What has been checked, by whom, and what has not.

What you can observe

Every model call leaves a human-readable row in the firm's own record: who asked, on which matter, what the model was asked to do, and which model answered. Never the content. A supervising attorney can read it for any matter at the firm at any time; under the agreement it is the firm's record, not ours.

Every statement about the record shows its source: the passage it rests on and whose words they are. A draft pleading carries each paragraph's source beside it. When sources disagree the workspace shows both and decides nothing. An outcome can be reproduced from the record without asking the model to vouch for itself.

The provider is watched from outside the model. Four models are probed every few minutes from the production account, and their refusals, slowness and errors are recorded and alarmed. When the provider fails, the screen says a request is waiting on the provider; it does not fail silently.

What has been tested

No model answers a client without a passing battery, and the judge is never the model under test. A faithfulness battery runs three mornings a week against the workspace's own reads (217 dimension checks at the last full run, October 9, 2026); the model under test is graded by a different model, pinned, and a second judge replays the same run. A model is admitted to or removed from the ladder on the result.

Failures are tested, not only successes. A rehearsal switch, which cannot be set in a deployed environment, makes a model refuse, stall or go silent on purpose so that the fall-through to the next model is proven before it is needed. A stranger run, a scripted first use by someone with no prior session, precedes every deployment. An isolation harness (867 checks at the last run) refuses a deployment if any firm can see any other firm's rows.

Outside parties have looked, and will. An independent PostgreSQL security firm reviewed the access design and the row policies in 2026. An independent security firm begins the penetration test on October 26, 2026 against a build frozen on October 9; nothing deploys before the test except a fix the testers ask for. AWS answered the retention question in writing.

What is contained

The model supplies; it holds no authority. It is given no tools, no credentials and no door to the database. It returns text. The workspace checks that text against the record and the expected form before anything is kept, and the only acts of record, inviting, approving, sending, are an attorney's, recorded as such. The model does not weigh evidence, rank authorities, choose a theory, advise a client, send, sign or file.

The controls sit outside the model. Who may read a matter is a row a supervising attorney wrote on purpose, enforced by the database rather than by the application, and the model cannot reach either. The retention setting under which every call runs is verified in the account before any call is allowed. A firm decides who is seated, which matters they see, and which disclosure sentence goes to a court.

No single model is the dependency. More than one model is kept ready in a fixed order; each must pass the same battery; the record names the one that answered. A model that could not run under zero retention is refused before any prompt is processed.

Where processing and data are maintained

The United States, on Amazon Web Services, and nowhere else. The workspace runs in one AWS region in the western United States; the database (PostgreSQL, on AWS's managed database service) and the document store (AWS's object storage) live in that region; backup copies live in a second United States region in a locked vault. The language model runs inside AWS's own model service and may be served from any of three AWS regions, all in the United States. Nothing is processed or stored outside the country.

Subprocessors, named

One company: Amazon Web Services. The services it provides are the compute that runs the workspace, the managed database, the object store, the key service, the sign-in service, the model service, and the e-mail service that sends content-free notices (that something is waiting in a matter, never what). The models are Anthropic's Claude models, run by AWS inside its model service under AWS's terms; Anthropic does not receive a firm's content. No other company handles a firm's content, and a firm on the platform is told in writing if that ever changes.

Data status in the model: zero retention

The model keeps nothing. Every request runs under the model service's retention setting of none, in which no request or response is written to durable storage by AWS or shared with the model's maker, and nothing is used to train or improve any model. AWS confirmed that in writing to us in October 2026, in two support cases, including that a model which required retention would be refused before any prompt was processed. The workspace adds its own check: it refuses every model call unless that setting has been verified in the account it runs in, so no deployment can run on an unverified setting.

Data status in the workspace: the matter record, encrypted under its own key

The workspace keeps what a firm uses it to keep: the client's account in the client's words, the client's answers, the documents, and the drafts. Each matter's content is encrypted under that matter's own key; the key is itself encrypted by a key held in AWS's key service and is unwrapped only for an act on that matter. Everything is encrypted in transit and at rest. The record stays until the firm closes the matter and directs deletion; then the matter's keys are destroyed, that act is recorded, and the backup copies made before it expire within thirty-five days in a vault no one, including us, can alter or delete early.

The supervising attorney establishes access, and only the matter's members can read it

Access is a row someone at the firm wrote on purpose, never something inferred from a title. A supervising attorney puts a colleague on a matter or takes one off; the client joins only at an attorney's invitation. The database itself, not the application, refuses anyone who is not on the matter: an attorney at another firm cannot see that the matter exists, an attorney at the same firm who is not a member cannot open it, and a client sees only the matter's own file. Sign-in requires a second factor. No one at ClearlyConcise reads a firm's matters in the course of running the service; the application gives our staff no path to client content.

The record of acts, content-free

Every act on a matter is recorded as a fact: who invited whom, who was granted or removed, who read what, who approved what, what was sent, what the model was asked to do and which model answered. Never the content of what was read or written. A supervising attorney can read that record for any matter at the firm, and under the agreement it is part of the firm's own record.

Checked by

An outside PostgreSQL security firm reviewed the access design and the row-level policies in 2026. An isolation harness runs after every change (867 checks at the last run, none failing) and refuses a deployment on any failure. A faithfulness battery runs three mornings a week against the workspace's own reads (214 cases at the last full run), and a model is admitted to or removed from service on its result. AWS answered the retention question in writing.

