ArsLexHow we handle your data.
Everything a firm's privacy counsel or security reviewer asks us, on one page. The documents that govern are the Privacy Policy, the Terms of Service and the Subprocessor list; this page summarizes them and never overrides them.
Zero-retention AI. Your work kept until you delete it.
Two things are true at once, and we state them separately because they are often confused. No AI provider retains or trains on your content; that has never changed. And we keep your documents and work product until you delete them: they are never deleted on a schedule, and there is no timer to turn on. Only temporary copies we make to deliver or process them expire.
Where your data lives, and who touches it
- Hosted in the United States, in our own cloud account. The application, the database, the document store and the search index run on Amazon Web Services (us-east-1) in an account ArsLex controls.
- AI generation runs on Amazon Bedrock under zero-retention terms. Bedrock does not store the inputs or outputs of a request, no AWS operator can access them, and they are never used to train or improve any model. We do not opt in to any setting that would change that.
- Embeddings never leave our infrastructure. Search by concept, grouping a production by subject and choosing which passages the AI review pass reads all work by turning text into vectors. Every one of those vectors is computed on infrastructure ArsLex controls; no third-party embedding service ever receives your text.
- A short, published subprocessor list. Hosting, inference, transactional email and payment processing, each with its role, the data it sees and its region, at arslex.ai/subprocessors. Material changes are noticed under the Terms.
- We do not read your work. We do not monitor or review client content. Personnel access to production data is limited to the people who need it, on a least-privilege basis, and is audited.
Encryption and keys
- Encrypted in transit and at rest. Every connection to the Service is over TLS. Documents, the database, the search index, snapshots and backups are encrypted at rest with AES-256.
- A key of your firm's own, on request. A firm can ask to have its documents in our durable store sealed under a key held in AWS Key Management Service for that firm alone and used for nothing else. Destroying that key makes the firm's stored documents unreadable everywhere at once, which is a stronger statement than walking a deletion through every copy.
- A key destruction is never silent and never immediate. Every administrator on the account is warned in the app and by email, an explicit confirmation is required, a waiting period runs before anything is destroyed, and the destruction itself is a deliberate act by ArsLex personnel, never a scheduled job. If no administrator can be reached, it cannot proceed.
Custody, deletion and backups
Data stays until the firm deletes it. Nothing is deleted on a schedule, and there is no setting that does.
Deleting a document, a project, a matter or an account removes the record, the search index and the file from live systems in the same operation. There is no trash can and no restore.
Encrypted nightly backups exist for whole-system recovery only. Deleted data leaves them within thirty days. We never restore individual items from backup.
We perform periodic tested restore drills to confirm that backups can actually be recovered.
A deletion can be documented: an inventory of what was removed, gone from live systems at once and from backups on the published schedule.
Close a matter to the archive rate and bring it back yourself. Archiving changes the rate, not the custody.
Because deletion is permanent, keep your own copy of anything you cannot afford to lose. That is prudent practice, not a limit on our obligation to hold what you have entrusted to us.
Preservation holds
Your firm can place a preservation hold on a matter, with the reason recorded. While it is on, nothing under that matter can be deleted, by a user or by us: every delete path asks the hold first and refuses out loud. Setting and releasing a hold are both written to the audit log, so preservation can be demonstrated after the fact. Deciding whether a hold is required, its scope and its release remains the attorney's judgment and the firm's duty; we provide the mechanism.
Tenant isolation and access
- Each firm is walled off from every other. Isolation is enforced at the database, the file store and the search index, and exercised by automated tests on every deployment. Within a firm, data is scoped by matter and project.
- Accounts are protected the way you would expect. Passwords are stored only as one-way hashes, multi-factor authentication is available to every user, sessions use short-lived signed tokens, and roles are enforced at the API.
- Chat is session-only. Conversations with the assistant are never saved. They are held in server memory so your signed-in devices share one thread, and are wiped when your session ends, when you sign out or when you clear them. They are never written to a database, to disk or to a backup.
- On-premises on request, with the boundary stated. The application, your database and your search index can run inside your own environment. AI generation still calls Amazon Bedrock under the zero-retention terms above, so that portion of processing leaves your network. A deployment in which nothing leaves your environment is on our roadmap, not available today.
When an agreement ends
Cancelling a subscription deletes nothing, and does not by itself end your firm's agreement with ArsLex. When the agreement does end, your firm has thirty days to export its data or to have us provide it. After that export period we delete the firm's content, served productions and held matters included unless a legal demand directed at ArsLex requires us to keep it, and the deletion is carried out deliberately by ArsLex personnel, never by a scheduled job.
Compliance posture
- SOC 2. A SOC 2 program is underway: controls are tracked to the AICPA Trust Services Criteria, with a Type I audit planned and Type II to follow. We will say so here when a report is available, and not before.
- GDPR and UK GDPR. Supported through our Data Processing Addendum (Schedule C to the Master Services Agreement), with the Customer as controller and ArsLex as processor, and the EU Standard Contractual Clauses and the UK International Data Transfer Addendum as the transfer mechanism to the United States.
- HIPAA. We do not claim to be "HIPAA compliant"; no vendor can self-certify that. Litigation productions routinely contain medical records, so we operate a HIPAA Security Rule program for protected health information that reaches us through your matters: our hosting and AI inference run under an executed AWS Business Associate Addendum, and we will sign a Business Associate Agreement with a firm that is a covered entity or a business associate. Ask for it before uploading PHI.
- Professional responsibility. The Service is built with ABA Model Rules 1.1, 1.6 and 5.3 in mind: tenant isolation, encryption, deletion controls and the absence of model training support your confidentiality obligations. Using it does not by itself satisfy any ethics obligation; that judgment stays with you.
- Incidents. If a security incident affects your data, we notify you as the Terms and applicable law require.
Security reviews and questionnaires
Our Information Security Addendum (Schedule B to the Master Services Agreement) describes the controls behind this page in contractual detail: hosting, encryption, access control, logging, personnel, secure development, incident response, backups and recovery, vendor management and independent assessment. It is provided to customers and to prospects under NDA, together with the Data Processing Addendum, on request to legal@arslex.ai. Send security questionnaires to the same address.