Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
Non-US customers contract with Dialog Enterprises Inc. (Canada); US customers with Spellbook US Inc. The public Terms cover the Spellbook AI Platform. ACM is marketed as early access. Beta, preview and early-access features have weaker warranties and a CAD 10,000 liability cap. Associate access is provisioned by the vendor, not fully self-served.
Ask: Confirm the contracting entity, Order modules (Word add-in, Associate, ACM, Library, Market), which features are generally available versus beta, and whether our tenancy is on the current Terms or a negotiated MSA.
Deployment model
Public claim only
The product is SaaS. The Word add-in can be deployed centrally through the Microsoft 365 admin centre. Associate is a separate web application at login.spellbook.legal. No private-cloud or on-premises option was found.
Ask: Is any private-cloud, dedicated-tenancy or virtual-desktop-certified deployment available on the plan we would buy, and which Office builds (Windows, Mac, web, Citrix) are supported?
Product features in scope
Public claim only
Public features include Review (redlines and playbook comments in Word), Draft, Ask, Market/Compare, Playbooks, Library, Associate multi-document workflows, and ACM in early access. Legal Data Sources connect to public databases. iManage and cloud-drive connectors are optional.
Ask: Which of Review, Draft, Ask, Playbooks, Library, Associate, Market, Legal Data Sources, ACM and each connector will be enabled on our Order, and which are billed separately?
Governing law and Australian coverage
Public claim only
For customers outside the United States, the Terms select Ontario law and a Toronto forum, then confidential binding arbitration from a vendor-supplied arbitrator list. Legal Data Sources include AustLII among 1,000+ public databases. No Australian office or named Australian customer was found on primary pages.
Ask: Will you accept Australian law and courts (or at least a non-exclusive Australian forum) for our Order, and what Australian legal collections, currency and citator controls actually apply to Legal Data Sources?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client-facing use and authority to process
Public claim only
The public product is a lawyer-facing Word add-in and Associate workspace. Terms state Spellbook does not provide legal advice, require Users to review Outputs, and require the Customer to have rights and consents to provide Customer Data. No client-facing chatbot or intake portal was found. No template Australian engagement-letter disclosure was found.
Ask: Confirm there is no client-facing AI on our plan; provide wording suitable for engagement terms and outside-counsel guidelines covering hosting countries, model providers, retention and the absence of training; and can we exclude individual clients or matters technically?
Foundation-model providers
Public claim only
The subprocessor list names OpenAI, Anthropic and Google Cloud Platform as LLM providers, all located in the US. Company materials refer to OpenAI GPT-5 and other LLMs. Trust Center resources include OpenAI and Anthropic DPAs and ZDR artefacts. A Google ZDR artefact was not listed next to those items. Customer model choice was not documented.
Ask: Name every model family and version that will process our content, the hosting route (direct API, Azure, Vertex or otherwise), whether we can pin or disable a provider, and produce the Google Cloud ZDR/DPA equivalent to the OpenAI and Anthropic artefacts.
Subprocessors
Public claim only
A named list with purpose and location is published, including AWS and MongoDB Atlas (Canada), OpenAI, Anthropic, Google Cloud, WorkOS, Oso, Datadog, Reducto (Associate extraction), Retool, LaunchDarkly, Stripe and Intercom (US). Terms say subprocessors are identified in the Trust Center as updated from time to time. No public 30-day objection or termination right was found.
Ask: Provide the current dated list with entity names, countries of processing, data types each receives, 30-day (or longer) change notice, and a right to object or terminate if a new subprocessor is unacceptable.
Training and secondary use
Public claim only
Terms s 4.1(b)(iv) prohibit Third Party LLMs from using Customer Data to train, improve or develop their models, with opt-out of training mechanisms. Spellbook may process de-identified Customer Data for in-tenancy personalisation and may compile Derived Data (anonymous aggregated statistics) that Spellbook owns. Customer Data is not shared with other customers.
Ask: Confirm in the signed Order that prompts, uploads, outputs, embeddings, QA Data, feedback and telemetry are not used to train or improve any model for other customers, including Google Cloud processing, and that Derived Data cannot be reverse-engineered to our matters.
Feedback, ratings and product improvement
Public claim only
Customer Data includes feedback provided in the platform. QA Data (Inputs and corresponding Outputs) may be retained up to 90 days to identify output-quality issues, evaluate prompt and system improvements, and diagnose support matters, accessible only to authorised personnel. Personalisation is described as de-identified and customer-specific. Productboard is listed as a product-feedback subprocessor.
