Product and intended use
Define the configuration, people, information and tasks being assessed.
Enterprise SaaS versus other SKUs
Public claim only
This profile covers Reveal Enterprise SaaS (processing, review, visual analytics, supervised models, generative ASK search, and the Reveal AI agentic suite announced 24 August 2026). Logikcull, Onna, Reveal Hold, TrialDirector and Reveal Private Deployment are separate products. A signed Master Services or Licence Agreement, if any, governs over the public SaaS Terms.
Ask: Confirm the Order Form products (Enterprise versus Logikcull/Onna/Hold/RPD), whether Reveal AI agents and the CoCounsel connector are in scope, and whether a signed MSA replaces the website Terms.
Multi-tenant SaaS; private deployment is a separate product
Public claim only
Reveal SaaS is described as cloud-native on AWS (from 2016). A 2019 release claimed 19 data centres across five continents, including Tokyo. Trust Centre infrastructure lists AWS and Azure. Reveal Private Deployment is a separate SKU on AWS, Azure, private cloud or on-premises and is not this profile.
Ask: Which cloud provider and region will store our SaaS Hosted Data, backups and generative-AI inference?
Review, models, gen AI and agents
Public claim only
Product pages describe processing (900+ file types), visual analytics and clustering, OCR, translation of 160+ languages, audio/video transcription, supervised learning and an AI Model Library. Generative AI answers natural-language questions with cited source snippets. Reveal AI (August 2026) unifies aji review, ASK fact-finding and agentic case building (chronologies, facts, deposition materials) with attorney direction and approval. MCP connectors and end-to-end orchestration were described as following in later releases.
Ask: Which of ASK, aji, supervised models, agentic case building, MCP and CoCounsel sync will be enabled at go-live versus later, and which remain preview?
US operator; Australian office and customer, unnamed AU region
Public claim only
Reveal Data Corporation is headquartered in Chicago. Privacy policy: personal data may be accessed or transferred to the United States. A 2022 announcement names a Sydney office and Grant Thornton Australia as a SaaS customer. SaaS Terms list Australia among support locations. No current Australian SaaS region was named on the pages reviewed.
Ask: Will our matter data be stored and inferred in Australia, and if not, which countries apply and what APP 8 wording do you provide?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Matter data; client consent and optional connectors
Not confirmed
Reveal holds confidential Hosted Data. Optional workplace connectors, the announced CoCounsel sync and planned MCP connectors are further disclosures. No per-client AI exclusion control was documented on the pages reviewed. Grant Thornton Australia is named as a customer; that does not substitute for our clients' consent.
Ask: Can we disable generative AI, CoCounsel sync, MCP and workplace connectors per matter, and what region/subprocessor description can we give clients?
Customer model choice claimed; default LLM unnamed
Public claim only
The 24 August 2026 Reveal AI announcement states customers can use their own or preferred large language models rather than a single vendor choice, and run in Reveal's commercial cloud or their own environment. The default SaaS generative-AI model family and region were not named on the product pages reviewed. Trust Centre infrastructure lists AWS and Azure.
Ask: Which models and regions process ASK/aji/agent prompts for our SaaS tenancy by default, and how do we bind a customer-chosen model in the Order Form?
Trust Centre list is partial and gated
Public claim only
The public Trust Centre names subprocessors including Atlassian, Salesforce, Google Cloud, Microsoft Azure and Amazon Web Services. The full list, countries and notice/objection rights sit behind a request-access flow and were not downloaded. SaaS Terms incorporate a DPA only for EU/EEA/Swiss/UK personal data, also gated.
Ask: Provide the current subprocessor schedule (hosting, LLM, support, connectors) with countries and 30-day notice/objection, including India and Australia personnel.
No training without explicit permission
Public claim only
AI Pledge and About page: Reveal never uses client data for AI models without explicit permission. SaaS Terms grant a licence to use Hosted Data as necessary to provide the Service, including improving search and tagging functions within the customer's account, and a perpetual licence to Feedback. Aggregated Statistics exclude Hosted Data. The Pledge is a marketing commitment, not the SaaS Terms.
Ask: Confirm in the signed terms that prompts, outputs, embeddings and logs are not used to train Reveal or third-party models unless we consent in writing, and that in-account search/tagging improvement cannot leak across customers.
