Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Xakia AI is a named feature set inside the Xakia Platform, not a separate product. The product page (checked 2026-09-27) publishes four features as live — contract review and redlining against a playbook, key terms extraction, natural language search and invoice review — and states 'All of it is opt-in. You decide what your team uses, and when.' A fifth item, read-only connections from Claude or Microsoft Copilot to a team's Xakia matter data, is published as coming soon. Under Terms cl 2.2 Paid Access Services are added or enabled by a Privileged User or by an Order Form.
Ask: Which Xakia AI features are enabled on our Order Form, at what price, and can the platform be run with every AI feature disabled?
What the AI features do
Public claim only
Per the product page (checked 2026-09-27): contract review opens in Word and marks a third-party contract up 'against your chosen Playbook, the governing law, market practice and basic drafting standards', at a strictness the user sets to Pragmatic, Balanced or Strict; key terms extraction returns each term 'with a confidence score, the clause it came from and the exact text it relied on'; natural language search builds a query that 'stays visible in the search bar, you can edit it, and you can save it'; invoice review checks invoices against billing guidelines and named billing-hygiene rules (block billing, duplicate entries, round-number billing, time-increment breaches) and compares the invoice file against what was submitted. The page does not say which of the invoice checks are performed by a model and which are fixed rules.
Ask: For each feature, which steps are performed by a language model and which by deterministic rules, and what does the strictness setting change in the request sent to the model?
Deployment and data location
Public claim only
Cloud SaaS. Terms cl 4.3 states available Data Locations are Australia, Canada, the Netherlands, the United Kingdom and the United States. Privacy cl 7.1 states the organisation selects a preferred data location when it creates the account and that 'Once selected, this data location preference cannot be changed.' The trust centre subprocessor list (effective 1 April 2024) records 'The Xakia platform is hosted on Microsoft Azure data centers' with the location customer-selected at account creation. No on-premises or private-cloud option was found in the documents read.
Ask: Confirm in writing that our tenancy's Main Data Location is Australia for storage, backups, search indexes and AI processing, and what happens to the AI features if we decline any non-Australian processing.
Jurisdiction and legal content
Public claim only
The product page says contract review is measured against the firm's playbook, 'the governing law, market practice and basic drafting standards' but names no legal content library, jurisdiction coverage or source for market practice. Xakia is an in-house legal operations platform, not a legal research product. Separately, where the Main Data Location is Australia the agreement itself is governed by the laws of Victoria with exclusive jurisdiction in the courts of the State of Victoria (Terms, Definitions).
Ask: Which Australian jurisdictions and governing-law positions has the contract review been built for, and what source supplies the 'market practice' it compares our contracts against?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A 40-URL search-filtered map of xakiatech.com returned no /ai-info, /llms.txt or /for-ai page, and none of the pages read for this profile — the Xakia AI product page, the Terms of Service, the privacy policy, the Data Processing Addendum or the trust centre — carries a heading or block addressing AI models, assistants or crawlers, or instructing them how to describe the product. The map was search-filtered and does not exhaust the site.
Ask: Do you publish any page, block or file (for example /llms.txt or an AI-information page) that tells AI assistants or crawlers how to describe Xakia?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and the sensitive-data exclusion
Public claim only
Terms cl 8.1: 'You acknowledge that the Xakia Platform is not designed for handling Sensitive Data and agree that Xakia has no liability in connection with any Sensitive Data that you submit to the Xakia Platform.' Sensitive Data is defined to include health information, credit, debit and bank account numbers, government ID numbers and GDPR Article 9 special categories. DPA Schedule 1 repeats that 'Xakia does not knowingly collect any sensitive data'. Terms cl 7.3(b) puts on the customer the warranty that it has all rights necessary to use Subscriber Data with the platform.
Ask: Our matters and contracts routinely contain health, financial-account and identity information. How does clause 8.1 apply to those matters when they are processed by the AI features, and will you accept liability for them?
Foundation-model providers
Not confirmed
No foundation model or model provider is named on the Xakia AI product page, in the Terms of Service, in the Data Processing Addendum or in the trust centre subprocessor list (effective 1 April 2024), which names ChurnZero, HubSpot, Intercom, Microsoft (Azure hosting and Microsoft 365), Stripe, Twilio/SendGrid, Xero and Xakia group entities. Claude and Microsoft Copilot are named on the product page only as external AI clients that will be able to read Xakia data, not as the model behind Xakia AI.
