Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
Contracting entity is Tensis Group Pty Ltd trading as Smarter Drafter (ABN 16 163 715 428). AU App Usage Terms (20 September 2024) list Core plus modules: Court Documents, Marketplace, Essentials, PMS/DMS integration, Intake 2.0, E-Signatures, Word plugin, Clause Bank, AI Tools, Author; eCommerce portal is discontinued. Smarter Drafter Pro has separate Global Subscription Terms (26 June 2026) and is sold via implementation partners.
Ask: Confirm we are buying AU Core/Essentials (or FLENA) versus Pro, which modules are on the Order, and which PDF (App Usage Terms 20 September 2024 versus Pro Global Terms 26 June 2026) is incorporated.
Deployment model
Not confirmed
The product is SaaS (app.smarterdrafter.com.au). The AU homepage says both a 'locally-hosted solution' and 'Hosted onshore, with Microsoft Azure cloud'. Microsoft 365 App Certification for the Pro Word add-in (developer update 11 August 2025) states PaaS on Azure and HQ Australia. Privacy (16 July 2024) lists cloud hosting 'e.g. AWS, Microsoft Azure'. No on-premises option was found.
Ask: Name the Azure region(s) for our AU tenancy, whether any AWS services still process matter data, and whether private cloud or customer-VNet isolation is available.
Product features in scope
Public claim only
AU pricing and Essentials pages: guided assembly, submission dashboard, Word/PDF output, firm-wide Clause Bank in Word, branded documents, PMS integration, Google Maps and ABR lookup, instruction-taking forms, e-signatures. App Usage Terms add Court Documents, Marketplace, Intake 2.0, Author and AI Tools (document summary and cover-letter writing). Pro/.com additionally markets MCP (private beta) to drive automations from an AI agent.
Ask: Which of Essentials, FLENA, Author, AI Tools, Intake, e-signatures, each PMS/DMS connector and MCP will be enabled, and which are generally available versus beta?
Governing law and Australian coverage
Public claim only
AU App Usage Terms and Pro Global Terms are governed by the laws of New South Wales. AU customers submit to the non-exclusive jurisdiction of the NSW courts. Non-AU Pro customers go to ACICA arbitration seated in Sydney. Content is Australian precedents, court forms and FLENA family-law materials; Lexon documents are limited to Lexon-insured firms.
Ask: Will the Order keep NSW law and courts, and which Australian precedent banks and court-form packs are actually licensed for our practice areas?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who is controller, and client-matter authority
Public claim only
Privacy: Tensis is controller for the website and processor for customer services, processing only on customer instructions and applicable agreements. App Usage Terms nonetheless grant Tensis a licence to use User Data for marketing, new products and services and, for the Word plugin, to develop new AI services. Permitted Purpose is legal services to an existing client on an active matter. Customer must comply with Privacy laws for client data.
Ask: Confirm in writing that for our tenancy Tensis is processor only of matter data, that the Word-plugin AI-services licence is disapplied or narrowed, and that marketing use of User Data is off.
Foundation-model provider
Public claim only
AU App Usage Terms name an 'AI Tools' module (document summary and cover-letter writing) but do not name a model vendor. Pro Global Terms s 8.2 state that certain Pro features leverage Azure OpenAI (or affiliates/licensors). MCP is demonstrated with Claude and is described as MCP-standard so other MCP-compatible agents should connect. Customer model choice was not found.
Ask: Name every model and inference region used for AI Tools on AU Core and for Pro, whether Azure OpenAI is the only LLM, and whether we can disable generative features.
Subprocessors and subprocessors list
Not confirmed
No published subprocessor schedule was found. Privacy gives examples only: AWS, Microsoft Azure, analytics and CRM, Stripe, professional advisers, support, marketing/research partners. Payments: Stripe; Tensis says it does not store full card details. Pro terms allow need-to-know access by third-party partners to Customer Data to deliver the service.
Ask: Provide a current named subprocessor list with locations, functions and change-notice period, including Stripe, Azure/OpenAI, AWS, HubSpot/analytics and any e-sign or PMS connectors.
Training and secondary use of customer content
Not confirmed
AU App Usage Terms s 5.2: to use the Word plugin, Tensis will use User Data to develop new AI services and the customer must consent. Privacy: 'Where appropriate, we may also use data to improve our systems, including training and refining automation and AI-assisted functionality.' Pro s 8.2(b): Customer Data used with Azure OpenAI features is not used to train Azure OpenAI. Pro s 9.5: Tensis may use Usage Data (including anonymised/aggregated) to improve the Services.
