Security & trust

You're trusting us with privileged data.

Here is how we protect it — the controls we run today, what our providers receive, and what we haven't built yet.

Last updated: · About 5 minutes to read

Draftiro does not use your matter content to train AI models. Gemini runs under Google's paid-service terms, which bar Google from using your prompts and responses to improve its products. Google may keep requests for a limited period for abuse monitoring. Privacy Policy, Section 4
  • No AI training
    On your matter content
    Live
  • Encrypted
    TLS in transit · AES-256 at rest
    Live
  • SOC 2
    Not audited · readiness program
    In progress

How your data flows

Your case content lives in a shared, multi-tenant Postgres database (Supabase on AWS us-east-1), separated by firm with row-level security and encrypted at rest by our database and storage provider. When you chat or draft, Draftiro sends your request and the matter context needed to answer it to Google's Gemini API over TLS, and stores the conversation in your workspace. Google Search grounding is off by default. To find and check case law, Draftiro sends CourtListener, a public legal database, short search terms (with party and client names removed) and the case citations it detects — not your full message.

Connecting Microsoft 365 is optional and is not read-only: it consents toCalendars.ReadWrite, Mail.Send, Mail.Read and read access to OneDrive/SharePoint files. Draftiro uses them to sync calendar events (including description previews), sync previews of your 50 most recent inbox messages, create calendar events, send email you ask it to send, and import files you choose. Disconnecting deletes the connection tokens and synced calendar events; saved inbox previews stay with your firm's records until your account is deleted.

  1. INPUT
    Your matters

    Stored in Supabase on AWS us-east-1.

  2. AI
    Google Gemini over TLS

    Your request and needed matter context go to Google Gemini. Not used to train models.

  3. CITES
    CourtListener

    Case-law search terms and citation checks on a public legal database — not your full message.

  4. MICROSOFT 365
    Microsoft Graph

    Calendar, inbox previews and email you send — only if you connect it.

Data at rest is stored in the US (AWS us-east-1 via Supabase). AI processing by Google is not limited to a US region. EU data residency is not available.

Encryption & isolation

At rest
Our database and storage provider (Supabase on AWS us-east-1) encrypts databases and case files at rest with AES-256. Data your browser keeps in localStorage (your sign-in session and unsaved drafts) is not covered.
In transit
TLS-encrypted connections (TLS 1.2+ where supported). HSTS is enforced on the production domain.
Connection tokens
Outlook connection tokens are encrypted before they are stored and deleted when you disconnect.
Firm isolation
Firm data is stored in a shared database. For signed-in requests, Postgres row-level security limits each user to their own firm's records. Some background and administrative processes (such as billing webhooks, scheduled jobs and account administration) run with elevated database access and rely on application checks instead.

Features that support your professional duties

These features are designed to support — not satisfy — your obligations under the ABA Model Rules. You remain responsible for meeting them.

Rule 1.1 (Competence)
When supported case citations are detected, Draftiro attempts a CourtListener check when available and shows verified, missing, or unchecked status. Statutes, regulations, and court rules are extracted but not validated — the UI surfaces them as unchecked so you know to confirm in your authority. Each conversation shows an attorney-review notice, and citation statuses appear on each answer.
Rule 1.6 (Confidentiality)
Encryption, firm-scoped access controls and an audit log of significant actions. Access is firm-wide, so authorized members of your firm may see shared matters. Draftiro does not use your matter content to train AI models; what our AI and legal-search providers receive is described in Privacy Policy, Section 4.
Rule 1.7 (Conflicts)
Conflict checks run when you add client and opposing-party names, and any acknowledgment is recorded with the user and time.
ABA Formal Op. 512 (Generative AI)
For case-scoped AI work, Draftiro can create a draft AI-assisted time entry for attorney review, editing, or deletion before billing. Draft entries default to the elapsed time of the AI exchange; adjust them to the time you actually spent. It makes no compliance determination.

Audit & accountability

Audit log
Draftiro records significant account actions — such as matter and draft changes, file deletions, conflict acknowledgments, exports, security and billing events — with the user, time, IP address and browser. Not every action is logged. Entries are kept for the life of the firm account.
Conflict acknowledgment trail
When a lawyer proceeds past a flagged conflict, the case row records who acknowledged and when.

