Security and confidentiality

Start with your firm’s obligations.

A useful workflow begins with a considered data decision.

Before uploading matter files, evaluate your authorization, client obligations, firm policies, and the sensitivity of the material. This page describes evaluation topics and the intended approach, not unverified implementation or contractual guarantees.

Firm and matter access

Confirm organization isolation, matter access, team roles, and who can approve spending. Evaluate how departing members lose access and how shared outputs are handled.

Providers and subprocessors

Request current information about hosting and model providers, processing locations, and applicable provider terms. Do not assume documents remain inside a single application.

Retention and deletion

Confirm retention periods, deletion procedures, backups, and whether provider processing has separate retention conditions. Establish a firm policy for original files and working outputs.

Source traceability and review

Source references help reviewers return to supplied documents. They do not guarantee accuracy or independently verify authorities. Review facts and legal conclusions before use.

Incidents and contractual commitments

Confirm the product agreement’s incident contact and reporting procedures before submitting sensitive material. No SOC 2, HIPAA, guaranteed privilege preservation, zero retention, hosting-region, or encryption implementation claim is made here.