Feedback licence; Aggregated Statistics
Public claim only
SaaS Terms: Customer grants a worldwide, perpetual, irrevocable, royalty-free licence to use and incorporate Feedback into the Service. Reveal may compile Aggregated Statistics from instrumentation and logging; those statistics must not include Hosted Data or identify the customer. In-product thumbs-up/down for generative answers was not described.
Ask: Is there any in-product feedback or evaluation path that sends our prompts or documents to Reveal or a model provider, and is it off unless we opt in?
Not a records system; no live-matter day count
Public claim only
SaaS Terms: the Service is not intended as a document storage system for record retention; Customer must keep separate copies. No numbered retention for live Hosted Data, prompts, generative outputs, model-provider copies or backups is published. Privacy policy last modified 12 December 2025 addresses website and account personal data, not a matter-data schedule.
Ask: Provide a numbered retention schedule for documents, prompts, outputs, logs and backups while a matter is live and after we delete a project.
30-day export then delete; 60-day unpaid delete
Public claim only
SaaS Terms: during the Term, Customer may export Hosted Data at any time. After expiry, Reveal will make Hosted Data available for export or download for up to 30 days, then delete or destroy copies unless legally prohibited. If payment is not received at 60 days, Reveal may terminate and delete all Hosted Data. No deletion certificate is described.
Ask: On matter close or contract end, what is deleted from SaaS, backups and any LLM provider, within how many days, with what certificate, and will you freeze deletion on a billing dispute?
Support access across six countries including India
Public claim only
SaaS Terms: support personnel are located in the United States, United Kingdom, Europe, Canada, Australia and India. Hyderabad (January 2024) is described as software development, AI, generative AI and deployment support, with a planned workforce of more than 300. Privacy policy: personal data, cookies, audit logs and uploaded data are not shared with a third party without written authorisation, with exceptions in the Agreement. Compelled disclosures: reasonable efforts to give prior notice where legally permitted.
Ask: Is support access to Hosted Data per-ticket with our approval, logged to us, limited to named countries, and will you notify us of legal process seeking matter content?
SSO documented at index level; MFA not specified
Public claim only
SSO documentation exists (SAML and OIDC per the public page description). Trust Centre lists audit logging, credential management and access monitoring as topics behind access request. SaaS Terms require the customer to control account credentials. MFA enforcement and SCIM were not specified in the pages that rendered.
Ask: Do you support SAML/OIDC SSO-only, MFA enforcement, SCIM and matter-level ethical walls for our tenancy?
TLS and encryption at rest in the SaaS Terms
Public claim only
SaaS Terms: Reveal shall encrypt Hosted Data at rest and in internet transmission using TLS or similar technologies. Algorithms, TLS version and customer-managed keys were not stated. Trust Centre lists a Data Encryption topic behind access request.
Ask: Confirm TLS 1.2+ and AES-256 (or equivalent) in transit and at rest, including backups and generative-AI paths, and whether CMK is available on SaaS.
SOC 2 Type 2, ISO 27001, CSA STAR on Trust Centre
Public claim only
Trust Centre badges: SOC 2 Type 2, ISO/IEC 27001 (and SoA), CSA STAR Certification and CSA STAR Level 1, EU-US DPF and GDPR. A 1 August 2024 post says the ISO 27001:2022 certificate for the 2025 audit covers Reveal Enterprise, Logikcull, Onna, ZyLAB, Reveal Hold Classic and IPRO. Reports are request-gated and were not downloaded. Why Reveal also claims ISO 27001 and SOC 2 Type 2.
Ask: Provide current SOC 2 Type II and ISO 27001 reports covering our SaaS region and generative-AI features, including the period and entities in scope.
Public SaaS Terms; Delaware law; 12-month cap; breach excluded
Public claim only
Public SaaS Terms (accepted by Order Form, click-accept or use). Delaware law; exclusive venue Cook County, Illinois. Aggregate liability capped at amounts paid in the 12 months before the claim. Liability for loss of data and breach of data or system security is excluded to the maximum extent permitted. DPA is incorporated only for EU/EEA/Swiss/UK personal data and is gated. A separate MSA or Licence Agreement, if executed, governs over these Terms. Customer indemnifies Reveal for Hosted Data and use of the Service.
