---
title: "ServiceNow Legal Service Delivery (ServiceNow, Inc.)"
url: "https://ailawframework.com/software/servicenow-legal-service-delivery"
type: "software_profile"
site: "AI Law Framework"
id: "servicenow-legal-service-delivery"
vendor: "ServiceNow, Inc."
category: "Legal-specific"
segment: "Intake and client service"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# ServiceNow Legal Service Delivery (ServiceNow, Inc.)

> In-house legal suite on the ServiceNow platform: employees submit and track legal requests, and the legal team runs matters, investigations, legal holds and compliance disclosures from a counsel workspace with…

Canonical page: https://ailawframework.com/software/servicenow-legal-service-delivery  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Covers the Legal Service Delivery application suite in a customer's ServiceNow instance, Zurich documentation updated 12 March 2026. The paid ServiceNow Otto for LSD add-on and the platform subscription need separate review.

In-house legal suite on the ServiceNow platform: employees submit and track legal requests, and the legal team runs matters, investigations, legal holds and compliance disclosures from a counsel workspace with dashboards.

## Capabilities

- Intake and triage
- Matter management
- Knowledge search
- Compliance monitoring
- Conflict checking
- Practice analytics

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, Multiple specified locations |
| Australian region | On request |
| Assurance | ISO/IEC 27001:2022, ISO/IEC 27017:2015 (certified since 2018), ISO/IEC 27018:2019 (certified since 2016), ISO/IEC 27701:2019, ISO/IEC 42001 Artificial Intelligence Management System, SSAE 18 SOC 1 Type 2, SSAE 18 SOC 2 Type 2 (annual since 2013; report period 1 October to 30 September, issued via ServiceNow CORE), BSI C5 attestation, CSA STAR Level 2 certification, APEC Privacy Recognition for Processors, MTCS Level 3 (Singapore), ASD IRAP assessed for OFFICIAL and PROTECTED, stated for ServiceNow's Australian Platforms, FedRAMP High provisional authority to operate and DoD Impact Level 4, for the Government Community Cloud, HITRUST certification, UK Cyber Essentials Plus, Data Privacy Framework programme participant (EU-U.S., UK extension, Swiss-U.S.) |
| Training on customer content | Unknown |
| Retention | No retention period is published for legal requests, matters, attachments, knowledge articles or logs. The Data Processing Addendum's Data Security Guide, clause 3.1, states only that 'ServiceNow backs up all Customer Data in accordance with ServiceNow's standard operating procedure', and that procedure sits in the login-protected ServiceNow CORE portal, which was not read. Data Processing Addendum clause 4.4 deals with deletion at termination, and the Ordering Agreement read states that after termination ServiceNow may delete all Customer Data unless legally prohibited. |
| Integrations | Employee Center, Now Mobile app, Mobile Agent app, Virtual Agent, Search in Legal Service Delivery (documentation topic listed in the page navigation; not opened, and the page read does not say whether it uses AI Search), Performance Analytics content pack for Legal Service Delivery, Integration Hub connector to Legal Tracker (ServiceNow Store, named on the Australian product page), ServiceNow Otto for Legal Service Delivery (separately licensed add-on) |
| Legal content coverage | No primary law, case law or legislative content is described. The suite operates over the organisation's own legal requests, matters, documents and knowledge articles in its ServiceNow instance, and nothing read states that any matter template or knowledge article is written for Australian law. |
| Pricing | No price is published. The localised Australian product page (read 2026-09-27) publishes a package named 'Legal Service Delivery Standard' with a feature list and a 'Contact Us for Custom Quote' action, and states 'Whatever workflow you need to simplify, we have a package and pricing plan that works for you'. No amount, unit or licence metric is given, no tier comparison is published, and the generative AI add-on is a separately paid ServiceNow Store application. The Ordering Agreement read states fees are set on each Order Form. |
| Australian presence | Yes. An Australian ServiceNow entity is named in a binding document: the Data Processing Addendum lists 'ServiceNow Australia Pty Ltd (Australia)' among the affiliate subprocessors at clause 8.1.1, and its Standard Contractual Clauses name the data importing organisation as 'ServiceNow Australia PTY LTD.' at 'Suite 9, Waverley Masonic Centre, 318-322 Stephensons Road, Mount Waverley VIC 3149 Australia'. NO ACN or ABN is published on any page read, and which ServiceNow entity signs an Australian order was NOT established: the only ordering agreement reachable on the vendor's site is the ServiceNow Japan G.K. version, governed by Japanese law. An Australian hosting region exists - the trust and compliance page states "ServiceNow's Australian Platforms has been independently assessed by an endorsed IRAP assessor to meet the Australian ISM controls for OFFICIAL and PROTECTED data" - and Data Processing Addendum clause 4.5 makes the instance region a matter for the Order Form, while clause 4.3.4 requires near-real-time replication to a mirrored data centre 'in a different geographic region' that is not named. The customers named on the localised Australian page are a United States state human services department and three named companies, none identified there as Australian. 'Australia' also appears as a ServiceNow platform release name in compatibility lists and must not be read as a residency statement. |
