Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, contracting entity and modules
Public claim only
Website Terms/Privacy (3 July 2026) name Syntheia (US) LLC for syntheia.io and syntheia.app. Site footer copyright is Syntheia Pty Ltd. Products: Compare, Curate, Query, plus Services advisory. Private deploy is carved out to a separate written agreement. No public DPA or Order Form template was found.
Ask: Name the contracting entity (Pty Ltd vs US LLC), which of Compare, Curate, Query, API/MCP and Services are on the Order, and provide the private-deploy or MSA paper if we are not on website clickwrap.
Deployment model
Public claim only
Hosted Website at syntheia.io/.app (SaaS). Privacy and Terms: privately deployed instances exist; Syntheia will not collect, access or retain information on those instances unless agreed in writing. Security describes a multi-tenant cloud with customer isolation; cloud providers are not named. No on-premises appliance was described.
Ask: Is our tenancy SaaS or private deploy, which cloud and region, and is tenant isolation logical-only or a dedicated VPC?
Product features in scope
Public claim only
Compare: multi-document blacklines and issues lists; page states the comparison engine does not use generative AI. Curate: funds side letters, MFN and LP provisions as structured searchable data. Query: structure-aware retrieval with citations, offered via API/MCP so a customer's LLM answers from retrieved text. Word/Outlook add-ins and in-Word precedent search are described as coming soon. Aug 2026 update: personal API keys.
Ask: Which of Compare, Curate, Query, Word/Outlook add-ins and MCP will be enabled, and is generative AI used in any module we buy?
Governing law and Australian coverage
Public claim only
Website Terms: New York law; exclusive US federal or New York State courts, with Syntheia retaining the right to sue in the user's country of residence. Optional AAA arbitration at the company's sole discretion, applying New York law. Private-deploy agreement unread. Curate claims customers in Australia; no Australian law option on the public Terms.
Ask: Will the MSA for our AU matter work be NSW/Australian law (or at least non-exclusive Australian courts), and does the NY website ToU apply at all?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Who is controller, and client-matter authority
Public claim only
Privacy is a US LLC website policy: Syntheia collects account, usage and Customer Content submitted through the Website, including documents and prompts for AI features. It does not use the words controller/processor for matter data. No public DPA. Private deploy: Syntheia will not collect, access or retain unless agreed in writing.
Ask: Execute a DPA stating we are controller of matter documents, and confirm private-deploy instances are outside Syntheia's processing unless we ticketing-access them.
Foundation-model provider
Not confirmed
Privacy lists 'artificial intelligence service providers' as a class of recipients, unnamed. Compare states the comparison engine does not use generative AI. Query is designed so the customer's LLM answers from retrieved, cited text via API/MCP. No Azure OpenAI, OpenAI, Anthropic or Google model name appears on the pages read.
Ask: Name every model that will see our documents on Compare, Curate, Query and any summary/suggested-language features, with regions, and whether Query uses only our LLM.
Subprocessors and subprocessors list
Not confirmed
No published subprocessor table. Privacy: cloud hosting, analytics, payment, communications, identity and AI service providers, plus affiliates, all unnamed. reCAPTCHA appears on the public site. No 30-day objection mechanism was found.
Ask: Provide the current customer-data subprocessor list with regions and a 30-day objection right, including any AI provider.
Training and secondary use of customer content
Public claim only
Privacy (3 July 2026): unless expressly agreed in writing, Syntheia does not use Customer Content submitted through the Website to train publicly available AI models. That leaves room for training non-public/Syntheia-only models unless a written agreement forbids it. Curate page: fund documents are never shared and never used for benchmarking. About page describes a 'knowledge flywheel' as users contribute documents to a repository that powers insights — scoped as the customer's own system, not a cross-customer corpus, but it is not in the Privacy clause.
Ask: Contract that Customer Content will not train any model (public or Syntheia-only), will not be used for cross-customer benchmarking, and that the knowledge flywheel stays inside our tenancy.
Feedback and evaluation use
Public claim only
Privacy: AI processing is for requested outputs, improving security and reliability of the Website, legal obligations, and as otherwise in the policy or a separate agreement. Aggregated non-identifying information may be disclosed without restriction. Terms grant a licence over User Contributions on Interactive Services, including 'machine learning model training interfaces'.
Ask: Confirm matter documents are not User Contributions, are excluded from Website-improvement analytics, and that any training-interface feature is off by default.
Retention of prompts, documents and logs
Public claim only
Privacy: retain personal information only as long as reasonably necessary; periods vary. No numbered retention for deal documents, AI prompts or backups. Private deploy: no collection/retention unless written. Account-level: Syntheia cannot delete personal information except by deleting the user account.
Ask: State retention for documents, issues lists, API logs, prompts/outputs and backups on SaaS versus private deploy.
Deletion and certified erasure
Public claim only
Privacy: email hello@syntheia.io to request deletion; copies of User Contributions may remain in caches. No certificate-of-deletion or backup-purge timeline. Private deploy: Syntheia does not retain unless agreed. Website Terms allow Syntheia to terminate access for any or no reason.
Ask: On exit, within how many days are SaaS documents and backups deleted, and will you issue a deletion certificate?
