Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
VXT is published as three parts: Phone (integrated calling and SMS), Team (internal team chat) and Meet, described in the law page FAQ as 'an AI notetaker that transcribes and summarizes virtual and in-person meetings for lawyers, saving these notes directly to their legal software'. Phone and Meet are each priced per user per month on the pricing page. The FAQ states 'No, unlimited AI transcripts and summaries are included as part of the VXT Phone subscription'; that sentence sits on a marketing page and is not repeated in the terms of service or on the pricing page.
Ask: Confirm on our order form which of Phone, Meet and Team we are licensing, and warrant in writing that unlimited AI transcripts and summaries are included in the Phone subscription with no usage cap.
AI features in scope
Public claim only
The law page lists 'AI summaries' ('Customise the prompts for your AI notes') and 'AI transcripts' ('Keep a record of every conversation and know who said what') as separate features, and states that 'After every call and meeting VXT writes a file note, saves it to your legal software, and drafts a follow-up email ready for you to send' and that VXT 'automatically tracks the time you spend in calls and meetings and creates a time entry for you'. The same page lists non-AI features: call flows, contact syncing, call recording, call and SMS records, analytics, administrative controls and phone-number porting. Checked 2026-09-27.
Ask: Demonstrate on our tenancy which of the file note, time entry, transcript, summary and drafted email are produced by a model, and which prompts an administrator can fix firm-wide.
Deployment model
Public claim only
Cloud service only. The privacy policy states that information entered into the website, software applications or phone system 'is automatically transferred to the VXT system' and that the customer consents to storage 'on systems hosted by Google Cloud Platform, Amazon Web Services, and Microsoft Azure'. Access is through a web application and downloadable applications. No on-premises or private-cloud option appears on any page read on 2026-09-27.
Ask: Is any single-tenant or private-cloud deployment available, and which of the three named cloud platforms holds call audio, meeting recordings and transcripts for an Australian customer?
Jurisdiction and legal content
Public claim only
The terms of service are governed by New Zealand law with exclusive jurisdiction in New Zealand courts. The product carries no legal-content library: its inputs are call and meeting audio and the connected practice-management system, and nothing on the pages read claims coverage of Australian legislation or case law. Clause 9.2 puts compliance with applicable laws on the customer, and clause 8 puts compliance with recording and monitoring laws on the host of the call or meeting.
Ask: Will VXT agree to Australian governing law and an Australian forum, and confirm in writing that the product makes no representation about Australian legal content or advice?
Vendor content directing how AI describes the product
Not confirmed
A deliberate check for content telling AI models, assistants or crawlers how to describe the product was made on 2026-09-27 across a 38-URL site map of vxt.ai and the law, About, sub-processor, terms, privacy, pricing and security pages actually read. No /llms.txt, /ai-info or /for-ai page appeared in the map, and no 'Instructions for AI Assistants' heading or equivalent block appeared on the pages read. The check covers only those pages and the mapped URL list.
Ask: Does VXT publish, or plan to publish, any page or embedded block directing how AI assistants should describe the product, and where is it?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority, recording notice and consent
Public claim only
Clause 8 of the terms of service states that the customer is 'responsible for compliance with all Laws governing the monitoring or recording of conversations as the Host or Phone Host', that 'By using the Services, you authorize VXT to store recordings', that 'You will receive a notification (visual or otherwise) when recording and AI analysis is enabled', and that 'If you do not consent to being recorded, you can choose to leave the recorded session'. Clause 10.6 makes the customer solely responsible for Customer Content and for obtaining any third-party consents needed to use it. Clause 28.4 separately records the customer's consent to VXT recording its own dealings with the customer, including calls and emails, for staff training, service-quality and dispute purposes.
Ask: What exact recording and AI-analysis notice does the other party to a client call or a mediation receive, in what form, and can AI analysis be disabled for a nominated matter while call recording continues?
Foundation-model and speech providers
Public claim only
The published sub-processor list at /legal/sub-processors, read 2026-09-27, names three third parties under the data-use heading 'AI services': Anthropic, AssemblyAI and OpenAI. The list does not state which service performs which function, so no allocation between transcription, summarisation and email drafting can be recorded, and it names no contracting entity, country or processing region for any of them. Google Cloud Platform is listed separately under 'Cloud infrastructure', and Symbio, Twilio and Voxbone under 'Telephony services'. The list carries no version number or date.
Ask: For our account, name which of Anthropic, AssemblyAI and OpenAI processes call audio, transcripts, summaries and drafted emails, the contracting entity and endpoint region for each, and the notice we get if one is swapped.
