Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The product page describes a four-stage pipeline - ingest of a case folder, SharePoint library or EDRMS export with files OCR'd, classified and prepared; detection; review; and export of a redacted release pack - together with published exemption taxonomies for six release regimes and connectors for four record systems. No plan, edition or module structure is published, and the website terms state that nothing on the site is an offer to sell or a binding quote and that features and capabilities described on the site do not form part of any contract.
Ask: Is Seers Redact sold as a single product or in editions, what is included in the base deployment, and which of the described capabilities are in production today rather than roadmap?
Deployment and tenancy
Public claim only
The product page states Seers Redact 'Runs in your Azure Australia tenant', is 'deployed into your Azure tenant - Australia East / Central', and offers 'PROTECTED-ready deployment options'. The page also displays an interface panel reading 'Tenant Australia East / Status Operational / v2.4', which is an illustration on a marketing page rather than a status page. No architecture document, no resource list and no statement of which components run outside the customer tenant was found. Hosting, checked 2026-10-10 on the vendor's own page (https://www.seers.digital/seers-redact): "nd. No offshore data processing. No black-box decisions. - Hosted in your Azure tenant - Australia East / Central - NV1-cleared, Australian-based engineering" Recorded as yes.
Ask: Provide the deployment architecture: which Azure resources are created in our subscription, which services are called from outside it, and what 'PROTECTED-ready' means in terms of controls we must implement ourselves.
What the product does
Public claim only
The product page states detection 'Detects names, identifiers, court-protected entities and case-specific terms across PDFs, Office and email' and that 'AI surfaces PII, exempt content and case-specific terms with confidence scores and citations to the source line', that detection is 'Pre-trained for FOI, GIPA, RTI and Discovery exemption schedules' with custom taxonomies for case-specific terms, codenames and protected identities, that review offers bulk actions, keyboard shortcuts and side-by-side comparison, and that release exports a redacted pack with a 'sealed audit trail'. It also claims processing of 'tens of thousands of pages in a single matter' and '10x Faster release'. What 'pre-trained' covers as against taxonomy configuration is not explained, and no mechanism is published for the audit trail described as 'Cryptographically anchored'.
Ask: What does 'pre-trained' mean for each regime - a trained model, a rule set, or a term list - and what cryptographic mechanism anchors the audit trail?
Regimes and statutory coverage
Public claim only
The product page names the regime for each published taxonomy: Freedom of Information Act 1982 (Cth); Government Information (Public Access) Act 2009 (NSW); Right to Information Act 2009 (Qld and Tas); Freedom of Information Act 1982 (Vic); civil litigation and royal commission discovery; and court-ordered subpoena production. It states the taxonomies were 'Built with input from former FOI officers, government lawyers and Discovery specialists'. Western Australian, South Australian, Northern Territory and ACT regimes are not listed, and no mapping from a taxonomy entry to a section of an Act is published.
Ask: Provide the mapping from each taxonomy entry to the section of the Act it implements, and state who maintains it when a decision of a tribunal or an amendment changes the ground.
Vendor content directing how AI describes the product
Not confirmed
Checked 2026-09-27 for a page or block directing how AI models, assistants or crawlers should describe the product. The firecrawl map of seers.digital returned 39 URLs covering the product page, privacy, terms, about, blog, locations, panels and every case study, and listed no /llms.txt, /ai-info, /ai or /for-ai path; none of the pages read carries such a block. A map lists linked pages, so an unlinked file at that root cannot be excluded from what was checked.
Ask: Do you publish any file or page - llms.txt, an AI-information page or similar - that tells AI assistants how to describe Seers Redact, and if so at what address?
Release stage and references
Not confirmed
No release stage, general-availability date or named customer for Seers Redact is published. The site's case studies, as listed in the 39-URL site map, cover other engagements including one titled as automating digital evidence processing for state government prosecutors, and none is presented as a Seers Redact deployment. Existence of the product beyond the vendor's own site rests on a vendor-supplied profile on the Public Sector Network marketplace naming it as a proprietary product alongside Seers Care.
