Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The Copilot is tier-gated. The generative AI page states 'Generative AI features are included FREE with the newest Power PDF Business ONLY' (checked 2026-09-27), and the Business feature list carries 'Generative AI Copilots (bring your own OpenAI license)'. Power PDF Standard and Advanced are listed separately and the pages read do not offer the Copilot on them.
Ask: Confirm in writing that the licences we are quoted are the Power PDF Business version that carries the Copilot, and state which Power PDF build number first included it.
What the AI panel does
Public claim only
The generative AI page names exactly three Copilot functions, checked 2026-09-27: Document Q&A (asking questions of an open document), Document Summary and Document Translation. The surrounding PDF editor, not the AI panel, performs OCR, redaction, Bates numbering and password protection. No legal content set, retrieval layer, citation layer or verification step is described for the Copilot on the pages read.
Ask: Beyond document question-and-answer, summary and translation, does the Copilot perform any other function in the current build, and does it ever act on more than the document open in the editor?
Deployment model
Public claim only
Power PDF is Windows desktop software; the Business tier page lists 'Support for Citrix, Microsoft App-V and Windows Server deployment', a minimum of 5 users, a browser-based Cloud Editor, an included Microsoft Teams app and 'Single admin to manage users, installs, security, updates' (checked 2026-09-27). The pages read do not say where the Cloud Editor or the Teams app is hosted.
Ask: In which region is the Power PDF Cloud Editor and the Teams app hosted for an Australian customer, and can the Copilot be licensed on desktop installs with the Cloud Editor and Teams app disabled?
Australian facts and jurisdiction
Not confirmed
No Australian contracting entity, ACN or ABN, hosting region, data-residency option or named Australian customer was found on the pages read, checked 2026-09-27. The trust centre lists 'IRAP Readiness Assessed - PROTECTED Level' and defines it on the same page as meaning the organisation 'has completed a preliminary gap analysis against the Australian Government's security controls, but it is not a formal certification', without naming the products assessed. On the published bring-your-own-licence design, where inference runs is determined by the customer's own OpenAI or Azure OpenAI tenancy, so inference in Australia is a question for the firm's own model contract and is not something the vendor states it provides.
Ask: Which legal entity contracts with an Australian firm for Power PDF Business, with its ACN or ABN, and which products were within the IRAP readiness assessment?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27; no content directing how AI should describe the product was found. A 187-URL map of www.tungstenautomation.com returned no /llms.txt, /ai-info, /ai or /for-ai path, and did return non-HTML files such as /sitemap.xml, so such a file would have been capable of appearing in the map. Five vendor pages were read in full and searched for an 'Instructions for AI Assistants' heading, any block addressed to AI models, assistants or LLMs, and any 'describe X as Y' wording: the generative AI page, the Business page, the trust centre overview, the privacy policy and the website terms of use. Two things on the site are separate matters and are not narrative direction: 'Meet Aria, your Tungsten Guide', which is the vendor's own customer-facing chatbot, and /solutions/artificial-intelligence, an ordinary product page. robots.txt was not fetched; crawler allow and disallow directives are access control, not narrative control, and were not part of this check. The check is negative on what was read, not exhaustive over the whole site.
Ask: Does Tungsten Automation publish, anywhere on its sites, guidance or instructions to AI models, assistants or crawlers about how Power PDF or the Copilot should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to send client material to the AI
Not confirmed
On the published design the Copilot passes content from the open document to a large-language-model account the customer contracts for separately: 'Must bring your own license from OpenAI (GPT-3.5 Turbo and GPT-4) and Microsoft Azure OpenAI (optionally, with Azure RBAC)' (generative AI page, checked 2026-09-27). Nothing on the pages read addresses client confidentiality, legal professional privilege or obtaining client authority, and the terms located are website terms rather than a software licence.
Ask: Which document content leaves the desktop when a user runs Document Q&A, Summary or Translation, and is any of it logged by Tungsten software before it reaches our own model endpoint?
Models and who supplies them
Public claim only
The generative AI page names OpenAI (GPT-3.5 Turbo and GPT-4) and Microsoft Azure OpenAI (optionally with Azure RBAC) and requires the customer to supply the licence, checked 2026-09-27. Tungsten publishes no model of its own for the three functions. The statement sits on a product page, not in a contractual document.
Ask: Which exact model deployments does the current Copilot build call, can we pin a model version and an Azure OpenAI region, and what happens to the feature if OpenAI retires GPT-3.5 Turbo?
Subprocessors
Public claim only
The trust centre publishes a subprocessor list with a 'View all' link; four entries were visible on the overview read 2026-09-27: Vanta (USA, security and compliance monitoring), Microsoft Azure (Ireland, 'Hosting Service Provider for most Subscription Services', services named as 'Printix and other Cloud Services'), Orange Business (Sweden, for Exder) and Google Cloud (UK and USA, cloud data management). None of the four visible entries names Power PDF, the Cloud Editor or the Copilot, and no Australian subprocessor region appears among them.
