Legal-specific · Practice management · Medium confidence
Xakia Technologies (Aust) Pty Ltd · Xakia matter/contract SaaS (Advance, Professional, Enterprise, All-In) with optional Xakia AI. Australian Data Location and Xakia Technologies (Aust) Pty Ltd terms. Trials/Betas and Connect exchanges need separate review.
Australian in-house legal operations platform for matter, spend and contract work, with optional opt-in AI review, redlining and search on Microsoft Azure.
Opens a private software assessment of Xakia for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | Australia, United Kingdom, United States, European Union / EEA, Canada |
| Australian region | On request |
| Assurance | ISO/IEC 27001:2022, SOC 2 Type II |
| Training on customer content | Unknown |
| Retention summary | Terms s 5.6: Subscriber Data retained 30 days after termination then permanently deleted. Security page: backups every five minutes, stored 35 days. AI page does not state model-provider retention. |
| Integrations | Microsoft 365, Gmail, NetDocuments, iManage, Salesforce, API, SSO |
| Pricing summary | Public per-user monthly or annual plans from A$105 (Advance) to higher Professional, Enterprise and All-In tiers. AI Access is an add-on on lower tiers and included on Enterprise/All-In with usage caps. Internal requesters and Connect are described as uncharged. Month-to-month with optional annual discount. |
| Legal content coverage | Customer matters, contracts and uploaded documents. No licensed Australian primary-law library is claimed. AI is marketed for contract review, redlining, key-term extraction, search and (coming soon) invoice review. |
| Australian presence | Yes — Xakia Technologies Pty Ltd (ACN 612 857 593) and Xakia Technologies (Aust) Pty Ltd (ABN 73 659 548 366), Level 13, 664 Collins Street, Docklands VIC 3008. Australian Azure Data Location is selectable at account creation and cannot later be changed (privacy 7.1). |
Define the configuration, people, information and tasks being assessed.
Public claim only
Four public plans (Advance, Professional, Enterprise, All-In). Xakia AI is an add-on on Advance/Professional and included on Enterprise/All-In with usage caps. Invoice-review AI is listed as coming soon. Trials and Betas have a US$1,000 liability cap (s 21).
Ask: Confirm our SKU, whether AI Access is on, usage caps, and whether any Beta features will be enabled.
Public claim only
Cloud SaaS on Microsoft Azure. Terms s 4: Data Locations are Australia, Canada, the Netherlands, the United Kingdom and the United States; the choice cannot be changed after account creation (privacy 7.1). Main Data Location drives contracting entity and Victorian law if Australia.
Ask: Confirm our Main Data Location is Australia only, including backups, logs and any AI processing.
Public claim only
Xakia AI is described as opt-in first-pass contract review and redlining, key-term extraction, natural-language search and (coming) invoice review, each with a human checkpoint. Non-AI platform covers matters, spend, intake, AutoDocs and Connect.
Ask: Which AI features will be enabled, and can we keep AI off for nominated matter types?
Public claim only
Xakia stores the customer's matters and contracts; it is not a licensed Australian case-law product. Australian Main Data Location uses Victorian law and Xakia Technologies (Aust) Pty Ltd.
Ask: Confirm AI will not browse open-web Australian law, and that Victorian law applies to our order.
Record the practical work needed to introduce and maintain the software.
Public claim only
Per-user monthly Service Periods, auto-renewing unless 30 days' non-renewal notice (s 16.1). Public list from A$105/user/month. Fees may change on 60 days' notice (s 12.3). AI Access extra on lower tiers.
Ask: Lock our unit price, AI add-on, annual vs monthly, and the 60-day fee-change right.
Public claim only
Advance lists M365 and Gmail integrations, API and SSO. Professional adds NetDocuments and iManage. Salesforce is a paid higher-tier item. Terms s 10: third-party platforms are under their own agreements. Connect exchanges data with outside counsel.
Ask: Demonstrate M365/iManage sync, SSO, and what Connect sends to law firms.
Public claim only
Terms s 6.1–6.3: commercially reasonable 24/7 support, 99.95% monthly availability target, knowledge base plus in-app chat. Trust list: Intercom (US) for in-app support; group entities in Australia, the UK or the USA may provide after-hours support. Notices to legal@xakiatech.com.
Ask: Provide the support SLA for our tenant and whether Intercom or overseas group staff can read matter content.
Compare complete work at the required quality, including checking and correction.
Not confirmed
AI marketing describes a first pass with a human checkpoint. No independent accuracy study was found.
Ask: Share any evaluation of Xakia AI redlining on Australian contracts, including miss and over-redline rates after the human checkpoint.
Public claim only
AI is positioned as first-pass work around legal thinking, not a substitute for sign-off. Time saved after checking is not independently measured.
Ask: On our playbook, show a redline Xakia AI proposes, what the checkpoint UI requires, and typical lawyer time to accept or reject it.
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Internal client portal and Connect put non-lawyers and outside counsel on the system. Terms s 8.1: the platform is not designed for Sensitive Data and Xakia has no liability for Sensitive Data submitted. AI outputs still need a human checkpoint per marketing.
Ask: How do we exclude privileged or Sensitive Data from AI and Connect, and what disclosure do internal requesters see?
Not confirmed
Xakia AI pages do not name OpenAI, Azure OpenAI, Anthropic or any other model. The trust-centre extract lists Microsoft Azure for hosting, not a named LLM. The dedicated subprocessors URL returned no content.
Ask: Name each model, legal entity, Azure region and contract used for Xakia AI, and the notice period before a model is swapped.
