Security

Built for confidential case files.

Litigation files hold privileged work product, medical records and personal data. Here is how they are protected, including what isn’t in place yet.

Encryption

TLS (HTTPS) for all data in transit.
Documents are kept in encrypted storage.
Case text, extracted facts, answers and AI output are also encrypted field by field in the database (AES-GCM), so they can’t be read from a database copy.

Each person has their own login. Optional two-factor authentication (TOTP) is available on every account.
Cases belong to your firm. Members you invite see your firm’s cases; nobody else does.
Permissions are checked on every request. Firm admins manage members and the firm profile.

Every question and analysis is limited to a single case.
Search, answers and work product never draw on another case or another customer’s data.

AI processing runs on Microsoft Azure OpenAI under Microsoft’s enterprise data terms. Case files are never sent to consumer AI services.
Your documents, questions and results are never used to train AI models.
Social Security numbers and payment card numbers are redacted from AI prompts. Prompts and responses are not written to application logs.
Azure processes prompts transiently. As a security measure, Microsoft may keep content flagged by its automated abuse detection for up to 30 days, then deletes it.
The service is a tool used by you and at your direction, and we treat your documents and AI output as your confidential information. Section 6 of our Terms of Use sets this out.
Documents and case data are stored on U.S.-based infrastructure. Some AI models currently run on Azure global deployments, which may process a request outside the U.S.; we are moving every model to Azure’s U.S. data zone.

Sign-ins, administrative actions and case activity are logged to support internal review and security investigations.

Matters with medical records are supported with encrypted storage, per-firm and per-case access, and case isolation.
We do not yet sign a Business Associate Agreement (BAA); that work is in progress. If your matter requires a BAA, contact us before uploading.

You own your documents and work product.
Data stays in your account until you delete it. Deleted documents are permanently removed; backups expire on a standard retention schedule.

If you believe you’ve found a security issue, email us. We take every report seriously and respond promptly.