Sub-processor list and change rights
Public claim only
VXT publishes a standing sub-processor list of 28 third parties with a two-column format, third party and data use, covering AI services, cloud infrastructure, telephony, analytics, advertising, customer relationship management, email, payments, eSigning, document management and internal communications. The page states 'we require all vendors to enter into data protection agreements with us that restrict their processing of Users' Personal Information'. It carries no dates, no countries, no legal entity names and no notice or objection mechanism. Clause 10.5 of the terms permits VXT's consultants, contractors, service providers and sub-processors to access and process Customer Content.
Ask: Provide a dated and versioned sub-processor register naming each entity, its country and the data it receives, and a contractual right to advance notice and objection before a new AI sub-processor is added.
Training on customer content
Public claim only
The privacy policy, incorporated into the agreement by clause 28.1 of the terms of service, lists among the purposes for which VXT collects, holds and uses personal information: 'train and improve the artificial intelligence features such as speech recognition and understanding'. The same wording appears again in section 4.0 as a use of non-personally identifiable data. Clause 10.2 of the terms assigns all rights in Service Generated Data to VXT and records the customer's consent to VXT using it 'for any purpose', including 'product and service development, marketing, analytics, quality assurance, testing, improvement of the Services'; clause 26 permits use of de-identified aggregated data to develop and improve the services for other customers. No opt-out from AI training appears on any page read on 2026-09-27.
Ask: Does the training purpose in section 3.0 of the privacy policy extend to our call audio, meeting recordings, transcripts and AI summaries, is there a contractual opt-out, and do Anthropic, AssemblyAI and OpenAI train on any of it?
Feedback and corrections
Public claim only
Clause 16.1 of the terms of service assigns to VXT all right, title and interest in any feedback, comments, suggestions or recommendations from the customer, its employees, contractors, agents or end users, with an unconditional and irrevocable assignment, and permits VXT to use it 'for any purpose whatsoever without any attribution, financial compensation, or reimbursement'. The clause does not state whether in-product corrections to an AI note or transcript are treated as Feedback. Section 3.0 of the privacy policy separately permits use of personal information to 'train and improve the artificial intelligence features'.
Ask: Are edits and corrections a fee earner makes to an AI transcript, summary or draft email treated as Feedback under clause 16.1, and are they used to tune models or prompts beyond our tenancy?
Retention of recordings, transcripts and summaries
Public claim only
The retention statement in the privacy policy is a single sentence: 'We will only keep personal information for as long as is needed to achieve its purpose, or to comply with relevant law, whichever is longer.' The policy states it was last updated 14 August 2023. No default or configurable window is published for call recordings, meeting recordings, transcripts, AI summaries or drafted emails, and the pricing page describes Meet storage and recordings as unlimited.
Ask: State the default and the configurable retention period for call audio, meeting recordings, transcripts, AI summaries and drafted emails, whether a firm can set a shorter period, and whether the AI sub-processors retain anything.
Deletion and access on exit
Public claim only
Clause 14.6 of the terms of service reads in full: 'Upon expiration or any termination of this Agreement, you will have no further access to your Customer Content.' It states no deletion period and no certified-erasure commitment. Clause 10.6 permits VXT to delete any Customer Content 'at any time without notice' if VXT becomes aware that it violates the agreement or applicable law. The GDPR addendum to the privacy policy gives a right to erasure of personal data on request for individuals in the United Kingdom and the European Economic Area; no equivalent Australian erasure commitment is published.
Ask: Within what period after termination is our content deleted from VXT, from Google Cloud Platform, Amazon Web Services and Microsoft Azure, and from the AI sub-processors, and will you certify the deletion in writing?
Vendor and sub-processor access to content
Public claim only
Clause 10.5 states that VXT's access to Customer Content 'may include VXT's consultants, contractors, service providers, subprocessors, and other VXT-authorized third parties accessing, using, collecting, maintaining, processing, storing, and transmitting Customer Content'. The privacy policy states that the customer's personal information 'is not controlled, accessed or used by the third parties who host our systems, except for the intended use of storing that information', that VXT 'is based in New Zealand and may access your personal information from New Zealand', and that one purpose of collection is to 'carry out training of our personnel in relation to the Services'. No ticketed-approval process, named access roles or customer-visible access log is published.
Ask: Which VXT roles can play back our call and meeting recordings or read transcripts, from which countries, under what approval, and can we obtain a log of every such access?