Public claim only
DPA points to https://trust.xakiatech.com/ with 30 days' email notice and objection/termination rights. The trust page extract lists Microsoft Azure (customer-selected region), Microsoft 365 (Australia), Intercom (USA), Stripe Payments Australia, Twilio/SendGrid (USA), Xero, and Xakia group entities (Australia, UK, USA). A named AI subprocessor was not on that extract.
Ask: Provide the current dated register including any AI processor, with entity, country, purpose and our objection path.
Not confirmed
AI page: 'your data is never used to train any AI model.' Terms s 5.3: Xakia may collect usage and content data and use it to operate, improve and support products, disclosing only if de-identified and aggregated. The DPA does not add an LLM-training ban. Those two statements are not the same.
Ask: Does any signed document prohibit training of Xakia or third-party models on uploads, prompts, outputs and embeddings, and how does s 5.3 sit with the AI page?
Not confirmed
Human checkpoint is described as sign-off before anything is saved, applied or sent. Whether rejected redlines train a shared model is not stated. s 5.3 allows improvement use of content data.
Ask: Do checkpoint accept/reject labels stay in our tenant only, and can we disable s 5.3 improvement on our content?
Public claim only
s 5.6: 30 days after termination then permanent deletion of Subscriber Data. Security: backups every five minutes kept 35 days. AI chat/embedding and model-provider retention are not stated.
Ask: State default and configurable retention for AI prompts, redlines, embeddings and model-provider logs on an Australian Data Location.
Public claim only
s 5.6 and DPA: automatic deletion 30 days after termination; earlier deletion on written request as soon as reasonably practicable and within 30 days. Self-service delete/export in-product. No certification template or model-provider erasure was found.
Ask: On exit, will you certify deletion of Subscriber Data including backups, Intercom and any AI processor within 30 days?
Public claim only
DPA TOMs: a subset of employees have access via controlled interfaces for support, troubleshooting and security incident response. Trust list: after-hours support by group entities in Australia, the UK or the USA; Intercom for in-app chat.
Ask: Who can read our matters and AI chats, from which countries, under what approval, and can we see those access logs?
Public claim only
Advance plan lists SSO. Security page: matter-level confidentiality flags inherited by the DMS. DPA: uniform password policy, OAuth or API key for public APIs. MFA was not described on the pages read.
Ask: Confirm SSO/SCIM and MFA on our plan, and whether we can export a complete AI prompt/redline audit log.
Public claim only
Security page: 'best practice' encryption in use, in transit and at rest, including uploaded documents. Algorithms and customer-managed keys were not named.
Ask: Confirm algorithms for matters, documents and any AI path, and whether customer-managed keys are available for an Australian tenant.
Not confirmed
Security and AI pages claim ISO/IEC 27001:2022, SOC 2 Type II and HIPAA. Terms s 6.4 contractually require ISO/IEC 27001:2013 and SOC 2 Type II for each Service Period. Those ISO edition numbers differ. Reports were not inspected.
Ask: Provide the current ISO 27001 (state the edition) and SOC 2 Type II reports covering Xakia AI, with scope and exceptions.
Public claim only
Public Terms (effective dating aligned to 1 October 2025 PDFs) plus incorporated DPA. Australian Data Location: Xakia Technologies (Aust) Pty Ltd, Victorian law and courts. General liability cap = fees in the prior 12 months; 3× cap for confidentiality/DPA breaches (s 18). No unlimited-liability carve-out for data.
Ask: Confirm these Terms and DPA are the documents on our order, and whether we can negotiate the Sensitive Data exclusion and AI schedule.
Public claim only
Privacy 7.1: hosting in the selected Data Location, plus transfers to group companies and service providers including Australia and the United States. Trust list includes US Intercom and Twilio and possible UK/US support staff. DPA authorises transfers outside Europe subject to SCCs.
Ask: For Xakia AI on an Australian Data Location, list every country for storage, inference, backups and support.
Public claim only
DPA: notify Subscriber of a Security Breach without undue delay, with information reasonably required for the Subscriber's reporting duties. No fixed 72-hour clock. Incident history was not published.
Ask: State the contractual notification period from discovery, NDB/OAIC cooperation, and any material incidents in the last 24 months.
Public claim only
ToS changes: 60 days' email notice; Subscriber may terminate under s 16.1 and receive unused prepaid fees (s 22). Subprocessors: 30 days' email to Privileged Users, 30-day objection, then termination if unresolved (DPA 6.2). No model-list freeze.
Ask: What written notice will we get before a new AI model is added, and can we object separately from the subprocessor list?
Public claim only
In-term self-service export (s 5.5). After termination, 30-day retention; Xakia will quote to provide data (s 5.7) or restore access for a further paid Service Period (s 5.8). Then permanent deletion. Format of an assisted export is not specified.
Ask: What export we receive for matters, contracts and AI history, and will you certify deletion within 30 days including subprocessors?
Not confirmed
Terms s 10: enabling Third-Party Platforms is the customer's choice under that provider's terms. Connect exchanges data with outside counsel. Salesforce, iManage and NetDocuments are plan-dependent.
Ask: List every connector that will be on for our tenant and the data each receives.
Not confirmed
Xakia AI is described as reviewing the customer's contracts and searching the customer's matter data. No open-web browsing toggle was found.
Ask: Does Xakia AI browse the open web, and can we disable any such retrieval?
Public claim only
AI page: nothing is saved, applied or sent anywhere until someone on the team signs off. Enterprise plan includes contract approval and signing workflows that are customer-configured.
Ask: Which AI or workflow actions can send a redline, email or DocuSign packet without a second Legal confirmation?
Public claim only
Every AI feature is marketed with a human checkpoint. The Terms do not require a lawyer to approve an AI output before an internal requester sees it.
Ask: Can we require every AI redline or summary to be approved by a named lawyer before it is visible to the business?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI practice management tools Australia
