Product and intended use
Define the configuration, people, information and tasks being assessed.
Modules, licence level and what a subscription covers
Public claim only
The vendor publishes the platform as separately named modules, each carrying 'LLM' in its name: Novelty Checker LLM (prior-art search producing 'Automated Novelty Reports with precise key feature mappings'), Invalidator LLM (invalidity search that 'Highlights the top 50 most relevant references'), Claimchart LLM, PatDigger LLM (portfolio and licensing analysis), Standigger LLM (standard-essential patent and standards mapping), Drafting LLM, Ideacue 10X, TechScaper LLM / xSDI (technology and competitor monitoring with 'Multilingual support (EN/JP/CN/DE)'), AI-Assisted Source Code Review, and SDG and GX analytics dashboards, read 2026-09-27. The Master Agreement makes the commercial scope depend on a signed Cover Sheet that fixes the 'License Level', the 'Delivery Method', the term and the fees; no module-to-tier mapping is published.
Ask: Which modules, licence level and End User count will appear on our Cover Sheet, and which of the published modules are excluded from it?
What the AI does in each module
Public claim only
The homepage headline reads 'INTEGRATED INNOVATION & PATENT MONETIZATION PLATFORM LEVERAGING LLMs & GEN AI' and the About Us paragraph describes 'harnessing the potential of advanced Al technologies like Large Language Models (LLMs) and Generative Al', read 2026-09-27. Per-module bullets describe retrieval over a patent and literature corpus, 'ParaEmbed-based contextual mapping of prior arts with claims', automated report generation, claim-chart generation, and drafting with 'an AI chatbot as a virtual assistant for instant revisions'. One module is described as 'AI-powered, expert-validated', so for that module the vendor states a human step of its own; the division of labour between model output and human checking is not published for the other modules.
Ask: For each module we license, which steps are model-generated, which are retrieval, and which involve a human reviewer employed by XLSCOUT or a supplier?
Deployment and where the service runs
Not confirmed
The Security & Privacy Controls page states 'We rely on enterprise-level cloud-based servers. Our clients can choose to have their data stored in either USA or EU based servers. Some of the cloud hosted server providers that we rely on are AWS, Microsoft Azure and others.' The Privacy Policy's data annex instead states 'We store data in a multi-tenant environment on privately-owned servers. The data and file system architecture are replicated between multiple geographically dispersed data centers', and describes the data centres in the first person without naming any provider. Both were read 2026-09-27. The two documents differ on whether the servers are public-cloud or privately owned, and on whether storage sits in one elected region or is replicated across dispersed data centres; no country is named for the replicas.
Ask: Which statement governs our tenancy — an elected United States or European Union region, or replication across multiple geographically dispersed data centres — and in which countries do the replicas and backups sit?
Jurisdictional and content coverage
Public claim only
The homepage claims '170M+ Patents from 100+ countries', '220M+ Non-Patent Literature (Bibliographic)' and '106+ Jurisdictions', read 2026-09-27, with no register of sources, no currency date and no methodology. No Australian source is named on the pages read, and the vendor's own Australia and New Zealand article, which addresses AusPat and IP Australia, was not read within the credit cap. The Master Agreement's definitions state that an 'Automated Patentability search' and an 'Automated Invalidity' search are run 'on the database on an As is Where is basis'.
Ask: Which databases are searched for an Australian filing, is IP Australia's AusPat among them, how current is each, and what is excluded?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page, file or block telling AI models, assistants or crawlers how to describe the product. None was found on the homepage, the Master Agreement, the Privacy Policy or the Security & Privacy Controls page, and a 60-URL map of xlscout.ai run with search terms including 'llms' surfaced no /llms.txt, /ai-info or /for-ai page. The check is limited to those four pages and that URL list; robots.txt was not fetched.
Ask: Does XLSCOUT publish any page, file or metadata addressed to AI models or crawlers setting out how its modules should be described?
