Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
triConvey is the conveyancing practice-management software supplied by TriSearch Services Pty Limited; the General Terms define 'TriConvey Software' as 'the conveyancing practice management software which is provided by TriSearch' and define 'TriSearch Systems' as the TriSearch Platform plus the TriConvey Software, all under one agreement. Two add-ons are priced separately in the Fees Schedule current from 1 September 2026: the Productivity Pack at $10 inc GST per matter opened and Additional Matter Types at $99 inc GST per matter opened. The AI features sit in the add-on or in OneFlow, so a firm on triConvey does not necessarily have them.
Ask: Which triConvey modules and add-ons are on our order form, and can the software be licensed with the Productivity Pack and AI Contract Review both off?
What the base software is described as doing
Public claim only
The product page, read 2026-09-27, lists matter management; customisable tasks and workflows; forms and precedents with automated document creation and a supplied content library; a client communication app; contract preparation; billing and trust accounting with disbursements and invoices; a settlement adjustment calculator; reporting and dashboards; offline and on-device access; and OneFlow, described as a single workflow connecting a property matter. None of these base features is described by reference to AI.
Ask: Which base triConvey features use AI in the current release, and which of the features on the product page require an add-on?
Release stage of the AI features
Public claim only
The AI Contract Review page states the tool 'is available in triConvey v9.5 or higher' and, in its own FAQ, that 'The Contract review tool is a new product that is actively in development'; it also states that it currently reviews general contract information, special conditions, the title search and the section 10.7 certificate, that documents are limited to 50MB and that a review typically takes between 2 and 10 minutes. The Productivity Pack page states the Pack 'will be continuously updated with the latest features & innovations' and lists 'More coming soon…'.
Ask: What is the release and support status of AI Contract Review, what is on the roadmap for it, and how will version changes to it be notified to us?
Deployment and hosting
Public claim only
The Cloud Location page describes 'triConveys hybrid cloud-based system with live data syncing' that provides unlimited storage 'whilst still allowing local computer access', with local backup in one click and use while offline. The security page states that 'The triConvey Software is powered by SMOKEBALL' and that, 'Being a cloud solution, the software and all client data is stored on SMOKEBALL Servers, which are built on the Amazon Web Services (AWS) platform', adding that 'triConvey stores data in the jurisdiction of origin, located in Sydney' and that continuous backups are taken. The privacy policy states the triConvey Software is 'a white-label instance of the Smokeball application, which is provided to triSearch under licence by Smokeball Australia Pty Ltd' and that 'Smokeball owns and hosts the triConvey Software'.
Ask: Confirm the AWS region and account that hold our triConvey data and backups, who operates that environment, and what the local copy on each workstation contains.
Governing law and jurisdictional coverage
Public claim only
General Terms clause 24.11 states the agreement 'is governed by the law of New South Wales' with the non-exclusive jurisdiction of that state's courts. The AI Contract Review page states the tool is built for 'a NSW Law Society 2022 Contract' and is 'available to triConvey users for NSW Purchase matters through One Flow'. The Productivity Pack page states the Pack 'is aimed at conveyancers in Australia, particularly those on the East Coast (NSW, QLD, VIC)'. Schedule 1 clause 4.1 states the AI Services may not have been developed, designed or approved by legal practitioners and that TriSearch does not represent that they comply with or reflect applicable laws.
Ask: Which states and territories are supported for each AI feature, and what happens when AI Contract Review is run on a contract from another state?
Vendor content directing how AI describes the product
Not confirmed
A deliberate check for content addressed to AI models, assistants or crawlers found none for this vendor: https://www.trisearch.com.au/llms.txt returns the site's page-not-found page, checked 2026-09-27, and a URL map of the site searched for 'ai' surfaced no /ai-info, /for-ai or equivalent page. A URL map does not reliably discover an unlinked file, so the absence is established only for the pages and the map checked.
Ask: Do you publish any page, file or block of text that tells AI models, assistants or crawlers how to describe triSearch or triConvey, and if so at what address?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the product
Public claim only
General Terms clause 8.1 entitles TriSearch to rely on the accuracy and completeness of Client Data without any obligation to verify it, and clause 12.3 places warranties about Client Data on the firm. For the AI features, Schedule 1 clause 3.4 makes the firm responsible for holding 'all necessary rights and consents, including third party privacy consents (Client Consents)' to provide Matter Data to TriSearch and to permit its use for delivering the AI Services, with an indemnity, and records that 'TriSearch is not a legal authority, cannot, and has not provided You with advice related to the necessity of Client Consents within Your jurisdiction'. The privacy policy states that where a firm provides a third party's personal information it 'must ensure that the third party is aware of this Privacy Policy, understands it and agrees to accept it'.