Ask: Name the model and provider behind each of the four live AI features, the legal entity and endpoint region for each, whether any is an Azure-hosted deployment in Australia, and the contractual terms that apply to them.
Subprocessors and notice rights
Public claim only
The trust centre publishes a dated subprocessor list, effective 1 April 2024, with nine entries: ChurnZero (USA), HubSpot (USA), Intercom (USA), Microsoft Corporation for Azure hosting in the customer-selected location, Microsoft 365 (Australia), Stripe Payments Australia (Australia), Twilio/SendGrid (USA), Xero (USA) and Xakia group entities (Australia, UK, USA) for out-of-hours support. No AI or foundation-model provider appears on it. DPA s 6.2 requires notice to Privileged Users at least 30 days before a subprocessor is added or replaced, with a 30-day objection window and a right to terminate if no resolution is reached.
Ask: Has the subprocessor list been updated since 1 April 2024 for the AI features, and which entity on the current list processes contract text, invoices and prompts for Xakia AI?
Training and product improvement on customer content
Not confirmed
The product page states 'Xakia AI is opt-in, and your data is never used to train any AI model' (checked 2026-09-27). The binding documents contain no equivalent prohibition: Terms cl 5.3 provides that 'Xakia may collect usage and content data and use it to operate, improve and support Xakia's products and services and for other lawful business purposes, including benchmarking and reports', restricting only external disclosure to data that is de-identified and aggregated, and cl 5.3 survives termination (cl 16.5). The Data Processing Addendum (effective 1 October 2025) does not mention model training either way.
Ask: Will you warrant in our Order Form or DPA that no Subscriber Data, prompt, output or embedding is used to train or fine-tune any model, by Xakia or by any model provider, and how does that sit with clause 5.3?
Feedback, ratings and quality monitoring
Public claim only
Terms cl 5.3 permits collection of usage and content data to operate, improve and support Xakia's products and services, including benchmarking and reports. DPA Schedule 1 (Module One) lists 'to maintain or improve the performance of the Services' among the purposes for Account Data. The product page describes accept, correct, apply and waive decisions by the user at each human checkpoint, but no in-product rating control and no statement about whether those decisions feed product or model improvement.
Ask: Are the accept, edit and waive decisions our lawyers make on suggested redlines, extracted values and invoice findings used for product or model improvement, and can that be disabled for our account?
Retention of prompts, outputs and AI records
Public claim only
Terms cl 5.6: Xakia retains Subscriber Data for 30 days after termination of the agreement and then permanently deletes it. DPA Schedule 1 adds that on written request Xakia will delete within a maximum of 30 days. Privacy cl 6.1 retains Customer Data in accordance with the customer agreement. Nothing in the documents read states a retention period for AI prompts, model outputs, extracted key-term values, suggested redlines, search queries or the invoice-review audit trail while the subscription is live, or whether any model provider retains them.
Ask: State the retention period, during the subscription, for prompts, model outputs, extraction records, search queries and invoice-review audit entries, and confirm whether any model provider retains them at all.
Deletion and erasure evidence
Public claim only
DPA s 9: on termination or expiry Xakia will delete all Subscriber Personal Data including copies, automatically 30 days after termination unless otherwise agreed, with a carve-out where law requires retention, in which case the data is securely isolated and protected from further processing. DPA s 12.1 records self-service features to delete, obtain a copy of, or restrict use of Subscriber Data. No certificate of deletion and no deletion timetable for subprocessors was found in the documents read.
Ask: Will you certify deletion in writing after exit, and does the 30-day deletion cover backups, search indexes, AI records and every subprocessor copy?
Vendor staff access to content
Public claim only
DPA Schedule 2: 'A subset of Xakia's employees have access to customer data via controlled interfaces for support, troubleshooting, and security incident response', with access limited to what is necessary; all employees undergo a background check before an offer where law permits, sign confidentiality terms at hire, and employee roles are reviewed at least annually. The trust centre records that out-of-hours support may be provided by staff of Xakia group entities in Australia, the UK or the USA. DPA s 5.1 requires notice to the Subscriber before Xakia responds to a third-party request for data, where legally permitted.
