---
title: "Plexus (Plexus Gateway Pty Ltd)"
url: "https://ailawframework.com/software/plexus"
type: "software_profile"
site: "AI Law Framework"
id: "plexus"
vendor: "Plexus Gateway Pty Ltd"
category: "Legal-specific"
segment: "Practice management"
confidence: "medium"
last_reviewed: "2026-09-21"
---

# Plexus (Plexus Gateway Pty Ltd)

> Australian legal-operations platform for in-house teams: contract and matter workflows, trade-promotion compliance, and OpenAI-powered review on AWS.

Canonical page: https://ailawframework.com/software/plexus  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Plexus platform (contracts, matters, marketing/promotion compliance) including Plexus AI. Australian entity Plexus Gateway Pty Ltd. Subscription Terms (July 2025 PDF) are stated as not open to amendment.

## Capabilities

- Matter management
- Contract review and redlining
- Contract drafting
- Document automation
- Document summarisation
- Compliance monitoring
- Intake and triage

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United Kingdom, United States |
| Australian region | Yes |
| Model providers | OpenAI |
| Assurance | ISO 27001:2022, SOC 2 Type 2 |
| Training on customer content | Unknown |
| Retention | Data-security page: continuous backups recoverable to any point in the previous seven days. Subscription Terms Schedule 4: delete Personal Data on termination unless EU/UK law requires storage. Customer Data backup export: request within 20 days, delivery within 90 days. |
| Integrations | Microsoft Word, Microsoft Outlook, DocuSign, Auth0, InfoTrack, ABR.gov.au, SendGrid |
| Legal content coverage | Customer playbooks, precedents and contracts. Plexus AI is marketed as trained on the customer's GC playbooks. No licensed Australian primary-law library. Subprocessors include ABR.gov.au and InfoTrack lookups. |
| Pricing | Licence fees on an Order Form; annual increase of 7% plus CPI (Australia All Groups) in the AU schedule. List price unpublished. Terms state they are not open to amendment. |
| Australian presence | Yes. Plexus Gateway Pty Ltd (ABN 82 660 293 952), Level 4, 411 Collins Street, Melbourne VIC 3000. Victorian law for Australia/NZ/Asia-Pacific. Privacy: personal information currently stored on secure servers in Australia. About timeline starts June 2011. |
| Website | https://www.plexus.co/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | Order Form plus July 2025 Subscription Terms cover the Services (Automation Apps, matters, AI). The PDF opening says standard terms are not open to amendment. Plexus AI is a marketed module. | Confirm which modules (AI, Word/Outlook, promotions, CLM) are on our Order Form and that the July 2025 PDF is the signed document. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Deployment model | Public claim only | SaaS on AWS. Privacy: currently stored on secure servers in Australia; may also sit on third-party/cloud servers in Australia, the UK and the USA. Data-security page does not name the AWS region. No on-premises option was found. | Will our tenant, backups, logs and Plexus AI indexes sit only in an Australian AWS region? | [Plexus Privacy Policy](https://www.plexus.co/privacy); [Plexus data security](https://www.plexus.co/data-security); [Plexus — Security](https://www.plexus.co/security) |
| AI features in scope | Public claim only | Plexus AI: contract review, document summaries and compliance checks, using the customer's playbooks and precedents. Word and Outlook clients are advertised. Automation Apps generate documents from tagged templates. Random-draw and trade-promotion tools are separate modules. | Which AI and Automation App features will be live, and can we disable generative review for nominated document types? | [Plexus AI](https://www.plexus.co/legal-ai-software); [Plexus — home](https://www.plexus.co/) |
| Jurisdictions and legal content | Public claim only | Content is the customer's playbooks and contracts plus lookup subprocessors (ABR, InfoTrack, UK Companies House). AU/NZ/Asia-Pacific contracting entity is Plexus Gateway Pty Ltd, Victorian law and courts. | Confirm Victorian law applies to our Order Form, and that Plexus AI will not browse open-web Australian case law. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Licence and pricing unit | Public claim only | Annual licence fees on the Order Form, 7% plus CPI increase (Australia schedule). Initial Term then renewal. Prepaid bundles exist. List price unpublished. | Provide an itemised quote (Professional vs General Users, AI, term, CPI increase, auto-renewal). | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Word, Outlook and matter-system integration | Public claim only | Legal-AI page advertises Plexus for Word and Outlook. Annex III subprocessors include DocuSign, Auth0, InfoTrack, SendGrid, OnlyOffice, Draftable. Automation Apps may integrate with third-party systems per the Terms definitions. | Demonstrate Word/Outlook add-ins, DocuSign and which other connectors will be on. | [Plexus AI](https://www.plexus.co/legal-ai-software); [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Support and security contact | Public claim only | Privacy: two-factor authentication mentioned for stored personal information. No public Sev-1 times. Professional Services and remote Automation App training are in the Terms schedules. | Provide the support SLA for our tenant and a security escalation path. | [Plexus Privacy Policy](https://www.plexus.co/privacy); [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Published