Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The product page publishes three tiers (Starter, Essential, Pro) of one cloud platform for electronic briefs and hearings, checked 2026-09-27. Law In Order lists SmartBundle in its navigation alongside separate products that are not SmartBundle: SmartAAI, Cicero, Smart DeDuper, eDiscoTech and managed access to Relativity aiR for Review. The login for SmartBundle is served at smartbundle.lawinorder.com under a path named lexelsignin.html.
Ask: Which SmartBundle tier, modules and AI functions are in our quote, and are SmartAAI, Cicero or Relativity aiR for Review included or separately licensed?
Deployment and hosting
Public claim only
SmartBundle is described as a secured cloud-based platform with no on-premises option published. The product page states the solutions use 'ISO27001-certified Australian datacentres'. The data security page describes the data centres as certified to ISO 27001, with critical data centres holding IRAP, SOC 1 Type II and SOC 2 Type II, but does not name a country or an operator.
Ask: Name the data centre operator and Australian region that will hold our bundle content, exhibits, multimedia and backups, and confirm in the Schedule that no copy leaves Australia.
AI functions in scope
Public claim only
The product page badges the whole platform as 'AI-powered', an 'AI Technology platform' and 'AI-driven' without attaching those words to any listed feature; the twelve itemised features are described in non-AI terms (matter creation and sharing, access control, upload and storage, boolean and OCR search, exhibit numbering and metadata, juror and witness annotation, in-court display, third-party integrations, storage, archiving and modification reporting). The FAQ on the same page is the only place where an AI function is itemised: 'SmartBundle leverages Lexel's GenAI technology to automate tasks like entity extraction, timeline generation, and case material summarisation.' No accuracy, evaluation or model information is published for those three functions.
Ask: Demonstrate entity extraction, timeline generation and summarisation on our own material, and state which tiers include them and whether they can be switched off per matter.
Jurisdiction and legal content
Public claim only
The platform holds the firm's own case material; no legal-research library, citator or primary-law content is published. Terms clause 13.2(c) states that the Services do not constitute legal, financial, merger, due diligence or risk management advice. The agreement is governed by NSW law with exclusive NSW jurisdiction (clause 25.10) and mediation appointments fall to the Law Society of New South Wales (clause 25.6).
Ask: Confirm no legal content or citation is generated by the AI functions, and that generated timelines and summaries are drawn only from the material we upload.
Vendor content directing how AI describes the product
Not confirmed
A deliberate check for vendor content directing how AI models, assistants or crawlers should describe the product found none, checked 2026-09-27. A site map of lawinorder.com searched on pricing, security, privacy, terms, subprocessors and ai returned 40 URLs that were case studies and awards news and surfaced no /llms.txt, /ai-info or equivalent page, and no such block appears on the four pages read.
Ask: Does Law In Order publish any page or embedded instruction aimed at AI models or crawlers describing SmartBundle, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and third-party access
Not confirmed
The platform is designed to grant access to parties outside the firm: the product page describes collaborative access for court staff, judges, counsel and witnesses, and a live jury book in which jurors and witnesses annotate digital exhibits. Terms clause 13.1(i) makes the customer responsible for all authorised users and anyone else it gives access to, and clause 13.2(b) forbids giving third parties access to the Services without the vendor's prior written consent. Clause 13.2(c) states the Services are not legal advice.
Ask: What client and court authority do we need before uploading privileged material and granting judge, juror or witness access, and how is each grant recorded and revoked?
AI technology and model providers
Public claim only
The FAQ names one supplier: 'SmartBundle leverages Lexel's GenAI technology to automate tasks like entity extraction, timeline generation, and case material summarisation.' No foundation model, model provider, model version or inference location is named anywhere on the pages read, and the terms contain no AI clause. The SmartBundle login is served from a path named lexelsignin.html, which is the only other appearance of that supplier name in the material read.
Ask: Name the legal entity behind Lexel, the models used for entity extraction, timeline generation and summarisation, the country where inference runs, and the contract between Law In Order and that supplier.
Subprocessors
Not confirmed
No subprocessor list or register is published: the site map and the four pages read surfaced none. The privacy policy says external service providers may receive personal information under agreements limiting use to specified purposes, and that while data is stored within Australia 'wherever possible', some vendors store data overseas 'including but not limited to UK and USA'. Terms clause 17.3 permits disclosure of anonymous usage data to service providers, and clause 8 contemplates unnamed Third Party Inputs.
Ask: Provide a dated subprocessor register for SmartBundle, including the GenAI supplier, the hosting provider and any overseas support entity, with country, purpose and data types for each.
Training and product improvement on customer content
Public claim only
Clause 16.8 grants a limited licence to copy, transmit, store, back up and otherwise access or use Your Data during the Term and for a reasonable period after it, in order to supply the Services, diagnose problems, 'enhance and otherwise modify the Services', perform Analytics, and 'develop other services, provided we de-identify Your Data'. The terms contain no clause about training, fine-tuning or prompting AI models, and no statement either way about whether bundle content reaches the GenAI supplier for model improvement. Clause 16.7 keeps ownership of Your Data with the customer.