| Website | https://www.servicenow.com/au/products/legal-service-delivery.html |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Applications the suite is made of | Public claim only | The vendor's documentation (Zurich release, page states 'Updated March 12, 2026') names the constituent applications: Legal Practice Apps Core, described as 'a required application for using all legal practice applications'; Legal Request Management, of which the page states 'All other applications that you choose to install require the installation of Legal Request Management'; Legal Matter Management; the practice applications Legal Content Review, Legal Digital Forensics, Legal Investigations, Legal Simple Contracts, Legal Simple Privacy and Legal Hold Notification; Legal Simple Compliance, containing Gifts and Entertainment Compliance, Legal Conflict of Interest and Legal Stock Preclearance; Legal Counsel Center; External Legal Service Center; a Performance Analytics content pack; Legal Virtual Agent Conversations; and Legal Mobile. Generative AI is a separate licensed application, ServiceNow Otto for Legal Service Delivery, profiled separately. | Which of these applications are on our entitlement, and which need to be added to the order before the legal team can use them? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Deployment and where the instance sits | Public claim only | The applications install into the customer's own ServiceNow instance, so hosting follows the instance. The Data Processing Addendum, clause 4.5, states that 'Data Processor will host Data Controller's instances of the Subscription Service in data centers located in the geographic regions specified on the Order Form', and its Data Security Guide, clause 3.1, states that hosting is 'in a pair of data centers that attained SSAE 18 Type 2 attestations or have ISO 27001 certifications (or equivalent or successor attestations) acting in an active/active capacity for the Subscription Term'. The same clause states that 'The production database servers are replicated in near real time to a mirrored data center in a different geographic region', and neither document says whether that mirrored region is inside Australia for an Australian instance. The add-on documentation refers to 'self-hosted customers' as a category; no self-hosted option was confirmed for this suite. | For an Australian instance, which two data centres form the active/active pair and in which country is the near-real-time mirrored data centre named in Data Security Guide clause 3.1? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| What the applications do | Public claim only | The documentation states that employees 'can submit legal requests, monitor their progress, and read legal knowledge base articles - all through an omni-channel experience across portal, mobile, and virtual agent channels', and that fulfillers 'can also designate requests as privileged and confidential using Attorney Client Privilege feature. When privileged and confidential is enabled, the system restricts access to authorized stakeholders, and marks communications with confidentiality banners.' Legal Matter Management handles 'cross-departmental tasking and workflow with a mechanism to store documents and track important milestones' with 'embedded record level security' and matter templates. Legal Investigations accepts complaints 'either by name or anonymously through the Anonymous Reporting Center portal'. Legal Hold Notification 'enables you to submit a legal hold matter, add custodians, send notices, and close the legal hold matter'. Legal Stock Preclearance sets up trading windows and an access list. | Which of these applications are configured in the base implementation and which are configuration projects of their own for an in-house team of our size? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Jurisdiction and legal content | Not confirmed | No jurisdiction-specific legal content is described. The documentation describes the suite as operating over the organisation's own legal requests, matters, documents and knowledge articles; no case law, legislation or primary-law library is named on either page read, and the Australian product page names no Australian law, regulator or statutory obligation. Nothing read states which country's law the knowledge articles or matter templates are written for. | Are any matter templates, knowledge articles or compliance workflows shipped with Australian content, for example an Australian conflict-of-interest or gifts register policy, or must every template be written by us? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html) |
| Licence and entitlement | Public claim only | The Australian product page publishes a package named 'Legal Service Delivery Standard' with a feature list (Legal Request Management, Legal Matter Management, Practice Apps, Legal Counsel Center, Legal Investigations, Legal Contracts, Legal Knowledge Management, Reporting, Employee Center, Now Mobile, Mobile Agent, Virtual Agent) and a 'Contact Us for Custom Quote' action, read 2026-09-27. No licence metric, user type, tier comparison or entitlement document is published on either page read, and no licensing document for the suite was reached. | What is the licence metric for Legal Service Delivery - fulfiller, requester, instance or something else - and is the Employee Center requester access included at no additional licence? | [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html) |
