Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Archie is marketed as the Smokeball AI matter assistant. Pricing lists it as an add-on on Boost, Grow and Prosper+ without a published fee; Bill has no Archie add-on. Support badges say Archie is available on Boost, Grow and Prosper+. LawY is included with the Archie add-on. Intake and AutoTime are separate add-ons.
Ask: Confirm our Australian order form: which plan, whether Archie and LawY are included or extra, any usage caps, and which Archie Apps are in or out of scope.
Deployment model
Public claim only
Smokeball is sold as multi-tenant SaaS hosted on AWS, with desktop, web, Word and Outlook clients. No public on-premises or private-cloud option for Archie was found. Shared-responsibility text puts end-device security and MFA setup on the firm.
Ask: Is our tenant exclusively in an Australian AWS region, including replicas, logs and Archie indexes, and is any private-cloud option available?
AI features in scope
Public claim only
Archie answers matter questions with document citations, drafts correspondence, reviews documents against firm playbooks, edits in Word, summarises Outlook threads, creates tasks/memos/events after confirmation, accepts knowledge-source uploads, and can send a response to the Client Portal. Legal questions can be routed to LawY, including Deep Research and optional lawyer verification. Archie Apps are a marketplace of third-party AI tools.
Ask: Which of Archie chat, Word, Outlook, playbooks, knowledge sources, LawY (including Deep Research and verification), Client Portal send, and named Archie Apps will be enabled for which roles?
Jurisdictions and legal content
Public claim only
The Australian site and terms are NSW-governed for AU customers. LawY in Archie is described as available for all practice areas and matter types across all Australian states, with a proprietary knowledge base. Currency of authorities and whether a licensed citator is used are not specified on the pages read.
Ask: List the Australian collections, jurisdictions and currency controls LawY actually searches for our matter types, and whether unverified answers are labelled as such.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
AU terms put Client Consents on the firm, including privacy consents to provide Client Data to Smokeball and to 'Interfacing Third Parties'. Enabling Archie indexes the 50 most recent matters. Drafts can be sent to the Client Portal. No template AI-disclosure or court-practice-note wording was found. Putting matter files into Archie or facts into LawY is the firm's authority decision.
Ask: What client-disclosure wording, matter-exclusion controls and court-practice-note records (for example NSW SC Gen 23) does Smokeball supply, and can we block Archie and LawY on nominated matters?
Foundation-model providers
Public claim only
Configure Archie Settings (AU help, reviewed 2026-09-20) lists OpenAI GPT-5.2 (default, including Thinking), GPT-5.3, GPT-5.4, GPT-5.5 (including Thinking), and Anthropic Claude Opus 4.6 (including Thinking) and Opus 4.7. It claims all listed models passed a privacy and security review and do not share, use, store or train on user data. Endpoint region (Azure, Bedrock or direct API) is not stated. LawY uses its own models.
Ask: For our tenant, name each model, legal entity, endpoint region and contract (including Azure/Bedrock if used), and the notice period before a model is added or swapped, including LawY.
Subprocessors
Not confirmed
The AI privacy article says cloud and AI providers operate under DPAs and that relevant subprocessors 'can be reviewed in the Smokeball marketplace' or via a Smokeball contact. Privacy names ChurnZero, Salesforce, Zendesk, Pardot, Jira/Confluence, Outreach and Google Analytics, plus Group companies and payment processors. OpenAI, Anthropic, AWS and LawY Pty Ltd are not on a dated public subprocessor register. The marketplace is a partner directory, not a processor list.
Ask: Provide the current dated subprocessor register for Australian Smokeball plus Archie and LawY, with entity, country, purpose, data types, and our notice and objection rights.
Training on customer content
Not confirmed
Security, Archie marketing and the AI privacy article say customer data is never used to train Smokeball or third-party models and that Archie runs under enterprise zero-retention agreements. AU terms clause 20 nevertheless allow Smokeball to de-identify and aggregate Client Data and use it to improve and develop products. LawY is included with Archie; LawY Terms clause 7.1 authorise LawY and its AI providers to use Input and Output to develop and improve products, including training machine-learning models. Smokeball does not publish which document prevails for LawY-in-Archie.
