A

Augmetec

The models drive several core capabilities on an investigations platform that would work without them. The AI functions are named on the platform page, as updated in November 2025: identifying relevant evidence and building fact patterns against a Line of Inquiry using what the vendor calls accurate AI algorithms, document fraud detection, automatic identification of witnesses and preparation of interview questions, chronology building, and AI driven triage, scoping and categorization of cases.

Underneath sits a full case management system that does a great deal on its own: a central data lake, evidence management, templates, customizable workflows, dashboards, collaboration, single sign on, enterprise integrations and automated evidence bundles. Without the models, an investigations team still has a working command center. The master services agreement never mentions artificial intelligence in its operative terms.

Accuracy and defensibility are the central promise, and neither is measured. The platform page says a team can answer questions defensibly, that investigations are run accurately and defensibly, and that evidence identification uses accurate AI algorithms, alongside industry leading document fraud detection. None of those claims carries a figure, test set, evaluation, error rate or statement of failure modes. Grounding is not described: nothing says whether a finding surfaced against a Line of Inquiry links back to the document and page it came from, the control a reader would look for when output feeds regulatory reporting.

The agreement is more candid than the marketing. Clause 2.5 has the customer acknowledge that the software may contain bugs, errors, defects and design flaws and may produce unexpected results. A product sold on defensibility is contracted on an acknowledgment of unexpected results.

The level of automation is stated precisely for some features, and no control structure is described. The platform page says case scoping is semi automated, smart actions suggest team actions, and witnesses are identified and interview questions prepared automatically in real time. Semi automated and suggest are real words about where the machine stops. Nothing says which outputs need review before use, what a reviewer sees, when the system acts without a person, what happens when a fraud detection flag is wrong, or whether generated material is marked as generated.

No abstention behavior or confidence signal is described. The agreement assigns the consequence without describing a mechanism: under clause 10.2 the customer bears sole responsibility for results and conclusions drawn from the software. For a product that prepares interview questions and identifies witnesses in fraud or bribery investigations, the missing review point is the live question.

No production evidence is published. No customer is named anywhere on the estate, no logo wall appears, no case study exists, and no deployment is described or dated. The single customer voice is one unattributed sentence on the About page, carrying no name, role or organization, saying that LEIAA is clearly built by practitioners for practitioners. Two figures are published on the platform page and neither is attributed or explained: administrative effort alleviated by up to 45 percent, and the platform being up to 80 percent cheaper than other platforms, the second being a competitive pricing claim rather than an outcome and naming no comparator.

The founding team's own experience is set out in detail, including more than 150 investigations conducted by the chief executive before founding the company, which is credential rather than deployment evidence and is recorded as such.

Contractual commitments are substantive and refer to privilege expressly, without describing how privileged material is handled. Clause 8.3 of the master services agreement is the core: the customer keeps full title to Customer Content, and without consent Augmetec will not access, use or disclose it except as reasonably needed to support use of the software, answer support requests, or for other purposes the customer authorizes in writing.

That is a closed list of purposes, not an open license. Clause 8.4 allows collection of usage and performance data only if it cannot identify the customer or its customers and is not confidential or privileged in nature. Clause 6 makes Customer Content the customer's confidential information for five years, and the addendum puts everyone processing the data under a strict duty of confidentiality. Separation is documented: each customer has a dedicated instance, and Annex II says segregation procedures keep other customers out.

Nothing describes how privileged material is handled inside the platform, no walls between matters within a customer are described, and no model provider is named.

Nothing published addresses the advice line. No statement that Augmetec is not a law firm, no disclaimer that output is not legal advice, nothing on the professional judgment needed before a finding is acted on, no jurisdiction limit, and nothing on supervision or competence is published. The platform, about and security pages and the master services agreement, the natural home for such a clause, contain none. The nearest provision is clause 10.2, under which the customer bears sole responsibility for results and conclusions, which allocates liability rather than saying what the product is not.

The exposure is specific: the platform builds fact patterns, identifies witnesses, prepares interview questions and produces investigation reports in matters of fraud, bribery and misconduct, where a conclusion affects named people. The website terms of use page was not opened and may say more.

No governance position of any kind is published. There is no responsible AI page, principles statement, accountable owner for model behavior, evaluation regime before release, AI management system or certification such as ISO 42001. Nothing addresses uneven output, which matters here: a system that identifies which people are witnesses, flags documents as fraudulent and builds fact patterns about alleged misconduct is making determinations about named people, and nothing describes how those are tested or governed.

The governance material that exists is about security: an information governance committee and ISMS group, a person overseeing information security and compliance, and certified security staff. The chief security officer holds a doctorate in machine learning, a credential rather than a governance framework.

Stewardship is documented in detail, with one gap. Annex II of the published addendum runs to several pages: AES-256 at storage system and device level with separately keyed backups, TLS 1.2 or higher in transit, VPN and multi factor authentication, access control lists on a need to know basis with differentiated profiles, automatic account locking and idle logout, network separation through a DMZ, a web application firewall, logging of access, changes, entries and deletions, intrusion detection, disaster recovery and continuity planning, physical security of data centers, an ISMS group and a named security function, internal and external audits, penetration testing with remediation, and a responsible disclosure program.

Incident practice is contractual: clause 2.13 commits to telling the customer of a security incident without undue delay and within 72 hours, and to cooperating with the customer's own reporting duties. Clause 2.14 covers deletion: destroy or return on written instruction at termination. No retention period is stated; data is kept as required to perform the agreement.

