✦ Security and data

Where your data lives, in plain words.

What we store, where it is, who processes it and how to delete it. The legal terms are in the privacy policy; this page explains them.

Where your data lives

Your account, Vault documents, research sessions and records are stored in India, on Microsoft Azure (East India region).
Every connection uses HTTPS, and HTTPS is enforced. Data in our database is encrypted at rest, and the database is reachable only from our application server.
Public judgment pages are served through Cloudflare's network. The source judgment archive, which is public court records and holds no personal data, is stored on AWS in Mumbai.

AI processing

When you use an AI feature (research, drafting, order analysis, summaries, judge profiles), your prompt and the relevant text are sent to Microsoft Azure OpenAI, which processes them in the United States.
Your drafts, Vault documents and research are never used to train AI models, by us or by the provider.
Like every standard Azure OpenAI customer, Microsoft may keep prompts and outputs for up to 30 days to detect and prevent abuse, encrypted and not accessible to OpenAI or other customers, and then deletes them.
Research and drafting retrieve judgments from our own index first; the model only sees what was retrieved. See the methodology.

How long we keep it

Order Analysis: the PDFs you upload are read in memory to extract their text and are never stored. The extracted text is sent to Azure OpenAI to write the brief; the brief is kept only if you save it to your Vault.
Style samples: only the extracted text is kept, never the original file.
Vault documents, research sessions, client records and reminders: kept while your account is active, deleted within 30 days of account closure or an erasure request.
Server logs (IP address, timestamps): 90 days, then deleted automatically.
Records of credit purchases: 7 years, as tax law requires. These never include your documents.

Deleting your data

Write to our Grievance Officer (address in the privacy policy) to delete your account. Your account and everything in it is deleted within 30 days of a verified request. You can edit your display name and similar details in your profile settings.

What we don't claim

We don't hold ISO or SOC certifications yet, and we'll say so here when that changes. We never sell your data, and your drafts, Vault documents and research are never used for advertising. Our pages load Google Analytics, to measure visits, and Google AdSense; both set their own cookies.