Ask: Can in-product ratings, thumbs and QA sampling be disabled for our tenancy; what exactly is sent to Productboard; and is feedback excluded from training and from Derived Data?
Retention of prompts, documents and logs
Public claim only
Trust FAQ: OpenAI and Anthropic ZDR so request/response data is not persisted at those LLMs. Terms still allow Spellbook QA Data retention up to 90 days, then permanent deletion, and up to 30 days (or longer for investigations) of abuse-monitoring data for self-service onboarding customers. Administrator-configurable workspace retention was not documented. Google Cloud LLM retention is not covered by the OpenAI/Anthropic FAQ answer.
Ask: For our tenancy, list retention for prompts, document copies, embeddings, Associate projects, playbooks, QA Data, abuse logs, backups and each LLM provider, and whether ZDR applies to Google Cloud as well as OpenAI and Anthropic.
Deletion on instruction and on exit
Public claim only
Trust Center controls state customer data is deleted upon leaving and that data-retention procedures are established. Terms treat Customer Data as Confidential Information but do not state a numbered deletion period, backup lag, matter-level self-service deletion, or a deletion certificate. Access ends immediately on termination.
Ask: Contract a deletion and return period (including backups, embeddings, QA Data and subprocessors), matter-level deletion, and a written certificate; confirm the period after termination during which we can export first.
Vendor and contractor access to content
Public claim only
QA Data is accessible only to authorised Spellbook personnel on an as-needed basis, bound by confidentiality, for quality, prompt evaluation and support, for no longer than 90 days. Retool is listed for customer-success tooling. Terms s 4.3(d) require prompt notice of legal or governmental demands and reasonable cooperation on a protective order. Customer-visible access logs were not found.
Ask: Enumerate every human-access path (support, QA, abuse, legal process) at Spellbook and each model provider; can we require per-ticket consent; is access logged and exportable; and can human review of content be switched off?
SSO, MFA, admin controls and audit logs
Public claim only
Trust FAQ: Word add-in uses Microsoft accounts for SSO so Entra MFA can be enforced. WorkOS is listed for identity; help materials mention third-party SSO on request. Admins can invite, assign Editor/Admin roles, organise teams and block users immediately. SCIM, customer-exportable audit logs and SIEM streaming were not documented. Associate access is managed by Spellbook.
Ask: On the plan we are buying, confirm SAML/OIDC SSO-only, SCIM deprovisioning, Entra conditional access, per-feature admin switches, and an exportable audit log of prompts, exports, admin changes and vendor access with stated retention.
Encryption in transit and at rest
Public claim only
Terms s 4.1(b)(i) require Customer Data transmitted to Third Party LLMs to be encrypted in transit according to industry-standard protocols. Trust Center lists 'data encryption utilised'. Privacy policy refers to encrypted data transfers and storage. AES-256, TLS 1.2+, coverage of embeddings/logs/backups, and key management (KMS, HSM or customer-managed keys) are not named.
Ask: Name algorithms and protocols for every store (including embeddings, logs, backups and the LLM link), who holds keys, rotation, whether customer-managed keys are available, and the SOC 2 control references.
Independent security assurance
Public claim only
Trust Center lists SOC 2 Type II 2026 (request access), SOC 3 2026, HIPAA Type I 2026, TX-RAMP Level 2, GDPR and an EU AI Act opinion letter from CMS Law. Security page repeats SOC 2 Type II, HIPAA, GDPR and EU AI Act. Full reports were not inspected. ISO 27001, ISO/IEC 42001 and IRAP were not found. Penetration testing is listed as a control without date or tester.
Ask: Provide the current SOC 2 Type II report (scope, period, exceptions) under NDA, any ISO 27001/42001 certificates, a penetration-test executive summary covering AI features, and whether Australian Essential Eight or IRAP mapping exists.
Contract, DPA, confidentiality, IP and liability
Public claim only
Article 4 of the Terms is a data-processing schedule (LLM DPAs, subprocessors, ZDR, privilege). Customer Data (Inputs, Outputs, Document Data) is Confidential Information. Customer owns Outputs and custom playbooks. IP indemnity covers claims that the Services infringe, not Output content. Liability is capped at 12 months' fees except Articles 4, 7 and 9. Privacy policy is alterable; no standalone Australian APP DPA URL was found.
Ask: Will you sign an APP-aligned DPA with 72-hour breach notice, flow-down to every subprocessor, Output IP indemnity, Australian law, and a confidentiality clause that expressly meets NSW SC Gen 23 cl 9A for court-protected material?
