Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The terms of service (last updated 13 June 2026) set out the subscription tiers as Free trial (3 reviews within the first 30 days, 40 chat messages per chat during the trial), Starter (5 reviews per month, AI chat not included), Pro (15 reviews, 40 messages per chat), Pro+ (20 reviews, 60 messages) and Max (25 reviews, 60 messages). The pricing page adds a strata-report review add-on priced separately on Pro, Pro+ and Max, and pay-as-you-go review packs. The pricing page also invites firms running more than 20 reviews a month to ask for a bespoke arrangement with its own pricing, terms and onboarding, which this profile does not cover.
Ask: For our firm, which tier and which add-ons would be on the order, and would a bespoke firm arrangement replace the published terms of service or sit alongside them?
Deployment model and hosting location
Public claim only
The privacy policy (last updated 22 July 2026) states that 'Our application servers, database, and Google Cloud Storage buckets are hosted in Australia' and that personal information, account data and encrypted analysis results are stored domestically. The same policy states contract PDFs are uploaded to Google Cloud Storage and then processed by the AI model, and its cross-border table lists Google Vertex AI with the country given as 'Global (Google infrastructure)'. No page read states that the model inference itself runs in Australia, and no on-premise or self-hosted option is published.
Ask: Is the Vertex AI endpoint that processes our contracts pinned to an Australian Google Cloud region, and will you confirm that in writing for our engagement?
AI features in scope
Public claim only
The Victorian page (checked 2026-09-27) states Torri 'reads the contract of sale and the Section 32 vendor statement together', checks the section 32 'clause by clause against the vendor's statutory disclosure duties - rates and outgoings, insurance, building permits within the past seven years, owner-builder warranty insurance, notices, GAIC, services, planning and title', names anything missing 'with the reason it is required for this property and the impact of its absence - not just counted', reads special conditions against the standard LIV/REIV general conditions, and recognises the contract and the section 32 inside a single combined PDF. Further named functions are owners corporation certificate review, an assistant that answers questions about the contract with a clause and page reference, and pushing a finished review into Smokeball.
Ask: Which of these functions are available on the tier we would buy, and which are gated to a higher tier or to the strata add-on?
Jurisdiction and legal content
Public claim only
The terms of service state the service 'assists with the review of Australian conveyancing contracts in the supported jurisdictions - currently New South Wales and Victoria', that in NSW it 'operates within the scope of NSW property law, specifically the Conveyancing (Sale of Land) Regulation 2022' and 'supports the 11 recognised property title types under NSW legislation', and that in Victoria it operates within the scope of the Sale of Land Act 1962 (Vic) including review of the contract of sale together with the section 32 vendor statement. The home page FAQ states 'More states are coming'. The Victorian page states that a clause adjusting land tax against the purchaser 'the Sale of Land Act has prohibited for most contracts since 1 January 2024'.
Ask: How is the NSW and Victorian rule set kept current when the legislation or the standard contract form changes, and how are we told that a change has taken effect?
Firm size the plans are shaped for
Public claim only
The pricing page describes Starter as 'For solo conveyancers running a handful of matters a month', Pro as 'The working standard', Pro+ as 'Built for a busy desk' and Max as 'for the highest-volume desks', and directs firms 'Running more than 20 reviews a month' or with 'their own templates, compliance requirements, or procurement process' to a bespoke arrangement. The terms of service tie each tier to a monthly review count rather than to a number of users.
Ask: For a firm with several conveyancers sharing a monthly review allowance, how are allowances and user accounts related on the billing side?
Vendor content addressed to AI tools
Public claim only
Every Torri page read (checked 2026-09-27) carries a block headed 'Ask AI about Torri' with four buttons that open ChatGPT, Claude, Gemini and Perplexity carrying a pre-composed query, verbatim: 'How can Torri help my conveyancing practice review NSW & VIC property contracts faster? Summarize the highlights from Torri's website: https://torri.au'. This is a query a site visitor sends to a chat tool from the page. A complete firecrawl map of torri.au on 2026-09-27 returned 34 URLs and showed no /llms.txt, /ai-info, /ai or /for-ai path, and no page read contains a block addressed to AI models, assistants or crawlers setting out how the product should be described.