Ask: How many agencies run Seers Redact in production today, since when, and can we speak to a reference agency in our jurisdiction?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who holds the decision and the accountability
Public claim only
The product FAQ asks 'Does the AI make the redaction decision?' and answers 'No. The AI surfaces candidates with citations and confidence scores. Your cleared officer accepts, refines or rejects every single one. The decision - and accountability - stays with the officer.' The capability list repeats that 'Every AI suggestion is reviewable, overridable and explainable'. These statements sit on a marketing page; the website terms state that information on the site about services, including features and capabilities, does not form part of any contract.
Ask: Will the licence agreement warrant that no redaction is applied to a release copy without a named officer's acceptance, and does the product record that acceptance against the officer?
Model and service providers
Not confirmed
No model, provider, cloud AI service or third-party component is named anywhere on the pages read, although detection is described as the mechanism the product is built on. The site map returned no security page, no trust centre and no architecture document where such a list might sit. Whether the detection is the vendor's own model, a fine-tune, or a call to a cloud service in the customer's subscription is not published.
Ask: Name every model and service that reads our documents - the OCR, the classifier and the detector - their vendors, whether any is a hosted third-party endpoint, and the region each runs in.
Subprocessors
Not confirmed
No subprocessor list, register or dated table is published, and the 39-URL site map returned none. The only third party named in connection with the product is Microsoft, as the tenant and Marketplace platform. The privacy policy's list of providers - Microsoft for form intake, CRM, email, file storage and hosting - is about the vendor's own corporate systems and website, and that policy notes some of those providers 'may store or process data outside Australia (for example, in Microsoft data centres in other regions)'.
Ask: Provide a dated list of every party that processes customer documents or metadata for Seers Redact, stating for each whether it sits inside our tenant, and our notice and objection rights.
Training on customer content
Public claim only
The product FAQ states 'we do not train shared models on your content, and we do not retain copies', in answer to where data is processed. The qualifier 'shared' is the vendor's own wording and does not address tuning a model for a single customer, and no contractual document behind the statement was found: the website terms expressly exclude site content from any contract, the privacy policy does not cover customer content, and the site map returned no data processing agreement.
Ask: Will you warrant in the licence agreement that no customer document, detection output, officer decision or audit record is used to train, tune or evaluate any model, shared or customer-specific?
Feedback and quality monitoring
Not confirmed
The review design generates a quality signal - officers 'accept, reject or refine' each candidate - but nothing published states what happens to those decisions beyond the matter: whether they are used to tune detection, whether they are visible to the vendor, or whether they leave the customer tenant. No in-product feedback control, telemetry description or model-update cycle is described.
Ask: Are officer accept, reject and refine decisions used to adjust detection, do they leave our tenant, and can that be turned off while keeping the audit trail?
Retention of documents, detection output and logs
Public claim only
The product FAQ states that processing happens entirely within the customer's Azure tenant in Australia East or Central and that the vendor does 'not retain copies'. No retention period or configuration is published for the ingested case folder, the OCR output, the detection candidates, the release pack or the audit log, and nothing states how long the 'sealed audit trail' must be retained to remain usable as evidence on review.
Ask: State the default retention for ingested documents, OCR text, detection output, release packs and the audit log, whether each is configurable, and what you hold outside our tenant.
Deletion and disposal
Not confirmed
No deletion process, period or certification is published. The related published statement is the FAQ claim that the vendor does not retain copies, which describes an absence of vendor-held data rather than a deletion process for the data inside the customer tenant. No statement addresses deletion of the audit trail, whose integrity is claimed to be cryptographically anchored, or how a disposal authority is honoured against it.
Ask: On closing a matter or ending the licence, what is deleted, by whom, in what period, will you certify it, and how does deletion interact with the sealed audit trail?