Cross-border processing and Australian residency
Public claim only
Trust FAQ: data centres in Canada and the US. AWS and MongoDB Atlas are Canada; LLM and several identity, monitoring and extraction subprocessors are US. No Australian region, on-request AU pin, or IRAP statement was found. APP 8 analysis is required for any personal information in matter files.
Ask: Is an Australian (or other nominated) region available for storage and inference; if not, list every category of data that leaves Canada, the US CLOUD Act exposure, and the APP-equivalent contractual commitments we can rely on?
Breach notification and incident history
Public claim only
Privacy policy: in a data security breach involving Personal Information, Spellbook notifies without undue delay after becoming aware, as required by applicable law. No hour count, no suspected-incident trigger, and no Notifiable Data Breaches cooperation clause were found. No public status page or incident register was found. A vulnerability disclosure policy exists.
Ask: Contract notification within a defined period (for example 72 hours) of suspected incidents affecting any Customer Data, cooperation with NDB assessments, a named security contact with Australian-hours coverage, and disclose material incidents in the last 24 months.
Change of terms, models and control
Public claim only
Terms may be amended by posting; an amendment is deemed accepted 30 days after posting unless the customer rejects, in which case it takes effect at the next Order renewal unless the customer terminates. Privacy policy may be revised by posting. No contractual advance notice of model-version swaps or a pin/testing window was found. The vendor's assignment is not restricted the way the customer's is. Debt financing in 2026 was described as acquisition capital.
Ask: Lock the Order against mid-term term changes; require written notice and a testing window before model, prompt or retrieval changes; and give us termination and data-return rights on change of control, discontinuance or a prohibited-provider substitution.
Export, transition and shutdown
Public claim only
Customer owns Outputs and custom playbooks. On termination the customer must cease use immediately and delete Documentation copies. No bulk-export API, post-termination read-only window, transition assistance rate card or escrow was found. Trust Center claims deletion upon leaving without a numbered period or certificate.
Ask: Demonstrate a full tenancy export (documents, playbooks, Associate projects, prompts, outputs, audit logs) in open formats, a 30–90 day retrieval window, deletion including derived artefacts with a certificate, and transition assistance rates.
DMS and storage connectors
Public claim only
iManage: authenticate once, add selected files in Word Ask, Associate Ask and Associate Projects; vendor states existing iManage permissions and ethical walls apply. SharePoint, OneDrive, Dropbox and Google Drive are listed as optional connectors. Terms treat Integration Partner Products as optional, as-is, and loss of an integration does not justify a fee refund. Query-time versus ingestion permission trimming is not described.
Ask: For each connector we would enable, show the identity used, scopes, whether a service account exists, how wall changes propagate, what is copied into Spellbook, and how we disconnect and purge connector copies.
Public legal databases and web retrieval
Public claim only
Legal Data Sources connect to 1,000+ public legal databases (including AustLII, BAILII, CanLII) so statutes and case law can be surfaced inside drafting and review. It is not described as a general open-web browse. Whether the open contract is sent to those sites, whether the feature can be disabled per tenancy, and citation behaviour when nothing is found were not specified in a contractual document.
Ask: Can Legal Data Sources (and any other web retrieval) be disabled for our tenancy; what query payload leaves the tenant; which databases and jurisdictions are current; and does the product refuse to answer when no source is retrieved?
Agent actions and confirmation gates
Public claim only
Associate runs multi-document workflows (review, Q&A, analysis) and can add iManage files to a project. ACM is marketed as end-to-end contract management in early access. No public list of actions the assistant may take without per-action confirmation (send, share, delete, write-back to DMS) or prompt-injection testing was found. Terms disclaim integration-partner availability.
Ask: List every action Associate and ACM can take on Word, iManage or email; which require explicit per-action approval; how untrusted document text is isolated from instructions; and provide the latest injection/red-team summary.
Human review of outputs
Public claim only
Redlines and playbook comments land in Word for the lawyer to accept or reject. Terms require Users to review Outputs and not rely on them as legal advice. There is no documented mandatory approval gate that ordinary users cannot disable, no junior-user supervisor sign-off, and no exportable per-output review log. Review-page copy that the counterparty need not be told it was AI conflicts with several Australian court disclosure expectations.
Ask: Can we require supervisor sign-off before redlines leave the firm, export a per-document record of model version and reviewer, and disable any workflow that applies changes without a human click?