Ask: Will you warrant in the Schedule that no bundle content, extracted entities, generated timelines or summaries are used to train or fine-tune any model, including the GenAI supplier's, and that clause 16.8(c) and (e) do not extend to that?
Analytics, telemetry and feedback
Public claim only
Clause 17.1 permits the vendor to monitor, analyse and compile statistical and performance information about the customer's use of the Services in aggregated and anonymised form (Analytics) and to make it publicly available, provided it carries no identifying information and is not compiled from a sample small enough to make underlying portions of Your Data identifiable. Clause 17.2 vests all rights in the Analytics in the vendor, and the definition of Your Data expressly excludes Analytics and back-end outputs. Clause 17.3 allows anonymous usage data to be disclosed to service providers to improve the Software Solution.
Ask: What exactly is captured as Analytics for the AI functions (prompts, extracted entities, corrections, ratings), and can our tenancy be excluded from clause 17.1 and 17.3?
Retention of bundle content and AI outputs
Public claim only
Clause 23.2(b) says Your Data is dealt with under the vendor's Data Retention Policy, which clause 26 defines as a document provided on request; it is not published. Clause 23.3 says documents are retained as required by law or regulatory requirements and that agreement to the terms is authority to retain or destroy documents in accordance with statutory periods. The data security page says retention varies by service or client request; no period is published for exhibits, annotations, juror notes, extracted entities or generated summaries.
Ask: Provide the Data Retention Policy and state the default and configurable retention for exhibits, annotations, juror notes, audit logs, extracted entities and generated summaries.
Deletion and certified erasure
Public claim only
The data security page states data is securely deleted using best-practice methods and that destruction certificates are available on request. The terms give no deletion timetable: clause 23.2(b) defers to the unpublished Data Retention Policy, clause 16.8 allows continued use of Your Data 'for a reasonable period after the Term', and clause 23.3 preserves retention required by law. The privacy policy says personal information is securely deleted or de-identified when no longer needed.
Ask: What is the contracted period for deleting bundle content and derived AI outputs after termination, does it bind the GenAI supplier and hosting provider, and will you issue a destruction certificate covering all of them?
Vendor access to content
Public claim only
The data security page states access to data and systems uses unique accounts, strong passwords and multi-factor authentication on a least-privilege basis, limited to personnel needed to deliver the requested services, with access logs reviewed regularly and changes recorded in the IT service desk. Personnel undergo identity and work-rights verification, two reference checks and an Australian Criminal History Check before employment. The service is a managed bureau with offices in Hyderabad and Chicago as well as four Australian cities, and no statement was found about which offices can access Australian client bundles; a managed security service provider monitors the environment 24/7.
Ask: Which offices and which third parties can open our bundles, under what ticketed approval, and can we receive the access log for our matters on request?
Access control, authentication and audit
Public claim only
The product page states high-level protection so only authorised individuals can access case material, with collaborative access for court staff, judges, counsel and witnesses, and lists 2FA among the security measures. Terms clause 5 requires an account with a per-user login, obliges the customer to keep credentials secure and notify suspected unauthorised access immediately, and permits the vendor to suspend access where it reasonably believes there has been unauthorised use. The data security page describes an Access Control Policy and least-privilege access for the vendor's own systems; single sign-on, SCIM and mandatory MFA for platform users are not described.
Ask: Is MFA mandatory for every SmartBundle user including external parties, is SSO supported, and can we export a complete access and annotation audit trail per matter?
Encryption in transit and at rest
Not confirmed
The sources disagree. The data security page says data transfers are facilitated using best-practice encryption and data transfer methods, and the product FAQ says security includes encrypted storage. Terms clause 13.2(a) states that the customer acknowledges and agrees that 'the technical processing and transmission of the Services, including Your Data, may be transferred unencrypted and involves transmissions over various networks'. No algorithm, TLS version or key-management arrangement is published.
Ask: Reconcile clause 13.2(a) with the encryption described on the data security page: which transfers of our data may be unencrypted, and will you contract to encrypt all of them in transit and at rest?
Independent security assurance
Public claim only
The data security page states Law In Order actively maintains ISO/IEC 27001 certification, has aligned with the ASD Essential Eight at maturity Level 3, and that all its data centres are certified to ISO 27001 with critical data centres holding IRAP, SOC 1 Type II and SOC 2 Type II. The product page makes a broader claim for the solutions: ISO27001-certified Australian datacentres, 2FA, 'IRAP Protected classification', and compliance with SOC 1, SOC 2, ASD Essential 8 and the Australian Government ISM. No certificate, statement of applicability, IRAP assessment report, SOC report or scope statement was read, and the vendor's supplier-selection criteria mention ISO/IEC 42001 for its providers rather than for itself.
Ask: Provide the ISO/IEC 27001 certificate and scope, the IRAP assessment report and its Protected-level conclusions, and the SOC reports for the data centres holding SmartBundle, with SmartBundle named in scope.