Ask: Will our MSA include a DPA with APP flow-down, output ownership, a meaningful cap for confidentiality/data breach, and Australian or NSW law/forum?
US processing, DPF, India development, AU support
Public claim only
Privacy policy (modified 12 December 2025): headquarters in the United States; personal data may be accessed or transferred to the US or affiliates; SCCs for European transfers; EU-US / UK / Swiss DPF certification covering listed US affiliates. Support and the Hyderabad generative-AI office imply access from India and Australia. SaaS hosting country for an Australian customer was not named.
Ask: Name every country of storage, inference and support access for our tenancy, including any LLM provider and India personnel, in writing.
No public notification period
Not confirmed
Trust Centre lists Incident Response as a gated topic. Vulnerability reports go to security@revealdata.com. SaaS Terms require the customer to notify Reveal of unauthorised use at that address. No numbered customer-notification period or NDB cooperation clause appears in the public Terms or privacy policy.
Ask: Within how many hours of discovering a suspected incident affecting our Hosted Data will you notify us, and will you support an NDB assessment?
Terms amendable on 15 days' notice; features may change
Public claim only
SaaS Terms: Reveal may amend the Agreement by posting or written notice; the amendment is deemed accepted 15 days later unless Customer rejects, in which case it takes effect at the next Term. Feature changes: Reveal may update or remove functionality provided it does not materially diminish the Service without reasonable notice. Reveal AI agents, MCP and CoCounsel sync are new or forthcoming.
Ask: Will Enterprise freeze terms during the term, and notify us before adding LLM providers, MCP, CoCounsel sync or changing hosting/inference regions?
Customer export plus 30-day post-term window
Public claim only
During the Term, Customer may export or retrieve Hosted Data at any time. After expiry, a 30-day export window, then deletion unless legally prohibited. No bulk-export format or certified destruction wording is in the public Terms. RPD marketing says matters can move between RPD and SaaS without loss of workflow state; that is a separate product.
Ask: How do we export natives, work product, productions, AI models and audit logs on exit, in what format, and when are remaining copies deleted from SaaS, backups and any LLM?
Workplace connectors, CoCounsel and planned MCP
Not confirmed
No-code connectors collect workplace data (OneDrive, Jira, Confluence, Zendesk, AWS and others). The CoCounsel Legal integration authenticates to Reveal and syncs chosen documents into Thomson Reuters research/drafting, stated as available October 2026. MCP connectors to Claude, ChatGPT and others were described as in preparation. Each is a disclosure of matter content.
Ask: What scopes does each connector request, what does CoCounsel or MCP send outbound, and how do we disable all of them without a ticket?
Generative answers grounded in the matter corpus
Public claim only
Generative AI pages state every answer is grounded in the customer's matter data and linked to supporting documents, including when evidence does not support an answer. Open-web search as a Reveal feature was not found. CoCounsel Legal would combine synced Reveal documents with Westlaw and Practical Law inside Thomson Reuters' product, not inside Reveal.
Ask: Confirm Reveal ASK/aji do not call the open web on our matters, and how CoCounsel or MCP assistants are blocked from web search using our record.
Agentic case building under attorney direction
Not confirmed
August 2026 announcement: from a plain-language request, Reveal AI plans and carries out steps (chronologies, key facts, deposition materials), grounding results in cited sources, with an attorney directing and approving throughout. A later orchestration layer would run hold, collection, search, review and production across the suite. MCP would let other applications reach Reveal data and workflows. Guardrails, kill-switch and which actions are autonomous versus approval-gated were not in a contract.
Ask: Which agent actions can run without a named approver, how do we freeze agents and MCP immediately, and is orchestration off until we enable it?
Citations and attorney approval described; not a contractual duty
Public claim only
Generative AI: answers are linked to source documents and snippets so the team can verify. Agentic case building is described as under the lawyer's direction and approval. GenAI first-pass review is marketed with transparent reasoning and citations. Public SaaS Terms do not contain a clause requiring qualified legal review of outputs before use.
Ask: Can we require named sign-off before a chronology, coding decision or production leaves Reveal, with an export of who verified which items?
