Written to be forwarded.

Platform models run through Microsoft Foundry and the Vercel AI Gateway under zero-data-retention terms: the prompt and the documents are used to answer the question in front of the model and are not stored by the provider afterwards, and nothing is used to train or fine-tune any model, ours or theirs.

If you bring your own provider key, inference runs on your firm's own account instead. We show you which providers offer zero data retention on their own terms and how to turn it on, so the same posture holds whichever route you choose. That option is on every plan, including Free.

Files, answers and matter records are stored in Microsoft Azure UK, with no data leaving the UK region, encrypted in transit and at rest.

Documents you keep in your own systems stay there. We do not copy a document library across from anywhere else: the DMS tiles in the marketplace catalogue are not live integrations today.

Sensitive columns, provider API keys, storage credentials, integration secrets, are encrypted field by field with AES-256-GCM, under a key derived for that purpose alone rather than shared with any other subsystem.

If your firm brings its own provider key, that is where it lives.

Owners and admins see everything in the firm and manage members, matters and billing. Members see the matters they are on, plus anything shared firm-wide, plus their own private chats and files. Nothing leaves the firm unless someone deliberately creates a share link, and any link can be revoked.

Alongside those three access roles sit four staffing grades: partner, fee-earner, paralegal and business services, which describe supervision and billing, not permission.

Where a conflict check hits a matter the reader is not on, the result is redacted for them and names the partner to ask. That is a redaction, not an information barrier: the product does not offer ethical walls as a feature.

External links carry a six-digit passcode by default, passed on separately from the URL. Expiry is seven days by default, with thirty and ninety available, and it is checked on every open. An optional email gate asks the reader to identify themselves, self-identified, not verified.

Technically: the URL token is a 32-character random string of which only the SHA-256 hash is stored; the passcode is scrypt-hashed against a per-link salt and compared in constant time; a viewer who clears the gate carries an HMAC-signed cookie rather than a client-set flag.

Every open, every download, every successful passcode entry and every failed one is recorded in the link's view log and the firm's audit and compliance register.

Every agent run starts with a plan, and the plan is screened before anything else happens. The prompt is checked for personal and client data against an allow-list and redacted where it needs to be: a case number becomes a reference, and the run tells you what it changed and why. The matter's jurisdiction is confirmed too: the Jurisdiction Gatekeeper protocol blocks a run that would mix in authorities from a jurisdiction the matter is not configured for, so an English question is not answered with Scottish or US authority, and the reverse holds just as firmly.

For the Research Agent the plan then pauses for your approval. You can approve it as written, modify it or cancel the run. What you approved, and what was redacted, is recorded in How this was made.

Email and password, Google sign-in, or two-factor authentication with an authenticator app, enabled per user from Settings. SAML single sign-on is available on request: ask us before your firm relies on it, and we will tell you honestly where it stands.

The add-in is a manifest file, not software on the machine. Sign-in opens a dialog on the workspace's own domain, the firm's ordinary sign-in with two-factor included, and returns a session token bound to that member and one workspace. Only the token's hash is stored. Sessions expire after 30 days by default and can be revoked by the member, a firm admin or the platform; they end automatically when a member leaves the firm.

The assistant sees the paragraphs it reads for a turn, the selection and, when asked, comment threads and existing tracked changes, all under the firm's AI configuration. The document file itself leaves the machine only when a member chooses Save a copy. Every change it proposes is a Word tracked change a person applies or, with auto-apply on, accepts or rejects in Word. It never accepts or rejects a tracked change itself. Only the add-in's own pages may be framed, and only by Microsoft Office origins.

A single audit and compliance register of runs, verification checks, share links, documents, members and conflict checks, projected from the operational records rather than written alongside them. Export it as CSV, or print a bundle carrying the period, the totals and a SHA-256 digest of the exact rows exported.

That digest is a content digest. Two exports of the same window produce the same value; one altered row does not. It is not a tamper-evident hash chain, and we do not describe it as one.

Chats, matters and agent runs can be deleted from the app immediately. Documents are archived immediately and erased permanently on request: a regulated firm's file must never be destroyed by one member's click, so permanent erasure is an owner-level action confirmed by us. Deleting the firm removes all of its data. If you need written confirmation of deletion for a client or a regulator, email hello@legalaispace.com and we will provide it.