Contract, liability and forum
Public claim only
SmartBundle Terms and Conditions v1.2 (document reference 20260723) are accepted by signing, email confirmation, online acceptance, instructing the vendor to proceed or paying the fees, with a Schedule that prevails for specific terms. Liability is limited to resupply of the Services or repayment of fees paid in the 12 months before the event, with Consequential Loss excluded on both sides and Australian Consumer Law rights preserved; the agreement is governed by NSW law with exclusive NSW jurisdiction and a mediation step before proceedings. No data processing agreement, security schedule or AI schedule is published, and the extracted text names no contracting entity.
Ask: Name the contracting entity and its ACN, and provide any data processing agreement, security schedule and AI addendum, together with the negotiated position on the 12-month liability cap and clause 13.2(a).
Cross-border transfers
Not confirmed
The product page states the solutions use Australian data centres. The privacy policy is qualified: where the vendor engages external information technology service providers it ensures 'wherever possible' that data is stored within Australia, and states that some vendors do store data in overseas locations 'including but not limited to UK and USA', with reasonable steps taken so overseas recipients comply with the Australian Privacy Principles or substantially similar obligations. The vendor also operates offices in Hyderabad and Chicago, the terms contain no cross-border clause, and no country was published for the GenAI supplier or for inference.
Ask: For SmartBundle specifically, list every country in which our bundle content, backups, logs and AI inference occur, and confirm in the Schedule that none of it leaves Australia.
Incident notification and response
Public claim only
The privacy policy commits the vendor to comply with its obligations under the Notifiable Data Breaches scheme, including notification where required. The data security page describes 24/7 monitoring by a managed security service provider and a maintained Incident Response Plan covering identification, containment, remediation and reporting. The terms impose notification duties on the customer (clause 5.4 immediate notice of suspected unauthorised access, clause 13.1(h) 48 hours for a suspected breach of the agreement) but set no period within which the vendor must notify the customer of an incident affecting its data.
Ask: What contracted period from discovery will you notify us of an incident affecting our bundles, including one at the GenAI supplier or hosting provider, and have there been any in the last 24 months?
Change notice for the platform and its AI functions
Public claim only
The definition of Software Solution includes 'any updates, upgrades, patches, releases and modifications provided by us from time to time', and clause 7.2 allows scheduled and emergency maintenance with availability suspended and liability excluded. Customer-requested variations bind only when the vendor accepts them in writing (clause 12), and fee variations under clause 9.6 require 30 days' written notice with a right to terminate. Nothing in the terms requires notice before a change to the AI functions, the GenAI supplier or the models behind them, and the privacy policy may change from time to time.
Ask: What written notice will we get before the GenAI supplier, model or AI feature set changes, and can we hold a version for the duration of a live hearing?
Export and exit
Public claim only
On expiry or termination clause 23.2 ends the licence, requires payment for services provided, and deals with Your Data under the unpublished Data Retention Policy; it contains no export obligation, format commitment or migration assistance. Clause 16.9(b) states 'It is your responsibility to backup Your Data' and clause 9.4 excludes data recovery from support unless otherwise agreed. Where the vendor terminates for default, clause 23.4 requires fees for the remainder of the current term as a genuine pre-estimate of loss.
Ask: In what formats will exhibits, metadata, exhibit numbering, annotations and audit logs be returned on exit, in what period, at what cost, and will deletion be certified afterwards?
Connectors and third-party components
Public claim only
Clause 8 governs Third Party Inputs: the vendor obtains and maintains them where required, gives no warranty or representation in respect of them, and excludes liability to the extent a loss is caused by them, while the customer must comply with any third-party terms passed on and is liable for non-compliance. The product page says material can be transferred from eDiscovery or eTrial platforms but names no connector, and the GenAI supplier named in the FAQ is itself an unnamed-in-the-terms third party component.
Ask: List every third-party component and connector in the SmartBundle service, including the GenAI supplier, with its terms and the data each receives.
Open-web retrieval
Not confirmed
Nothing on the pages read describes open-web search or retrieval. The search function published is over material uploaded to the matter, using boolean operators and OCR cross-referencing within a customisable metadata framework. Whether the GenAI functions send text to an external endpoint, or retrieve anything from outside the tenancy, is not addressed on any page read.
Ask: Do entity extraction, timeline generation or summarisation call any external service or retrieve anything from outside our matter, and can that be disabled?
Automated actions
Not confirmed
No autonomous or agentic behaviour is described on the pages read: the published AI functions produce outputs (extracted entities, timelines, summaries) and the workflow actions described are user-driven, including exhibit numbering assigned in real time and annotation by jurors and witnesses. The terms contain no clause about automated actions, approvals or logging of AI-initiated steps.
Ask: Can any AI function change matter data, exhibit numbering or shared bundles without a user pressing a button, and is every such change logged?
Human review of AI outputs
Not confirmed
No product control requiring review of an AI output before use is published. Clause 13.2(c) states the Services do not constitute legal, financial, merger, due diligence or risk management advice, and clause 16.10(c) makes output quality dependent on the customer's own data, leaving verification of extracted entities, generated timelines and summaries to the firm to design. The archiving feature produces reports on document modifications and annotations, which records changes rather than requiring review.
Ask: What in-product controls can force a named reviewer to approve a generated timeline or summary before it is shared with counsel, the court or a witness?
