Home/Security
Security and privacy
We separate two questions: where the case files physically reside, and which data goes to the model providers. Both are configurable, both are visible in the interface, and both can be tightened towards greater strictness.
They go nowhere except the model provider you choose. We physically cannot see the contents of your cases.
Each firm has its own space: its own cases, users, keys and limits. One organisation's keys are inaccessible to another, even to us.
Only local models and local recognition are used. Quality is lower — the files never leave the machine. Assembled as an integration project in your perimeter.
The communication channel
If a lawyer works outside the office, the connection goes through our nodes — but as an encrypted stream that we do not decrypt. Otherwise the promise "files never leave your office" would be untrue at the very moment the lawyer steps out of it.
Model keys
A key from a personal subscription is fine for development but not for a product: personal rate limits and silent degradation at the worst possible moment.
Data governance
The firm can allow fact extraction on one service while sending the full text of the case nowhere except the chosen one. At the extreme, there is a mode in which nothing goes outside at all.
| Action | What is sent | To whom | How to restrict it |
|---|---|---|---|
| Analysis and debates | The case fragments needed for the answer | The selected models for the roles | Local models for the roles |
| Fact extraction | Volume pages | A cheap model, or locally | Local extraction |
| Recognition | Only disputed pages, a fraction of a percent | Arbiter | A local arbiter |
| Embeddings | Fragment texts | The embeddings provider | Local embeddings |
| External sources | The search query | A legal database, a registry | Disabling the connector |
Double local recognition also saves money: the neural network sees a fraction of a percent of the pages, not the entire case.
Control
Administrator, partner, lawyer, assistant, client. The client sees only their own case: submit documents, the status, approval of a draft.
Approving a document, confirming a deadline, rejecting a fact, linking a chat, querying an external source — all with who and when.
Limits per organisation, per lawyer and per case; a warning and a hard stop; the estimate is shown before an expensive operation is run, not after.
A nightly copy of the database and files, retained for N days, with verifiable restoration. An update does not touch case files.
Boundaries
Formalising the relationship
We work under a contract describing data processing, a list of sub-processors (model providers) and the procedure for deleting files. For corporate clients there is a separate document pack and a service level agreement. We send the exact list of documents and annexes together with the quote.
Send us your internal policy or a question from your security department — we will answer substantively and, if needed, build an environment to match it.