Access control, single sign-on and audit
Not confirmed
Clause 1.1 requires accurate registration information and clause 1.2 prohibits sharing an account between users. The law page lists an 'Admin controls' feature described only as 'Easily manage your team and phone settings'. No statement about single sign-on, SAML or OIDC, SCIM provisioning, enforced multi-factor authentication, role-based restriction of recording playback, or an exportable audit log appears on the law, pricing, terms, privacy, sub-processor, security-contact or About pages read on 2026-09-27.
Ask: Does VXT support SAML or OIDC single sign-on, SCIM provisioning and enforced multi-factor authentication, can recording and transcript access be restricted by role, and can we export an audit log of playback and AI use?
Encryption in transit and at rest
Not confirmed
Clause 10.5 commits VXT to 'maintain reasonable and appropriate physical and technical safeguards to prevent unauthorized disclosure of or access to Customer Content'. The privacy policy says HTTPS is used while opted-in mobile contacts are transmitted, and that card details may be encrypted and stored by the payment provider; it also says 'we are unable to give an absolute promise that your information will always be safe'. No statement about encryption at rest for call audio, meeting recordings, transcripts or summaries, no algorithm or protocol version, and no customer-managed key option appears on any page read on 2026-09-27.
Ask: Confirm in writing the encryption in transit and at rest for call audio, meeting recordings, transcripts and AI summaries, naming the algorithms and key management, and whether customer-managed keys are available.
Independent security assurance
Not confirmed
No independent certification or audit report is claimed anywhere read on 2026-09-27. The page linked as 'Security contact' in the site footer is a vulnerability-report page only: 'If you believe you have found a security vulnerability in VXT, please let us know. We will investigate all reports and our security team will respond as soon as possible.' A 38-URL site map of vxt.ai showed no trust centre, security or compliance page, and neither the terms of service, the privacy policy nor the sub-processor list mentions SOC 2, ISO/IEC 27001, ISO/IEC 42001 or IRAP. The absence is the finding.
Ask: Do you hold SOC 2 Type II, ISO/IEC 27001 or any other independent certification covering the telephony platform and the AI transcription and summarisation pipeline, and will you provide the report and the latest penetration-test summary under non-disclosure?
Contract, DPA, liability and forum
Public claim only
The terms of service, effective 30 July 2026, are between the customer and VXT Limited, governed by New Zealand law with exclusive jurisdiction in New Zealand courts. Clause 24.1 excludes indirect, consequential and punitive damages, excludes liability for 'Unauthorized access to, loss of, deletion of, or alteration of system data, customer content, or customer data', and caps aggregate liability at the amount actually paid for the services in the twelve months preceding the event. Clause 22 disclaims warranties. Clause 28.3 states that where a business, enterprise or education account owner's use 'requires VXT to process an End User's personal data under a data processing agreement, VXT will process such personal data subject to VXT's Privacy Policy' — that is, the privacy policy stands in place of a separate data processing agreement, and no standalone DPA document was found.
Ask: Will VXT contract through an Australian entity under Australian law, execute a standalone data processing agreement with Australian Privacy Principle terms, and remove both the exclusion for unauthorised access to or loss of Customer Content and the twelve-month liability cap?
Hosting location and cross-border transfers
Not confirmed
No hosting region is published. The privacy policy states the customer consents to storage 'on systems hosted by Google Cloud Platform, Amazon Web Services, and Microsoft Azure and accessing your personal information from New Zealand', and also that 'Your personal information may be stored in locations outside the direct control of VXT' and that 'If you are not comfortable with your personal information being transferred to a system in another jurisdiction, you should not provide VXT with your personal information'. The sub-processor list read the same day names only Google Cloud Platform under 'Cloud infrastructure' and does not list Amazon Web Services or Microsoft Azure at all, so the two published documents name different sets of cloud hosts. Neither names a region or country for storage or for the three AI services. The GDPR addendum states some personal information is processed by third-party data processors in other countries, including Australia.
Ask: Which of Google Cloud Platform, Amazon Web Services and Microsoft Azure holds our data, in which region, why the sub-processor list omits two of them, and in which country does each AI sub-processor run inference on our call and meeting content? Is an Australia-only storage and inference option available?
Incident notification
Public claim only
Clause 10.5 states 'VXT will notify you if it becomes aware of an unauthorized disclosure or unauthorized access to Customer Content.' Section 6.0 of the privacy policy states 'If we become aware of any security breach relating to your personal information, we will advise you as soon as we can.' Neither sets a period measured from discovery, neither mentions the Notifiable Data Breaches scheme or the Office of the Australian Information Commissioner, and neither addresses notification of an incident at a sub-processor. No incident history is published on any page read on 2026-09-27.