| Channels and integrations named | Public claim only | The documentation names the Employee Center portal, the Now Mobile app for employees, the Mobile Agent app for the legal department, Virtual Agent chat, global search, the Anonymous Reporting Center portal and the External Legal Service Center portal for 'external users like customers, partners, and the public'. The Australian product page publishes one named outbound integration: 'Help legal fulfillers track outside legal engagement and spend with the Integration Hub connector to Legal Tracker', linking a ServiceNow Store application. No permission scope, credential or payload description was read for that connector. | For the Integration Hub connector to Legal Tracker, what matter and spend data leaves the instance, under whose credentials, and where does the receiving system hold it? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html) |
| Support and service levels | Public claim only | The documentation points to the ServiceNow Community for Legal Service Delivery and to ServiceNow University training, including a course named 'Legal Service Delivery (LSD) Essentials'. The Australian product page states that 'We offer services tailored to your needs and unrivalled support', with no availability target, response time or credit regime attached and no service level document linked; that is a marketing statement on a marketing page. The Ordering Agreement read states that customer support, availability, upgrades and updates are set out in a separate Customer Support Addendum, which was not read. | Please provide the Customer Support Addendum that would apply to us, with the availability target, response times by severity and the service credit regime. | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf) |
| Published evidence of output quality | Not confirmed | No measurement, benchmark, evaluation method or error rate is published for anything in the suite on either page read, checked 2026-09-27. The documentation's 'Key Outcomes' section is written as statements of intent ('faster legal request resolution', 'Frees legal teams to focus on high-value and complex legal work') with no figure, method or source. The Performance Analytics content pack is described as reporting the customer's own operational metrics, which measures the legal team rather than the software. | Has ServiceNow measured anything about this suite's effect on legal request handling, and if so on what data set and by what method? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Task the vendor offers it for | Public claim only | The documentation places the suite between employees and an in-house legal department: 'Legal Service Delivery provides a unified experience between the employees requesting legal support and the legal teams serving them', and the Performance Analytics dashboard is addressed to 'General counsel and practice area leads'. The requesters are the organisation's employees and, through the External Legal Service Center, external parties including the public; the fulfillers are the organisation's own legal team. It is not documented as a law firm practice management system, and no client billing, trust accounting or time recording is described. | For a legal team that acts for external clients rather than for one employer, which parts of this suite are supported and which are outside its intended use? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Who the vendor addresses | Public claim only | The documentation addresses employees submitting requests, 'request fulfillers', matter owners, lawyers working in the Legal Counsel Center, and general counsel and practice area leads reading the Performance Analytics dashboards. The Australian product page is addressed to an organisation's legal operations function. The named customers on the Australian page are a United States state human services department and three named companies, published as the vendor's own customer stories; none is identified on that page as an Australian customer. | Which Australian organisations are running Legal Service Delivery, and can we speak to an Australian reference in an in-house legal team? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html) |
| Release stage and versioning | Public claim only | The documentation page read is labelled 'Release version: Zurich' and 'Updated March 12, 2026'. ServiceNow versions its documentation by release family; the names of those families include 'Australia', which is a ServiceNow release name and not a statement about Australian hosting or availability. Nothing on the pages read marks any application in the suite as beta, limited availability or early access. | Which release family would our instance be on at go-live, and are any of the practice applications limited-availability on that release? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Check for vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. No page or block addressed to AI models, AI assistants, language models or crawlers, and no instruction about how the product should be described, was found on any of the nine ServiceNow pages read for this profile. Two firecrawl site maps of www.servicenow.com, one filtered for trust, privacy, terms and subprocessor pages and one filtered for other documents, contracting entity and customer agreement, returned no /llms.txt, /ai-info, /for-ai or robots path; no such path was guess-fetched, so its existence is unverified rather than disproved. A separate and different thing was found and is recorded so the two are not conflated: the documentation page opens with an 'AI sparkle' icon labelled 'Summarized using AI' above a 'Summary of Legal Service Delivery' block and states 'This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.' That is the vendor disclosing that part of its own documentation is machine generated. Every fact in this profile was taken from the human-written body text below that block. | Do you publish any file or page addressed to AI models, assistants or crawlers that describes your products or how they should be described, and which parts of each documentation page are machine generated? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html); [ServiceNow trust - Privacy](https://www.servicenow.com/company/trust/privacy.html) |