Ask: Do you publish any file or page addressed to AI models or crawlers, such as an llms.txt, that describes Torri or sets out how it should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the tool
Public claim only
The terms of service place the professional obligation on the practitioner: outputs 'are not a substitute for independent professional review and judgement', and 'Consistent with professional-body guidance on AI in legal practice (including the Law Society of NSW and the Law Institute of Victoria), practitioners using this Service retain full professional responsibility for the advice they provide to their clients. Use of the Service does not diminish or delegate that responsibility.' The privacy policy records that uploaded documents are PDF contracts and that chat messages are questions and instructions given to the assistant. Neither document addresses client consent or notification for uploading a client's contract.
Ask: Do you take any position on whether a firm needs client consent before uploading a client's contract and section 32, and do you provide wording a firm can use in its costs disclosure?
Model provider and model
Public claim only
The privacy policy states 'Torri uses Google's Gemini family of models via the Vertex AI platform to analyse contracts you upload - currently Gemini 3.6 Flash for contract analysis, and Gemini 3.5 Flash-Lite for the email assistant', and adds 'We may move between models in the Gemini family as they are released; the data-handling commitments described below apply regardless of which model is in use.' No option for the customer to select or pin a model is published on any page read.
Ask: Will you notify us before changing the model that analyses our contracts, and can a firm ask for a named model version to be pinned for its account?
Subprocessors and where they sit
Public claim only
The privacy policy publishes a cross-border disclosure table listing three overseas recipients: Google Vertex AI, country given as 'Global (Google infrastructure)', purpose 'AI contract analysis via API', data disclosed 'Contract PDFs (temporarily, deleted after processing). No data is used for model training'; Stripe, United States, payment processing, name, email and payment method details; and Resend, United States, transactional email delivery, name, email address and email content. The policy also names Google Cloud Storage for storage and backups. There is no separate standing subprocessor page and no published mechanism for notifying customers when a subprocessor changes.
Ask: How will we be told if you add or change a subprocessor, in particular if contract content moves to a different AI provider, and is that commitment in the agreement?
Use of our content to train models
Public claim only
The privacy policy states, in the cross-border table, 'No data is used for model training' against Google Vertex AI, and adds that 'Google's Vertex AI terms confirm that customer data sent via the API is not used to train or improve Google's models.' The home page security section states 'Documents and metadata stay scoped to your firm. No third-party sharing. No training on your files.' Separately, the policy's purpose list includes 'Improving the accuracy and reliability of our analysis' as a purpose for which personal information is used, without saying what that involves.
Ask: Does 'improving the accuracy and reliability of our analysis' involve any retention or human reading of our contract content or chat messages, and will you warrant no training on our content in the agreement?
Use of corrections, ratings and chat content
Not confirmed
The privacy policy records that Torri collects 'Chat messages - questions and instructions you provide to the AI assistant during contract review' and 'Usage data - contract processing metrics, feature usage, and interaction timestamps', and lists 'Improving the accuracy and reliability of our analysis' among the purposes of collection. The Victorian page states the practitioner can 'reword the review inline before it goes into the report'. No page read states whether those inline edits, corrections or any rating are retained, read by staff or used to change the product.
Ask: Are the inline edits a practitioner makes to a review, and the chat messages, retained or reviewed by your team, and can that be switched off for our account?
Retention periods
Public claim only
The privacy policy publishes a retention table: uploaded PDFs 'Deleted from cloud storage immediately after processing', enforcement automatic; analysis results '6 months from processing, then automatically cleaned up', on a weekly schedule; chat messages 'Deleted when the parent contract expires'; user sessions '8 hours of inactivity'; audit logs '7 years'; database backups '7 days (all), 30 days (daily), 8 weeks (weekly), 6 months (monthly), 2 years (yearly)'; account data for the duration of the account. The terms of service repeat that 'Contract analysis results are automatically cleaned up 6 months after processing'.
Ask: Can the six-month analysis-result retention be shortened or extended for our account, and does the backup schedule mean a deleted review can still be restored for up to two years?
Deletion on request and on exit
Public claim only
The privacy policy states that on account closure the 'Account profile, contracts, and chat messages deleted on account closure' while 'Audit logs are anonymised and retained per the retention period above', which is seven years, and that a user may 'request deletion of your account and associated data' by contacting support, with access and correction requests answered within 30 days. Uploaded PDFs are stated to be deleted from cloud storage immediately after processing. The interaction between a deletion request and the published backup retention schedule is not addressed.