Vendor staff access to matter data
Public claim only
Security: employees and contractors undergo background checks and sign confidentiality agreements before access to sensitive systems; least-privilege RBAC, reviewed and revoked. Privacy: staff access is not described as ticket-only. Private deploy: no access unless written. Curate: documents never accessible to other users.
Ask: Is staff access MFA-gated, ticketed, logged and exportable, and which countries' staff can see AU matter data on SaaS?
SSO, MFA, roles and audit logs
Public claim only
Security: role-based access and least privilege. Privacy lists identity providers as a class of subprocessors. Curate: full audit trail. No public Entra/Okta/SCIM or mandatory-MFA page. Aug 2026: users can generate personal API keys.
Ask: Does our plan include Entra/Okta SSO, mandatory MFA, RBAC scoped to matter, exportable audit logs, and customer-controlled API keys?
Encryption in transit and at rest
Public claim only
Security: data is encrypted at rest and in transit. Curate: end-to-end encryption (undefined). No TLS version, AES-256 or customer-managed keys were stated. Reports unread.
Ask: Confirm TLS version, at-rest algorithm, key custody and whether customer-managed keys are available on private deploy.
SOC, ISO and other audits
Public claim only
Security page: controls compliant with ISO 27001 and SOC 2; badges for SOC 2 Type 2 (Prescient Assurance) and ISO/IEC 27001:2022; copies of attestation on request. Reports were not inspected. The same page also says Syntheia helps manage 'billions of digital identities', which does not match a deal-document product and should be treated as unverified copy.
Ask: Provide current SOC 2 Type II and ISO 27001 certificates whose scope includes Compare, Curate, Query, API and any AI features.
Contract, DPA, liability and indemnity
Not confirmed
Public paper is Website Terms (3 July 2026), not an MSA/DPA. Liability: no damages of any kind except gross negligence or wilful misconduct; as-is warranties; AI Output disclaimer. NY law; company-optional AAA arbitration. Commercial-use prohibition in the clickwrap is unsuitable for a paid firm licence. Private-deploy agreement unread.
Ask: Replace clickwrap with an MSA/DPA: liability cap, IP indemnity, no-training, AU Privacy Act, and confirmation Website Terms do not govern production use.
Cross-border transfers and residency
Public claim only
Privacy: information may be transferred, processed or stored in countries other than the user's residence; 'appropriate safeguards' where required; no SCC/BCR text and no named region. Cloud provider unnamed. US LLC is the website contracting entity. No Australian region is published.
Ask: Name the hosting region for our tenancy, every AI-provider region, and APP 8 / SCC wording if any processing leaves Australia.
Breach notification
Not confirmed
Neither Privacy nor Website Terms nor the Security page state a customer-notice period (no 72-hour or undue-delay clause).
Ask: Write a 72-hour (or faster) customer-notice SLA into the Order, including the notification email.
Unilateral term and product changes
Public claim only
Website Terms: Syntheia may revise Terms in its sole discretion; changes effective immediately on posting, except dispute-resolution changes for disputes already notified. Features added to the Website are also subject to the Terms. Privacy: continued use is deemed acceptance of policy updates.
Ask: Will material AI-provider, hosting-region or liability changes require 30 days' written notice and a right to terminate without penalty?
Export, termination and lock-in
Not confirmed
No public export format or post-termination retrieval window. Terms allow Syntheia to terminate access for any or no reason. Curate markets a compounding library of side letters — lock-in risk if export is weak. Aug 2026 API keys may help extraction if the API exports structured nodes.
Ask: On termination, in what formats and within how many days can we export Compare issues lists, Curate libraries and Query indexes, and is deletion certified?
PMS, DMS and agent connectors
Public claim only
Compare mentions DMS without naming iManage/NetDocuments. Email ingest to a customer-domain start@ address. Query MCP lets external models call Syntheia retrieval. Word/Outlook add-ins coming soon. No PMS connector found.
Ask: Which DMS/PMS connectors are in our Order, is MCP in or out, and which Query tools can an external agent call?
Open-web search and browsing
Public claim only
Compare and Curate operate on uploaded/customer corpus. Query retrieves from the customer's structured documents. No page in this pass described browsing the open web. If Query is paired with a customer LLM that has web tools, that is outside Syntheia's privacy policy.
Ask: Does any hosted feature send matter text to an open-web index, and can web tools be disabled on the LLM attached to Query/MCP?
What the tool may do without a click
Public claim only
Compare produces blacklines and consolidated drafts for the user to take into Word. Query MCP lets an external agent retrieve clauses when the user/agent prompts it. No page described unsupervised sending of markups to counterparties.
Ask: Which Compare/Query/MCP actions require in-product confirmation, and is MCP disabled by default?
Required lawyer review before client use
Public claim only
Website Terms (KA): AI Output may be inaccurate; is not legal advice; user is solely responsible for reviewing and verifying before relying. Compare separately argues the comparison path needs no extra verification because it is not generative. Those two claims sit side by side for different features.
Ask: Contract that any generative or suggested-language output must be lawyer-reviewed before a counterparty or client receives it, and that Compare's non-generative claim is in the Order for the modules we buy.