| Authority to put legal and privileged material into the instance | Public claim only | The Data Processing Addendum puts the assessment on the customer: clause 3.2 states that 'before submitting any Personal Data to the Subscription Service, Data Controller will perform an appropriate risk assessment to determine whether the security measures within the Subscription Service provide an adequate level of security', and that 'Data Controller is solely responsible for determining the adequacy of the security measures within the Subscription Service in relation to the Personal Data Processed'. Its Data Security Guide, clause 7.1, makes the customer 'responsible for implementing encryption and access control functionalities available within the Subscription Service for protecting all Customer Data containing sensitive data'. On the product side the suite offers an Attorney-Client Privilege feature that 'restricts access to authorized stakeholders, and marks communications with confidentiality banners'; the documentation makes no representation about whether privilege is preserved. | Does ServiceNow make any representation that the Attorney-Client Privilege feature preserves legal professional privilege under Australian law, and what does your risk assessment guidance say for privileged material? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Model provider and model | Not confirmed | No model, model provider or inference location is named for anything in the base suite. The documentation names AI only in three places: 'ServiceNow Otto for Legal Service Delivery (LSD)', which is the separately licensed add-on; 'Legal Virtual Agent Conversations', described as providing 'predefined conversation topics to enable automated chats with employees seeking legal services'; and an employee interface 'with a guided intelligent workflow'. The Australian product page states that 'Legal Service Delivery includes AI-powered capabilities' and, under 'Intelligent automation', 'Supercharge your workflows with machine learning and AI-powered experiences', without naming a model, a provider or a feature. The four providers named in the add-on's documentation (Now LLM Service, Azure OpenAI, Google Gemini and Anthropic Claude on AWS) are published for that add-on and are not attributed here. | Without the Otto add-on, does any part of Legal Service Delivery call a language model, and if so which provider and in which country does it run? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Subprocessors and where they sit | Public claim only | The Data Processing Addendum names the vendor's own affiliate subprocessors at clause 8.1.1: 'ServiceNow, Inc. (USA), ServiceNow Nederland B.V. (the Netherlands), ServiceNow Australia Pty Ltd (Australia), ServiceNow Software Development India Private Limited (India), ServiceNow UK Ltd. (United Kingdom), ServiceNow Ireland Limited (Ireland), and ServiceNow Japan K.K. (Japan)'. Clause 8.1.2 requires notice to the customer before a new subprocessor is engaged, clause 8.2 gives the customer ten days to object and, if ServiceNow proceeds, a right to terminate the affected Order Form within forty-five days with a refund of unused prepaid fees, and clause 8.3 keeps ServiceNow liable for its subprocessors' acts. Clause 1.12 states that 'ServiceNow's colocation datacenter facilities are not Sub-Processors under this DPA'. The trust privacy page names a document called 'ServiceNow Sub-Processors' under 'Other Documents'; the page as read carried no link target for it, and no standing subprocessor list was reached. | Please provide the current dated ServiceNow Sub-Processors list that would apply to our instance, naming every non-affiliate subprocessor and the country each processes in. | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow trust - Privacy](https://www.servicenow.com/company/trust/privacy.html) |
| Use of our content to train models | Not confirmed | Nothing published states a position for the base suite. The Services Privacy Statement's processing table records, against identifiers, the purpose 'With your or your Employer's consent: To train and improve ServiceNow's artificial intelligence ("AI") and machine learning ("ML") models', which is a consent gate. The Data Processing Addendum's Data Security Guide, clause 5.2, permits ServiceNow to 'collect, use and disclose quantitative data derived from Customer's use of the Subscription Service for industry analysis, benchmarking, analytics, marketing, and other business purposes' and states that 'Any such data will be in aggregate form only and will not contain Customer Data'. The separately licensed add-on's documentation states that ServiceNow 'collects and uses the inputs, outputs, and edits to outputs of this application to develop and improve ServiceNow technologies', with an opt-out; that notice is published for the add-on, not for the base suite, and no equivalent notice was found on the base-suite pages read. | Without the Otto add-on installed, is any content from legal requests, matters or knowledge articles used to develop ServiceNow models, and where is that stated for the base