Security
Is it safe to upload client files to Draftiro?
Where uploaded case files are stored, who can see them, what our AI provider receives, what we do not have yet, and the questions you still have to answer yourself.
Last updated: 2026-10-26
Short answer: Draftiro is built for confidential matter files, and this page sets out exactly what happens to a file after you upload it, including the limits. Whether a given upload is appropriate for a given client is still your call under your state's rules. This article is not legal advice.
Where the file goes
- Storage. Files and case data are stored by Supabase on AWS us-east-1, encrypted at rest with AES-256. Connections use TLS. Data your browser keeps in localStorage (your sign-in session and unsaved drafts) is not covered by that at-rest encryption.
- Who can see it. Draftiro uses a shared, multi-tenant database. For signed-in requests, row-level security limits each user to their own firm's records. Access inside a firm is firm-wide: authorized members of your firm may see shared matters. Some background and administrative processes (billing webhooks, scheduled jobs, account administration) run with elevated database access and rely on application checks instead.
- The AI provider. To read a file, Draftiro sends it to Google's Gemini API for text extraction and search indexing. When you ask a question, it sends your request and the matter context needed to answer it. Gemini runs under Google's paid-service terms, which bar Google from using your prompts and responses to improve its products. Google may keep requests for a limited period for abuse monitoring, and AI processing is not limited to a US region.
- Citations. Draftiro does not send citations or search terms to any case-law service. The look-up link beside a citation opens a public search in your browser only when you click it.
Draftiro does not use your matter content to train AI models. The full list of vendors and what each receives is on the subprocessor page.
What we do not have yet
- SOC 2: Not audited · readiness program. Draftiro holds no SOC 2 report.
- DPA: A data processing agreement is being finalized. Email security@draftiro.com if your firm needs one.
- HIPAA: Draftiro does not sign Business Associate Agreements. Do not upload protected health information you hold as a HIPAA business associate.
- EU data residency is not available.
Keeping control of the file
- Deleting a document moves it to Trash, where it can be restored.
- Daily database backups are kept by our database provider for 7 days; uploaded files are not included in those backups.
- Significant actions (matter and draft changes, file deletions, exports, security events) are recorded in an audit log. Not every action is logged.
- You can turn on two-factor authentication and export your data or request account deletion. Deletion is a reviewed request, not an instant purge.
What ABA Formal Opinion 512 asks of you
ABA Formal Opinion 512 (July 29, 2024) applies the existing duty of confidentiality, Model Rule 1.6, to generative AI. As a baseline it expects a lawyer to read a tool's terms of use and privacy policy, or consult someone who has, to learn who can access what is entered. It says informed client consent is needed before entering client information into a self-learning tool whose output could disclose it, and that engagement-letter boilerplate is not enough for that consent. The opinion is guidance on the Model Rules, not binding law; your state's rules and ethics opinions control.
A practical routine before your first upload: read the Privacy Policy (Section 4 covers AI processing) and the Trust page, decide whether this client's engagement terms call for disclosure or consent, and keep files you have no reason to upload, such as health records or unrelated client material, out of the matter. For a vendor-neutral checklist, see Is AI safe for client data?
Questions about a specific workflow: security@draftiro.com.