Product and intended use
Define the configuration, people, information and tasks being assessed.
Vincent versus Studio
Public claim only
Current site uses Vincent by Clio. Studio is a separate no-code workflow builder with different residency and retention rules for workflow assets.
Ask: Which product, country edition, modules and source rights are on our order, and is Studio in scope?
Residency
Public claim only
Vincent can store and process in US, AU or EU; region setup is via support. Studio: US or EU/Ireland. AU for Studio remains unknown until confirmed.
Ask: For Vincent and Studio separately, which countries cover storage, inference, keys, backups and support?
Capabilities
Public claim only
Research over vLex, analysis, comparisons, chronologies, recordings/transcription and Studio workflows are advertised. Independent productivity claims (38%) are vendor-cited studies, not our trial.
Ask: List enabled skills and demonstrate citations plus unsupported-answer behaviour for our matters.
Source coverage
Not confirmed
Global database is claimed. Australian primary-law depth, currency and citator behaviour were not specified on the overview page.
Ask: Which Australian courts and legislation are in our licence, and how is negative treatment shown?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client data in workflows
Not confirmed
Studio warns not to put sensitive or client-specific information in workflow assets unless it is meant to be permanent. Recording features need consent analysis.
Ask: Can we exclude matters, and what is the recommended client-disclosure wording?
Model providers
Public claim only
ZDR article discusses OpenAI ZDR APIs and quotes that nobody including OpenAI trains on platform work. A complete current provider list was not published.
Ask: Provide the model/provider register and ZDR contract for each endpoint we will use.
Subprocessors
Not confirmed
No dated public subprocessor list was found. Trust Centre exists.
Ask: Provide the current list with locations, notice and objection rights.
Training
Public claim only
Data-protection help: uploaded material is never used to train underlying models. Studio: firm data is never used to train or improve foundational models. ZDR article: ZDR APIs so providers do not store or train.
Ask: Point to the signed no-training and ZDR clauses covering prompts, uploads, Studio assets and transcripts.
Feedback
Not confirmed
Product copy says Vincent learns preferences. Whether that is per-tenant personalisation or shared training was not specified in the security pages.
Ask: What 'learns your preferences' stores, and is it used across customers?
Platform versus provider retention
Public claim only
Default one-year retention for conversations/files, configurable, then permanent deletion. Provider ZDR is not deletion from Vincent. Studio workflow assets persist until the workflow is deleted.
Ask: Set our default, and list retention for conversations, files, workflow assets, embeddings and backups.
Deletion
Public claim only
Expiry permanently deletes conversation/file data. Workflow-asset deletion is manual. Exit certification was not described.
Ask: Demonstrate deletion of conversations, uploads, workflow copies, embeddings and backups, with a certificate.
Personnel access
Public claim only
Data-protection help: uploads not accessible to other users or vLex personnel. Core security: RBAC and access only under documented circumstances; third-party-managed audit logs of data access.
Ask: When can staff read content, is it customer-visible, and can we forbid it?
Access control
Not confirmed
Role-based access is described internally. Customer SSO/SCIM/MFA were not documented on the pages reviewed.
Ask: Confirm SAML/SSO, MFA and SCIM on our tier.
Encryption
Public claim only
FIPS 140-2 compliant suite at rest and in transit; per-enterprise unique encryption master key.
Ask: Name algorithms, key custody, and whether BYOK is available.
Assurance
Public claim only
SOC 2 January 2025 and ISO 27001 June 2025 claimed; reports via trust.vlex.com. Independent pen tests claimed. Scope covering Studio and model providers was not inspected.
Ask: Provide current reports covering Vincent and Studio, with exceptions.
Contract
Not confirmed
Public MSA/DPA were not reviewed in this pass. Clio is now parent; contracting entity may have changed.
Ask: Provide the DPA, liability cap, governing law and output-ownership clause for our Vincent order.
Transfers
Public claim only
AU region is available for Vincent if configured. Studio is documented as US or EU/Ireland. Inference country for ZDR APIs is not stated.
Ask: Map storage, inference, backups and support countries for our exact products.
Incidents
Not confirmed
No public breach-notification timeline was found on the security help pages.
Ask: What contractual notice period from discovery applies?
Changes
Not confirmed
No model-change notice policy was found. Clio ownership may change product packaging.
Ask: What notice applies to model, residency or Clio-platform changes?
Exit
Not confirmed
Configurable deletion after retention. Export formats and post-termination window were not described.
Ask: How do we export conversations, files and Studio workflows, and what is certified deleted?
Connectors
Not confirmed
Not documented on the pages reviewed.
Ask: List connectors, data copied, and residual copies after disconnect.
Web search
Not confirmed
Product is described as using vLex's legal database. Whether optional web search exists was not stated.
Ask: Does any skill send prompts to the open web, and can it be disabled?
Studio actions
Public claim only
Studio embeds custom workflows. Autonomous external actions were not catalogued.
Ask: Which workflow steps can send email or write to other systems without a click?
Human review
Public claim only
Research outputs still need citation checking. Reliability claims do not remove verification duty.
Ask: Show sample outputs with pinpoint citations and unsupported-answer behaviour.