Ask: For our Order, is User Data/Customer Data used to train Tensis models or automations, is the Word-plugin AI-services licence in force, and is Azure OpenAI (or any other LLM) on zero-retention?
Feedback and evaluation use
Public claim only
AU terms s 4.2: Tensis employees or representatives may view User Data to provide support and to evaluate future enhancement of products/services, and may disclose User Data to a third party to improve products/services. Pro s 19.11: Feedback is not confidential and Tensis may use it freely. Pro Usage Data is owned by Tensis.
Ask: Can support access and product-improvement review of live matter data be limited to named tickets, and is Feedback defined to exclude prompts and documents?
Retention of prompts, documents and logs
Public claim only
Privacy: retain personal information only as long as necessary to provide services, fulfil the policy purposes, comply with law, and resolve disputes, then delete or anonymise. AU App Usage Terms set no numbered day-count. Pro: Customer Content and Field Data stay in the Customer Instance for the subscription; Usage Data stored in Pro and retained or deleted at Tensis' discretion; 90-day post-termination extract window.
Ask: State retention periods for AU Core form data, generated documents, backups, support tickets, logs and any AI Tools prompts/outputs, including backup lag.
Deletion and certified erasure
Public claim only
AU terms s 6.1(a)(viii): if a client requests amendment or deletion of personal information stored on Tensis' database, the customer must tell Tensis as soon as reasonably practical so Tensis can make equivalent changes 'if We are able to do so'. Privacy lists deletion as an EU/UK and CCPA right, not as an Australian Privacy Act right. Pro: customer may delete Documents and Field Data during the term; after the 90-day exit window Tensis may delete or archive, except data it reasonably must keep for compliance, audit or legal obligations. No certificate-of-deletion clause was found.
Ask: What is the maximum time to delete AU Core User Data on request, including backups, and will you issue a written deletion certificate?
Vendor staff access to matter data
Public claim only
AU terms s 4.2 expressly allow employees or representatives to view User Data for support and product improvement. Pro s 9.6(b): Tensis may grant third-party partners need-to-know access to Customer Data to deliver the service, with confidentiality obligations; Tensis remains responsible. Pro also contemplates remote access to the Customer Environment under the SLA. Microsoft certification: MFA for code repositories, DNS and credentials; employee account provisioning process claimed.
Ask: Is staff access to our matter data logged, MFA-gated, limited to ticketed support, and available as an audit export? Are implementation partners in scope?
SSO, MFA, roles and audit logs
Not confirmed
Microsoft certification (Pro Word add-in): no Microsoft Entra ID SSO; MFA enabled for vendor code repos/DNS/credentials, not stated for customer logins. MCP page: OAuth 2.1 so the agent only surfaces automations each user is permitted to access, plus an audit trail of MCP actions. .com security strip: 'Multifactor authentication keeps your data protected'. Customer-facing SSO/SCIM for AU Core was not found.
Ask: Does AU Core support Entra/Okta SSO, mandatory MFA, role-based admin, ethical walls and exportable audit logs on our plan?
Encryption in transit and at rest
Public claim only
Site footer and MCP/security strip: '4096-bit SSL encrypted' and 'Latest version of TLS and data encrypted at rest'. Privacy: 'encryption where appropriate'. No public statement of algorithms, key management or customer-managed keys. Microsoft certification does not spell out encryption ciphers.
Ask: Confirm TLS version, at-rest algorithm, key custody (including Azure), and whether customer-managed keys are available for AU Core and Pro.
SOC, ISO and other audits
Not confirmed
AU and .com sites claim ISO/IEC 27001 certification. Microsoft publisher attestation (11 August 2025) for Smarter Drafter Pro: ISO 27001 Yes; SOC 2 No; SOC 3 No; CSA Star No; FedRAMP No; annual pentest Yes; quarterly vulnerability scanning Yes; annual PCI DSS assessments Yes. The ISO certificate itself was not inspected. The Security Fact Sheet URL is a marketing page with a download CTA, not the certificate.
Ask: Provide the current ISO 27001 certificate (scope, dates, registrar) and say whether a SOC 2 Type II exists for AU Core despite the Microsoft 'No'.
Contract, DPA, liability and indemnity
Public claim only
AU Core is click-to-accept App Usage Terms plus Privacy Policy; no standalone DPA was found. Liability for non-excludable warranties is limited to resupply or the cost of resupply; broader liability is disclaimed to the maximum extent permitted. Customer indemnifies Tensis. Documents are not legal advice; Tensis is not a law firm. Pro Global Terms include processor-style privacy clauses (documented instructions, TOMs, Security Fact Sheet) but still no separate DPA URL. Privacy Legal Hub date (16 April 2026) disagrees with the live privacy page (16 July 2024).
