Product and intended use
Define the configuration, people, information and tasks being assessed.
Agent, Intake and case SKUs
Public claim only
This profile covers Supio SaaS: Agent (firm- and case-level), Intake, medical chronologies, demand letters, case ledger/economics and litigation drafting. Website Terms of Service (DocEquity, Inc.) apply to the marketing site, not the product. A product MSA was not published. The Vanta security portal is linked but reports were not downloaded.
Ask: Confirm the Order Form modules (Agent, Intake, drafting, Westlaw), hosting country, and whether a signed MSA/BAA/DPA replaces the website Terms.
Claimed US/UK/Canada centres versus US-only privacy wording
Not confirmed
Security page: data will remain in your country of origin, with data centres in the US, UK and Canada. Homepage repeats those three countries. Privacy statement (28 March 2025): personal information collected is stored solely in the United States. Those statements are not the same. On-premises is not offered.
Ask: Which country and cloud region will store our case files, prompts and outputs, and do UK/Canada tenancies exist?
Chronologies, demands, drafting, Agent
Public claim only
Product pages: medical chronologies, AI demand letters, case economics, litigation drafting, intake without adding staff, and Supio Agent for firm-wide and cross-case work including mass torts. Integrations can sync documents from CMS and push insights back to Litify and SmartAdvocate.
Ask: Which of Agent, Intake, chronologies, demands, drafting and CMS write-back will be enabled, and which remain beta?
US plaintiff product; Westlaw; no AU region
Public claim only
Positioned for US personal-injury firms. Westlaw Advantage is listed for citation verification. Website Terms: Washington law and King County courts (site only). Privacy stores personal information in the US. No Australian hosting or AustLII/Jade connector was found.
Ask: If we proceed, which country holds our files, and what APP 8 wording and Australian-authority coverage do you provide?
Adoption and implementation
Record the practical work needed to introduce and maintain the software.
No public product price list
Not confirmed
No list prices. Website Terms disclaim all warranties and all damages for the Site only. Product fees would sit on an unpublished order form.
Ask: Provide an itemised quote for our user count, Agent, Intake, page or case volume, Westlaw add-on and any auto-renewal.
CMS, DMS, Westlaw, communications
Public claim only
Integrations page: Litify, SmartAdvocate, Casepeer, MyCase, Smokeball, Jove; DMS (Dropbox, OneDrive, SharePoint, Box, ShareFile, Google Drive); Westlaw Advantage; Outlook, Zoom, RingCentral, Dialpad. Structured insights can be pushed back to Litify and SmartAdvocate. An API is mentioned. SSO/SCIM were not documented on the pages reviewed.
Ask: Demonstrate CMS sync scopes, write-back, SSO-only with our IdP, and whether Westlaw queries leave our tenancy.
Email contacts; no public SLA
Public claim only
security@supio.com and privacy@supio.com are published. A Support link exists on the site. No severity matrix or Australian-hours coverage was found. Employees are said to undergo background checks.
Ask: What are severity response times, and is there an Australian-hours security contact?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Medical records; CMS connectors
Not confirmed
Supio holds medical and case files. HIPAA/PHIPA are claimed. CMS and DMS connectors import firm files; Litify/SmartAdvocate write-back exports insights. Cross-case Agent and mass-tort features increase the disclosure surface. No per-client AI exclusion was documented.
Ask: Can we disable Agent, CMS write-back and Westlaw per matter, and what region/subprocessor description can we give clients?
Foundation-model vendor unnamed
Not confirmed
Homepage: client information never trains foundation models. The foundation-model provider, region and zero-retention addendum were not named on the product, security or privacy pages reviewed.
Ask: Which model providers and regions process our prompts and documents, and is there a zero-retention contract with each?
No published list
Not confirmed
Privacy: data may be shared with agents, vendors and service providers who perform functions on Supio's behalf, under contractual confidentiality. Vanta is used for monitoring. No dated public subprocessor schedule, countries or notice/objection period was found. The security portal may hold more behind access request.
Ask: Provide the current subprocessor list (cloud, LLM, Vanta, CMS, Westlaw) with countries and 30-day notice/objection.
No foundation-model training claimed
Public claim only
Homepage and a later homepage block: client information never trains foundation models and is not pooled into shared training models. Privacy allows use of personal information to operate the business, analytics and to enhance enjoyment of the Services, and allows anonymous information to be used for any purpose. Those privacy purposes are not a signed no-training DPA clause.
Ask: Confirm in a signed DPA that documents, prompts, outputs and logs are not used to train Supio or third-party models, including analytics and 'enhance the Services'.
Anonymous information may be used for any purpose
Public claim only
Privacy: Supio may create anonymous information by excluding identifiers and may use and disclose anonymous information for any purpose and to any third party in its sole discretion. In-product thumbs-up/down was not described.
Ask: Is any in-product feedback or anonymised case content used to improve models, and can Enterprise switch that off?
As long as necessary; no day count
Public claim only
Privacy (28 March 2025): retain only as long as needed for the legitimate business need, longer for legal, tax, accounting, disputes or statutes of limitation; then delete or de-identify, or archive until deletion is possible. Residual data in databases may not be removed after an access/deletion request.