Ask: What consent wording do you expect us to obtain from conveyancing clients before their documents are processed by your AI features, and does any part of the agreement address it?
Which models and model providers are used
Not confirmed
No foundation model, model provider, model version or inference location is named in the General Terms, the privacy policy, the security page, the AI Contract Review page or the Archie page, all read 2026-09-27. Schedule 1 clause 2.1 says only that 'The AI Services utilise artificial intelligence (AI) algorithms and technologies, including generative AI', and clause 3.1 says 'The AI Services involve the use of third-party services' without naming them. Amazon Web Services is named as the hosting platform, which is infrastructure rather than a model provider.
Ask: Name the third-party services and model providers behind AI Contract Review and Archie, the country in which inference runs, and the notice you give before changing them.
Subprocessors and third-party recipients
Public claim only
The privacy policy names categories and some individual recipients: reseller and integration partners including 'Practice Evolve, LEAP, PEXA, Silqware, InfoTrack'; contractors and subcontractors including providers of customer relationship management, 'technology providers, including cloud, software and development services', marketing consultants and website hosts; and third-party suppliers for searches including ACIC and NPCS, the Document Verification Service, state and territory land registry offices, ASIC and AFSA. It also names Smokeball Australia Pty Ltd as the licensor that owns and hosts the triConvey Software. General Terms clause 7.3 permits sub-licensing and disclosure of Client Data to Third Party Suppliers and subcontractors, and clause 5.4 permits disclosure to TriSearch Affiliates. No consolidated subprocessor register with locations, and no notification or objection mechanism, was found.
Ask: Provide a dated subprocessor list for triConvey and its AI features, including every entity able to access matter data and the country each operates from.
Use of firm and client content for training or improvement
Public claim only
Schedule 1 (Archie AI) clause 3.3 of the General Terms current from 14 July 2026 states: 'You acknowledge that TriSearch may use Your de-identified Matter Data, together with other de-identified data, for the purpose of improving and training services and features You may access, and You instruct TriSearch to process Your Matter Data for such purpose', and that TriSearch 'retains all ownership in and to aggregated machine learning results'. Schedule 1 applies 'For Clients using the Smokeball Archie AI services', so on its terms the training right attaches to the AI services rather than to base triConvey; no equivalent clause appears in the General Terms for the base software, where clause 7.2 limits use of Client Data to providing the systems and products and forbids other use without written consent. No opt-out from clause 3.3 is published.
Ask: Does clause 3.3 of Schedule 1 apply to a firm that has not enabled Archie, and can the training instruction be struck out of our agreement?
Prompts, feedback and usage data
Public claim only
General Terms clause 6.2 reserves the right to 'gather analytics in relation to any and all activity on the TriSearch Systems, use of the TriSearch Products and Client Data for internal purposes (subject to clause 20 and 21), including for purposes such as billing, gauging interest and identifying usage patterns'. The definition of TriSearch Materials includes 'any metadata generated by TriSearch in the operation of the TriSearch Environment or supply of the TriSearch Products', which is TriSearch property under clause 19. The AI Contract Review page invites feedback on the tool; no document read says how prompts, flagged results or feedback about them are stored, used or retained.
Ask: How are AI Contract Review inputs, flagged outputs and any feedback we give classified, who can read them, and how long are they kept?
Retention of matter data
Public claim only
General Terms clause 17.1(d) requires each party, unless a request for return is made within 30 days of termination, to 'promptly securely and permanently delete or destroy' the other party's materials and records containing its confidential information; clause 17.1(e) then permits each party to retain copies required by law, regulator order, accounting, corporate governance, insurance or litigation purposes for a maximum of seven years from termination. Clause 23.1 requires the firm to keep auditable records for at least seven years after termination. The privacy policy commits only to 'taking reasonable steps to destroy or de-identify personal information after we no longer need it', and separately states criminal history check data is held for between 12 and 15 months.
Ask: State the retention period for matter documents, AI inputs and AI outputs during the term, and what exactly is retained under the seven-year retention period after exit.
Deletion on request and at exit
Public claim only
General Terms clause 17.1 requires deletion or destruction of the other party's materials after termination unless return is requested within 30 days, subject to the seven-year retention carve-out in clause 17.1(e). The privacy policy provides access and correction rights and states that reasonable steps will be taken to destroy or de-identify personal information when no longer needed. No customer-initiated deletion process during the term, no timeframe, and no certificate of destruction is published, and nothing addresses deletion of AI prompts or outputs specifically.
Ask: How do we have a single matter, document or AI interaction deleted during the term, within what period, and will you certify destruction including backups held by Smokeball?