Ask: Will you sign a DPA that binds subprocessors, sets an Australian-law liability cap in multiples of fees, and confirms which privacy text is current?
Cross-border transfers and residency
Not confirmed
AU homepage: hosted onshore on Microsoft Azure. Privacy and Pro s 11.3: personal information may be transferred to and processed in Australia, the United States, the United Kingdom and the European Union, with SCCs and adequacy mentioned as examples. Privacy also lists AWS as a hosting example. Microsoft certification names Azure only. No APP 8 assessment was published.
Ask: Map every flow of our matter data (Azure region, AWS if any, Stripe, Azure OpenAI, Claude/MCP, HubSpot) and confirm AU-only storage for AU Core if that is what we require.
Breach notification
Public claim only
Microsoft publisher attestation: Tensis reports app or service data breaches to supervisory authorities and affected individuals within 72 hours of detection. That is an attestation about the Pro Word add-in, not a clause in the AU App Usage Terms. Privacy requires compliance with applicable law (NBD scheme would apply in Australia) but does not restate a 72-hour customer-notice SLA. No public incident history was found.
Ask: Write a 72-hour (or faster) customer-notice SLA into our Order, including the notification email and whether the Microsoft attestation covers AU Core.
Unilateral term and product changes
Public claim only
AU terms s 12.5: Tensis may amend the App Usage Terms and any policy at any time in its sole discretion, effective immediately unless otherwise noted; continued use is acceptance. Products and third-party suppliers may be replaced, removed or added. Privacy may be updated with website posting and notice 'where appropriate'. Pro terms contemplate new functionality that may need extra fees.
Ask: Will material privacy, AI-training, hosting-region or liability changes require 30 days' written notice and a right to terminate without penalty?
Export, termination and lock-in
Public claim only
AU terms: you may use Database content only while the subscription is active; duplicating or varying content after expiry is a copyright and Fair Use Policy breach. Output during the term is Word and PDF. No AU Core export/certified-deletion timetable was found. Pro s 13.4: 90 days to extract Customer Data after termination, then Tensis may delete or archive. Mid-term cancellation of the 12-month AU term is not allowed.
Ask: On termination of AU Core, in what formats and within how many days can we export matter data and firm clauses, and may we keep previously generated Word/PDF client documents?
PMS, DMS and agent connectors
Public claim only
Contractual modules include PMS and DMS integration. Logo list: iManage, Actionstep, Clio, Smokeball, LEAP, NetDocuments, Aderant, Elite, DocuSign, Dye & Durham. MCP (Pro/.com, private beta) connects an AI agent to Smarter Drafter automations, can pull from PMS/DMS, and says saving to a DMS is expected via the DMS vendor's own MCP (e.g. iManage) rather than Smarter Drafter. MCP setup is described at developers.smarterdrafter.com (unread).
Ask: Which connectors are in our Order, what data they sync, and is MCP in or out of scope (including which agent platforms are supported)?
Open-web search and browsing
Not confirmed
No product page or term was found that describes the AU Core or Pro automation engine browsing the open web. MCP uses the customer's chosen AI agent (Claude in demos); that agent's own web-search tools would be outside Smarter Drafter's terms. Google Maps and ABR lookups are listed as data lookups, not general web search.
Ask: Does any Smarter Drafter feature send matter text to an open-web search index, and if MCP is enabled, can the connected agent’s web search be disabled?
What the tool may do without a click
Public claim only
Core assembly is form-driven document generation, not an unsupervised agent. MCP is designed so a natural-language request in Claude (or another MCP client) selects a template, gathers fields and produces a document; OAuth 2.1 scopes actions to the user. It is described as private beta. E-signatures send generated documents to clients for signing — a client-facing action once a user triggers send.
Ask: For our tenancy, which actions (generate, save to DMS, send for e-sign, MCP) require an in-product confirmation, and is MCP disabled by default?
Required lawyer review before client use
Public claim only
AU terms s 6.1(a)(ii): a document must never be forwarded to the client without first undertaking a thorough legal review. s 8.1: Tensis is not a law firm; documents are not complete and cannot be fit for a particular client's purposes; they are not the only matter to consider and are not legal advice. Pro s 8.2(a): the customer is solely responsible for reviewing Azure OpenAI outputs and must not rely on them as a sole source of truth.
Ask: Will you contract that court forms, AI Tools output and MCP-generated documents remain lawyer-reviewed before filing or client send, with no vendor warranty of legal correctness?