Ask: What is the contractual notification period from discovery, will you notify us of incidents at Anthropic, AssemblyAI, OpenAI or the cloud hosts, and will you cooperate with our assessment under the Notifiable Data Breaches scheme?
Change notice for terms, policies, sub-processors and models
Public claim only
Clause 15.1 permits VXT to make changes to the terms by posting them with an effective date, with continued use after that date constituting agreement, and says VXT 'may' request express confirmation in some instances. Clause 15.2 permits VXT to modify its guides, statements, policies and notices 'with or without notice to you' by posting an updated version. Clause 15.3 places the onus on the customer: 'It is your responsibility to keep your email address up to date for any notices that VXT may send to you from time to time and to regularly review this Agreement'. Section 14.0 of the privacy policy makes an amended policy effective 'as soon as it is posted'. The sub-processor page says vendors are updated over time but carries no version or date. Price changes are the one exception, with seven calendar days' notice under clause 12.3.
Ask: What advance written notice will we receive before a change to the terms or privacy policy, the addition of a new AI sub-processor, or a change of model, and do we have a right to object or to terminate without charge?
Export and exit
Public claim only
Clause 14.3 requires termination notice by the end of the then-current term, and permits termination for a material breach VXT has not cured within thirty business days of written notice. Clause 12.2 makes payments non-cancellable and non-refundable for the current term. Clause 14.6 states that on expiry or termination the customer has 'no further access' to its Customer Content. No export format, export window or self-service bulk download of recordings, transcripts, summaries or call records is published on any page read on 2026-09-27; nor is a buy-out or porting-out process for numbers, although the site offers a buy-out page for inbound switching.
Ask: Before termination takes effect, in what format and over what window can we export all call and meeting recordings, transcripts, summaries, drafted emails and call and SMS records, and how do we port our numbers out?
Connectors and third-party offerings
Public claim only
Clause 20 states that VXT 'is not responsible for, and VXT hereby disclaims any liability for, any act or omission of any provider of Third-Party Offerings or the operation of any Third-Party Offerings, including access to, modification of, or deletion of data', that VXT 'does not guarantee the interoperation, integration, or support of any Third-Party Offerings', that VXT may modify the services at any time with the result that an integration fails, and that use of a third-party offering 'is governed solely by the terms of such Third-Party Offerings'. Section 12.0 of the privacy policy is headed 'Your responsibility in transferring your data to third-party applications'. The law page names sixteen practice-management and document integrations.
Ask: For each integration we enable, what data leaves VXT, who holds it afterwards, and will VXT accept responsibility for a write that corrupts or deletes matter data in our practice-management system?
Open-web retrieval
Not confirmed
Nothing on the law page, the sub-processor list, the terms of service, the privacy policy, the pricing page or the security page describes any open-web search or browsing by the AI features. The published inputs are call and meeting audio and the connected practice-management system, and the sub-processor list contains no search-engine or web-retrieval provider. The absence of a statement is not the same as a statement that no web retrieval occurs.
Ask: Do the AI summary or email-drafting features make any outbound request to a search engine, a web index or any source outside our tenancy, and can that be disabled?
Automatic writes into the matter record
Public claim only
The law page states that 'After every call and meeting VXT writes a file note, saves it to your legal software, and drafts a follow-up email ready for you to send', and that VXT 'automatically tracks the time you spend in calls and meetings and creates a time entry for you'. On that wording the file note and the time entry are written into the connected system, and the email is left as a draft for the user to send. Contact syncing is described as automatic between VXT and the legal software. No published control makes any of these writes conditional on a confirmation step, and no audit trail of automated writes is described.
Ask: Which writes into our practice-management system occur without a human confirmation — file note, time entry, contact sync — and can each be configured to require approval before it is saved to the matter?
Human review before use
Public claim only
The only published review point is the follow-up email, described as a draft 'ready for you to send'. The AI summaries feature is described as 'Customise the prompts for your AI notes', which is configuration rather than review. Clause 8 of the terms provides a notification when recording and AI analysis is enabled but no review step. Nothing published requires a named person to approve an AI file note, transcript or time entry before it becomes part of the matter record, and the terms contain no AI-specific human-oversight clause.
Ask: What product control requires a fee earner to approve an AI file note, summary or time entry before it is saved to the matter, can that control be mandated firm-wide by an administrator, and is the approval recorded?
