Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Archie is the vendor's named AI assistant inside the Smokeball practice-management system. The Australian pricing page lists it as an add-on on the Boost ($129 per user per month), Grow ($249) and Prosper+ (custom price) plans and not on Bill ($59), and where the Intake and Autotime add-ons carry published figures the Archie line carries a 'Learn more' link instead of a price. Terms clause 11 defines an Add-on as a module offered for purchase separately from the core Services and charges the applicable fee for it.
Ask: Which Archie functions are on our order form, at what per-user fee, and can a Boost or Grow subscription be run with Archie switched off for named users?
What Archie is described as doing
Public claim only
The product page, read 2026-09-27, describes: asking 'what's happened, what's missing, or what comes next' with 'the answer arrives with the file behind it'; document and matter summaries 'including meetings, deadlines, and tasks - all linked to the source'; analysis of a matter as it changes to produce 'next best steps'; document comparison 'to catch conflicting terms or discrepancies'; surfacing LawY's 'jurisdiction-aware guidance, applied to your matter - with the option to have a lawyer verify the answer'; drafting with matter context in Microsoft Word, Microsoft Outlook and Smokeball, including summarising email threads and drafting replies with adjustable tone, length and style; and Playbooks, which 'automatically review each document against rules you define, flagging issues and suggesting fixes'. The same content is served at /features/archie-ai.
Ask: Demonstrate each Archie function on one of our own matters, and state which are generally available, which are in preview and which require a specific Archie App.
Archie Apps
Public claim only
The product page describes 'Archie Apps' as 'a marketplace of specialised AI tools, purpose-built for legal work, from analysing bank statements to building a legal chronology or turning a recording into a transcript', read 2026-09-27. No list of available apps, no publisher information and no pricing for individual apps appears on the product or pricing pages, and Archie Apps are not mentioned in the terms of service.
Ask: Provide the current list of Archie Apps, who publishes each one, whether each is charged separately, and where each app processes the data it is given.
Deployment and hosting
Public claim only
The security policy, read 2026-09-27, states 'Smokeball's solutions are hosted on Amazon Web Services (AWS)' and that 'our infrastructure is architected across multiple AWS Availability Zones'; it names no AWS region. The privacy policy states 'Our servers and the Smokeball Group companies are located in the United Kingdom, the United States, and Australia.' No on-premises or private-cloud option and no region election appears in the terms, the privacy policy or the security policy, and the terms contain no hosting clause at all.
Ask: Name the AWS region and availability zones that hold our matter data, backups and Archie processing, and confirm in the agreement that they will not change without our consent.
Governing law and legal-content sources
Public claim only
Terms clause 28 states the agreement is governed by the laws of New South Wales with the exclusive jurisdiction of that state's courts, and the contracting party is Smokeball Australia Pty Ltd. Clause 23.4 states that precedent documents and notifications 'may not have been developed, designed or approved by legal practitioners', that Smokeball 'is not a law firm, and is not regulated by the Law Society of NSW or any other professional body', and that it does not warrant that they comply with or reflect applicable laws. The product page adds a separate content source, LawY, whose owner, content scope and terms are not identified on any page read.
Ask: Who owns and maintains LawY, which Australian jurisdictions and subject areas does its guidance cover, and on whose terms is it supplied to us inside Archie?
Vendor content directing how AI describes the product
Not confirmed
A deliberate check for content addressed to AI models, assistants or crawlers found none for this vendor: https://www.smokeball.com.au/llms.txt returns the site's 'Page Not Found' page, checked 2026-09-27, and a URL map of the site searched for 'ai' surfaced no /ai-info, /for-ai or equivalent page. A URL map does not reliably discover an unlinked file, so the absence is not established beyond the pages and the map checked.
Ask: Do you publish any page, file or block of text that tells AI models, assistants or crawlers how to describe Smokeball or Archie, and if so at what address?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the product
Public claim only
Terms clause 20 makes the firm responsible for holding all necessary rights and consents, including third-party privacy consents, to provide Client Data to Smokeball and to permit Smokeball to process it and to provide it to Interfacing Third Parties, and indemnifies Smokeball for any loss arising from a failure to obtain and maintain those consents. Clause 7 makes the firm responsible for the acts and omissions of its users and of 'Related Party Users' such as clients, barristers and counterparty firms. Neither the terms nor the privacy policy addresses consent specifically for AI processing of client material.
