Twenty questions to ask
any AI scribe vendor.

The questions to put to any scribe vendor, aurii included, none of them written so only aurii can answer well.

Where your data lives and goes.

Hosting, subprocessors, training and deletion. The four questions that decide whether patient records stay where they should.

1

Where is our data hosted, and does it ever leave the country?

Why it matters

Health records carry residency obligations, and offshore storage widens who can compel access.

aurii's answer

In Australia, all of it. Sydney primary, Melbourne backup, and no clinical record is stored offshore, backups included. Verify on security

2

Who are your subprocessors, and what does each one touch?

Why it matters

You inherit the risk of every third party, so the list should be short and named.

aurii's answer

Three, each scoped: Microsoft Azure in Australian regions for hosting, a contracted AI service for drafting, Stripe for card payments. aurii never sees a card number. Verify on privacy

3

Is our patient data used to train your models, or anyone else's?

Why it matters

A consult dictated in confidence should not end up teaching a general-purpose model.

aurii's answer

No. The contracted AI service is bound by contract not to train its models on your content, and we do not use your patients' clinical information to train models for unrelated use. Verify on privacy

4

What is your retention policy, and what does deletion actually mean?

Why it matters

Deleted too often means hidden rather than destroyed, and retention should be a defined period, not indefinite.

aurii's answer

The audit is kept seven years, in-region, append-only. Purge on request means the data is destroyed for good, not just hidden. Verify on privacy

How it is protected and proven.

Encryption, sign-in, the audit trail and the certification question. The controls a security review checks first.

5

How is data encrypted, at rest and in transit?

Why it matters

Encryption only matters if it covers every tier and the keys live apart from the data.

aurii's answer

Every record is sealed with its own key, wrapped by a master key in Australian Key Vault, and everything is encrypted in transit. There is no unencrypted tier of storage. Verify on security

6

What multi-factor sign-in do you support?

Why it matters

A single stolen password should never reach patient records.

aurii's answer

WebAuthn passkeys and TOTP multi-factor sign-in, with least-privilege access so each role sees only what the work needs. Verify on security

7

Is there a tamper-evident audit trail, and can we verify it ourselves?

Why it matters

An ordinary log can be edited after the fact. A governance team needs proof a record was not altered.

aurii's answer

Every action is written to a hash-chained, append-only ledger kept seven years. Re-compute the chain and any change, reorder or deletion shows. Verify on security

8

Which certifications do you hold, and which do you inherit from your platforms?

Why it matters

A badge earned by your cloud provider is not a badge you hold, and honest vendors say which is which.

aurii's answer

One is ours: SMB1001:2026 Gold, held by Black Shard Pty Ltd. The rest are inherited from Azure and Stripe, and we label each in place. See the breakdown

The aurii audit trail: an append-only list of actions such as note created, note finalised and encounter updated, each with a hash, actor and timestamp that an evaluator can re-compute.
Question seven, in the product: the hash-chained audit an evaluator can re-compute themselves.

The certification question, answered in full.

The one to press every vendor on. A certification earned by your cloud provider is not one the vendor holds, and the honest thing is to say so on the page. Here is where aurii stands.

What we hold
  • SMB1001:2026 Gold (Level 3). Held by Black Shard Pty Ltd, the company that builds, hosts and secures aurii. Certified by CyberCert.
What we inherit from our platforms
  • ISO/IEC 27001 and SOC 2 Type II. Inherited via Microsoft Azure, which hosts aurii in Australian regions.
  • IRAP: PROTECTED. The ASD-assessed rating of Azure's Australian regions, inherited via Microsoft Azure.
  • PCI DSS Level 1. Inherited via Stripe, which handles every card payment, so aurii never sees a card number.
What we do not claim
  • Our own ISO 27001 and SOC 2. Not held in aurii's own name.

The same distinction, with each badge attributed in place, is on the security page, and the privacy-principle mapping is on the compliance page.

Where clinical responsibility sits.

Device status, who signs, and what happens when a draft is wrong. The questions your MDO asks before your clinicians do.