Who can see the content, and from where
Not confirmed
The product page states support is by 'NV1-cleared, Australian-based engineering and support' and that there is 'no offshoring - ever' and 'No offshore data processing'. Separately, a vendor-supplied profile on the Public Sector Network marketplace - a third-party site - states that Seers Digital 'combines local delivery with an offshore delivery centre in Vietnam to provide scalable, cost-effective project teams'. The two statements address different things on their face, one data processing and support for this product, the other the consultancy's delivery model, and no document reconciles them or records which personnel may access a Seers Redact deployment. No clearance certificate, personnel-vetting policy or access log commitment is published.
Ask: Which named roles can access our tenant, our documents and the audit log, in which countries are they located, does the offshore delivery centre have any access to this product or its deployments, and can we receive the access log?
Access control and administration
Not confirmed
Nothing published describes the product's role model, authentication, single sign-on, multi-factor authentication or segregation of duties. The statements adjacent to access are about who decides ('your cleared officer') and about the audit trail being a 'Cryptographically anchored history of who saw what, when and why', which implies per-user attribution without describing how identity is established or administered.
Ask: Does the product use our Microsoft Entra ID identities with single sign-on and enforced multi-factor authentication, what roles exist, and can we export the who-saw-what log?
Encryption and key management
Not confirmed
No encryption statement for the product appears on any page read. The privacy policy states the vendor takes reasonable steps including 'access controls, encryption in transit, and use of reputable cloud providers', but that policy governs website, recruitment and employee information rather than customer documents. No algorithm, key-management or customer-managed-key statement was found, and the site map returned no security page.
Ask: State encryption at rest and in transit for the review workspace, the detection output and the release pack, and whether customer-managed keys in our own key vault are supported.
Independent assurance - and what it covers
Public claim only
The about page states, as company compliance, 'ISO 27001:2022 - Information Security Management', 'Australian Government Essential Eight - Maturity Level 2' and 'Defence Industry Security Program (DISP) member', with a badge reading 'ISO 27001 Certified 2022'. The product page states 'IRAP Aligned controls', 'IRAP-aligned controls and ISO 27001:2022 certified delivery' and 'PROTECTED-ready deployment options'. No certificate, statement of applicability, IRAP assessment report or penetration-test summary is published, the site map returned no security page or trust centre, and 'IRAP-aligned' and 'certified delivery' are not the same as an assessment or certification of the product itself. IRAP: the vendor's own page states "default Runs in your Azure Australia tenant. No data ever leaves the country. NV1-cleared support, IRAP-aligned controls, no offshoring - ever. ### Tuned for your regime Pre-trained" (https://www.seers.digital/seers-redact, checked 2026-10-10). ISO 27001: the vendor's own page states "East / Central - NV1-cleared, Australian-based engineering and support - IRAP-aligned controls and ISO 27001:2022 certified delivery - Cryptographically sealed audit log of every action -" (https://www.seers.digital/seers-redact, checked 2026-10-10).
Ask: Provide the ISO/IEC 27001:2022 certificate and its scope statement, evidence of the Essential Eight Maturity Level 2 assessment and its date, and state whether Seers Redact itself has ever been IRAP assessed or penetration tested by whom.
Contract, liability and forum
Public claim only
The only published contract is website terms of use, last updated June 2026, for Seers Group Australia Pty Ltd trading as Seers Digital. They state the site does not sell anything and that any engagement is governed exclusively by a separate written agreement, that information about services on the site does not form part of any contract, and that total liability arising out of or in connection with the Website or the Terms 'will not exceed AUD $100' - a cap on website use, with clause 9.2 confirming that termination of website access does not affect any separate agreement for Services. Governing law is Queensland, the exclusive venue is the Queensland courts, and disputes require notice, good-faith negotiation and mediation in Brisbane. No master services agreement, licence agreement or data processing agreement is published.
Ask: Provide the master services agreement, licence agreement and data processing agreement for Seers Redact, with the liability cap, warranties, service levels and the Australian entity and its ACN or ABN.
