Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Intake web app for family law and estate planning, customised with Client Materials. AI Services are optional and require each User's express authorisation. LEAP bundle is a distinct commercial path. Terms last updated 14 July 2026.
Ask: Confirm whether we are on a direct Settify licence or the LEAP bundle, and whether AI Services are enabled.
Deployment model
Public claim only
SaaS on 'Settify Servers' with an embeddable Application. No region, AWS/Azure name or on-premises option is in the Terms. The DPA page did not scrape.
Ask: Where are User Files, backups and OpenAI processing hosted, and is an Australian region available?
AI features in scope
Public claim only
AI Services may provide matter summaries or briefs, predictions and/or insights from User File data using machine-learning and generative AI, including OpenAI, only after the User authorises AI processing. Core intake works without AI.
Ask: Which AI outputs (summaries, predictions, briefs) will be on, and can we disable AI entirely?
Jurisdictions and legal content
Public claim only
Questionnaires are family-law and estate-planning intake, not a case-law product. AI is disclaimed as not legal advice and may not reflect applicable laws. AU clients: Victorian law (cl 20(7)).
Ask: Confirm Victorian law on our Services Agreement, and that AI will not browse open-web Australian law.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
End Users are the firm's prospective clients completing questionnaires via embed or invite. User Files go to the firm only after the User authorises disclosure (and conflict check). AI processing needs a further User authorisation. The firm must publish its own privacy notice to Users.
Ask: What User-facing wording discloses OpenAI, and can we run intake with AI off?
Foundation-model providers
Public claim only
Terms cl 11(2)(d): third-party AI services including OpenAI's large-scale language-generation model and others from time to time. No model version, entity, region or ZDR is stated.
Ask: Name each model, OpenAI entity, endpoint region and retention contract, and the notice period before a model is swapped.
Subprocessors
Not confirmed
OpenAI is named in the Terms. The DPA at settify.com/gdpr did not scrape. No dated public register of other processors (hosting, email, analytics) was found.
Ask: Provide the current dated subprocessor register, including OpenAI and hosting, with country, purpose and objection rights.
Training on customer content
Public claim only
cl 10(1)(b)(ii): Settify may use User Files to analyse, evaluate and improve the Application and the service, including through data analysis. cl 10(1)(c): anonymised User Files for research and marketing. There is no clause prohibiting OpenAI from training on prompts. Those uses are not the same as a no-training warranty.
Ask: Does any signed DPA prohibit training of Settify or OpenAI models on User Files, prompts and AI outputs?
Feedback and quality monitoring
Public claim only
Metadata about how and when the Application is used is owned by Settify (cl 10(2)). Improvement use of User Files is authorised. Whether solicitor edits of AI briefs train a shared model is not stated.
Ask: Do solicitor corrections of AI briefs stay in our instance only?
Retention of prompts, outputs and matter indexes
Not confirmed
No numbered retention schedule for User Files, AI prompts or OpenAI logs. Privacy hub pages for customers and end users did not scrape.
Ask: State default and configurable retention for User Files, AI briefs and OpenAI logs, including after a User withdraws.
Deletion and certified erasure
Not confirmed
On termination: access ends, Embed Code must be removed, remaining authorised User Files are disclosed to the Client. No certified deletion of Settify copies, backups or OpenAI is stated.
Ask: On exit, what is deleted (User Files, AI briefs, OpenAI), in what period, and will you certify deletion in writing?
Vendor and verifier access to content
Public claim only
Settify uses User Files for support and troubleshooting (cl 10(1)(b)(i)) and to improve the Application. Confidentiality clause covers agreement terms and business information, not a ticketed-access log for User Files.
Ask: Who can read User Files and AI briefs, from which countries, under what approval, and can we see those access logs?
Access control, SSO and audit
Not confirmed
SSO/MFA/audit-log export were not described. Access is via Embed Code and email invite. Conflict check is a Client obligation before seeing a User File.
Ask: Confirm MFA/SSO if any, and whether we can export a complete User File and AI-brief audit log.
Encryption in transit and at rest
Not confirmed
No encryption statement on the Terms or privacy hub pages that scraped.
Ask: Confirm TLS and at-rest encryption for User Files and the OpenAI path, and whether customer-managed keys exist.
Independent security assurance
Not confirmed
No SOC 2 or ISO 27001 claim was found on the pages read.
Ask: Provide any current SOC 2 or ISO 27001 report covering Settify and OpenAI processing.
Contract, DPA, liability and forum
Public claim only
Terms (14 July 2026) incorporate a Services Agreement, DPA (gdpr URL) and Privacy Policy. AU: Victorian law. Liability cap = fees in the prior 12 months; no consequential loss. Client indemnifies Settify for Client breach. AI is as-is and not legal advice. DPA page did not scrape.
Ask: Provide the signed Services Agreement and DPA, and confirm the gdpr URL is the current DPA for Australian clients.
Cross-border transfers and APP 8
Not confirmed
OpenAI is a US-headquartered provider. Hosting region is unnamed. End-user and customer privacy subpages did not scrape. APP 8 analysis cannot be completed from the hub page.
Ask: List every country for User File storage, OpenAI inference, backups and support.
Incident notification and history
Not confirmed
No Security Breach notification period was found in the Terms. Incident history was not published.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months.
Change notice for models, terms and processors
Public claim only
Material Agreement changes: reasonable prior written notice; Client may terminate under cl 12 if it disagrees. OpenAI 'and others from time to time' is not a frozen model list. Subprocessor notice lives in the unscanned DPA.
Ask: What written notice will we get before a new AI provider is added, and can we object without terminating?
Export and exit
Public claim only
Export of User data in XML, CSV or JSON on request during the relationship. On termination, remaining authorised User Files are disclosed; Embed Code must be removed. Certified deletion is not stated. LEAP-bundle exit follows LEAP eligibility.
Ask: What export we receive for User Files and AI briefs, and will you certify deletion including OpenAI within 30 days?
Connectors and third-party AI tools
Not confirmed
LEAP bundle and Smokeball logos. Embed Code on the firm's public website. OpenAI for AI Services. Enabling each is the firm's choice.
Ask: List every connector (LEAP, Smokeball, OpenAI, analytics) that will be on and the data each receives.
Open-web search
Not confirmed
AI Services are described as based on User File data. No open-web browsing toggle was found. OpenAI models may have their own browsing depending on the unnamed product.
Ask: Does Settify AI browse the open web, and can we disable any such retrieval?
Agent actions and confirmation
Not confirmed
The Application collects User Files and, if authorised, runs AI. It does not claim to file court documents. Disclosure to the firm still requires User authorisation and the firm's conflict confirmation.
Ask: Can any Settify workflow email a client or write to LEAP/Smokeball without a second lawyer confirmation?
Human review before use
Public claim only
cl 11(2)(b)–(c): AI Services are not legal advice and should be reviewed by a qualified solicitor before being incorporated in or relied on in connection with any legal advice. The product does not technically force that review.
Ask: Can we require every AI brief to be marked reviewed by a named solicitor before it is visible on the matter?