9

Are you a registered medical device, under the TGA or ARTG?

Why it matters

The claim changes your regulatory obligations, so a straight answer matters.

aurii's answer

No. aurii drafts documentation and is not a medical device. It is not TGA or ARTG registered, and it does not diagnose. The doctor decides. Verify on safety

10

Who signs the note, and what is your role in clinical responsibility?

Why it matters

The tool should draft, not decide. Responsibility rests with a named clinician.

aurii's answer

The treating specialist reviews and signs every output. aurii drafts from what you say; it does not triage or make clinical decisions. Verify on safety

11

What happens when the draft is wrong?

Why it matters

Every scribe makes mistakes, so review must be enforced, not optional.

aurii's answer

Nothing is filed, sent or billed until a specialist has signed it, and every edit made before that signature is captured in the ledger. Verify on safety

12

Are you aligned to Australian clinical guidance?

Why it matters

Guidance written overseas may not match how Australian practices and colleges expect scribes to be used.

aurii's answer

aurii follows the RACGP position: the clinician always reviews and signs the note. That is built into the workflow, not left to habit. Verify on safety

What it costs, and how you leave.

Price transparency, how access starts, lock-in, export and support. The commercial terms that outlive the demo.

13

What does it cost, all in, and is the price public?

Why it matters

Published pricing tells you the vendor is not sizing the number to the logo on your lanyard.

aurii's answer

A$199 + GST per clinician per month, or A$1,908 + GST annually. It is on the pricing page, not behind a sales call. Verify on pricing

14

Is there a free trial, and when does the first charge land?

Why it matters

Try it on a real round before any money moves, and know exactly when.

aurii's answer

Early access by request rather than a self-serve trial. Ask, and we set you up on your own admissions and confirm the billing with you before anything is charged. Verify on pricing

15

Are we locked in, and can we export our records on exit?

Why it matters

Your records are yours, and leaving should not mean losing them or the history behind them.

aurii's answer

Export is set up at onboarding, so records leave in a usable form with their audit trail. Then, on your instruction, we purge. Verify on privacy

16

What does support actually look like?

Why it matters

Round-the-clock support often means an offshore queue. Know who answers when something breaks.

aurii's answer

aurii is run by a small engineering team. A suspected issue goes to the people who built the system, and a person reads and replies. Talk to the team

How it holds up in the day to day.

Offline behaviour, platforms, release cadence and integrations. The questions that decide whether it survives a real week on the ward.

17

How does it behave when the network drops?

Why it matters

Wards and clinics have dead spots, and a scribe that stops with the signal is no use at the bedside.

aurii's answer

Offline capture that syncs when signal returns, so the round does not wait on the wifi. Verify on product

18

Which platforms do you support?

Why it matters

The tool has to work on the device already in the clinician's hand.

aurii's answer

iOS, Android and web. The same account and the same records, wherever you sign in. Verify on product

19

How often does the product ship, and does the vendor stand behind a roadmap?

Why it matters

A living product improves on a steady cadence, and a stalled one goes quiet for months.

aurii's answer

aurii ships on a regular, near-weekly cadence, shaped by the practices onboarding now and the clinicians using it day to day. Ask any vendor when their last three releases landed. See the product

20

What integrations exist, and how do documents reach our systems?

Why it matters

A note that cannot leave the app cleanly creates the double-handling the tool was meant to remove.

aurii's answer

GP letters go out with delivery tracking, and inbound HL7 is used for delivery acknowledgements. The current list is on the integrations page. See integrations

Ask us these in writing. We answer in writing.

Send this list to any vendor, aurii included. Where our answer links to a page above, that page is the source of truth, and we hold to it. If a question here does not have a clean answer somewhere on this site, tell us at hello@aurii.com.au and we will fix that.

Bring the list.
We will answer it.

Put these to us on your own round. Requesting access takes one conversation, and every answer above is on a page you can check first.

hello@aurii.com.au

Stay in the loop.

Leave your email and we'll be in touch. No spam, unsubscribe any time.