Ask: What consent wording do you expect us to hold from clients before their matter documents are processed by Archie, and does any part of the agreement address that specifically?
Which models and model providers are used
Not confirmed
No foundation model, model provider or inference location is named on the product page, the pricing page, the terms of service, the privacy policy or the security policy, all read 2026-09-27. The product page states Archie 'runs under enterprise-grade zero-data-retention agreements', which refers to agreements with parties who are not identified; the privacy policy section 8 says only that 'We may offer or use artificial intelligence (AI), including generative AI solutions, as part of our Services.'
Ask: Name every model provider behind Archie and each Archie App, the model versions, the country in which inference runs, and whether you will notify us before changing any of them.
Subprocessors and third-party recipients
Public claim only
The privacy policy section 5, read 2026-09-27, states that 'Some of the third party services we use include: ChurnZero, Salesforce, Zendesk, Pardot, Jira/Confluence, and Outreach', which it presents as examples rather than a complete list, and it also names disclosure to other Smokeball Group members, payment processors, financiers and marketplace integrations. The security policy names Amazon Web Services as the hosting platform. No subprocessor register, no notification or objection mechanism and no AI or model provider appears in any document read, and there is no published DPA.
Ask: Provide the complete subprocessor list for Archie, including model providers and any hosting and support entities outside Australia, and the notice you give before adding one.
Use of firm and client content for training or improvement
Public claim only
Terms clause 20 states that Smokeball 'may also de-identify and aggregate your Client Data with other data and use that de-identified and aggregated data for the purposes of research and marketing, benchmarking and industry insights, the improvement of Smokeball's products and services, the development of new products and services, and any other business purposes of Smokeball'. The security policy states 'Smokeball does not provide customer data to third parties for AI model training or third-party AI modelling', and the product page states data 'is never shared with third parties for viewing, training, or AI modeling'. Both statements are about third parties; no document read says whether Smokeball itself trains or tunes models on de-identified customer content, and no opt-out is published.
Ask: Does Smokeball or any provider train, fine-tune or evaluate models on our de-identified matter content, and will you warrant the no-training position in our agreement with an opt-out?
Prompts, feedback and usage data
Public claim only
Terms clause 22 states that usage data, described as anonymous usage-related and technical data that excludes Client Data and personal information, may be collected, aggregated, monitored and used to improve and further develop the Services, and that any feedback, comments, feature requests, ideas and suggestions 'will be considered non-confidential and non-proprietary to You' and 'shall be exclusively owned by Smokeball'. The privacy policy separately records that Smokeball may infer information from use of the Services, including features used, login attempts, session duration and usage habits. Nothing published states how Archie prompts, outputs or thumbs-up or thumbs-down ratings are classified or retained.
Ask: Are Archie prompts and outputs treated as Client Data or as Usage Data, who can read them, and how long are they kept?
Retention of matter data and AI records
Public claim only
Terms clause 18 states that on termination Smokeball 'may immediately deactivate your Services and may delete your account and data after thirty (30) days' and grants 30 days' access to retrieve data. The privacy policy section 9 retains personal data while there is an ongoing legitimate business need or legal reason, gives no period, and states that where no need remains Smokeball 'will either delete or anonymise it', with backup archives isolated until deletion is possible. No retention period is published for Archie prompts, outputs, summaries or Archie App inputs, and the 'zero-data-retention agreements' claim on the product page is not defined or dated.
Ask: State the retention period for Archie prompts, outputs and any intermediate copies, and identify the document in which the zero-data-retention position is warranted to us.
Deletion on request and at exit
Public claim only
Terms clause 18 permits deletion of the account and data 30 days after termination and clause 19 requires the firm to extract its data within 30 days of the end of the subscription term. The privacy policy gives individuals a right to request deletion of personal data and notes that where data is held in backup archives it will be isolated from further processing until deletion is possible. No customer-initiated deletion process, no certificate of destruction and no timeframe for deleting a single matter or a single Archie interaction is published.
Ask: How do we have one matter, one document or one Archie interaction deleted during the term, within what period, and will you certify destruction including backups?