quality evidence | Not confirmed | AI page claims recommendations align with how the legal team thinks. No independent accuracy study was found. | Share any evaluation of Plexus AI on Australian playbooks, including incorrect-issue and missed-clause rates. | [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Task fit and verification | Public claim only | AI is bounded to uploaded playbooks. Automation Apps are rule/template based. Terms put sole responsibility on the customer for documents generated. Time saved after checking is not independently measured. | On our playbook, show a Plexus AI mark-up, what a Professional User must approve, and typical review time. | [Plexus AI](https://www.plexus.co/legal-ai-software); [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Client authority and professional use | Not confirmed | General Users and third parties the customer authorises can access the Services. Marketing-compliance and promotion tools may be used by non-legal staff. AI outputs are not legal advice in the marketing FAQ. | Which roles may run Plexus AI or send generated contracts, and what disclosure do business users see? | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Foundation-model providers | Public claim only | Security and AI pages: OpenAI enterprise-grade GPT models. Subscription Terms Annex III lists 'OpenAI (aka Chat GPT)' as a sub-processor. No model version or region is named. Customer model choice is not offered. | Name each GPT model, OpenAI entity, endpoint region and whether an Australian or Azure-hosted endpoint is available. | [Plexus — Security](https://www.plexus.co/security); [Plexus AI](https://www.plexus.co/legal-ai-software); [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Subprocessors | Public claim only | Annex III lists Amazon Web Services, Heroku (Salesforce), Google Cloud, DocuSign, Auth0, Webmerge, Cloud Convert, OpenAI, Only Office, Draftable, ABR.gov.au, InfoTrack, UK Companies House, Zoho, SendGrid. Schedule 4: customer consents to third-party processors; Plexus will notify before engaging a new sub-processor. SCC annex uses one-month notice in the EU module text. | Confirm the dated register that applies to our tenant, notice period, and which processors we can refuse (especially OpenAI and Heroku). | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Training on customer content | Public claim only | AI and security pages: data is never used to train public AI models; AI 'learns only from your uploaded legal playbooks' in a segregated tenant. The Subscription Terms do not contain a matching LLM-training prohibition. Playbook training inside the tenant is intended product behaviour. | Does the signed Order Form prohibit training of OpenAI or Plexus shared models on Customer Data, prompts and outputs, beyond the marketing pages? | [Plexus AI](https://www.plexus.co/legal-ai-software); [Plexus — Security](https://www.plexus.co/security); [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Feedback and quality monitoring | Not confirmed | No public description of whether reviewer accept/reject labels leave the tenant or improve a shared model. | Do review labels stay in our tenant only? | [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Retention of prompts, outputs and matter indexes | Public claim only | Backups recoverable for seven days. No numbered default for AI chats, embeddings or OpenAI logs. | State default and configurable retention for contracts, AI prompts, embeddings and OpenAI logs on the Australian tenant. | [Plexus data security](https://www.plexus.co/data-security) |
| Deletion and certified erasure | Public claim only | Schedule 4 cl 1.2.8: delete Personal Data on termination unless EU/UK law requires storage. cl 8.6.3: Plexus may destroy Customer Data unless a backup is requested within 20 days of termination, then reasonable endeavours to deliver within 90 days. SCC text offers certified deletion. Those clocks differ. | On exit, confirm the 20-day vs Schedule 4 deletion path, OpenAI erasure, and whether you will certify deletion in writing. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Vendor and verifier access to content | Public claim only | Schedule 4: staff authorised to process Personal Data are under confidentiality. Privacy: 2FA and access controls. OpenAI, AWS and Heroku will process Customer Data as subprocessors. | Who can read our contracts and AI chats, from which countries, under what approval, and can we see those access logs? | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus Privacy Policy](https://www.plexus.co/privacy) |
| Access control, SSO and audit | Public claim only | Auth0 is a listed subprocessor. Privacy mentions username/password and two-factor authentication. Security claims full audit logging for AI operations. SAML/SCIM were not described on the security page read. | Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete AI prompt/review audit log. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus Privacy Policy](https://www.plexus.co/privacy); [Plexus — Security](https://www.plexus.co/security) |
| Encryption in transit and at rest | Public claim only | Data-security and security pages: TLS in transit, AES-256 at rest (block-level), including backups. AI page: AES-256 and TLS 1.2+ for AI operations. Customer-managed keys were not offered. | Confirm encryption of the OpenAI path and whether customer-managed keys are available for the Australian tenant. | [Plexus data security](https://www.plexus.co/data-security); [Plexus — Security](https://www.plexus.co/security) |
