Product and intended use
Define the configuration, people, information and tasks being assessed.
Pro versus Enterprise
Public claim only
LegalDesk, Inc. dba Streamline AI. Pro from USD 22,900 (4 core users). Enterprise from USD 26,900. Privacy 12 June 2026: Streamline is processor of platform Customer Data under a DPA, not the public notice.
Ask: Which plan, DPA and enabled AI modules (Knowledge Bot, MCP, Slack agent) are on the order?
AWS SaaS
Public claim only
Security: production on Amazon Web Services. Subprocessors: hosted on AWS; Heroku for containers; MongoDB Atlas for the database. Region is not named.
Ask: Which AWS region holds our tenant, and is an Australian region available?
Intake, triage, agents
Public claim only
Home: request intake/triage, workflow automation, matter management, document generation, AI email intake, Knowledge Bot, Velo Copilot, MCP connector, Slack intake agent.
Ask: Which AI agents will we enable, and can we turn them off?
Not a law corpus
Public claim only
Product is in-house intake/workflow, not a licensed primary-law research database.
Ask: Confirm no Australian case-law retrieval is in scope.
Adoption and implementation
Record the practical work needed to introduce and maintain the software.
Published starting prices
Public claim only
Pro USD 22,900 / Enterprise USD 26,900 starting, contact sales. Terms: Delaware law; JAMS arbitration (San Francisco County for non-US users); Streamline is not a law firm.
Ask: Confirm seats, term and whether we can negotiate Australian law/forum.
SSO and DMS on Enterprise
Public claim only
Security: SSO with Google, Okta, OneLogin. Pricing: Slack/Teams on Pro; Enterprise adds Drive/Box/OneDrive/SharePoint, Salesforce, Ironclad, NetDocuments, Jira, API.
Ask: Which connectors will receive matter text?
support@streamline.ai
Public claim only
Terms point disputes and opt-out to support@streamline.ai. Footer claims 60-day implementation. No published severity SLA.
Ask: What are support hours and the security contact?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Processor role; no AU template
Not confirmed
Privacy: customer is controller of platform Personal Data. No Australian client-disclosure template.
Ask: Provide a client-disclosure for US AWS/OpenAI processing of in-house matter text.
OpenAI
Public claim only
Subprocessors: OpenAI powers email triage, document analysis and request classification. No customer model choice described.
Ask: Name the OpenAI models and region, and can we disable OpenAI for some workflows?
Published list, no dates
Public claim only
List names Heroku, AWS, MongoDB Atlas, Redis Labs, Google Workspace and OpenAI. No dated locations table or objection right on that page.
Ask: Provide locations, notice period and flow-down of no-training for each processor.
No GP-model training; not ZDR
Public claim only
Privacy: Streamline does not use Customer Data to train general-purpose AI/ML models. AI sub-processor does not train on Customer Data but retains it for a limited period under enterprise terms. Streamline does not represent zero data retention.
Ask: State OpenAI retention days on our tenancy and point to the signed API terms.
Improve the Service
Public claim only
Privacy: information used to administer, provide and improve the Services. Cookie analytics on the Site. Platform Customer Data is processor-side under the DPA.
Ask: Can matter text appear in product analytics?
Term then customer election
Public claim only
Privacy: customer account and matter data for the agreement duration and, after termination, for the period in that agreement, then returned or deleted at the customer’s election. OpenAI limited retention is not numbered here.
Ask: State live retention for requests, uploads, embeddings and OpenAI logs.
Return or delete on exit
Public claim only
After termination, data is returned or deleted at the customer’s election. No 30-day certified-deletion SLA in the public privacy notice.
Ask: Will you certify deletion of production, backups and OpenAI copies within 30 days?
Not numbered
Not confirmed
Security describes role-based user permissions. Staff access to customer matters is not numbered on the security page.
Ask: When may Streamline staff read our requests, and is access ticket-scoped and logged?
SSO, SCIM, role permissions
Public claim only
Security: permission by role and team; legal-only notes. SSO with Google/Okta/OneLogin. Pricing: SSO and SCIM on Pro.
Ask: Will SSO+MFA+SCIM be mandatory on our tenant?
AES-256 and TLS
Public claim only
Security: AES-256 at rest and TLS with 256-bit encryption in transit. No BYOK described.
Ask: Confirm TLS version and key custody.
SOC 2 Type II claim
Public claim only
Security and footer: SOC 2 Type II. AWS datacentres described as ISO 27001 with SOC 1/2/3. Regular third-party audits claimed. Reports not inspected. DPA URL not published.
Ask: Provide the current SOC 2 Type II report under NDA and the DPA.
Delaware JAMS terms; DPA referenced
Public claim only
User Terms: Delaware law; JAMS arbitration; as-is warranties; not a law firm. Privacy: platform processing governed by a Data Processing Agreement. Public DPA URL not found.
Ask: Attach the DPA with APP 8, 72-hour notice and no-training before go-live.
US processors
Public claim only
Named subprocessors have US addresses. Privacy has an international-transfers heading. No Australian region stated.
Ask: List every country of storage and OpenAI inference for APP 8.
No public 72-hour SLA
Not confirmed
Security: logs reviewed for suspicious activity. No customer-notification period in the pages reviewed.
Ask: Commit in writing to notify us within 72 hours of a confirmed incident.
Posted policy updates
Public claim only
Privacy and Terms may be updated. Subprocessor page has no dated change-notice. 30-day arbitration opt-out on term changes.
Ask: Will material processor or model changes get 30 days’ written notice?
Customer election
Public claim only
Privacy: after termination, return or delete at customer election. Export format not specified.
Ask: What export formats exist, and will backups be in the deletion certificate?
MCP, Slack, Teams
Public claim only
Home lists MCP connector and Slack intake agent. Enterprise adds DMS/CLM connectors. Those paths can send matter text outside the tenant.
Ask: List every connector on our order and how we disable outbound send.
Not described
Not confirmed
AI features described are intake classification and document analysis, not open-web search.
Ask: Can agents browse the open web, and can we disable it?
Agents complete routine work
Not confirmed
Home: agents intake and route requests and complete routine work. Privacy requires human review before legal/significant effects. Default unattended actions are not contractually listed.
Ask: Which agent actions can run without a human click?
Customer must validate outputs
Public claim only
Privacy: outputs from automated processing; customer must review and validate before reliance; not legal advice; no legal/significant decisions without human review.
Ask: Is there an in-product accept step before a request is closed or a document sent?