Vendor staff access to firm and client material
Public claim only
Terms clause 20 states the firm acknowledges that Smokeball 'may need to access and view Client Data to assist with your questions, technical support requests, training or other issues' and limits that access to what is reasonably necessary. The privacy policy section 2.3 states Client Data may be 'made temporarily visible to us when providing technical support or training', including where Smokeball needs to see the screen or access the account remotely to provide support. The security policy states access management, multi-factor authentication and role-based access control apply internally; no approval workflow, logging commitment or customer-visible access record is published.
Ask: Which Smokeball roles and which countries can view our matter data and Archie transcripts, is access logged and disclosed to us on request, and can it be gated on our approval?
Access control and matter isolation
Public claim only
The security policy states that each firm's data is logically isolated, that Archie 'can only access your firm's data and cannot access or learn from other Smokeball firms', that Archie 'operates within a single matter context and is designed not to cross-reference or mix information across separate matters', and that 'only users who already have permission to access a matter can use Archie AI for that matter'. It lists multi-factor authentication, role-based access control, periodic privilege reviews and monitoring for abnormal access. These statements appear in a security page, not in the terms, and no independent test of the isolation is published.
Ask: Show how Archie enforces matter-level and ethical-wall restrictions for a user with firm-wide document access, and confirm that a Playbook or Archie App cannot read outside the open matter.
Encryption in transit and at rest
Public claim only
The security policy states 'All sensitive data is encrypted using AES-256 encryption' and that 'communication between systems is secured using TLS 1.2+'. The privacy policy section 6 instead states 'Encryption utilising a minimum of TLS 1.2 for data in transit and at rest', so the two documents describe the at-rest mechanism differently. Neither document addresses key management, customer-managed keys or encryption of Archie prompt and output records.
Ask: Reconcile the two published encryption statements for data at rest, and state who holds and rotates the keys and whether customer-managed keys are available.
Independent assurance
Public claim only
The security policy states 'Smokeball is proud to be an ISO 27001 certified organisation' and that its information security management system is certified to the ISO 27001 standard, without naming the certificate number, the certification body, the scope or the version; the Archie product page states 'Smokeball is certified to ISO 27001:2022, independently penetration-tested every year, and aligned with the Australian Privacy Act'. The certifications listed for Amazon Web Services on the same security page, including ISO 27001, ISO 42001, SOC 1, SOC 2 and PCI DSS, are the hosting provider's, not Smokeball's. No certificate, statement of applicability, SOC report, penetration-test summary or trust centre was found for Smokeball itself.
Ask: Provide the ISO 27001 certificate and statement of applicability showing that Archie is in scope, plus the most recent penetration-test summary and any SOC 2 report for Smokeball.
Contract structure and contracting entity
Public claim only
The terms of service state that use of the Services is conditional on acceptance of the terms and of the privacy policy, and that the contracting entity is Smokeball Australia Pty Ltd; the agreement is constituted by the terms plus an order form (clause 1), applies to any order form agreed or renewed on or after 1 March 2024, and is governed by New South Wales law (clause 28). No ACN or ABN is published in the terms, the privacy policy or the security policy, and no data processing agreement, no subprocessor register and no security schedule was found; the security policy is referred to by clause 21 and may change under clause 5.
Ask: Provide the ACN or ABN of the contracting entity and a data processing agreement for Archie with the security policy annexed as a contractual schedule rather than a page you may change.
Cross-border transfer and where data is processed
Public claim only
The privacy policy section 7 states 'Our servers and the Smokeball Group companies are located in the United Kingdom, the United States, and Australia. Our third party service providers and business partners operate in the United Kingdom, the United States, Australia, and Japan', and that data may be processed in any of these countries; it states that for transfers out of the UK the International Data Transfer Agreement is used and that Australia is not subject to an adequacy decision. Nothing published commits to holding an Australian customer's matter data in Australia, and no inference location is stated for Archie. As context from a third party rather than from Smokeball: triSearch publishes that 'all client data is stored on SMOKEBALL Servers, which are built on the Amazon Web Services (AWS) platform' and that triConvey 'stores data in the jurisdiction of origin, located in Sydney' for its white-label instance of the Smokeball application.
Ask: Will you commit in writing that our matter data, backups and Archie inference stay in Australia, and list every country from which the data can be accessed or processed?