| Independent security assurance | Public claim only | ISO 27001:2022 claimed on security and ISMS policy pages. AI page also claims SOC 2 Type 2 and OpenAI enterprise privacy standards. Reports were not inspected. | Provide the current ISO 27001:2022 (and SOC 2 Type 2 if issued) reports covering Plexus AI, with scope and exceptions. | [Plexus — Security](https://www.plexus.co/security); [Plexus Information Security Policy](https://www.plexus.co/information-security-policy); [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Contract, DPA, liability and forum | Public claim only | July 2025 Subscription Terms (Victorian law for APAC) limit aggregate liability to fees in the prior 12 months and exclude loss of data and consequential loss. Terms are stated as not amendable. Schedule 4 plus SCCs are the DPA. Personal Data may be transferred outside the EEA. | Confirm this PDF is our contract and whether any negotiated AI or liability schedule exists despite the no-amendments statement. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Cross-border transfers and APP 8 | Public claim only | Privacy: current storage in Australia; cloud/databases may be in Australia, the UK and the USA; EEA/UK users consent to transfers (including a Privacy Shield reference). Annex III includes US-headquartered OpenAI, AWS, Google Cloud and Heroku. OpenAI inference region is unnamed. | For Plexus AI, list every country for storage, OpenAI inference, backups and support, and confirm whether Australia-only inference is available. | [Plexus Privacy Policy](https://www.plexus.co/privacy); [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Incident notification and history | Public claim only | Schedule 4 cl 1.4: each party notifies the other without undue delay of a Personal Data breach. No fixed 72-hour clock. Incident history was not published. | State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Change notice for models, terms and processors | Public claim only | New sub-processor: notify before engagement (Schedule 4); SCC module text uses at least one month. Terms themselves are presented as standard and not amendable. No model-version freeze. | What written notice will we get before a new GPT model or subprocessor is added, and can we object? | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Export and exit | Public claim only | On full termination, licences end. Backup of documentation and data: written request within 20 days, reasonable endeavours to deliver within 90 days if fees are paid. Otherwise Plexus may destroy the data. Format is not specified. | What export we receive for contracts, playbooks and AI history, and will you certify deletion including OpenAI within 30 days? | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Connectors and third-party AI tools | Not confirmed | DocuSign, InfoTrack, ABR, Word/Outlook and other Annex III tools are optional or inherent lookups. Enabling them is the customer's choice. OpenAI is required for Plexus AI. | List every connector that will be on for our tenant and the data each receives. | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Open-web search | Public claim only | Plexus AI is described as processing within secure, isolated environments and not sharing data with third-party systems except the named AI path. No open-web browsing toggle was found. ABR and InfoTrack lookups are structured connectors, not web search. | Does Plexus AI browse the open web, and can we disable any such retrieval? | [Plexus AI](https://www.plexus.co/legal-ai-software) |
| Agent actions and confirmation | Not confirmed | Automation Apps can generate documents, run workflows and send notifications. Professional Users approve or decline review phases. DocuSign is a subprocessor. Confirmation gates are configured by the customer. | Which apps can send email or a DocuSign packet without a second Legal confirmation? | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) |
| Human review before use | Not confirmed | Professional User definition includes reviewer/approver roles. Terms place sole responsibility on the customer for generated documents. Nothing requires a lawyer to approve a Plexus AI mark-up before a General User sees it. | Can we require every Plexus AI recommendation to be approved by a named lawyer before it is visible to the business? | [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf); [Plexus AI](https://www.plexus.co/legal-ai-software) |

## Notes

OpenAI named as subprocessor; inference region unnamed. Marketing no-public-training is not mirrored as an LLM ban in the Terms. Exit clocks (20-day backup request vs Schedule 4 deletion) differ. Terms presented as not amendable. Privacy Shield still referenced.

## Sources

- [Plexus — home](https://www.plexus.co/) (checked 2026-09-21)
- [Plexus — Security](https://www.plexus.co/security) (checked 2026-09-21)
- [Plexus Privacy Policy](https://www.plexus.co/privacy) (checked 2026-09-21)
- [Plexus AI](https://www.plexus.co/legal-ai-software) (checked 2026-09-21)
- [Plexus Subscription Terms (July 2025)](https://www.plexus.co/hubfs/Plexus-Subscription-Terms-0725.pdf) (checked 2026-09-21)
- [Plexus Information Security Policy](https://www.plexus.co/information-security-policy) (checked 2026-09-21)
- [Plexus data security](https://www.plexus.co/data-security) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.