Not yet

A SOC 2 Type II report (the service has not run long enough for an observation window). The independent penetration test (an independent security firm, late October 2026; the report in November). The written privilege opinion from outside California privilege counsel (in final revision). Single sign-on with a firm's own identity provider. A public status page. Each is listed again, with what stands in its place, in row 12 below.

1 · What enters the system, and where does it live?

A matter's record: the client's account in the client's words, the client's answers to follow-up questions, documents the client or the firm sends, and the drafts the firm makes from them. It lives in one AWS region in the western United States, in a PostgreSQL database on AWS's managed database service and in AWS's object store, encrypted at rest, each matter under its own key; backups live in a second United States region. Nothing leaves the United States.

Prompts and model outputs are not stored by the model service (question 3). The workspace's own logs record acts, never content: who did what, on which matter, when.

2 · Which companies handle it?

One: Amazon Web Services. The workspace, the database, the document store, the model service and the e-mail service that sends content-free notices are all AWS's. The models are Anthropic's Claude models, run inside AWS's own model service under AWS's terms; Anthropic does not receive a firm's content. More than one model is kept ready, in a fixed order, each admitted only after passing the same faithfulness test, and the record names the model that answered each request.

No processor has been added since the first. A firm on the platform is told in writing when one is, and when the list of models changes.

3 · Is anything retained by the model, or used to train one?

No. The model runs in a configuration in which no request or response is written to durable storage by AWS or shared with the model's maker, and nothing is used to train or improve any model. The workspace refuses every model call unless that configuration has been verified in the account it runs in; a model that required retention is refused before any prompt is processed.

4 · Who can read a matter, and what stops anyone else?

The members of the matter at the firm and that matter's client, who joins only at an attorney's invitation. The database itself, not the application, refuses anyone not on the matter. No one at ClearlyConcise reads a firm's matters in the course of running the service; the application gives staff no path to client content. A database operator, as at any hosted service, holds administrative access; it is logged as its own kind of act, is not used to read matters, and is one of the things the outside reviews exist to check.

Sign-in requires a second factor. Each grant, removal, screen and refusal of access is a recorded act a supervising attorney can read for any matter at the firm.

5 · How is it tested, and what are its known limits?

Three instruments run on the workspace itself. An isolation harness runs after every change and refuses the deployment on any failure. A faithfulness battery runs three mornings a week against the workspace's reads (214 cases at the last full run) and a model is admitted or removed on its result. A recall measure reads planted facts back out of records of increasing size, and the workspace tells the attorney, on screen, that it does not find everything.

Known limits, stated on the screens where they apply: the workspace finds differences between sources but no instrument finds every difference; it reads facts against elements but never decides what a fact is worth; it lists the authorities a draft cites and never records whether the attorney checked one.

6 · What does the model decide without an attorney?

Nothing the statute would call the practice of law. It organizes what the client said, asks what the account left open, compares the sources in the file, reads facts against the elements of a claim the attorney chose, and prepares drafts for the attorney's revision. It does not weigh evidence, rank authorities, choose a theory, advise the client, send, sign or file. Nothing reaches a client that an attorney of the firm did not approve, and the approval is a recorded act.

7 · Can every output be traced to its source?

Yes. Every statement the workspace makes about the record shows the passage it rests on and whose words they are. When sources disagree it shows both and decides nothing. A draft pleading carries each paragraph's source beside it. Exported paper states what generative AI touched, and only that.

8 · What is recorded, and for how long?

Every act on a matter: who invited whom, who read what, who approved what, what was sent, what the model was asked to do and which model answered. Never the content of what was read or written. The record of acts is part of the firm's own record under the agreement: readable by a supervising attorney at any time, kept and destroyed as the Operating Description says.

9 · What happens when a firm leaves, or a matter closes?

The firm may export a matter's complete client file at any time, and when it closes the matter and directs deletion, the matter's content is destroyed by destroying the keys that encrypt it, and that act is recorded. Backup copies made before the deletion are held in an isolated vault that no one, including us, can alter or delete early; they expire within thirty-five days, and until then the content could be recovered only by a deliberate restoration we will not perform for a deleted matter except at the firm's written direction or as the law requires.

10 · What if something goes wrong?

The platform agreement says it: if we confirm that someone gained unauthorized access to the firm's content, we notify the firm without undue delay, with the facts we then have. The service is watched continuously for the model provider's refusals and slowness, and the workspace itself tells a person on screen when a request is waiting on the provider rather than failing silently.

11 · Which of this is in the contract?

All of it that a firm could rely on: the processor, the retention configuration, who may read a matter, the record, export and deletion, and the notice obligation are terms of the platform agreement, not statements on a web page. The Operating Description a firm accepts states what the workspace does and is versioned; a firm is told in writing when it changes.

12 · What is still owed, in one list?

• A SOC 2 Type II report. None exists; the service has not run long enough for an observation window. Until one does, the two outside reviews and the documents below stand in its place, and this page says so rather than showing a badge.
• The independent penetration test. Scheduled for late October 2026 by an independent security firm; the report in November. The firm is named on the report.
• The written privilege opinion. Outside California privilege counsel, engaged since the summer; in final revision. A firm that engages receives it on its terms.
• Single sign-on with a firm's own identity provider; document-level grants and expiry for temporary staff; a public status page.
• A firm-side stop. No switch yet lets a firm halt model calls on a matter or firm-wide; the model's lack of any act of record stands in its place until it is built.
• ISO 27001. Not pursued yet.