suite? | [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Use of corrections, ratings and suggestions | Public claim only | The Ordering Agreement read, clause 4.2, states that 'If Customer provides ServiceNow with feedback such as suggestions or ideas regarding the ServiceNow Core Technology ("Feedback"), then ServiceNow has the irrevocable right to exercise all rights in such Feedback without restriction'; that clause is in the ServiceNow Japan G.K. version of the agreement, the only ordering agreement reached. The Data Security Guide clause 5.2 permits use of aggregate quantitative usage data that 'will not contain Customer Data'. Nothing read states what happens to a fulfiller's corrections inside the suite. The documentation pages themselves carry a 'Rate this content' control, which concerns the documentation rather than the product. | Does the Feedback clause in our Australian ordering agreement read the same way, and does it reach anything a fulfiller types into a legal request or matter record? | [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Retention periods | Public claim only | No retention period is published for legal requests, matters, attachments, knowledge articles or logs. The Data Processing Addendum's Data Security Guide, clause 3.1, states that 'ServiceNow backs up all Customer Data in accordance with ServiceNow's standard operating procedure', without stating a period or where back-ups sit, and that standard operating procedure is held in the ServiceNow CORE portal, which requires a customer login and was not read. Clause 4.4 of the addendum addresses deletion only at termination. The Services Privacy Statement's retention section governs data ServiceNow holds as controller and does not cover Customer Data processed on a customer's behalf. | State the retention period and location for instance back-ups of legal requests, matters and attachments, and confirm whether we can shorten it or exclude privileged matters from back-up replication. | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html) |
| Deletion on request and on exit | Public claim only | The Data Processing Addendum, clause 4.4, states that 'Upon termination or expiration of the Agreement, Data Processor shall return and delete Customer Data, including Personal Data contained therein, as described in the Agreement', so the mechanics sit in the subscription agreement rather than the addendum. Clause 9.1.4 states that 'the certification of deletion or destruction of Customer Data shall be provided by ServiceNow to Customer only upon Customer's written request, provided that such request is made through the customer support portal prior to the termination or expiration of the Agreement'. The Ordering Agreement read states at clause 9.2 that 'After termination of an Order Form or expiration of a Subscription Term, ServiceNow may delete all Customer Data unless legally prohibited', with no stated retrieval window; that clause is in the ServiceNow Japan G.K. version. No deletion period for individual records on instruction during the term was found. | What is the deletion timeframe after termination, does it cover back-ups and the mirrored data centre, and will you accept a standing obligation to certify deletion rather than only on a request lodged beforehand? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf) |
| Who at the vendor can see our legal records | Public claim only | The Data Processing Addendum, clause 4.2, states that 'Access to Personal Data by Data Processor will be limited to personnel who require such access to perform Data Processor's obligations under the Agreement and who are bound by obligations to maintain the confidentiality of such Personal Data'. Its Data Security Guide, clause 2.2.1, states that access by ServiceNow employees and contractors 'is protected by authentication and authorization mechanisms', that 'Access privileges are based on job requirements and are revoked upon termination of employment or consulting relationships' and that production infrastructure requires VPN connections, complex passwords with expiration dates and 'a two-factored authenticated connection'; clause 2.3.2 requires background screening of employees and contractors with access to Customer Data. Nothing read requires the customer's approval for an individual access event or gives the customer a log of vendor access. | Can ServiceNow personnel open a matter marked privileged and confidential in our instance, is our per-incident approval required, and can we export a log of every such access? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Access control available to us | Public claim only | Two layers are published. Contractually, the Data Security Guide clause 7.1 states the Subscription Service can 'authenticate users before access', 'encrypt passwords', 'allow users to manage passwords' and 'prevent access by users with an inactive account', and that 'Customer manages each user's access to and use of the Subscription Service by assigning to each user a credential and user type'; clause 2.2.2 states the service 'provides user and role based access controls. Customer is responsible for configuring such access controls within its instance.' In the product, the documentation states that Legal Matter Management has 'embedded record level security', that the Attorney-Client Privilege feature 'restricts access to authorized stakeholders, marks communications with confidentiality banners, and maintains a document audit trail', and that 'The Legal Service Delivery applications support domain separation at the Basic level'. Whether search and reporting honour the privilege restriction is not stated on the pages read. | Do global search, the documented Legal Service Delivery search and the Performance Analytics dashboards honour Attorney-Client Privilege restrictions and matter record-level security, or can a user see content from a matter they cannot open? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Encryption | Public claim only | Encryption of Customer Data is published as a customer responsibility exercised through product functionality, not as a vendor default. The Data Processing Addendum, clause 3.2, states that 'the Subscription Service includes, without limitation, column level encryption functionality and role-based access control, which Data Controller may use in its sole discretion to ensure a level of security appropriate to the risk of the Personal Data'. Its Data Security Guide, clause 7.1, states the customer 'shall be responsible for implementing encryption and access control functionalities available within the Subscription Service for protecting all Customer Data containing sensitive data' and that 'Customer is solely responsible for its decision not to encrypt such data and ServiceNow will have no liability to the extent that damages would have been mitigated by Customer's use of such encryption measures'. The Data Security Guide as read states no commitment on encryption of Customer Data in transit and names no algorithm or key management option; clause 2.1.3 covers destruction of media before disposal. | Which encryption offering covers legal request and matter attachments at rest, what does it cost, who holds the keys, and what is your written commitment on encryption in transit? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Independent assurance | Public claim only | The trust and compliance page, read 2026-09-27, publishes ISO/IEC 27001:2022, ISO/IEC 27017:2015 (certified since 2018), ISO/IEC 27018:2019 (since 2016), ISO/IEC 27701:2019, ISO/IEC 42001 for an artificial intelligence management system, SSAE 18 SOC 1 Type 2 and SOC 2 Type 2 (annual since 2013, report period 1 October to 30 September, available via ServiceNow CORE by the end of each calendar year with a bridge letter in the following first quarter), BSI C5, CSA STAR Level 2, APEC Privacy Recognition for Processors, MTCS Level 3 for Singapore, FedRAMP High provisional authority and DoD Impact Level 4 for the Government Community Cloud, HITRUST, UK Cyber Essentials Plus and Data Privacy Framework participation. For Australia it states that "ServiceNow's Australian Platforms has been independently assessed by an endorsed IRAP assessor to meet the Australian ISM controls for OFFICIAL and PROTECTED data". Contractually, Data Processing Addendum clause 7.2 gives the customer one audit a year of documentation evidencing ServiceNow's security policies, including a summary report of an independent assessment against ISO 27001, ISO 27018, SSAE 18/SOC1 and SOC2 Type 2, and clause 7.1 gives no-cost access to the ServiceNow CORE self-assessment portal. No certificate or report was opened; none of the pages read states whether the Legal Service Delivery applications are named in any certificate scope. | Please supply the IRAP assessment date and scope for the Australian Platforms, and confirm in writing whether the Legal Service Delivery applications and their data are inside the ISO/IEC 27001:2022, ISO/IEC 42001 and SOC 2 scopes. | [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Contract documents read, and the gap | Not confirmed | Two binding documents were read and neither is certain to be the one an Australian customer signs. The Data Processing Addendum is pre-signed by ServiceNow and its signature blocks carry signing dates of July and August 2019; it incorporates the Standard Contractual Clauses made under Directive 95/46/EC as Attachment 1 and states at clause 9.3 that 'ServiceNow, Inc. shall comply with the EU-U.S. and Swiss-U.S. Privacy Shield Framework', while the trust and compliance page instead publishes Data Privacy Framework participation. The only ordering agreement reachable is the ServiceNow Japan G.K. version, footer 'Version: 01OCT2023', whose clause 10.8 states 'The Agreement will be governed by the laws of Japan' with disputes heard 'only in any court of competent jurisdiction in Tokyo, Japan', and whose clause 2.2 points to a customer support addendum, data security addendum and data processing addendum published at a Japan-specific schedules page. No Australian ordering agreement, Australian schedules page or Australian entity signature block was found. | Which ServiceNow entity signs an Australian order, what is its ACN, which ordering agreement version and schedules page apply to us, and is the published data processing addendum with 2019 signing dates and Privacy Shield wording the current one you would execute? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Cross-border transfer and where data sits | Public claim only | The Data Processing Addendum ties the instance to a region but not the whole data path. Clause 4.5 states instances are hosted 'in data centers located in the geographic regions specified on the Order Form'. Clause 4.3.4 and Data Security Guide clause 3.1 state that 'The production database servers are replicated in near real time to a mirrored data center in a different geographic region', without naming the region for an Australian instance. For transfers out of the European Economic Area the addendum uses the Standard Contractual Clauses at Attachment 1, where the data importing organisation is named as 'ServiceNow Australia PTY LTD.' with the address 'Suite 9, Waverley Masonic Centre, 318-322 Stephensons Road, Mount Waverley VIC 3149 Australia'. No safeguard is named for transfers of data out of Australia, and Australian law is not mentioned in either document read. Separately, the add-on's documentation states that using that application 'requires data to be transferred from ServiceNow customers' individual instances to a centralized ServiceNow environment, which may be located in a different data center region from the one where your instance is'. | For an Australian instance, name the mirrored data centre region, confirm whether any legal request, matter or attachment content leaves Australia in ordinary operation or in support, and state the contractual safeguard for that transfer. | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Breach and incident notification | Public claim only | The Data Processing Addendum, clause 6.1, requires ServiceNow to report any 'accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data ("Breach") that it becomes aware of without undue delay following determination by ServiceNow that a Breach has occurred'; the Data Security Guide clause 5.1.2 is in the same terms. There is no fixed hour or day deadline and the clock starts on ServiceNow's own determination. Clause 6.2 sends the initial report to the security or privacy contacts the customer has designated in the support portal, or failing that the primary contact, with further information as it becomes available. Clause 6.3 states that 'Data Controller is solely responsible for determining whether to notify the relevant supervisory or regulatory authorities and impacted Data Subjects and for providing such notice.' | Will you accept a fixed notification period measured in hours from awareness of a suspected incident rather than from your determination, and will you commit to supporting an assessment under the Australian notifiable data breaches scheme inside that period? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Notice of change | Public claim only | Change is governed by document version rather than by advance notice. The Ordering Agreement read states at clause 2.3 that 'The CSA, DSA, and DPA, and any other addenda in effect as of the date of the Order Form apply to the Subscription Service specified on such Order Form. ServiceNow may update the CSA, DSA, DPA and any addenda, however, except to the extent otherwise expressly provided, in no event will any update automatically apply to such Subscription Service.' The Data Security Guide clause 1 allows ServiceNow to 'periodically review and update the Security Program to address new and evolving security technologies, changes to industry standard practices, and changing security threats, although no such update will materially reduce the commitments, protections or overall level of service provided to Customer'. The AI Acceptable Use Policy as read carries no effective date, and the add-on's documentation states it 'may be updated by ServiceNow'. Product change is published as release family and a page update date. | How far in advance are we told when a schedule, the AI Acceptable Use Policy or an application's behaviour changes, and can our order pin the addenda versions in force at signature? | [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Getting out and taking our data | Public claim only | The Ordering Agreement read states at clause 9.2 that 'At any time during the applicable Subscription Term, Customer may export Customer Data using the functionality of the Subscription Service' and that 'After termination of an Order Form or expiration of a Subscription Term, ServiceNow may delete all Customer Data unless legally prohibited', with no post-termination retrieval window and no transition assistance provision; that clause is in the ServiceNow Japan G.K. version. The Data Processing Addendum clause 9.1.4 requires a deletion certificate only where the customer asks in writing before termination. No export format, bulk export mechanism or escrow is described for legal matters, attachments, privilege markings or the document audit trail. | Demonstrate an export of legal requests, matters, attachments, privilege markings and the document audit trail in an open format, and state the retrieval window after termination and any transition assistance rate. | [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Connectors and what they can reach | Public claim only | The suite's reach is the instance plus its published channels. The documentation names the Employee Center portal, Now Mobile, Mobile Agent, Virtual Agent, global search, the Anonymous Reporting Center portal and the External Legal Service Center, through which 'external users like customers, partners, and the public' can submit concerns and requests. The Australian product page names an Integration Hub connector to Legal Tracker for outside legal engagement and spend. No permission scope, credential, payload description or data-flow diagram was read for any of these, and nothing read states whether the external portal can reach records other than the requests raised through it. | For the External Legal Service Center and the Legal Tracker connector, document exactly which tables and attachments each can read or write, and how we restrict them. | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html) |