Ask: Provide a numbered retention schedule for case files, medical records, prompts, outputs, logs and backups.
Request-based; residual copies possible
Public claim only
Privacy: deletion or de-identification when there is no longer a legitimate business need or if consent is withdrawn; residual data may remain. Website Terms allow the Company to terminate site access without notice. No product post-termination window or certificate was published.
Ask: On exit, what is deleted from Supio and its cloud/LLM providers, within how many days, with what certificate?
Background-checked staff; compelled disclosure
Public claim only
Security: every employee undergoes extensive background checks. Privacy: sharing with law enforcement if compelled; prior notice to the customer is not promised. Support staff necessarily touch tickets.
Ask: Is support access per-ticket with our approval, logged to us, and will you notify us of legal process seeking matter content?
SSO not documented on pages reviewed
Not confirmed
Portal login exists. Privacy collects account credentials. SAML/OIDC SSO, MFA enforcement and SCIM were not specified on the security or integrations pages reviewed.
Ask: Do you support SAML/OIDC SSO-only, MFA enforcement and matter-level permissions, including for Agent?
Algorithms not named on the public security page
Not confirmed
Security page claims SOC 2 Type II, Vanta 24/7 monitoring and HIPAA/PHIPA/GDPR controls. TLS/AES versions and CMK were not stated. The Vanta portal is offered for more detail.
Ask: Confirm TLS 1.2+ and AES-256 in transit and at rest, including backups and any LLM path, and whether CMK is available.
SOC 2 Type II claimed; Vanta portal gated
Public claim only
Homepage and security page: SOC 2 Type II; HIPAA, PHIPA and GDPR compliance claimed. Vanta security portal at security.supio.com holds certifications behind access. Reports were not downloaded in this review.
Ask: Provide the current SOC 2 Type II report covering our region and generative/Agent features, including period and entities in scope, and any BAA.
Website Terms only; product MSA unpublished
Not confirmed
Public Terms of Service are for the marketing site (DocEquity, Inc. d/b/a Supio): Washington law, King County courts, AS IS, all damages excluded to the maximum extent permitted. They are not a product MSA. No public DPA or liability cap for the SaaS was found.
Ask: Will our MSA include a DPA with APP/HIPAA flow-down, output ownership, a meaningful cap for confidentiality/data breach, and Australian or NSW law/forum?
US HQ; privacy says US-only storage; security also lists UK/Canada
Not confirmed
Privacy: Washington State headquarters; personal information stored solely in the United States; transfers use adequacy or SCCs; submitting information is consent to transfer. Security/homepage: data centres in the US, UK and Canada and data remaining in the country of origin. An Australian customer would be sending data to the US at minimum.
Ask: Name every country of storage and inference, including any LLM provider, in writing, and reconcile the US-only privacy sentence with UK/Canada data-centre marketing.
No public notification period
Not confirmed
Privacy cannot guarantee a breach will not occur. Vanta 24/7 monitoring is claimed. No numbered customer-notification period or NDB clause is in the public privacy or security pages. security@supio.com is the contact.
Ask: Within how many hours of discovering a suspected incident affecting our case data will you notify us, and will you support an NDB assessment?
Material privacy changes on 30 days' notice
Public claim only
Privacy: material changes that reduce privacy rights will be notified by email and/or in-product at least 30 days prior. Website Terms may be the only public contract and do not describe product-feature change notice. Agent is described as new.
Ask: Will our MSA freeze terms during the term, and notify us before adding LLM providers, Agent capabilities or changing hosting country?
No public product export window
Not confirmed
Privacy describes deletion/de-identification of personal information, not a bulk case-file export format. Website Terms do not grant a post-termination retrieval right for the product.
Ask: How do we export chronologies, demands, source links and audit logs on exit, in what format, and when are remaining copies deleted?
CMS, DMS, Westlaw, communications
Not confirmed
Document sync from Litify, SmartAdvocate and other CMS; write-back of insights to Litify and SmartAdvocate; DMS connectors; Westlaw; Outlook/Zoom/RingCentral/Dialpad. Each is a disclosure of case content. Custom API is offered.
Ask: What scopes does each connector request, what is pushed back to the CMS, and how do we disable them without a ticket?
Westlaw listed; open web not described
Public claim only
Westlaw Advantage is described as verifying citations against the law. Open-web search as a Supio Agent feature was not found on the pages reviewed.
Ask: Confirm Agent/drafting do not call the open web on our matters, and which Westlaw collections are queried.
Firm-wide Agent; CMS write-back
Not confirmed
Supio Agent is marketed as working across the firm, every case and role, including cross-case analysis. CMS write-back can change records in Litify/SmartAdvocate. Public pages do not describe approval gates or a kill-switch.
Ask: Which Agent actions can write to the CMS or send communications without a named approver, and how do we freeze Agent immediately?
No public contractual review duty
Not confirmed
Marketing emphasises specialised AI plus human expert accuracy. Website Terms disclaim accuracy of site content. No product clause requiring a qualified legal professional to approve outputs was found in the public Terms or privacy statement.
Ask: Can we require named sign-off before a chronology or demand leaves Supio, with a log of who verified which items?