Ask: Can we require that access to our matter data is limited to Australian-based staff, is each access ticketed and logged, and can we receive that access log?
Access control, authentication and logging
Public claim only
DPA Schedule 2 records a uniform password policy, an authorisation model designed so that 'only the appropriately assigned individuals can access relevant features, views, and customization options', API access by API key or OAuth, and infrastructure logging of system behaviour, authentication and application requests with alerting. Terms cl 3.2 makes the customer responsible for provisioning users, designating Privileged Users and keeping credentials confidential. Single sign-on, SCIM and enforced multi-factor authentication are not addressed in any document read.
Ask: Is SSO with enforced MFA and SCIM provisioning available on our plan, can the AI features be restricted to named users, and can we export an audit log of AI use?
Encryption in transit and at rest
Public claim only
DPA Schedule 2: 'Xakia makes HTTPS encryption (also referred to as SSL or TLS) available on the service using industry standard algorithms and certificates' and 'Xakia has implemented technologies to ensure that stored data is encrypted at rest'; passwords are stored under industry-standard practices. No algorithm, TLS version or key-management detail is given, and customer-managed keys are not offered in any document read.
Ask: Name the encryption algorithms, TLS versions and key-management arrangements for the Australian data location, and state whether customer-managed keys are available.
Independent security assurance
Not confirmed
The trust centre (checked 2026-09-27) lists ISO 27001, SOC 2 Type 2 and HIPAA in its compliance panel, offers an 'ISO 27001:2022 Certificate', a 'Penetrating Testing Attestation' and a SOC 2 Type 2 report on request, and states continuous monitoring by Secureframe. Terms cl 6.4 commits Xakia to maintain 'ISO/IEC 27001:2013 and SOC2 Type II certification for each Service Period' and to provide evidence on request — a different ISO version from the certificate the trust centre lists. The product page states 'ISO 27001, SOC 2 Type II, and HIPAA certified' without naming a version, scope or certification body.
Ask: Which ISO 27001 version does the current certificate cover, which certification body issued it, and do the ISO and SOC 2 scopes include the Xakia AI features and the Australian data location?
Contract, entity, liability and forum
Public claim only
The agreement is the Terms of Service (effective 1 October 2025), the privacy policies for each Data Location, any DPA and any Order Forms (cl 1). Where the Main Data Location is Australia, 'Xakia' is Xakia Technologies (Aust) Pty Ltd ABN 73 659 548 366, the Governing Law is the laws of Victoria and the Courts are the courts of the State of Victoria (Definitions). Liability is capped at fees paid in the preceding 12 months, raised to three times that cap for breaches of cl 5.2, cl 20 or the DPA (cl 18.1 to 18.2). The DPA prevails over the terms and the terms over the privacy policy (DPA s 14.1). If the Main Data Location changes, the agreement transfers between Xakia entities.
Ask: Confirm our contracting entity as Xakia Technologies (Aust) Pty Ltd ABN 73 659 548 366 with Victorian law and forum, and whether the liability cap can be raised for an AI-related breach.
Cross-border transfers
Public claim only
DPA s 11.1: Xakia and its subprocessors 'may transfer and Process Personal Data to and in the United States of America and other locations in which Xakia, its Affiliates or its Sub-processors maintain data processing operations', as described on the subprocessor page. Privacy cl 7.1 states data is processed in the organisation's selected location and that Xakia may also transfer personal data to group companies and service providers 'including to Australia and the United States'. The subprocessor list places support, marketing, notification and invoicing providers in the USA. EU and UK standard contractual clauses are incorporated for restricted transfers (DPA s 11.2). Nothing published states where model inference occurs.
Ask: For an Australian Main Data Location, list every country in which contract text, invoices, prompts and outputs are stored or processed, including model inference, support access and backups.
Security incident notification
Public claim only
DPA s 8.5: on becoming aware of a Security Breach involving Subscriber Personal Data, Xakia 'shall notify Subscriber without undue delay' and provide the information reasonably required to enable the Subscriber's own breach reporting; s 8.6 states that notification is not an admission of fault. Terms cl 3.2 requires the customer to notify Xakia if credentials are compromised. No fixed notification deadline in hours, no Australian notifiable-data-breach undertaking and no incident history were found in the documents read.
