Security & confidentiality
Attorneys have a duty to protect client information (ABA Model Rule 1.6) and to understand the AI tools they use (ABA Formal Opinion 512). LegiMatch is built so you can answer “where does my client's data go?” in one sentence: it's encrypted, stored on US servers, and never used for training.
Never used for AI training
Your uploads and results are never used to train any model, ours or our AI provider's. API data is processed under commercial terms that exclude training.
Encrypted at rest and in transit
Uploaded matters and extracted profiles are encrypted with AES (Fernet) before they're stored. All traffic uses TLS.
US data residency
Customer data is stored on servers in the United States. Our team can access it only for support and security, with access logged.
Automatic PII redaction
Emails, phone numbers, SSNs, card numbers and street addresses are removed before your text is processed or stored. You can turn this off.
Auto-delete and one-click deletion
Set research to auto-delete after 7, 30 or 90 days, delete any research instantly, or delete your whole account and data.
Account protection
Two-factor authentication (authenticator apps, one-time recovery codes), Google sign-in, strong passwords (Argon2), rotating session tokens with reuse detection, and a two-device limit per seat.
Firm-level controls
Firm owners can require two-factor authentication and Google Workspace sign-in for everyone, and share matters view-only or editable.
Audit trail
Sign-ins, failed attempts, security changes, exports and deletions are logged; firm owners can review and export the log. Sign-ins from a new country sign out other devices automatically.
Documented controls
Policies for access control, incident response, backups and vendors, mapped to the SOC 2 Trust Services Criteria. Security questionnaires answered on request.
Only real citations
Results come only from stored public court opinions with source links. The AI can explain a match but can't introduce a case.