Vendor staff access to firm and client material
Public claim only
The privacy policy states that 'people located overseas may be able to access (on a read only basis) your personal information in order to provide development services to us in relation to our Products and Services', that such access is strictly limited, under secure protocols and 'will remain under the supervision and control of our Australian based teams', and that 'Our overseas services providers are located in: Vietnam'. It also states that staff accessing the system 'must pass appropriate security clearance requirements' and that access is centrally restricted and monitored. The General Terms contain no clause limiting TriSearch personnel access to Client Data beyond the purpose limit in clause 7.2 and confidentiality in clause 20.
Ask: Which roles in Australia and in Vietnam can read our matter data, is that access logged and available to us, and can it be restricted to named individuals on our approval?
Access control
Public claim only
The security page lists identity and access management, access control lists, separation of duties, multi-vendor anti-virus, local and network firewalls, web application firewalls, intrusion detection, DDoS throttling, centralised log management, vulnerability assessment and anomaly detection, and makes the firm responsible for maintaining the security of passwords and user IDs. General Terms clause 8.2 requires the firm and its permitted users to protect user credentials and not to share them. Neither document describes matter-level or ethical-wall restrictions inside triConvey, and multi-factor authentication is not mentioned on the pages read.
Ask: Is multi-factor authentication available and enforceable for all triConvey users, and can access be restricted matter by matter for conflicts purposes?
Encryption in transit and at rest
Public claim only
The security page states that each triConvey application is accessed via HTTPS using Transport Layer Security and that 'Once client data reaches the triConvey cloud infrastructure, all information is then encrypted at rest, using AES-256'. The privacy policy states that 'All personal information we collect from you is stored in a secured location in Australia on infrastructure managed by TriSearch. Data is encrypted during transit using current TLS protocol and stored encrypted at rest using AES-256 encryption.' Neither document addresses key management or customer-managed keys, and the privacy policy's statement that the infrastructure is managed by TriSearch sits alongside its own statement that Smokeball hosts the triConvey Software.
Ask: Who manages the encryption keys for triConvey data held on Smokeball infrastructure, and are customer-managed keys available?
Independent assurance
Not confirmed
General Terms clause 22.1 warrants only that TriSearch will use commercially reasonable efforts to maintain security controls 'that meet or exceed ISO 27001:2013 and ISO 9001:2015 (or equivalent standard) and any successor standards' — a standard-alignment warranty, not certification. The privacy policy states 'TriSearch operates an Information Security Management System (ISMS) with full consideration of the ISO27001:2013 standard', which is also not a claim of certification. The security page names certifications held by Amazon Web Services and by DocuSign, not by TriSearch. No certificate, audit report, SOC 2 report, penetration-test summary or trust centre for TriSearch was found, and the ISO 27001 version cited in the contract (2013) has been superseded.
Ask: Is TriSearch itself certified to ISO 27001, to which version and scope, and will you provide the certificate, the statement of applicability and a penetration-test summary?
Contract structure and contracting entity
Public claim only
General Terms clause 1.1 states the agreement 'is made between TriSearch Services Pty Limited (TriSearch, We, Us or Our)' and the client, and comprises the General Terms, any Product Terms and Third Party Terms published on infotrack.com.au, and any order form, with later documents prevailing on inconsistency (clause 1.2). Clause 1.3 forms the agreement on clicking 'I Accept', first use, or signing an order form. The legal page states the contract model is 'General Terms + Product Terms + Third Party Terms + Privacy Policy' and that continuing to use the account on or after 14 July 2026 accepts the updated General Terms. The privacy policy gives the entity as 'TriSearch Services Pty Ltd (ABN 74 623 391 051)'; no ACN is published in either document, and no data processing agreement was found.
Ask: Provide the ACN of TriSearch Services Pty Limited, a data processing agreement covering the AI features, and confirmation of which Product Terms apply to triConvey.
Cross-border transfer and where data is processed
Not confirmed
The privacy policy states 'We store and retain your personal information in Australia. We do not presently disclose personal information to any organisations located overseas', while adding that it discloses information in Australia to multinational organisations located both in Australia and overseas including the United Kingdom, the United States and New Zealand, and that read-only access for development services is provided from Vietnam. The security page states triConvey data is stored on Smokeball servers 'in the jurisdiction of origin, located in Sydney'. The same privacy policy states Smokeball owns and hosts the triConvey Software, and Smokeball's own privacy policy, read the same day, places its servers in the United Kingdom, the United States and Australia and its service providers in those countries and Japan, so the two vendors' documents do not resolve to one statement about where triConvey matter data sits. For the AI features, Schedule 1 clause 3.1 records the firm's agreement that TriSearch 'may transfer any information automatically collected by the AI Services, submitted through TriConvey or the AI Services with third parties'.
Ask: Give a written commitment on which country holds triConvey matter data and backups, including Smokeball-operated infrastructure, and where AI processing of that data occurs.