Ask: When we ask for deletion, how long do our documents and reviews persist in backups, and will you confirm deletion in writing including from backups?
Who at the vendor can see our documents
Not confirmed
Nothing on the privacy policy, terms of service, pricing page, home page or Victorian page read on 2026-09-27 states whether Torri personnel can access a customer's uploaded contracts, analysis results or chat messages, or under what controls. The privacy policy describes customer-side controls only - 'Role-based access control - Admin and User roles with granular permissions' and 'Access is scoped to your account' - and records audit logs of 'document access' without saying whose access is logged.
Ask: Can your staff or contractors open our contracts or analysis results, on what authorisation, is that access logged, and will the log be available to us?
Access control available to us
Public claim only
The privacy policy states passwords are 'stored as bcrypt hashes, never in plaintext', multi-factor authentication secrets are 'encrypted at rest', sessions are 'stored in encrypted database sessions' and expire after '8 hours of inactivity', and lists 'Multi-factor authentication - TOTP-based MFA with encrypted backup codes' and 'Role-based access control - Admin and User roles with granular permissions'. The terms of service state MFA 'is available and recommended for all accounts' and that credential sharing is prohibited. Nothing read states whether an administrator can force MFA on for all users, or whether single sign-on beyond Google and Microsoft Azure OAuth is available.
Ask: Can an administrator enforce MFA for every user in our account, and is SAML or Entra ID single sign-on supported rather than OAuth sign-in only?
Encryption
Public claim only
The privacy policy states that 'sensitive fields (file paths, vendor names, analysis results, MFA secrets, and backup codes) are encrypted using AES-256-CBC' and 'Document-level encryption uses AES-256-GCM', that uploaded files are scanned for viruses before processing, and that documents are 'processed in cloud storage and deleted immediately after analysis'. The home page states 'Every contract is encrypted in storage and in transit.' Nothing read states who holds the keys or whether customer-managed keys are available.
Ask: Who holds and rotates the encryption keys for our documents and analysis results, and is a customer-managed key option available?
Independent assurance
Not confirmed
No certification, audit report or independent assessment for Torri was found on the privacy policy, terms of service, pricing page, home page or Victorian page read on 2026-09-27, and no trust centre or security document beyond the home page security section was published on the 34 URLs returned by a complete site map. The only certification named anywhere is a third party's: the privacy policy states that 'payment processing is handled by Stripe, which is PCI DSS compliant', and that 'Both Google Cloud and Stripe maintain robust security programmes and relevant compliance certifications'. Those are statements about Stripe and Google, not about Torri.
Ask: Has Torri been through any independent security assessment - ISO/IEC 27001, SOC 2, a penetration test or an Essential Eight assessment - and can we see the report or letter?
Contract terms
Public claim only
The terms of service (last updated 13 June 2026) are the published agreement. They are 'governed by the laws of New South Wales, Australia' with submission 'to the exclusive jurisdiction of the courts of New South Wales'. Liability is limited: 'Our total aggregate liability for any claims arising from your use of the Service is limited to the fees you have paid to us in the 12 months preceding the claim', subject to the Competition and Consumer Act 2010 (Cth). The customer indemnifies Torri including for 'Your reliance on AI-generated analysis without independent verification'. Subscription fees are 'generally non-refundable' and review credits are 'non-refundable'. No data processing agreement or separate schedule was published.
Ask: Will you enter a data processing agreement and an amended liability position for a firm engagement, given the cap is twelve months of fees and we indemnify you for relying on the output?
Cross-border transfer and APP 8
Public claim only
The privacy policy has a section headed 'Data Location and Cross-Border Disclosure (APP 8)' stating that application servers, database and Google Cloud Storage buckets are hosted in Australia and that account data and encrypted analysis results 'are stored domestically', then lists the overseas recipients as Google Vertex AI ('Global (Google infrastructure)'), Stripe (United States) and Resend (United States). It states 'We take reasonable steps to ensure these recipients handle your information consistently with the APPs'. The policy states Torri is 'bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth)'.
Ask: For APP 8 purposes, what contractual terms bind Google, Stripe and Resend, and can contract analysis be confined to an Australian Vertex AI region so no contract content leaves Australia?
