Legal-specific · Practice management · Medium confidence
Plexus Gateway Pty Ltd · Plexus platform (contracts, matters, marketing/promotion compliance) including Plexus AI. Australian entity Plexus Gateway Pty Ltd. Subscription Terms (July 2025 PDF) are stated as not open to amendment.
Australian legal-operations platform for in-house teams: contract and matter workflows, trade-promotion compliance, and OpenAI-powered review on AWS.
Opens a private software assessment of Plexus for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | Australia, United Kingdom, United States |
| Australian region | Yes |
| Model providers | OpenAI |
| Assurance | ISO 27001:2022, SOC 2 Type 2 |
| Training on customer content | Unknown |
| Retention summary | Data-security page: continuous backups recoverable to any point in the previous seven days. Subscription Terms Schedule 4: delete Personal Data on termination unless EU/UK law requires storage. Customer Data backup export: request within 20 days, delivery within 90 days. |
| Integrations | Microsoft Word, Microsoft Outlook, DocuSign, Auth0, InfoTrack, ABR.gov.au, SendGrid |
| Pricing summary | Licence fees on an Order Form; annual increase of 7% plus CPI (Australia All Groups) in the AU schedule. List price unpublished. Terms state they are not open to amendment. |
| Legal content coverage | Customer playbooks, precedents and contracts. Plexus AI is marketed as trained on the customer's GC playbooks. No licensed Australian primary-law library. Subprocessors include ABR.gov.au and InfoTrack lookups. |
| Australian presence | Yes — Plexus Gateway Pty Ltd (ABN 82 660 293 952), Level 4, 411 Collins Street, Melbourne VIC 3000. Victorian law for Australia/NZ/Asia-Pacific. Privacy: personal information currently stored on secure servers in Australia. About timeline starts June 2011. |
Define the configuration, people, information and tasks being assessed.
Public claim only
Order Form plus July 2025 Subscription Terms cover the Services (Automation Apps, matters, AI). The PDF opening says standard terms are not open to amendment. Plexus AI is a marketed module.
Ask: Confirm which modules (AI, Word/Outlook, promotions, CLM) are on our Order Form and that the July 2025 PDF is the signed document.
Public claim only
SaaS on AWS. Privacy: currently stored on secure servers in Australia; may also sit on third-party/cloud servers in Australia, the UK and the USA. Data-security page does not name the AWS region. No on-premises option was found.
Ask: Will our tenant, backups, logs and Plexus AI indexes sit only in an Australian AWS region?
Public claim only
Plexus AI: contract review, document summaries and compliance checks, using the customer's playbooks and precedents. Word and Outlook clients are advertised. Automation Apps generate documents from tagged templates. Random-draw and trade-promotion tools are separate modules.
Ask: Which AI and Automation App features will be live, and can we disable generative review for nominated document types?
Public claim only
Content is the customer's playbooks and contracts plus lookup subprocessors (ABR, InfoTrack, UK Companies House). AU/NZ/Asia-Pacific contracting entity is Plexus Gateway Pty Ltd, Victorian law and courts.
Ask: Confirm Victorian law applies to our Order Form, and that Plexus AI will not browse open-web Australian case law.
Record the practical work needed to introduce and maintain the software.
Public claim only
Annual licence fees on the Order Form, 7% plus CPI increase (Australia schedule). Initial Term then renewal. Prepaid bundles exist. List price unpublished.
Ask: Provide an itemised quote (Professional vs General Users, AI, term, CPI increase, auto-renewal).
Public claim only
Legal-AI page advertises Plexus for Word and Outlook. Annex III subprocessors include DocuSign, Auth0, InfoTrack, SendGrid, OnlyOffice, Draftable. Automation Apps may integrate with third-party systems per the Terms definitions.
Ask: Demonstrate Word/Outlook add-ins, DocuSign and which other connectors will be on.
Public claim only
Privacy: two-factor authentication mentioned for stored personal information. No public Sev-1 times. Professional Services and remote Automation App training are in the Terms schedules.
Ask: Provide the support SLA for our tenant and a security escalation path.
Compare complete work at the required quality, including checking and correction.
Not confirmed
AI page claims recommendations align with how the legal team thinks. No independent accuracy study was found.
Ask: Share any evaluation of Plexus AI on Australian playbooks, including incorrect-issue and missed-clause rates.
Public claim only
AI is bounded to uploaded playbooks. Automation Apps are rule/template based. Terms put sole responsibility on the customer for documents generated. Time saved after checking is not independently measured.
Ask: On our playbook, show a Plexus AI mark-up, what a Professional User must approve, and typical review time.
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
General Users and third parties the customer authorises can access the Services. Marketing-compliance and promotion tools may be used by non-legal staff. AI outputs are not legal advice in the marketing FAQ.
Ask: Which roles may run Plexus AI or send generated contracts, and what disclosure do business users see?
Public claim only
Security and AI pages: OpenAI enterprise-grade GPT models. Subscription Terms Annex III lists 'OpenAI (aka Chat GPT)' as a sub-processor. No model version or region is named. Customer model choice is not offered.
Ask: Name each GPT model, OpenAI entity, endpoint region and whether an Australian or Azure-hosted endpoint is available.