Ask: What is the maximum notification period in hours from discovery, will you commit to assisting with an OAIC notifiable data breach assessment, and have there been material incidents in the last 24 months?
Change notice for terms, processors and models
Public claim only
Terms cl 22.1: Xakia will email the Subscriber and post revised terms at least 60 days before changes take effect, and continued use is taken as acceptance; cl 22.2 allows termination instead. DPA s 6.2 gives 30 days' notice of subprocessor changes with an objection right; DPA s 14.6 gives 30 days' notice of DPA amendments; Terms cl 4.5 allows Xakia to change the Main Data Location on 30 days' notice, but only to a location the customer has made available; cl 12.3 gives 60 days' notice of fee changes. DPA s 8.3 permits security measures to be updated provided overall security is not degraded. No notice commitment was found for changing the model behind an AI feature.
Ask: What notice will we receive before the model or model provider behind an AI feature changes, and can we pause that feature pending our own review?
Export and exit
Public claim only
Terms cl 5.5: during a Service Period the Subscriber may export certain Subscriber Data using in-product functionality. Within the 30-day post-termination window the Subscriber may ask Xakia to supply the data, in which case 'Xakia will provide a reasonable quote to provide that data as requested' (cl 5.7), or may pay Paid Access Service Fees for an additional Service Period to re-establish access and export it themselves (cl 5.8). After 30 days the data is permanently deleted (cl 5.6).
Ask: Which export formats cover playbooks, extracted key terms, redline history, saved searches and invoice-review audit trails, and what would the clause 5.7 quote cost for our data volume?
Connectors and third-party platforms
Public claim only
Terms cl 10: enabling an integration or exchanging Subscriber Data with a Third-Party Platform is governed by the customer's agreement with that provider and 'Xakia is not responsible for Third-Party Platforms or how their providers use Subscriber Data'. Terms cl 9 treats making data accessible to a Xakia Connect law-firm subscriber as a transfer of that data, with the customer responsible for arrangements governing its use. The privacy policy lists 'Customer-Authorized Third Parties' including document management and email platforms. The announced Claude and Microsoft Copilot connections would be external AI clients reading Xakia data.
Ask: Which connectors will be enabled for our tenancy, what data does each receive, and will the Claude and Copilot connections be off until we authorise them in writing?
Retrieval outside the tenancy
Not confirmed
The product page describes contract review against 'your chosen Playbook, the governing law, market practice and basic drafting standards' without naming a source for governing law or market practice, and describes natural language search as running over the team's own Xakia data with the generated query visible in the search bar. No open-web retrieval or browsing is described, and the Terms of Service and Data Processing Addendum are silent on it.
Ask: Does any AI feature retrieve material from outside our tenancy — including legislation, case law, market-practice reference data or the open web — and can external retrieval be switched off?
What the AI can do without a confirmation
Public claim only
The product page states that each feature has 'a human checkpoint so nothing happens without your sign-off' and that 'nothing is saved, applied or sent anywhere until someone on your team signs off': redlines are suggested for the lawyer to accept in Word, extracted values are applied only on the user's click, and the announced Claude and Copilot connections are 'Read-only to start' with write actions requiring approval in Xakia. No clause in the Terms of Service or the Data Processing Addendum requires these checkpoints.
Ask: Which of these checkpoints are enforced in the product rather than by convention, can an administrator remove them, and will the requirement be recorded in our Order Form?
Human review before output is used
Public claim only
The published design routes every output through a person: lawyers review flagged deviations and make the calls in the document; extracted values are reviewed and corrected before 'Nothing lands in your contract repository until you say so'; invoice findings are reviewed and waived with each decision recorded in an audit trail. Against that, Terms cl 7.4 disclaims all implied warranties including fitness for a particular purpose, and cl 7.3(b) makes the customer responsible for the content and accuracy of Subscriber Data. Neither the terms nor the DPA contains a human-oversight obligation.
Ask: Which product controls force a named reviewer before an extracted term is written to the contract repository or an invoice decision is finalised, and can those controls be made mandatory for our tenancy?