Ask: Which signed document prevails for Archie and LawY-in-Archie, and does it prohibit training and product improvement on prompts, outputs, uploads, embeddings, feedback and telemetry, including by OpenAI, Anthropic and LawY?
Feedback and quality monitoring
Public claim only
Archie invites thumbs-up/down on user-initiated chats 'to help refine the quality of Archie's responses in real-time'. AU terms treat Feedback as non-confidential, non-proprietary and exclusively owned by Smokeball. Usage Data (excluding Client Data) may be used to improve the Services. Whether ratings include prompt text or are used for model training is not stated.
Ask: Can we disable rating feedback, and is feedback content excluded from model training and from access by staff outside a ticketed review?
Retention of prompts, outputs and matter indexes
Public claim only
Help centre claims zero retention at the model-provider API. Archie keeps per-user conversation history and a question log visible to authorised users on the matter; users can clear their own history, not others'. Privacy retains personal data while a legitimate need exists and may keep it after subscription end for legal reasons. No published default for Archie embeddings or knowledge-source copies.
Ask: State default and configurable retention for Archie chats, embeddings, knowledge sources, LawY conversations, verified-answer copies, logs and backups for the Australian tenant.
Deletion and certified erasure
Public claim only
On termination, AU terms grant 30 days to retrieve data, after which Smokeball may delete the account and data. Privacy says unused personal data is deleted or anonymised, or isolated in backups until deletion is possible. Individuals may request deletion. No public certified-deletion SLA covering model providers or LawY was found.
Ask: On exit or matter close, what is deleted (chats, embeddings, knowledge sources, LawY history, backups, subprocessors), in what period, and will you certify deletion in writing?
Vendor and verifier access to content
Public claim only
Terms and privacy allow Smokeball staff to view Client Data as reasonably necessary for support, training and maintenance, including remote screen access and incidental capture in call recordings. LawY Deep Research + Verification sends research and selected matter facts to a 'qualified lawyer in the practice area' (about 1–3 business days). Model-provider staff access is not described beyond ZDR claims.
Ask: Who can read our matter content (Smokeball, LawY, verifiers, model providers), under what ticketed approval, from which countries, and can we see those access logs and disable LawY verification?
Access control, SSO and audit
Not confirmed
By default all firm users can use Archie; a Firm Owner can disable it per user. Archie follows existing matter permissions. 2FA is stated as mandatory from 30 November 2025. SSO via Microsoft Entra SAML is an optional setup Smokeball enables after 2FA. Question logs are visible to authorised users on the matter. SCIM and a firm-wide Archie audit export were not described. Knowledge sources can be activated for all staff and all matter types.
Ask: Confirm Entra SSO/SCIM availability on our plan, default-off Archie, per-matter AI blocks, and whether we can export a complete Archie/LawY audit log.
Encryption in transit and at rest
Public claim only
The security policy and AI privacy article claim AES-256 at rest and TLS 1.2+ in transit. The privacy notice instead describes 'encryption utilising a minimum of TLS 1.2 for data in transit and at rest'. Customer-managed keys were not offered on the pages read.
Ask: Confirm encryption of Archie indexes, knowledge sources, logs and the path to each model provider and LawY, and whether customer-managed keys are available for the Australian tenant.
Independent security assurance
Public claim only
Smokeball claims ISO 27001 and ISO 27001:2022 certification of its ISMS. It claims annual independent penetration testing, most recently October 2025 with no critical, high or medium issues. AWS's SOC 2 and ISO 42001 are cited for infrastructure, not as Smokeball certifications. No certificate number, scope statement or report was inspected. SOC 2 for Smokeball itself was not claimed on the AU pages read.
Ask: Provide the current ISO 27001 certificate and any SOC 2 Type II report covering Archie, with scope, exceptions, bridge letter and the October 2025 (or later) penetration-test summary.
Contract, DPA, liability and forum
Public claim only
AU terms (9 July 2026) are governed by NSW law with exclusive NSW courts. Aggregate liability is capped at fees paid in the preceding one-year period, with ACL non-excludable guarantees preserved. There is an IPR indemnity with customer-side carve-outs. No AI-specific warranty, output IP clause, or prompt confidentiality term was found. A standalone DPA URL is not published; the help article says DPAs exist and a contact can provide them. LawY has its own terms.
