---
title: "SCX.ai sovereign models (SCX.ai)"
url: "https://ailawframework.com/software/scx-ai"
type: "software_profile"
site: "AI Law Framework"
id: "scx-ai"
vendor: "SCX.ai"
category: "General-purpose"
segment: "General-purpose assistants"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# SCX.ai sovereign models (SCX.ai)

> Australian sovereign-model build service, including Project MAGPiE, a reasoning model the vendor says is fine-tuned on Australian legal and regulatory material and offered through an OpenAI-compatible API.

Canonical page: https://ailawframework.com/software/scx-ai  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The SCX.ai model-build engagement and the published Project MAGPiE model, as described on the sovereign-models page and the trust centre. A customer-specific order was not published.

## Capabilities

- Legal research
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, Private cloud, Self-hosted |
| Hosting regions | Australia |
| Australian region | Yes |
| Model providers | Open weights named by the vendor: GPT-OSS, Qwen, DeepSeek, Llama or Mistral, chosen per engagement |
| Assurance | SOC 2 Type I, ISO 27001:2022 |
| Training on customer content | Your account only |
| Retention | The trust centre says customer data is deleted on request and that data-retention procedures exist. It does not state a period. A DPA for GDPR and the APPs is available on request. |
| Integrations | OpenAI-compatible API |
| Legal content coverage | Project MAGPiE is described as fine-tuned on curated Australian legal, regulatory and cultural corpora and evaluated against ASIC, APRA and Privacy Act scenarios. It is not described as a citator. |
| Pricing | No price list. The page describes a conversation, an optional fixed-scope pilot, then a build. It says the engagement is not a packaged product. |
| Australian presence | Yes. The trust centre says no sub-processor is based outside Australia and lists Google Workspace, Amazon Web Services, Servers Australia, Equinix and Stripe. The trust centre was last updated June 2026. Project MAGPiE is described as in production since early 2026 for Australian government, financial services and the legal sector. |
| Website | https://scx.ai/build-sovereign-models |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan and modules | Public claim only | The page describes a model-build engagement: a Model Brief, an optional pilot, then a build after which the customer owns the weights, data, evaluation suite and runbook. Project MAGPiE is a separate published model, described as in production since early 2026, with an OpenAI-compatible API. SCX-coder and a New Zealand partnership are also described and are outside a legal-sector order unless included. | Are we buying access to MAGPiE, a new model built on our data, or both, and who owns the weights? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Deployment and hosting | Public claim only | The page says a finished model can run on infrastructure the customer controls, on SCX.ai infrastructure, or on a partner's. The trust centre says hosting sub-processors are Amazon Web Services, Servers Australia and Equinix, and that none is based outside Australia. | Where will inference run for our deployment, and which of AWS, Servers Australia and Equinix is in the path? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models); [SCX — trust centre](https://trust.scx.ai/) |
| Product surfaces | Public claim only | Project MAGPiE is described as a reasoning model fine-tuned on curated Australian legal, regulatory and cultural corpora, evaluated on ASIC, APRA and Privacy Act scenarios, with auditable reasoning traces, and exposed as an OpenAI-compatible API. The vendor says a US base model gave jurisdictionally incorrect answers on 38% of its Australian regulatory test cases and MAGPiE reduced that to under 4%. | Can we re-run that evaluation set, and does an answer cite the source provision? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Jurisdiction and legal content | Public claim only | The corpora and tests named are Australian: legal and regulatory material, ASIC, APRA and the Privacy Act. Case law, a specific court, and a currency date for legislation are not named. The page also says bases can include models that are not Australian. | Which Australian legislation and cases are in MAGPiE, how current are they, and which base model is underneath? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Licence and pricing unit | Not confirmed | The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on licence and pricing unit. | What is the written position on licence and pricing unit for the deployment we would buy, and which contract or policy states it? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Integrations | Not confirmed | The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on integrations. | What is the written position on integrations for the deployment we would buy, and which contract or policy states it? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Support and service levels | Not confirmed | The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on support and service levels. | What is the written position on support and service levels for the deployment we would buy, and which contract or policy states it? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Independent quality evidence | Public claim only | The 38% to under 4% figure is SCX's own evaluation, not an independent study. The page does not publish the test set. Auditable reasoning traces are claimed. | Can we see the evaluation set, the date of the legislation it used, and the trace behind a sample answer? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Task fit | Public claim only | MAGPiE is a reasoning model for regulatory and legal questions, not a document-automation or practice-management system. The vendor says a generic chatbot is a poor fit and points those users elsewhere. Answers can be wrong; the vendor's own comparison is that the base model was wrong on jurisdiction in over a third of its tests. | Which tasks may call MAGPiE, and which require a lawyer to check every citation? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Client authority and client-facing use | Not confirmed | The pages do not discuss client consent to send matter facts to the API. | What client authority do we need before matter content is sent to MAGPiE or used in a fine-tune? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Model providers | Public claim only | The page says a sovereign model starts from openly published base weights and names GPT-OSS, Qwen, DeepSeek, Llama or Mistral as examples. The customer is not renting a single unnamed API. The choice of base is part of the engagement. MAGPiE's actual base is not named on the page. | Which base weights does MAGPiE use, and will our build exclude any named base we do not accept? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Subprocessors | Public claim only | The trust centre, last updated June 2026, lists Google Workspace, Amazon Web Services, Servers Australia, Equinix and Stripe, and says none is based outside Australia. It does not list a model-weight provider. | Confirm this list is complete for MAGPiE inference, and where each sub-processor processes data. | [SCX — trust centre](https://trust.scx.ai/) |