A real two sided position is published in full, with a cap a buyer should read before signing. Clause 9.2 commits Augmetec to indemnify the customer against direct damages from third party intellectual property claims connected to use of the software, with remedies at 9.3: securing continued rights, or replacement or modification on stated equivalence conditions. Clause 10.3 keeps liability for death or personal injury, fraud and willful misconduct outside all caps.

Against that, clause 10.1 provides the software as is, with the customer assuming the liability. Clause 10.4 caps liability at the lesser of one year's subscription fees or twenty thousand US dollars, and the IP indemnity at the lesser of two years' fees or fifty thousand dollars. For an investigations platform sold to enterprises, twenty thousand dollars is a low ceiling, and it applies to everything except the IP indemnity.

The exclusions in 10.4 expressly cover loss of privilege and loss of confidentiality. Nothing warrants the accuracy of any output.

Integration is claimed as a core proposition, and no counterparty is named. The platform page promises core enterprise integrations, single sign on and secure integrations with existing platforms, document management systems, and Microsoft and Google. That names the productivity and identity tools, and document management only as a category. Clause 4 of the agreement covers third party services the customer connects and single sign on, and says connecting a service authorizes Augmetec to access and store information from it.

Nothing says what data moves between LEIAA and any outside system, in which direction, on what trigger, or what a firm must configure, and no API or developer documentation is published. The addendum mentions material from Microsoft Teams, Slack, WhatsApp, Telegram, Amazon Chime and Google Meet as categories of personal data that may be uploaded, not as connectors. A knowledge base on a third party support platform was not opened and may say more.

Tenancy is answered thoroughly and region not at all. The security page says, under the heading your LEIAA, your environment, that each customer's instance runs on a separate dedicated environment available only to that customer, on a virtual private cloud built for data isolation. Clause 10.1 of the agreement repeats that each customer's instance is held on separate dedicated infrastructure, and the software is reached at a customer specific subdomain of leiaa.com.

Annex II adds that customer data sits on its own instance with segregation procedures preventing access by other customers, and names Google Cloud Platform as the host. No region is named. The virtual private cloud is described as a global network across multiple regions, which describes reach, not residency. No region choice is offered and no residency commitment appears in the agreement, though the addendum includes transfer mechanisms through the EU standard contractual clauses and the UK addendum.

Four certification marks appear as images, with no scope, date, auditor or report, and the agreement describes something weaker than the badges imply. The security page shows marks for ISO/IEC 27001:2022, HIPAA, GDPR compliance and an AICPA SOC logo. Each is an image with no text claiming certification, naming a certifying body or giving a period or scope, and one image file name misspells the statute it refers to. Nothing in the page text says any certification is held.

Annex II of the published agreement is more precise and points lower: it lists regular benchmarking and testing against industry standards, giving ISO 27001, the SANS Top 20 controls and NIST guidelines as examples, on certain systems. Benchmarking against a standard on some systems is not certification to it. A trust page exists at a published subdomain, named twice in the agreement for backup and disaster recovery detail and subprocessor change notices. It was not opened and may say more.

The vendor refers to its algorithms and identifies nothing underneath them. The platform page speaks of accurate AI algorithms and AI-powered analytics, and the addendum's own definition of the services includes the development of future functions, features, tools, algorithms and models, so a model layer is acknowledged as existing. No model is named, no version, no provider and no hosting arrangement for the model layer, and no commitment to notify customers when any of it changes is published.

Clause 2.4 concedes the shape of the gap without filling it, stating that the services may use technology and data licensed by Augmetec from third parties, sublicensed to the customer, and naming none of them. One infrastructure provider is named and is not a model: Google Cloud Platform, identified in Annex II as the hosting environment and as the source of the secret management service. The approved subprocessor list at Annex III is referenced in the agreement and fell outside the extraction window of the published PDF, so its contents are unread and nothing is inferred from them in either direction.

The unit and the commercial structure are established from the published agreement, and no figure appears anywhere. There is no pricing page in the site navigation and every route is a demo request. The agreement supplies the shape: the software is licensed under an Order Form as a Package with stated features and pricing, User Rights itemize the number of user licenses and the software instance subscribed to, each authorized user holds a single non-shareable account, and the commitment runs across an Initial Term with defined Renewal Terms.

A buyer can therefore establish that this is per-user licensing on a committed term with the package defined in an order form, and cannot establish any rate, band, minimum or implementation cost. One published number is a comparative claim rather than a price and is recorded as such: the platform page states that the product is up to eighty percent cheaper than other platforms, naming no comparator and no basis. The floor band does not fit, because the unit of charge is published even though the price is not.

The practice is defined precisely, and the buyer boundary is left open. The product covers internal and regulatory investigations end to end, from scoping through evidence management, witness interviews and analysis to reporting, extending to ethics, compliance and regulatory reviews. The subject matter is evidenced: the addendum's data description names identity documents, invoices, expense receipts, financial payment data and material from corporate and ephemeral messaging apps, and the founder's background covers fraud, money laundering, bribery and corruption.

Users are law firms and in house professionals. Nothing else is stated: no size band, no jurisdiction despite an English law agreement and a UK base, no statement of which investigation types or regulated sectors the product does not suit, and nothing on languages for a platform taking in messaging data in many languages.