| Whether the tool reaches the internet | Not confirmed | Nothing on the pages read states that any part of the base suite retrieves content from the open internet. The described searches are internal: knowledge base articles, global search inside the instance and the documented 'Search in Legal Service Delivery' topic, which was not opened. Absence of a description is not confirmation that no platform capability reachable from the suite can perform an external retrieval. | Can anything reachable from Legal Service Delivery, including the Legal Service Delivery search and the Virtual Agent topics, retrieve content from outside our instance, and can that be disabled at instance level? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| What the suite can do without being asked | Not confirmed | The suite runs workflows that act. The documentation states Legal Hold Notification 'enables you to submit a legal hold matter, add custodians, send notices, and close the legal hold matter'; Legal Stock Preclearance lets an organisation 'set up trading windows, manage an access list, and approve or reject stock preclearance requests'; Legal Virtual Agent Conversations provides 'predefined conversation topics to enable automated chats with employees seeking legal services'; and the employee interface has 'a guided intelligent workflow'. The documentation does not say which of these steps can complete without a person. The AI Acceptable Use Policy bears on this: the customer agrees not to use ServiceNow AI offerings 'As part of an automated decision-making process, that has a consequential impact on any individual's legal position, financial position, access to services, or employment opportunities unless there is meaningful human oversight of the system or the final decision is made by a human being'. | Which workflow steps in Legal Hold Notification, Stock Preclearance and Conflict of Interest can approve, reject or send a notice without a person, and how do we make the human step mandatory and auditable? | [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html) |
| Human review of output | Public claim only | The AI Acceptable Use Policy states that 'Outputs generated by a machine learning model are probabilistic' and that, for any ServiceNow AI offering, 'you are responsible for determining whether the following are required: Implementation of human oversight of any output; Meaningful human control over decisions informed by AI; and Evaluating output for accuracy, harm, and appropriateness for your use case.' So the obligation to decide on oversight sits with the customer. The add-on's documentation states that customers are 'advised to thoroughly test and evaluate the outputs for suitability and accuracy, maintaining human oversight especially in sensitive areas such as legal matters', that 'None of the Advanced AI and Data Products provide legal or professional advice' and that they 'do not create an attorney-client relationship'. For the base suite the documentation describes no generative output that would need review. | For the base suite without the add-on, is there any output a fulfiller is expected to check before relying on it, and where is the record of who checked it? | [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |

## Notes

What the suite does is established from the vendor's own documentation. Data handling is established from two binding documents read in full on 2026-09-27 - the Data Processing Addendum with its Standard Contractual Clauses and Data Security Guide, and an Ordering Agreement - but both carry a caveat recorded in the considerations: the addendum is pre-signed with 2019 signing dates, uses the Standard Contractual Clauses made under Directive 95/46/EC and refers to the Privacy Shield framework, while the only ordering agreement reachable on the vendor's site is the ServiceNow Japan G.K. version governed by Japanese law. Not established: the Australian contracting entity and its ACN or ABN; the Australian ordering agreement and schedules page; whether any model is called by the base suite at all; retention periods; the country of the mirrored data centre for an Australian instance; and the standing subprocessor list, which the trust privacy page names but does not link. Not reached within the operation cap, and all login-protected or not found: the ServiceNow CORE Compliance Portal (KB0564067), the Customer Security Portal, the Customer Support Addendum, and knowledge base articles KB0743854, KB1584492 and KB2593939, which the vendor itself names as the source of truth for AI feature and model availability by data centre, including the Australia IRAP-Protected data centre. Capability vocabulary gap reported to the Maestro: no CAPABILITY value expresses litigation-hold preservation, so the Legal Hold Notification application is described in the findings but carries no tag of its own, and 'conflict-checking' is used for employee conflict-of-interest disclosure rather than law firm client and matter conflict searching.

## Sources

- [ServiceNow product documentation - Legal Service Delivery (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) (checked 2026-09-27)
- [ServiceNow localised Australian product page - Legal Service Delivery](https://www.servicenow.com/au/products/legal-service-delivery.html) (checked 2026-09-27)
- [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) (checked 2026-09-27)
- [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) (checked 2026-09-27)
- [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html) (checked 2026-09-27)
- [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf) (checked 2026-09-27)
- [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, the separately licensed add-on (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) (checked 2026-09-27)
- [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html) (checked 2026-09-27)
- [ServiceNow trust - Privacy](https://www.servicenow.com/company/trust/privacy.html) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.