| Training on customer content | Public claim only | The page says nothing about the customer's data trains anyone else's model, and that at the end of a build the weights are the customer's. A build fine-tunes on the customer's corpus, so customer data is used to train the customer's model. The trust centre does not add a training prohibition. | For a MAGPiE API call, as distinct from a build, are prompts and documents used to train any model? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models); [SCX — trust centre](https://trust.scx.ai/) |
| Feedback and secondary use | Not confirmed | The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on feedback and secondary use. | What is the written position on feedback and secondary use for the deployment we would buy, and which contract or policy states it? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Retention | Public claim only | The trust centre says data-retention procedures are established and customer data is deleted on request. No period is stated. | What is the default retention for prompts, documents and fine-tuning data, and how is a deletion request confirmed? | [SCX — trust centre](https://trust.scx.ai/) |
| Deletion and export | Public claim only | Customer data is deleted on request. No timetable or backup rule is stated. | Within what time is data deleted from live systems and backups after a request or the end of a build? | [SCX — trust centre](https://trust.scx.ai/) |
| Human access to customer content | Not confirmed | Staff background checks are listed. Whether staff can read customer prompts or fine-tuning data is not stated. | Who can read our corpus and prompts, and is that access logged? | [SCX — trust centre](https://trust.scx.ai/) |
| Access control | Public claim only | The trust centre lists unique production-database authentication, unique account authentication, penetration testing and background checks. Customer SSO and MFA are not stated. | How do our users authenticate to the API, and do you support SSO and MFA? | [SCX — trust centre](https://trust.scx.ai/) |
| Encryption | Public claim only | The trust centre lists data-transmission encryption and key management as controls. It does not name TLS or AES. | Which encryption standards apply in transit and at rest for prompts and fine-tuning data? | [SCX — trust centre](https://trust.scx.ai/) |
| Assurance and certifications | Public claim only | The trust centre says SCX holds SOC 2 Type I, audited annually, and ISO 27001:2022. It says a data processing addendum for the GDPR and the Australian Privacy Principles is available on request. Certificates can be requested. They were not downloaded. Penetration testing and encrypted transmission are listed without algorithms. | Provide the current SOC 2 Type I report and ISO 27001 certificate, including scope and whether MAGPiE inference is included. | [SCX — trust centre](https://trust.scx.ai/) |
| Contract, DPA and liability | Not confirmed | A DPA is available on request and was not read. No master terms, liability cap or governing law was published. | Provide the DPA and the build contract, including APP 8, liability and who owns the weights. | [SCX — trust centre](https://trust.scx.ai/) |
| Cross-border transfers | Public claim only | The trust centre says no sub-processor is based outside Australia. The model page says a model can also run on a partner's infrastructure, which might not be in Australia if the customer chooses that. | For our order, confirm every processing location is in Australia, including the base-model files and any partner. | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models); [SCX — trust centre](https://trust.scx.ai/) |
| Incidents and breach notice | Not confirmed | The trust centre gives security@scx.ai for disclosures and audit requests. It does not state a breach-notice period. | What notice do we get of a breach, and is security@scx.ai the address? | [SCX — trust centre](https://trust.scx.ai/) |
| Changes to terms and models | Not confirmed | The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on changes to terms and models. | What is the written position on changes to terms and models for the deployment we would buy, and which contract or policy states it? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Exit, return and deletion | Not confirmed | The pages read on 2026-10-10 (the SCX.ai sovereign-models page and the trust centre) do not state a position on exit, return and deletion. | What is the written position on exit, return and deletion for the deployment we would buy, and which contract or policy states it? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Connectors and external tools | Public claim only | The published interface is an OpenAI-compatible API. No practice-management connector is named. | What is logged for each API call, and can we restrict the caller to our network? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Web search and open-web grounding | Not confirmed | No web-search tool is described. Answers come from the fine-tuned model. | Can MAGPiE or the API call the open web or a live legislation site? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Actions the system can take | Public claim only | The product described is a model and an API, plus a build service. SCX-coder is described as planning and executing engineering tasks; that is a different model. MAGPiE is not described as sending email or filing documents. | Confirm MAGPiE cannot take an external action, and that any agent built on the API is our responsibility. | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |
| Human review of output | Public claim only | The page stresses evaluation and auditable traces because fluent answers can be wrong. It does not insert a lawyer in the API response. | Where in our workflow is a lawyer required to check a MAGPiE answer before it is used? | [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) |

## Notes

SOC 2 is Type I, not Type II. The 38% to under 4% jurisdictional-accuracy comparison is the vendor's own evaluation. The vendor lists DeepSeek among possible open-weights bases. No registered office is stated on the pages read, so headquarters country is left empty; Australian hosting is recorded separately. No people's names are recorded.

## Sources

- [SCX.ai — build a sovereign model](https://scx.ai/build-sovereign-models) (checked 2026-10-10)
- [SCX — trust centre](https://trust.scx.ai/) (checked 2026-10-10)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.