Vendor answering superlative questions about its own products in machine-readable Q&A
Public claim only
The homepage carries a published FAQ that poses and answers superlative questions about the vendor's own modules, read 2026-09-27. Verbatim: the question 'What makes Novelty Checker LLM one of the best novelty search tools available today?' is answered 'Novelty Checker LLM's integration with AI-powered ideation tools like Ideacue, automated reporting, and its ability to accurately map key features of inventions make it a top-tier choice for thorough and effective novelty searches.' The question 'What features make Invalidator LLM a leading patent invalidation search tool?' is answered 'Invalidator LLM stands out due to its automated invalidation reports, targeted claim analysis, user-friendly interface, and enhanced efficiency, all powered by the latest AI technologies.' A site URL listing of the vendor's own site also contains a case-study URL whose slug reads 'claude-for-legal-is-not-built-for-high-stakes-patent-decision'; that page was not read, so only the presence of the URL in the vendor's own site listing is established.
Ask: Which of the FAQ answers about your own modules rest on a published test or benchmark we can review, and what is the basis of the comparison in the case study addressing a named third-party assistant?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority, confidentiality of invention disclosures and publicity
Public claim only
Inputs are client invention disclosures, draft claims and, for one module, source code, so a firm is putting unfiled and privileged material into the platform. The Master Agreement (read 2026-09-27) binds each party to confidentiality at clause 7, but clause 6.2 also permits XLSCOUT to 'share and transmit the customer's input with trusted third-party suppliers' and to sublicense those rights to them for 'collaboration', where 'the third-party supplier may have access to whole or part of the data'. Separately, clause 10.5 states XLSCOUT 'may use customer's name and logo as part of a list of customers and may refer to customer as a user of its products and services in its advertising and marketing activities' and that the customer 'agrees to participate in other marketing activities' including references, case studies and webinars.
Ask: Will you delete clause 10.5's publicity and marketing-participation obligation, and will you name every third-party supplier that may receive our clients' unfiled invention disclosures before we sign?
Foundation-model providers and inference region
Public claim only
The Security & Privacy Controls page states 'XLSCOUT uses a combination of its proprietary, custom fine-tuned LLMs, embedding and RAG models along with Microsoft Azure end-points to draft patents, identify infringements and search prior art', read 2026-09-27. The homepage names one XLSCOUT model, the ParaEmbed embedding model, and refers to 'Proprietary ParaEmbed-based analysis'. No generative model, version, supplier contract or inference region is named anywhere read, and neither the Master Agreement nor the Privacy Policy mentions a model or an inference provider. The security page is marketing content, not a contractual document.
Ask: Name every model behind each module, the Azure service and region each call is made to, and whether any call leaves the United States or European Union region we elect.
Subprocessors and third-party suppliers
Public claim only
No subprocessor list, register or trust centre was found for XLSCOUT. The Master Agreement (read 2026-09-27) defines 'Agent' or 'Third Party Supplier' as 'a third-party supplier of content, software, or technology', and clause 6.2 grants XLSCOUT the right to share and transmit customer input to trusted third-party suppliers and to sublicense them for collaboration, in which they 'may have access to whole or part of the data'. Clause 10.3 permits subcontracting without customer consent. No supplier is named, no notice or objection right is given, and the Privacy Policy names no processor either; the only named third parties anywhere read are 'AWS, Microsoft Azure and others' on the security page.
Ask: Provide the current dated list of third-party suppliers who may receive our inputs and outputs, with entity, country, purpose and data types, and a contractual notice and objection right before any addition.
Training on customer content
Public claim only
Master Agreement clause 6.4 states verbatim: 'XLSCOUT undertakes that the data is not used to train, retain, or improve the models of XLSCOUT or the third-party suppliers. The sharing of data shall be done under confidentiality obligations, mutually agreed upon and signed between the customer and XLSCOUT or available under the terms of the content security policy.' 'Data' is defined in clause 6.2 to mean both input and output. The Security & Privacy Controls page repeats the position ('XLSCOUT does not use your data to train its LLMs'), and the homepage FAQ states XLSCOUT is 'not storing any customer data and not training our AI models on customer-provided inputs'. All read 2026-09-27. The clause reaches XLSCOUT and its third-party suppliers; the Content Security Policy it points to for the terms of sharing was not read in this pass.
Ask: Will clause 6.4 appear unchanged in our signed agreement, and does it bind the operator of the Azure end-points as a third-party supplier for the purposes of that clause?