Breach and incident notification
Public claim only
The privacy policy has a section headed 'Notifiable Data Breaches' stating that in the event of a breach likely to result in serious harm Torri will 'Assess the breach within 30 days of becoming aware of it', 'Notify the Office of the Australian Information Commissioner (OAIC) if the breach is deemed notifiable' and 'Notify affected individuals as soon as practicable with details of the breach and recommended steps'. It records audit logging of 'security-relevant actions such as login attempts, MFA changes, and document access'. No commitment to notify the firm as customer, and no notification period to the firm, is published.
Ask: Within how many hours will you notify our firm of a security incident affecting our documents, whether or not it is notifiable under the Privacy Act, and to whom?
Notice of change
Public claim only
Both published documents commit to notice: the terms of service state 'Material changes will be communicated to registered users via email or an in-application notice at least 30 days before taking effect', and the privacy policy says the same and that the 'Last updated' date indicates the most recent revision. The privacy policy separately states 'We may move between models in the Gemini family as they are released', which is not tied to the 30-day notice. The terms of service were last updated 13 June 2026 and the privacy policy 22 July 2026.
Ask: Does the 30-day notice commitment extend to a change of AI model, a change of AI provider or a change of hosting region, and where would that notice be published?
Getting out and taking our data
Public claim only
The terms of service state plans are month-to-month, that cancellation is 'at any time via the Stripe billing portal' effective at the end of the billing period, and that on account closure 'your analysis results and associated data will be deleted in accordance with our data retention policy'. Purchased review credits 'do not expire' and survive cancellation. The privacy policy gives an APP 12 access right - 'request a copy of the personal information we hold about you' - answered within 30 days. No bulk export of reviews in a machine-readable format is published; the published outputs are the PDF report, a Word document from the firm's template, and the push into Smokeball.
Ask: On exit, can we export every review we have run in a machine-readable format, and for how long after cancellation is that export available?
Connectors and what they can reach
Public claim only
The connectors named on the pages read are the Smokeball integration, which the Victorian page describes as pushing the review into Smokeball with 'matter layouts prefilled, contacts created, the report PDF filed in Documents'; OAuth sign-in via a third-party provider 'such as Google or Microsoft Azure', from which Torri states it receives name and email address; Stripe, from which it receives 'subscription status, payment outcomes, and invoice data'; and Resend for outbound email. The privacy policy also refers to an 'email assistant' running on a separate model without describing what mailbox or content it reaches.
Ask: What does the email assistant read and send on our behalf, what mailbox access does it need, and what scopes does the Smokeball connector request?
Whether the tool reaches the internet
Not confirmed
Nothing on the pages read states whether the analysis or the assistant can retrieve anything from the internet. The published description is document-bound: the Victorian page shows the assistant answering 'when is settlement due?' with '42 days from exchange - clause 16, page 7' under a label reading 'Grounded', and the home page states 'Every finding carries the page and clause it came from'. The terms of service restrict uploads to conveyancing contracts and related property documents. Whether title searches, planning certificates or other external sources are retrieved by the product is not addressed anywhere read.
Ask: Does the product retrieve anything from outside the uploaded bundle - a title search, a planning certificate, or a web lookup - and if so from which sources?
What the tool can do without being asked
Not confirmed
The Victorian page describes an outward write into another system: the finished review is pushed into Smokeball with 'matter layouts prefilled, contacts created, the report PDF filed in Documents'. Nothing read states whether that push happens automatically on completion or only when a user presses it, whether it can create or alter an existing matter, or whether it can be limited to nominated users. The privacy policy lists report generation and chat assistance as the product's functions and does not describe any other outbound action.
Ask: Is the Smokeball push always user-initiated, can it create or overwrite records in an existing matter, and can we restrict which users may trigger it?
Human review of output
Public claim only
The terms of service state, in bold, 'The Service does not provide legal advice', that 'AI outputs are not a substitute for independent professional review and judgement', that 'Users must independently verify all extracted information against the original contract' and that the service 'should be used as one input in a professional review process, not as the sole basis for any legal opinion or advice'. The privacy policy states 'No consequential decisions are made solely by the AI - it assists qualified professionals in their review'. The Victorian page states 'You sign the report' and that the report goes out under the firm's name 'with only the sections you choose'.
Ask: What in the product records that a practitioner has checked each finding before a report is released, and is that check auditable per report?