Ask: Which entries on the subprocessor list apply to Power PDF, its Cloud Editor, the Teams app and any Copilot telemetry, and will we be notified before a subprocessor serving those is added or changed?
Training on customer content
Not confirmed
The generative AI page states 'All data related to Copilot usage resides in customer's account. Tungsten will not have access to any user's data' (checked 2026-09-27). That addresses Tungsten's own access, not whether the model provider trains on the content, and on the bring-your-own-licence design that setting sits in the customer's own OpenAI or Azure OpenAI agreement rather than in any Tungsten document. No Tungsten statement on training was found in the website terms, the privacy policy or the trust centre overview.
Ask: Will Tungsten warrant in our licence that neither Tungsten nor any Tungsten subprocessor trains on Copilot prompts or document content, and confirm that the training setting for the model itself is governed solely by our own OpenAI or Azure OpenAI agreement?
Prompt, output and feedback capture
Not confirmed
Nothing on the generative AI page, the Business page, the trust centre overview, the privacy policy or the website terms describes rating controls, prompt logging, output logging or product telemetry from the Copilot panel, checked 2026-09-27.
Ask: Does the Copilot panel send any prompt text, document text, output or usage telemetry to Tungsten or to a Tungsten subprocessor, and can that be switched off by the single administrator?
Retention of documents and prompts
Public claim only
The Business page states 'Tungsten does not permanently store customer documents; files are retained only for the duration of the editing session', checked 2026-09-27. That sentence sits in the Power PDF Cloud Editor and Teams collaboration section and is not expressly made about the Copilot. No retention period for Copilot prompts or outputs was found, and the privacy policy's retention clauses are about website-visitor and customer-relationship personal data.
Ask: Does the 'duration of the editing session' statement extend to Copilot prompts and outputs as well as Cloud Editor files, and what is the retention period for each in writing?
Deletion on request
Not confirmed
The privacy policy gives data-subject deletion rights over personal data the Company holds, exercised through a DSAR centre and a data protection officer contact, checked 2026-09-27; those rights concern personal data, not customer documents or Copilot prompt history. No product deletion commitment for Power PDF, the Cloud Editor or the Copilot was found on the pages read.
Ask: How do we require deletion of any Copilot prompt, output or Cloud Editor file held by Tungsten, within what period, and will Tungsten certify the deletion?
Vendor staff access to content
Public claim only
The generative AI page states 'Tungsten will not have access to any user's data' in a footnote about Copilot usage, checked 2026-09-27. It is a product-page footnote; no equivalent clause was found in the website terms of use, the privacy policy or the trust centre overview, and the pages read say nothing about staff access on the customer's own model provider's side.
Ask: Will Tungsten repeat the 'will not have access to any user's data' statement as a warranty in our licence, and does it also cover support staff access to Cloud Editor files and to any diagnostic logs?
Administration and access control
Public claim only
The Business page lists 'Single admin to manage users, installs, security, updates', 'Centrally managed security, document-access restrictions and redactions' and password protection, checked 2026-09-27. The generative AI page mentions Azure role-based access control as an option on the customer's own Azure OpenAI side. Nothing on the pages read states whether an administrator can enable or disable the Copilot per user or per group, or whether single sign-on is supported.
Ask: Can the single administrator turn the Copilot off for named users or groups and enforce that centrally, and does Power PDF Business support our identity provider for sign-on?
Encryption in transit and at rest
Not confirmed
No encryption statement for the Copilot, the Cloud Editor or the Teams app was found on the generative AI page, the Business page or the trust centre overview, checked 2026-09-27. The Business page's 'Password protection' feature is document-level PDF security, which is not a statement about service encryption.
Ask: State the encryption in transit and at rest for Cloud Editor files and for the call the Copilot makes to our model endpoint, including the TLS version and who holds the keys.
Independent assurance
Public claim only
The trust centre compliance panel lists ISO/IEC 27001:2022, SOC 2 Type 1 and Type 2 (separate public cloud and private cloud reports), SOC 3, PCI DSS, Peppol, GDPR, CCPA, HIPAA, a Hellios accreditation, FedRAMP High, NIS 2, GovRAMP authorisation and 'IRAP Readiness Assessed - PROTECTED Level', checked 2026-09-27. Certificates and SOC reports sit behind a request-access gate. The overview does not say which products any of these cover, and an ISO scope note on the same page refers to Vanta's Trust Management Platform, which leaves the scope of the listed ISO certificate unclear from the overview alone.
Ask: Provide the ISO/IEC 27001 certificate with its scope statement and the SOC 2 Type 2 report, and confirm in writing whether Power PDF, its Cloud Editor and the Copilot are inside the certified and audited scope or outside it.