Your data, your control

Data export
Settings → Download my data — a JSON archive of your firm's cases, clients, conversations, messages, drafts, document records, calendar events, collaborators, and your 1,000 most recent audit-log entries. It does not carry everything: time entries export as CSV from the time tracker on each matter, the file bytes themselves download per case from the Files panel, and some records (such as tasks, inbox previews, draft version history and Discovery Review data) are not in the archive — ask us if you need them. Export helps you return client files when a matter ends.
Account deletion
Account deletion is a reviewed request, not an automatic purge. Request it in Settings → Delete account or by emailing support@draftiro.com; we aim to complete verified requests within 30 days. Details are in our Privacy Policy.
No model training
Draftiro does not use your matter content to train AI models. Gemini runs under Google's paid-service terms, which bar Google from using your prompts and responses to improve its products. See the Privacy Policy for what providers may retain.
No selling
We do not sell your firm's data. We share data with infrastructure, communications, analytics, and AI providers only as needed to operate enabled features, as described in the subprocessor list and our Privacy Policy.

Data retention

How long each class of data lives. The full table is in our Privacy Policy.

DataRetention
Cases, documents, drafts, clientsWhile your account exists; deleted or anonymized under a verified deletion request. Files you delete go to Trash; matters can be archived, not deleted.
Chat history & AI exchangesUntil you delete the conversation or your account is deleted
Audit log (including IP address and browser)For the life of the firm account
Database backups (point-in-time recovery)Encrypted; expire on our database provider's rolling schedule
Error reports (Sentry)A limited period set by our error-monitoring provider; request bodies are not sent
Microsoft 365 tokens and copiesTokens and calendar copies deleted on disconnect; saved inbox previews kept until your account is deleted
Stripe billing recordsRetained by Stripe per their legal/tax obligations

Subprocessors

The vendors that process data on our behalf. The full subprocessor list is the authoritative list, with what each vendor receives.

  • Supabase (PostgreSQL, Storage, Auth)
    Database + file storage + authentication · AWS us-east-1
  • Vercel
    Application hosting + CDN · Edge network
  • Google (Gemini API)
    AI responses, document text extraction, search indexing · Google-managed; may be outside the US
  • Microsoft (Graph API)
    Optional Microsoft 365 calendar, inbox and file integration · Your Microsoft 365 tenant
  • Stripe
    Payment processing — Draftiro does not receive your full card number · Stripe-managed
  • Resend
    Transactional email delivery · Not currently enabled
  • Sentry
    Error tracking; request bodies are not sent · Sentry-managed
  • CourtListener (Free Law Project)
    Case-law search terms and citation checks · Public legal database
  • Vercel Analytics
    Cookieless page views and product events · Global edge

Standards & compliance timeline

  1. Encryption and firm-scoped access controlsLive

    Live. TLS in transit; AES-256 at rest on our database and storage provider; row-level security on signed-in requests.

  2. No AI training on your matter contentLive

    Live. Draftiro does not use your matter content to train AI models; Gemini runs under Google’s paid-service terms, which bar Google from using it to improve its products.

  3. AI-assisted time entries and conflict checksLive

    Live. Case-scoped AI work can create a draft time entry labeled “AI-assisted” for you to edit or delete; conflict checks run when you add parties and record any acknowledgment. These features support, but don’t determine, your billing and conflict obligations.

  4. SOC 2 Type IIIn progress

    Readiness program in progress. Draftiro has not completed a SOC 2 audit, has not engaged an auditor, and holds no SOC 2 report. We’ll update this page if that changes.

  5. EU data residencyIn progress

    On the roadmap; not yet available. Today all data at rest is stored in AWS us-east-1.

  6. SAML SSOIn progress

    Not generally available. If your firm needs single sign-on, tell us.

DPAs, security reviews and HIPAA

A data processing agreement is being finalized — contact us if your firm needs one. We also answer security questionnaires.

HIPAA: Draftiro is not designed for HIPAA-regulated workflows and does not sign Business Associate Agreements. If your firm is a HIPAA business associate of a client, do not upload that client's protected health information.

Contact us

Report a vulnerability

Found a security issue? Email security@draftiro.com. We credit reporters who'd like public acknowledgement.

Email security@draftiro.com