Feedback, corrections and product improvement
Not confirmed
No document read grants or excludes a right to use customer feedback, telemetry or corrections. Master Agreement clause 6.1 limits the licence over inputs and outputs to 'exclusively perform and render the services, as desired by the customer', and clause 6.4 excludes use of the data to train, retain or improve models; neither addresses whether a fee earner's edits to a generated claim chart, novelty report or draft are collected separately from that data. The Privacy Policy addresses only website and account personal information and log data.
Ask: Are corrections, rejected suggestions and usage telemetry from our accounts collected, and if so are they inside or outside the clause 6.4 exclusion?
Retention of inputs, reports and drafts
Public claim only
Master Agreement clause 6.1 licences XLSCOUT to 'collect, process, store, and otherwise use the client's inputs, and the output generated by XLSCOUT based on the input', and clause 6.2 says the data is stored 'as per the content security policy'. Clause 11 incorporates that Content Security Policy into the agreement; it was not read in this pass, so the operative retention rule is not established. No retention period for inputs, novelty reports, claim charts or drafts appears in the Master Agreement, the Privacy Policy or the security page, all read 2026-09-27. The security page states 'Our model does not retain any user data', which addresses the model rather than the platform; the Privacy Policy's only published periods are data-centre surveillance records retained up to 30 days and a disk erase policy for decommissioned disks.
Ask: State the default and configurable retention for inputs, generated reports, claim charts and drafts, and provide the Content Security Policy that clause 6.2 makes the governing document.
Deletion and erasure
Public claim only
The Security & Privacy Controls page states 'You have full control on your data and output and can delete it any time', read 2026-09-27. The Master Agreement does not match it: clause 3 provides only that on termination or expiry 'all licenses granted under this agreement shall cease and customer shall immediately cease access to and use of all confidential information', with no obligation on XLSCOUT to delete or return customer inputs or outputs and no deletion period or certificate. The Privacy Policy contains no data-subject deletion or erasure section at all, and its only deletion mechanism is the disk erase policy applied to decommissioned disks.
Ask: Where is the delete-at-any-time capability contractually committed, what does it delete from backups and from any supplier's systems, and will you certify deletion on termination?
Vendor and supplier access to content
Public claim only
Master Agreement clause 6.2 permits third-party suppliers to 'have access to whole or part of the data' during collaboration on a service, read 2026-09-27, and the homepage describes the source code review module as 'AI-powered, expert-validated', so human review of customer material by the vendor or a supplier is part of at least one published module. The Privacy Policy describes internal controls in general terms — a centralised access management system, access 'to a limited number of authorized personnel', unique user IDs, strong passwords, two factor authentication, monitored access lists and access logging 'to create an audit trail for accountability' — but names no role, no country and no approval workflow for access to customer inputs, and offers the customer no view of that log.
Ask: Which XLSCOUT roles and which supplier personnel, in which countries, can read our invention disclosures, draft claims and source code, under what approval, and can we obtain that access log?
Access control, authentication and audit
Public claim only
The Privacy Policy states 'Customer's administrators must authenticate themselves via a central authentication system or via a single sign on system in order to administer the Services', read 2026-09-27; two-factor authentication is described for XLSCOUT's own personnel rather than for customer End Users. The Master Agreement defines 'Login Details' as the unique user name and password used by End Users 'and/or Customer's IP address (as notified by the Customer in writing from time to time) required by XLSCOUT to validate access', and defines a 'Secure Network' whose users are authenticated at login and periodically thereafter. Nothing read states whether enforced multi-factor authentication, SCIM provisioning or an exportable audit log of who ran which module on which matter is available to the customer.
Ask: Can we enforce single sign-on and multi-factor authentication for all End Users, and can we export an audit log showing which End User ran which module against which invention?
Encryption in transit and at rest
Public claim only
The Security & Privacy Controls page states 'XLSCOUT secures all user information through encryption protocols like RSA256 and Ed25519', read 2026-09-27, and the homepage FAQ claims 'robust end-to-end encryption'. The Privacy Policy's network annex describes transport security only: 'The system makes HTTPS encryption (also referred to as SSL or TLS connection) available. Servers support ephemeral elliptic curve Diffie-Hellman cryptographic key exchange signed with RSA and ECDSA.' For storage it says only 'Data is stored using proprietary algorithms to augment data security and redundancy.' No statement of encryption at rest, no algorithm for stored data, and no key management or customer-managed key option appears on any page read.
