Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan and modules
Public claim only
The page describes a model-build engagement: a Model Brief, an optional pilot, then a build after which the customer owns the weights, data, evaluation suite and runbook. Project MAGPiE is a separate published model, described as in production since early 2026, with an OpenAI-compatible API. SCX-coder and a New Zealand partnership are also described and are outside a legal-sector order unless included.
Ask: Are we buying access to MAGPiE, a new model built on our data, or both, and who owns the weights?
Deployment and hosting
Public claim only
The page says a finished model can run on infrastructure the customer controls, on SCX.ai infrastructure, or on a partner's. The trust centre says hosting sub-processors are Amazon Web Services, Servers Australia and Equinix, and that none is based outside Australia.
Ask: Where will inference run for our deployment, and which of AWS, Servers Australia and Equinix is in the path?
Product surfaces
Public claim only
Project MAGPiE is described as a reasoning model fine-tuned on curated Australian legal, regulatory and cultural corpora, evaluated on ASIC, APRA and Privacy Act scenarios, with auditable reasoning traces, and exposed as an OpenAI-compatible API. The vendor says a US base model gave jurisdictionally incorrect answers on 38% of its Australian regulatory test cases and MAGPiE reduced that to under 4%.
Ask: Can we re-run that evaluation set, and does an answer cite the source provision?
Jurisdiction and legal content
Public claim only
The corpora and tests named are Australian: legal and regulatory material, ASIC, APRA and the Privacy Act. Case law, a specific court, and a currency date for legislation are not named. The page also says bases can include models that are not Australian.
Ask: Which Australian legislation and cases are in MAGPiE, how current are they, and which base model is underneath?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and client-facing use
Not confirmed
The pages do not discuss client consent to send matter facts to the API.
Ask: What client authority do we need before matter content is sent to MAGPiE or used in a fine-tune?
Model providers
Public claim only
The page says a sovereign model starts from openly published base weights and names GPT-OSS, Qwen, DeepSeek, Llama or Mistral as examples. The customer is not renting a single unnamed API. The choice of base is part of the engagement. MAGPiE's actual base is not named on the page.
Ask: Which base weights does MAGPiE use, and will our build exclude any named base we do not accept?
Subprocessors
Public claim only
The trust centre, last updated June 2026, lists Google Workspace, Amazon Web Services, Servers Australia, Equinix and Stripe, and says none is based outside Australia. It does not list a model-weight provider.
Ask: Confirm this list is complete for MAGPiE inference, and where each sub-processor processes data.
Training on customer content
Public claim only
The page says nothing about the customer's data trains anyone else's model, and that at the end of a build the weights are the customer's. A build fine-tunes on the customer's corpus, so customer data is used to train the customer's model. The trust centre does not add a training prohibition.
Ask: For a MAGPiE API call, as distinct from a build, are prompts and documents used to train any model?
Feedback and secondary use
Not confirmed
The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on feedback and secondary use.
Ask: What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it?
Retention
Public claim only
The trust centre says data-retention procedures are established and customer data is deleted on request. No period is stated.
Ask: What is the default retention for prompts, documents and fine-tuning data, and how is a deletion request confirmed?
Deletion and export
Public claim only
Customer data is deleted on request. No timetable or backup rule is stated.
Ask: Within what time is data deleted from live systems and backups after a request or the end of a build?
Human access to customer content
Not confirmed
Staff background checks are listed. Whether staff can read customer prompts or fine-tuning data is not stated.
Ask: Who can read our corpus and prompts, and is that access logged?
Access control
Public claim only
The trust centre lists unique production-database authentication, unique account authentication, penetration testing and background checks. Customer SSO and MFA are not stated.
Ask: How do our users authenticate to the API, and do you support SSO and MFA?
Encryption
Public claim only
The trust centre lists data-transmission encryption and key management as controls. It does not name TLS or AES.
Ask: Which encryption standards apply in transit and at rest for prompts and fine-tuning data?
Assurance and certifications
Public claim only
The trust centre says SCX holds SOC 2 Type I, audited annually, and ISO 27001:2022. It says a data processing addendum for the GDPR and the Australian Privacy Principles is available on request. Certificates can be requested. They were not downloaded. Penetration testing and encrypted transmission are listed without algorithms.
Ask: Provide the current SOC 2 Type I report and ISO 27001 certificate, including scope and whether MAGPiE inference is included.
Contract, DPA and liability
Not confirmed
A DPA is available on request and was not read. No master terms, liability cap or governing law was published.
Ask: Provide the DPA and the build contract, including APP 8, liability and who owns the weights.
Cross-border transfers
Public claim only
The trust centre says no sub-processor is based outside Australia. The model page says a model can also run on a partner's infrastructure, which might not be in Australia if the customer chooses that.
Ask: For our order, confirm every processing location is in Australia, including the base-model files and any partner.
Incidents and breach notice
Not confirmed
The trust centre gives security@scx.ai for disclosures and audit requests. It does not state a breach-notice period.
Ask: What notice do we get of a breach, and is security@scx.ai the address?
Changes to terms and models
Not confirmed
The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on changes to terms and models.
Ask: What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it?
Exit, return and deletion
Not confirmed
The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on exit, return and deletion.
Ask: What is the written position on exit, return and deletion for the deployment we would buy, and which contract or policy states it?
Connectors and external tools
Public claim only
The published interface is an OpenAI-compatible API. No practice-management connector is named.
Ask: What is logged for each API call, and can we restrict the caller to our network?
Web search and open-web grounding
Not confirmed
No web-search tool is described. Answers come from the fine-tuned model.
Ask: Can MAGPiE or the API call the open web or a live legislation site?
Actions the system can take
Public claim only
The product described is a model and an API, plus a build service. SCX-coder is described as planning and executing engineering tasks; that is a different model. MAGPiE is not described as sending email or filing documents.
Ask: Confirm MAGPiE cannot take an external action, and that any agent built on the API is our responsibility.
Human review of output
Public claim only
The page stresses evaluation and auditable traces because fluent answers can be wrong. It does not insert a lawyer in the API response.
Ask: Where in our workflow is a lawyer required to check a MAGPiE answer before it is used?