Security incident and data breach notification
Not confirmed
The terms of service contain no data breach or security incident notification obligation on Smokeball: clause 8 instead requires the firm to notify Smokeball immediately of any unauthorised access to the Services or compromised credentials, and the words 'breach' and 'notifiable' appear in the terms only in relation to breach of contract. The security policy lists 'incident response planning and readiness' among its continuous-improvement activities and gives infosec@smokeball.com for reporting a concern, without any notification commitment or timeframe. The privacy policy read on the same day contains no notifiable data breach process.
Ask: Within what period will you notify us of a data breach affecting our matter data or Archie records, in what detail, and will that obligation be written into our agreement?
Changes to the service, the AI and the terms
Public claim only
Terms clause 5 lets Smokeball 'update, change or amend these Terms and/or the Services' during a subscription term, provided the change does not require additional fees or deprive the firm of a substantial or material benefit, with notice by email to the nominated contact taking effect 30 days later; clause 6 applies the same 30-day mechanism to minimum system requirements. Clause 5 also records that the Services are delivered on a one-to-many model 'that is generally not tailored to any specific customer's requirements'. Nothing published requires notice of a change of model, model provider or AI behaviour, and the security and privacy pages carry 'last updated' dates but no change log.
Ask: Will you notify us before changing Archie's model, provider or prompt behaviour, and can we pause a change that alters output for matters in progress?
Exit and data portability
Public claim only
Terms clause 18 grants access to the Services for 30 days after termination 'for the sole purpose of permitting you to retrieve your data', and clause 19 requires the firm to extract its data within 30 days of the end of the term, uninstall all copies and confirm in writing if asked. No export format, no bulk-export tool, no migration assistance and no charge for export is published, and nothing states whether Archie outputs, summaries or Playbook results are included in an export.
Ask: In what formats can we export matters, documents and Archie outputs at exit, at what cost, and how long will you keep our data available for retrieval?
What Archie is connected to
Public claim only
Terms clause 24.2 states that Interfacing Services are supplied under an agreement between the firm and the relevant third party and not by Smokeball, and clause 24.3 records that those third parties may include Smokeball's related bodies corporate and that Smokeball may receive commissions; clause 20 authorises Smokeball to provide Client Data to Interfacing Third Parties where the firm requests their services. The product page places Archie inside Microsoft Word, Microsoft Outlook and the matter, and the privacy policy notes that personal data and Client Data may be shared with providers of integrated third-party services at the firm's request.
Ask: Which connectors can Archie read from and write to, which of them send matter data outside Smokeball, and how do we restrict Archie to a named set?
Whether Archie reaches outside the matter
Not confirmed
Nothing on the product page, the pricing page, the terms, the privacy policy or the security policy states whether Archie can retrieve information from the internet. The product page describes Archie as working 'only within the matter you're in' and separately describes a legal-question function that 'surfaces LawY's jurisdiction-aware guidance', which indicates a content source outside the matter whose retrieval mechanism, currency and provider are not described.
Ask: Can Archie or any Archie App retrieve content from the internet or from sources outside our tenancy, and how is LawY guidance retrieved and kept current?
Whether Archie can act without confirmation
Not confirmed
The product page describes drafting an email reply that the user adjusts 'before you send', Playbooks that flag issues and suggest fixes, and matter analysis that 'automatically' produces next best steps; no document read states whether any Archie function writes to the matter, saves a document, records time, sends a communication or changes data without a user confirming it. The terms of service contain no clause about automated actions taken by the Services.
Ask: List every Archie or Archie App action that changes matter data or sends a communication, and show the confirmation step and audit record for each.
Human review of AI output
Public claim only
Terms clause 23.4 states that the Services 'are not a substitute for legal or other professional skill, judgment and experience, and should only be used by or under the supervision of qualified legal practitioners', that notifications may not be accurate or up to date and are for the firm to validate or ignore, and that precedent documents are templates to be edited using the firm's own judgement. The product page states every finding cites its source, that anything ambiguous is flagged, and that a legal answer carries 'the option to have a lawyer verify the answer' through LawY. Nothing published records who that verifying lawyer is, on what terms they act, or whether verification is charged.
Ask: Who verifies an answer when the lawyer-verification option in Archie is used, under whose professional indemnity, within what time, and at what cost?