Ask: Specify encryption at rest for stored inputs and outputs, the key management model, and whether customer-managed or customer-held keys are available.
Independent security assurance
Not confirmed
The homepage describes XLSCOUT itself as 'An SOC 2 Type II certified, AI super intelligence platform' and the Security & Privacy Controls page shows three badges, 'SOC2 Type 2 Certified', 'ISO 27001 Certified*' and 'GDPR Compliant', with the footnote '*APPLIES TO OUR DATA-CENTER PARTNERS'. The Privacy Policy's compliance section instead states 'XLSCOUT XLPAT INC is hosted with the world's leading cloud providers whose data centers are strictly controlled and monitored ... The below certifications apply to our data-center partner:' and then lists ISO 27001, ISO 27017, ISO 27018, SOC 2, SOC 3, CSA STAR and PCI DSS. All read 2026-09-27. So SOC 2 is attributed to XLSCOUT on two pages and to the data-centre partner on a third, and no report, scope, auditor, period or date is published for any certification; a /soc2-type-2-certified/ page and a press release with a matching slug exist and were not read in this pass.
Ask: Provide the SOC 2 Type II report issued in XLSCOUT's own name, with auditor, scope, period and exceptions, and confirm which of the ISO and SOC certifications on your pages are held by XLSCOUT rather than by a hosting provider.
Contracting entity, liability and forum
Public claim only
The published Master Agreement (read 2026-09-27) is made by 'XLSCOUT XLPAT INC (USA), on behalf of itself and its Affiliates, an entity incorporated in the United States of America having offices at 1000 N, West Street Suite 1200, Wilmington, Delaware, 19801'. Clause 5.1 excludes indirect, special, punitive and consequential loss for both parties; clause 5.2 caps liability related to a service at 'an amount equal to the fees paid by customer for that service' and otherwise at the aggregate fees paid in the preceding twelve months; clause 4.4 excludes implied warranties and clause 4.5 disclaims any warranty as to the accuracy, completeness or correctness of the licensed materials. Clause 10.8 submits all disputes to the Singapore International Commercial Court 'except as otherwise agreed to the contrary between the contracting parties in writing'; no governing-law clause appears. Clause 11 incorporates the privacy policy and content security policy, with the general terms prevailing on any contradiction.
Ask: Will an Australian or Singaporean entity contract with us instead of the Delaware entity, will you name a governing law, and will you accept an Australian forum in place of the Singapore International Commercial Court?
Cross-border transfers and APP 8
Not confirmed
The Security & Privacy Controls page states clients 'can choose to have their data stored in either USA or EU based servers', naming AWS and Microsoft Azure among providers, while the Privacy Policy states data is stored 'in a multi-tenant environment on privately-owned servers' and that 'The data and file system architecture are replicated between multiple geographically dispersed data centers', without naming a country. Both read 2026-09-27. No Australian region is offered on any page read, no country list is published for the replicas or backups, no inference region is published for the Azure end-points, and no document read addresses Australian Privacy Principle 8, standard contractual clauses or any other transfer mechanism. The Master Agreement's only relevant term is clause 6.2's right to share input with third-party suppliers, with no location limit.
Ask: For an Australian firm, in which countries will our inputs, outputs, replicas and backups be stored, in which country does inference run, and what APP 8 arrangements will you accept?
Incident notification and history
Public claim only
The Privacy Policy's annex states 'Incident Response. The system monitors a variety of communication channels for security incidents, and authorized security personnel will react promptly to known incidents', and describes intrusion detection intended 'to provide adequate information to respond to incidents', read 2026-09-27. No notification period from discovery, no notification recipient, no reference to Australia's notifiable data breach scheme and no commitment covering a supplier or model-provider incident appears in the Privacy Policy, the Master Agreement or the security page. No incident history was found on the pages read.