Security incident and data breach notification
Public claim only
General Terms clause 21.5 requires a party with reasonable grounds to suspect a data breach to notify the other in writing with all relevant details 'without undue delay and no later than 72 hours after becoming aware of such a breach', to co-operate in the investigation, to mitigate, to prevent recurrence and to liaise on communications with the privacy regulator and affected individuals; clause 21.4 requires notice within 72 hours of any regulator compliance notice or any breach of the privacy clause. The security page states 'triSearch will notify the subscriber without undue delay and in writing on becoming aware of any Data Breach in respect to our client's data' and gives a contact address for reporting vulnerabilities.
Ask: Confirm the notification path and content for an incident affecting data held on Smokeball infrastructure, and who notifies affected clients under the Notifiable Data Breaches scheme.
Changes to the service and the terms
Public claim only
General Terms clause 6.1 reserves the right to modify supply, 'to change or discontinue any feature or functionality of the TriSearch Systems or TriSearch Products for any reason and at any time', and to amend the agreement, with at least 14 days' written notice only where a change 'materially and adversely affect[s] Your rights'; clause 6.3 then allows termination within 60 days of the change taking effect. The legal page records that the 14 July 2026 update added 'New terms for triSearch's use of AI in its Products and Services', added Schedule 1 (Archie AI), incorporated an updated Fees Schedule, removed the client's right to audit TriSearch, and replaced a 30-day notice requirement for changes to the General Terms or licence fees with 'reasonable notice'.
Ask: Will you give advance notice of changes to the AI features, their models or their scope, and reinstate a fixed notice period for changes to the terms and fees?
Exit and data portability
Public claim only
General Terms clause 17.1 requires the firm on termination to cease use and pay outstanding fees, and requires each party to delete the other's materials unless a request for return is made within 30 days of termination, with the seven-year retention carve-out in clause 17.1(e). The Cloud Location page states data can be backed up locally 'within one click or simply request a copy anytime'. No export format, no migration assistance, no charge for export and no statement about whether AI outputs are included in an export is published; clause 4.3(b), referenced in clause 17.1(d), was not examined in this pass.
Ask: In what format will matters, documents, trust records and AI outputs be returned at exit, within what period, at what cost, and who produces the copy given that Smokeball hosts the data?
What the software is connected to
Public claim only
General Terms clause 2 records that many TriSearch Products are Third Party Products supplied under a separate supplier contract formed between the firm and the third-party supplier, with TriSearch acting as agent, and that the firm's remedies for loss in connection with Third Party Products lie against the supplier rather than TriSearch; clause 7.3 permits disclosure of Client Data to those suppliers and to subcontractors. The product page names the triSearch search platform, Microsoft Word and Outlook, MYOB, Xero, electronic verification of identity, electronic signing, PEXA and Sympli, and the security page adds DocuSign behind triSign, Communicate and Securexchange.
Ask: Which connectors can the AI features read from, and can we prevent a connector from passing matter documents to an AI feature?
Whether the software's AI reaches outside the matter
Not confirmed
Nothing on the pages read states whether any AI feature retrieves information from the internet. AI Contract Review is described as operating on a contract uploaded by the user together with the title search and section 10.7 certificate, and Archie as answering questions from the data and documents within a triConvey matter; Schedule 1 clause 3.1 records only that the AI Services 'involve the use of third-party services'. No retrieval source outside the matter is described or excluded.
Ask: Can AI Contract Review or Archie retrieve anything from outside our tenancy, and which third-party services receive the documents we submit?
Whether the AI features can act without confirmation
Not confirmed
The AI Contract Review page states the tool does not change the contract — 'Rather than making changes to your Contract, the AI Contract Review tool will analyse the document and flag anything that may require your attention' — but also describes writing extracted contract details back into matter fields, with the FAQ recording that 'Importing data back to your matter can only be done once per matter' and that 'A warning message will be displayed before navigating you to the Contract extraction screen to view the fields before sending the data back to your matter'. That is a write to the matter record that the firm must review, and no audit record of it is described.
Ask: What is recorded in the matter audit trail when AI-extracted contract details are written into matter fields, and can that write be restricted to named users?
Human review of AI output
Public claim only
Schedule 1 clause 4.1 of the General Terms states that the firm acknowledges the AI Services 'do not constitute legal advice nor should they be relied upon as such by You', that they 'should be reviewed by a qualified lawyer before being incorporated in, or relied on, in connection with any legal advice', that they may not be accurate or up to date and are for the firm to validate or ignore using its own professional skill, judgement and experience, and that generated documents 'may include technical inaccuracies or typographical errors'. The AI Contract Review page states the tool 'is designed to support your due diligence, not replace it'.
Ask: What review workflow do you recommend for AI Contract Review output in a purchase matter, and is any record kept of who reviewed a flagged item?