Public claim only
Annex III lists Amazon Web Services, Heroku (Salesforce), Google Cloud, DocuSign, Auth0, Webmerge, Cloud Convert, OpenAI, Only Office, Draftable, ABR.gov.au, InfoTrack, UK Companies House, Zoho, SendGrid. Schedule 4: customer consents to third-party processors; Plexus will notify before engaging a new sub-processor. SCC annex uses one-month notice in the EU module text.
Ask: Confirm the dated register that applies to our tenant, notice period, and which processors we can refuse (especially OpenAI and Heroku).
Public claim only
AI and security pages: data is never used to train public AI models; AI 'learns only from your uploaded legal playbooks' in a segregated tenant. The Subscription Terms do not contain a matching LLM-training prohibition. Playbook training inside the tenant is intended product behaviour.
Ask: Does the signed Order Form prohibit training of OpenAI or Plexus shared models on Customer Data, prompts and outputs, beyond the marketing pages?
Not confirmed
No public description of whether reviewer accept/reject labels leave the tenant or improve a shared model.
Ask: Do review labels stay in our tenant only?
Public claim only
Backups recoverable for seven days. No numbered default for AI chats, embeddings or OpenAI logs.
Ask: State default and configurable retention for contracts, AI prompts, embeddings and OpenAI logs on the Australian tenant.
Public claim only
Schedule 4 cl 1.2.8: delete Personal Data on termination unless EU/UK law requires storage. cl 8.6.3: Plexus may destroy Customer Data unless a backup is requested within 20 days of termination, then reasonable endeavours to deliver within 90 days. SCC text offers certified deletion. Those clocks differ.
Ask: On exit, confirm the 20-day vs Schedule 4 deletion path, OpenAI erasure, and whether you will certify deletion in writing.
Public claim only
Schedule 4: staff authorised to process Personal Data are under confidentiality. Privacy: 2FA and access controls. OpenAI, AWS and Heroku will process Customer Data as subprocessors.
Ask: Who can read our contracts and AI chats, from which countries, under what approval, and can we see those access logs?
Public claim only
Auth0 is a listed subprocessor. Privacy mentions username/password and two-factor authentication. Security claims full audit logging for AI operations. SAML/SCIM were not described on the security page read.
Ask: Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete AI prompt/review audit log.
Public claim only
Data-security and security pages: TLS in transit, AES-256 at rest (block-level), including backups. AI page: AES-256 and TLS 1.2+ for AI operations. Customer-managed keys were not offered.
Ask: Confirm encryption of the OpenAI path and whether customer-managed keys are available for the Australian tenant.
Public claim only
ISO 27001:2022 claimed on security and ISMS policy pages. AI page also claims SOC 2 Type 2 and OpenAI enterprise privacy standards. Reports were not inspected.
Ask: Provide the current ISO 27001:2022 (and SOC 2 Type 2 if issued) reports covering Plexus AI, with scope and exceptions.
Public claim only
July 2025 Subscription Terms (Victorian law for APAC) limit aggregate liability to fees in the prior 12 months and exclude loss of data and consequential loss. Terms are stated as not amendable. Schedule 4 plus SCCs are the DPA. Personal Data may be transferred outside the EEA.
Ask: Confirm this PDF is our contract and whether any negotiated AI or liability schedule exists despite the no-amendments statement.
Public claim only
Privacy: current storage in Australia; cloud/databases may be in Australia, the UK and the USA; EEA/UK users consent to transfers (including a Privacy Shield reference). Annex III includes US-headquartered OpenAI, AWS, Google Cloud and Heroku. OpenAI inference region is unnamed.
Ask: For Plexus AI, list every country for storage, OpenAI inference, backups and support, and confirm whether Australia-only inference is available.
Public claim only
Schedule 4 cl 1.4: each party notifies the other without undue delay of a Personal Data breach. No fixed 72-hour clock. Incident history was not published.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months.
Public claim only
New sub-processor: notify before engagement (Schedule 4); SCC module text uses at least one month. Terms themselves are presented as standard and not amendable. No model-version freeze.
Ask: What written notice will we get before a new GPT model or subprocessor is added, and can we object?
Public claim only
On full termination, licences end. Backup of documentation and data: written request within 20 days, reasonable endeavours to deliver within 90 days if fees are paid. Otherwise Plexus may destroy the data. Format is not specified.
Ask: What export we receive for contracts, playbooks and AI history, and will you certify deletion including OpenAI within 30 days?
Not confirmed
DocuSign, InfoTrack, ABR, Word/Outlook and other Annex III tools are optional or inherent lookups. Enabling them is the customer's choice. OpenAI is required for Plexus AI.
Ask: List every connector that will be on for our tenant and the data each receives.
Public claim only
Plexus AI is described as processing within secure, isolated environments and not sharing data with third-party systems except the named AI path. No open-web browsing toggle was found. ABR and InfoTrack lookups are structured connectors, not web search.
Ask: Does Plexus AI browse the open web, and can we disable any such retrieval?
Not confirmed
Automation Apps can generate documents, run workflows and send notifications. Professional Users approve or decline review phases. DocuSign is a subprocessor. Confirmation gates are configured by the customer.
Ask: Which apps can send email or a DocuSign packet without a second Legal confirmation?
Not confirmed
Professional User definition includes reviewer/approver roles. Terms place sole responsibility on the customer for generated documents. Nothing requires a lawyer to approve a Plexus AI mark-up before a General User sees it.
Ask: Can we require every Plexus AI recommendation to be approved by a named lawyer before it is visible to the business?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI practice management tools Australia