Ask: State the contractual notification period from discovery, to whom notice is given, and whether it covers incidents at a third-party supplier or the Azure end-point operator.
Change notice for terms, models and regions
Public claim only
The two published change mechanisms differ. Master Agreement clause 10.4 states 'Any amendment to this agreement shall only be effective if in writing and executed by a duly authorized representative of each party', but clause 11 incorporates the privacy policy and content security policy 'as updated from time to time'. The Privacy Policy states changes 'will be in effect immediately after being posted on this page', that the customer should check periodically, that continued use constitutes consent to the modified policy, and that material changes will be notified 'either through the email address you have provided us or by placing a prominent notice on our website'. Both read 2026-09-27. Nothing commits XLSCOUT to notice before changing the model behind a module, the end-point provider or the storage region.
Ask: What written notice will we receive before a change of model, end-point provider or storage region, and will you agree that changes to the incorporated policies do not bind us without our written acceptance?
Export and exit
Public claim only
Master Agreement clause 3 provides that on termination or expiry 'all licenses granted under this agreement shall cease and customer shall immediately cease access to and use of all confidential information', and clause 2.3 limits XLSCOUT's cancellation liability to a refund of pre-paid fees for the cancelled service for periods following the Initial Term. Read 2026-09-27, the agreement says nothing about exporting the customer's inputs, novelty reports, claim charts or drafts, no post-termination access window, no format and no transition assistance. The security page's statement that the customer has 'full control' of data and output is not reflected in any exit clause.
Ask: What export format and post-termination access window apply to our reports, claim charts and drafts, at what cost, and how long does data remain retrievable after the end date?
Connectors and data flow out of the platform
Not confirmed
No API, connector, webhook or integration is described in the homepage, the Master Agreement, the Privacy Policy or the Security & Privacy Controls page, read 2026-09-27. The only outward data flow described anywhere is clause 6.2's sharing of customer input with third-party suppliers for collaboration on a service, and the Azure end-points named on the security page. The Master Agreement leaves the 'Delivery Method' to the Cover Sheet.
Ask: Which connectors or APIs exist, what does each move out of the platform, and can each be disabled for our tenancy?
Open-web retrieval
Not confirmed
The published corpus is patents and non-patent literature, and the monitoring module is described as tracking technology and competitor activity with taxonomy categorisation. Read 2026-09-27, no page states whether any module queries the open web at run time, and none states that it does not. Master Agreement clause 4.6 acknowledges that 'The licensed materials may contain links to internet sites operated by third parties' and disclaims responsibility for their content, which establishes that third-party links are surfaced but not that live retrieval occurs.
Ask: Does any module make live calls to the open web or to any source outside your licensed corpus, and can that be disabled for confidential invention disclosures?
Autonomy and action control
Not confirmed
The published modules generate artefacts rather than act outside the platform: novelty and invalidity reports, claim charts, portfolio and standards analyses, drafts, and, in the drafting module, 'an AI chatbot as a virtual assistant for instant revisions'. Read 2026-09-27, nothing describes an agent that files, sends, transacts or writes to an external system, and nothing states what a module may do without a user action. Because the artefacts are search reports and patent drafts, the control that matters commercially is whether an automated report can be relied on or forwarded without a search professional's check, and the Master Agreement expressly limits automated searches to a first pass.
Ask: Can any module produce, finalise or send a report or draft without a user step, and what in-product control records that a search professional reviewed it before release?
Human review before use
Public claim only
The Master Agreement's definitions state that 'Automated Invalidity' means 'automated first pass Invalidation search obtained by running the proprietary algorithm on the database on an As is Where is basis and shall in no manner be a comprehensive or a full search', and give the same wording for 'Automated Patentability search'; clause 4.5 adds that XLSCOUT 'makes no warranty or representation as to the accuracy, completeness, or correctness of any licensed materials'. Read 2026-09-27. The homepage describes one module as 'AI-powered, expert-validated' and otherwise markets automated reporting, including 'Automated Novelty Reports'. No product control is published that records or enforces a human review step.
Ask: Given the contractual first-pass limitation, what does XLSCOUT state a firm must still do before relying on an automated report, and is any reviewer sign-off recorded in the product?