Contractual documents located
Public claim only
The only contractual document located is the website Terms of Use, which by its own clause 1.2 governs use of the website and its tools, information and content, and whose clause 14.1 states that 'You also may be subject to additional terms and conditions that may apply when You use Tungsten or third-party products or services'. It disclaims warranties for the website on an 'AS IS' basis, and sets California law with exclusive jurisdiction in the courts of Orange County, California, checked 2026-09-27. No Power PDF software licence, master agreement or executed DPA text was located; the trust centre lists a 'Tungsten Automation standard DPA (template)' as a request-access resource rather than publishing it.
Ask: Provide the Power PDF Business software licence and the standard DPA for signature, and state the governing law and jurisdiction that would apply to an Australian purchaser rather than to website use.
Cross-border transfers
Public claim only
The privacy policy states that personal data may be transferred to affiliates and third parties overseas, gives Microsoft Azure and Amazon Web Services as examples of third parties 'involved in transfer of personal data', and relies on European Commission standard contractual clauses or a vendor's processor binding corporate rules where there is no adequacy decision, checked 2026-09-27. Those clauses concern personal data the Company processes, not documents processed in the product, and no Australian transfer mechanism is addressed. A Transfer Impact Assessment is listed on the trust centre behind a request-access gate.
Ask: For an Australian firm, which countries will Power PDF, the Cloud Editor and any Copilot telemetry route data through, and what transfer mechanism applies given that the standard contractual clauses cited are European instruments?
Incident and breach notification
Not confirmed
The trust centre publishes a security contact (security@tungstenautomation.com), an uptime FAQ and, in an update published 9 December 2025, an EMEA cloud services status page, checked 2026-09-27. No breach-notification obligation or timeframe was found in the website terms of use, the privacy policy or the trust centre overview, and none of the material read addresses notification to an Australian customer under the Notifiable Data Breaches scheme.
Ask: What is the contractual notification period and channel if an incident affects Power PDF, its Cloud Editor or the Copilot, and will Tungsten assist us with Notifiable Data Breaches scheme assessment and notification?
Notice of change
Not confirmed
The website Terms of Use clause 7 reserves the right 'at any time to modify, suspend or terminate the Services (or any part thereof), and/or Your use of or access to them, with or without notice' and to amend the terms by posting them, checked 2026-09-27; that clause is about the website. The privacy policy says significant changes will be notified by a posting on the website. No commitment on notice of changes to the Copilot's functions, models or availability was found.
Ask: What notice will we receive before the Copilot's functions, its supported model providers or its availability in Power PDF Business change, and is that notice contractual?
Exit and data return
Not confirmed
No statement was found on the pages read about what happens at the end of a Power PDF Business licence: there is no published commitment on return or deletion of Cloud Editor content, no export commitment, and no statement whether the desktop editor continues to open existing PDFs after a licence lapses, checked 2026-09-27. Documents themselves remain ordinary PDF files held by the firm.
Ask: On expiry or termination of our Power PDF Business licence, what happens to Cloud Editor files and Copilot configuration, and does the desktop application continue to open and read our existing PDFs?
Repository and application connectors
Public claim only
The Business page states Power PDF integrates with document management systems 'including iManage, Sharepoint and eDOCs', includes an app for Microsoft Teams, offers 'Custom and flexible configurations with SDK and API capabilities', and integrates Tungsten SignDoc for signing with an additional purchase required, checked 2026-09-27. Nothing on the pages read says whether the Copilot can read from those repositories or only from the document open in the editor.
Ask: Can the Copilot read documents from iManage, SharePoint or eDOCS, or only the file open in the editor, and does an SDK or API integration change what content is sent to the model?
Internet retrieval
Not confirmed
The generative AI page describes three document-scoped functions and says nothing about internet retrieval, web browsing or any external source beyond the open document and the customer's model endpoint, checked 2026-09-27. Absence of a description is not a statement that retrieval cannot occur.
Ask: Does the Copilot ever retrieve anything from the internet, and if not, will Tungsten confirm that its only outbound call is to the model endpoint we configure?
What the AI can do without a further step
Not confirmed
The three published functions return text in the Copilot panel; the generative AI page does not describe any agentic behaviour, file writing, sending or multi-step workflow, and does not say whether a summary or translation is inserted into the document or saved automatically, checked 2026-09-27.
Ask: Does any Copilot output write into, overwrite or save the PDF without a further user action, and is there an audit record of Copilot use per user?
Verification of output
Public claim only
The generative AI page describes translation as allowing teams to handle translations in-house 'while still ensuring quality through human oversight when needed', checked 2026-09-27. That is a marketing description of the customer's practice, not a product control. No citation layer, source linking, confidence indicator or verification step is described for any of the three functions, and no accuracy measure is published.
Ask: What in the product signals to the user that a Copilot answer, summary or translation may be wrong, and is any check built in beyond the user reading the source document?
