated on the page.
Ask: Confirm the processors in scope for our SKU, 30-day notice/objection, and whether Mexico support and India engineering will see Content.
No public no-training clause for Content
Not confirmed
The public Ingenuity page does not state that Customer Content is never used to train Opus 2 or third-party models. End User Privacy Statement allows Opus 2 as controller to use aggregated, non-identifying Usage Information for product development and benchmarking. Training use of Content would have to be in the unpublished Customer Agreement/DPA.
Ask: Confirm in the DPA that Content, prompts, outputs and logs are not used to train Opus 2, Anthropic, Microsoft, Google or AWS models.
Pendo, surveys and aggregated usage
Public claim only
Opus 2 as independent controller processes Usage Information for product engagement communications, feedback requests, marketing (with unsubscribe) and aggregated non-identifying development. Pendo.io (USA) is used for personalisation, analytics and in-app guides, processing name and email. Labs/evaluation is a separate agreement.
Ask: Can we disable Pendo and in-product feedback, and is any Content (not just usage metadata) used to improve Ingenuity?
Customer-controlled; no public day count
Not confirmed
End User Privacy Statement: depending on the Software Services, the Customer may access, retain, export or delete End User data. No numbered Opus 2 retention schedule for Content, prompts or backups is published.
Ask: Provide a numbered retention schedule for Content, prompts, outputs, logs and backups while a matter is live and after we delete a project.
Customer may delete; Opus 2 timeline unpublished
Not confirmed
The Customer can instruct export, retention or deletion of End User data. No public post-termination deletion period or certificate for AWS, MongoDB, Bedrock or Anthropic copies was found.
Ask: On exit, what is deleted from AWS, MongoDB and each LLM provider, within how many days, with what certificate?
Group support, Mexico, India, Uncover
Public claim only
Group companies (UK, US, Singapore, Australia) may perform out-of-hours support. Zahoree (Mexico) handles support tickets and may process Content. Eastern Enterprise (Netherlands and India) and Uncover Legal B.V. (Netherlands) provide engineering/platform support that may involve incidental access to Content. Hearing contractors are named to the customer on request.
Ask: Is support access per-ticket with our approval, logged to us, limited to named countries, and will you notify us of legal process seeking Content?
SSO, MFA and customer-managed users
Public claim only
Security: client-defined password policy, MFA options, SSO, and full customer control to create, modify and remove users and permissions. SCIM was not mentioned.
Ask: Do you support SAML/OIDC SSO-only, MFA enforcement, SCIM and matter-level ethical walls that Ingenuity cannot cross?
AES-256 at rest; TLS 1.2 in transit
Public claim only
Security page: production data at rest encrypted with AES-256; TLS 1.2 between browsers and infrastructure; internal component traffic also TLS; emails encrypted end-to-end. Encrypted volumes are listed under logical segregation. CMK was not mentioned.
Ask: Confirm TLS 1.2+ and AES-256 for backups and AI Feature paths (Bedrock/Microsoft/Google/Anthropic), and whether CMK is available.
ISO 27001:2022 and Cyber Essentials Plus claimed
Public claim only
Security page badges: ISO/IEC 27001:2022 and Cyber Essentials Plus. CREST-accredited external penetration testing is described. Reports were not downloaded. SOC 2 was not named on the security page reviewed.
Ask: Provide current ISO 27001 and Cyber Essentials Plus certificates covering our hosting region and Ingenuity AI Features, and whether a SOC 2 Type II exists.
Customer Agreement and DPA not public
Not confirmed
No public master terms or liability cap. Privacy and End User statements point to a Customer Agreement and a DPA in that agreement. Opus 2 is processor of Customer Data and independent controller of Usage Information. DPF certification applies to Opus 2 International Inc (US). Privacy last updated 23 December 2025; End User statement 9 July 2026; material privacy changes will be notified.
Ask: Will our Customer Agreement include a DPA with APP flow-down, output ownership, a meaningful cap for confidentiality/data breach, and Australian or English law/forum?
SCCs, DPF; Anthropic US; Mexico support; India engineering
Public claim only
End User statement: UK/EEA transfers use SCCs, EU–US DPF where Opus 2 International Inc is the recipient, or another lawful mechanism. Anthropic locations include the US. Pendo and Grafana are USA. Zahoree is Mexico. Eastern Enterprise includes India. LLM Microsoft/Google locations follow the AWS hosting region (US or UK+EU). Australian Privacy Act is listed as a regime the services meet.
Ask: Name every country of storage, inference and support access for our tenancy, including Anthropic US and Mexico/India, in writing.
24/7 monitoring claimed; no public hours
Not confirmed
Security: 24–7 monitoring and real-time response to suspicious activities. Grafana is used for security events. No numbered customer-notification period or NDB clause is in the public privacy pages. privacy@opus2.com is the DPO contact.
Ask: Within how many hours of discovering a suspected incident affecting our Content will you notify us, and will you support an NDB assessment?
Subprocessor list updated; privacy change notice
Public claim only
Subprocessor page records additions (Anthropic, 8 September 2026) but does not state a prior-notice/objection period. Privacy: material changes will be notified; last-updated date revised. Security: formal change management and STRIDE threat modelling before production. Ingenuity is agentic and expanding.
Ask: Will our Agreement require 30-day notice and objection before adding LLM providers or changing AWS/AI regions?
Customer export/delete; format unpublished
Not confirmed
The Customer may export or delete End User data depending on the Software Services. No public bulk-export format, post-termination window or certified AWS/LLM deletion was found. Customer-hosted (non-Lex) is a different deployment.
Ask: How do we export natives, transcripts, hearing records and audit logs on exit, and when are remaining copies deleted from AWS, MongoDB and LLM providers?
Hearing stack and Pendo
Not confirmed
Hearing Services subprocessors include Zoom (US), Dacast (US streaming), Google and Cantab transcription, stenograph vendors, and individual hearing contractors. Pendo injects in-app guides. Third-party integrations may be enabled by the Customer (usage metadata).
Ask: Which hearing/Pendo/third-party integrations are on by default, what they send outbound, and how we disable them without a ticket?
Matter workspace; open web not described
Not confirmed
Ingenuity is described as running on intelligence generated in the platform. Open-web search as an Opus 2 feature was not found on the AI or security pages reviewed.
Ask: Confirm Ingenuity does not call the open web on our matters.
Agentic framework; guardrails not in public terms
Not confirmed
Ingenuity is marketed as an agentic AI framework for understanding, surfacing, creating and acting on intelligence, including in the courtroom. Public pages do not describe approval gates, a kill-switch or which actions can write outside the workspace.
Ask: Which agent actions can run without a named approver, and how do we freeze Ingenuity immediately?
No public contractual review duty
Not confirmed
The product is aimed at practising lawyers. No public clause requiring qualified legal review of Ingenuity outputs before use was found in the privacy pages. Accuracy warranties would sit in the unpublished Customer Agreement.
Ask: Can we require named sign-off before an Ingenuity chronology or hearing note is exported, with a log of who verified which items?