Cross-border processing
Public claim only
The product page states 'Your data never leaves Australia', 'Hosted in your Azure tenant - Australia East / Central', 'No offshore data processing' and, in the FAQ, 'Entirely within your Azure tenant in Australia East or Central. We do not move your data offshore'. No contractual document supports those statements; the website terms exclude site content from any contract, and the privacy policy - which governs the vendor's own corporate and website data rather than customer content - states that some of its providers 'may store or process data outside Australia (for example, in Microsoft data centres in other regions)'.
Ask: Will the licence agreement warrant Australia-only storage, processing, inference, backup and support for our matters, and name every exception?
Incident notification
Not confirmed
Neither the website terms nor the privacy policy states an incident notification period, assessment process or regulator-cooperation commitment for the product. The privacy policy addresses the vendor's handling of website, recruitment and employee information and does not commit to a notification period to a customer. No incident history and no status page for the product were found; the 'Status Operational' text on the product page is part of an illustration.
Ask: What is the contractual period from discovery for notifying us of an incident affecting a Seers Redact deployment or our documents, who notifies the OAIC or state regulator, and have there been any notifiable incidents?
Change notice
Public claim only
The website terms state the vendor 'reserves the right to review and change any of the Terms by updating this page at its sole discretion' and that changes take immediate effect from publication. Nothing published states what notice a customer receives before a change to the detection model, a taxonomy, a connector or a deployed version; the product page shows a version marker ('v2.4') only inside an illustration.
Ask: What written notice will we receive before a change to the detection model, an exemption taxonomy or a deployed version, and can we pin a version for a matter already under review?
Exit and evidentiary continuity
Not confirmed
No termination, export or transition provision for the product is published; the website terms deal only with website access and defer everything else to an unpublished separate agreement. The related published facts are that deployment is into the customer's own Azure tenant and that release packs and 'export-ready evidence packs for tribunals, OAIC reviews and Discovery' are produced during normal use. Whether an exported release pack and its audit trail remain verifiable after the licence ends is not addressed.
Ask: On exit, what remains usable in our tenant, in what format, and can an exported release pack and its sealed audit trail still be verified by a tribunal once the software is removed?
Connectors and what they reach
Public claim only
The product page states native connectors for Microsoft SharePoint, Objective, OpenText Content Manager (TRIM, HPRM, CM10) and Dynamics 365 case management, with 'APIs for everything else' and anything else able to be 'wired via the API in a sprint or two'. Ingest accepts a case folder, a SharePoint library or an EDRMS export. No permission model, API documentation or statement of what each connector reads or writes back was found.
Ask: For each connector, what permissions does it require in our tenant, does it read in place or copy into the product, and does it write anything back to the source system?
Open-web retrieval
Not confirmed
Nothing on the pages read describes any open-web or external lookup. The described inputs are the customer's own case folder, SharePoint library or EDRMS export, and the taxonomies and case-specific term lists. Because no component is named, whether any step reaches a service outside the customer tenant cannot be established from published material.
Ask: Does any step - OCR, classification, detection or the review surface - send document content or extracted entities to any service outside our tenant, including a search service or a hosted model endpoint?
What the product does on its own
Public claim only
On the published description the product prepares and proposes rather than acts: ingest OCRs, classifies and prepares files; detection surfaces candidates; the officer accepts, rejects or refines; release exports the pack. The FAQ states the AI does not make the redaction decision. Bulk actions are offered in review, which is a control a firm would need to configure, and nothing states whether a bulk accept can apply candidates without opening each document.
Ask: Can a bulk action apply candidate redactions without an officer opening each document, is there a maximum, and can bulk accept be disabled by policy?
Human review before release
Public claim only
The product page states every AI suggestion is 'reviewable, overridable and explainable', that each candidate carries a confidence score and a citation to the source line, and that 'Your cleared officer accepts, refines or rejects every single one'. The audit trail is described as recording 'who saw what, when and why'. No document requires that review, and no published control prevents release before review; these statements sit on a marketing page that the website terms exclude from any contract.
Ask: What product control prevents a release pack being exported before every candidate has been dispositioned, and does the audit trail record the officer who dispositioned each one?