Ask: Provide the APP-aligned DPA, confirmation whether LawY terms are incorporated, and any negotiated overrides of the one-year liability cap, training/improvement licence and unilateral-change clause.
Cross-border transfers and APP 8
Not confirmed
The AI privacy article says, as a principle, Australian data stays in Australia and transfers are governed by DPAs. The privacy notice (2 June 2026) says Group servers are in the UK, United States and Australia, providers also operate in Japan, and collected personal data may be processed in any of those countries. Model-provider inference regions are not named. UK-to-non-adequate transfers are described as using the UK IDTA; an APP 8 pack is not published.
Ask: For Archie and LawY, list every country for storage, inference, backups, support and logs, the transfer mechanism, and whether an Australia-only inference option exists.
Incident notification and history
Not confirmed
The security policy mentions incident-response planning and 24/7-style monitoring in the AI FAQ. Privacy directs privacy complaints to Smokeball and notes the OAIC. No public contractual timeline (for example 72 hours), NDB cooperation clause, or incident history was found. Status pages are linked from support (status.smokeball.com.au) but were not used as a substitute for a notification SLA.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, subprocessor incidents, named contact, and any material incidents in the last 24 months affecting Archie or LawY.
Change notice for models, terms and processors
Public claim only
Terms clause 5 allows Smokeball to change the Terms and the Services during a subscription if the change does not add fees or deprive a substantial or material benefit. Operational emails to the nominated contact cannot be opted out of. No published notice period for adding model providers or subprocessors was found. Model options in Archie settings can change as new GPT/Claude releases are listed.
Ask: What written notice will we get before a new model, subprocessor or LawY term is introduced, and can we object or freeze the model list?
Export and exit
Public claim only
On termination or end of term, the firm has 30 days of limited access to retrieve data, then Smokeball may delete the account. The firm must uninstall clients and extract data within 30 days. Export formats, Archie/LawY history portability and certified deletion of model-provider copies are not specified.
Ask: What export formats cover matters, documents, Archie chats and LawY history, and will you certify deletion from Smokeball, LawY and model providers within 30 days?
Connectors and third-party AI tools
Not confirmed
Archie Apps are marketed as a marketplace of specialised AI tools (examples: bank-statement analysis, chronologies, transcripts). Privacy says data shared with marketplace or interfacing services is governed by those providers' terms, not Smokeball's. LawY is a third-party research product inside Archie. Enabling a connector is the firm's configuration choice.
Ask: List every connector and Archie App that will be on for our tenant, the data each receives, and confirm they are out of scope unless we enable them in writing.
Open-web search
Public claim only
Legal questions in Archie can be routed to LawY's proprietary knowledge base rather than an advertised open-web search. No public Bing/Google browsing toggle for Archie was found. Knowledge sources are firm-uploaded documents. Whether Deep Research uses live web tools is not specified ('newest and latest AI tools and models').
Ask: Does Archie or LawY Deep Research browse the open web or unlicensed sources, and can we disable any such retrieval?
Agent actions and confirmation
Not confirmed
Archie can create tasks, memos and calendar events; help text says a draft is shown and Save is required. Word playbooks can Apply Edit or Apply all edits, then appear as tracked changes for Accept/Reject. Matter suggestions are described as one-click to run. Correspondence can be opened in Outlook or sent as a Client Portal message. Full workflow automation is stated as not yet supported for events.
Ask: Which Archie actions can execute without a second confirmation, can we disable portal-send and one-click suggestions, and are Word 'Apply all edits' logged?
Human review before use
Public claim only
The Smokeball AI disclaimer tells users an answer may be wrong and to verify citations. Terms say precedents and notifications are not legal advice and Smokeball is not a law firm. LawY requires users to check accuracy and offers optional paid-time verification by an external lawyer. Nothing in the terms requires a second solicitor to approve an Archie draft before it is sent to a client.
Ask: What product controls force a named reviewer before Client Portal send, Outlook send, or saving an Archie draft to the matter, and can those controls be mandated firm-wide?
