Security
Security & Compliance Built for Legal AI
Law firms hold some of the most sensitive information there is. ClauseBorne is designed to protect confidential firm, client, and matter information at every step, from intake to drafting to workflows to attorney review.
Your Data Stays Under Your Control
Your matters are your firm's, and we treat them that way.
- Your firm owns its data. Documents, clauses, templates, and matter information you put into ClauseBorne remain yours.
- Separated by firm. Logical multi-tenant isolation at the database level.
- Access based on roles. Only the people your firm authorizes can see your firm's matters. ClauseBorne staff access is revoked immediately upon offboarding or contract termination.
- You can take it with you. If you leave, you can export your data, and your data is permanently deleted 30 days after the 30-day export window closes.
How ClauseBorne Uses AI and Your Data
AI in legal software raises fair questions. Here are direct answers.
- Is your data used to train AI models? No. Customer Data, uploaded legal documents, and prompts are never used to train foundational or public AI models.
- Which AI providers are involved? Cloud-hosted LLM APIs, such as OpenAI and Anthropic.
- How long do providers keep it? Data is kept strictly transient, per the providers' API data retention policies.
- What happens to AI output? Output stays in your firm's workspace and goes through an attorney review gate before it goes anywhere. Nothing is finalized without sign-off.
AI can make mistakes, which is why human review is built into the workflow rather than left as an option.
Encryption & Data Protection
- In transit: Data moving between your browser and ClauseBorne is encrypted with TLS 1.2 or higher.
- At rest: Stored data is encrypted with AES-256.
- Tenant separation: Logical multi-tenant isolation at the database level.
- Secure document handling: Uploaded documents are encrypted and processed securely in isolated environments.
Identity, Access & Permissions
Controls your firm can use to manage who sees what:
- Role-based access for partners, associates, paralegals, and staff
- Administrator permissions for managing seats and settings
- Multi-factor authentication (MFA)
- Single sign-on (SSO), optional for enterprise clients
- Least-privilege access for ClauseBorne personnel
Security Monitoring & Testing
- Vulnerability management: Automated, continuous vulnerability scanning through our cloud pipelines.
- Secure development: Regular code reviews and change management tracking.
Compliance & Independent Assurance
We only list standards we actually hold or support.
| Framework | Status |
|---|---|
| SOC 2 Type II | In progress / Planned |
| GDPR | Compliant via DPA |
| CCPA / CPRA | Compliant via DPA |
| HIPAA | Not supported |
Security documentation is available on request.
Data Hosting, Backups & Business Continuity
- Hosting: Vercel / AWS, U.S. East.
- Redundancy: Multi-region redundancy.
- Backups: Automated daily backups.
- Disaster recovery: Disaster recovery failovers.
Subprocessors & Vendor Security
Some of our services rely on trusted third parties, including infrastructure and AI providers. Vendors are reviewed annually for security posture. We remain responsible for the vendors we use to deliver ClauseBorne.
Our Privacy Policy explains how we handle personal information.
Security FAQ
Does ClauseBorne use my data to train AI models?
No. Customer Data, uploaded legal documents, and prompts are never used to train foundational or public AI models.
Where is my data stored?
On Vercel / AWS infrastructure in the U.S. East region.
Is my data encrypted?
Yes. TLS 1.2+ in transit and AES-256 at rest.
Who can access matter data?
Only the users your firm authorizes. At ClauseBorne, access is restricted to authorized engineering personnel on a least-privilege, need-to-know basis for critical debugging or security maintenance.
Does ClauseBorne support MFA or SSO?
Yes. MFA is supported, and SSO is optional for enterprise clients.
What happens to my data if I leave ClauseBorne?
You can export it for 30 days. Your data is permanently deleted 30 days after that export window closes.
Which compliance standards does ClauseBorne meet?
GDPR and CCPA compliance via DPA. SOC 2 Type II is in progress / planned. HIPAA is not supported.
Questions about security? We're happy to talk.
Our team can walk you through how ClauseBorne protects your firm's data and share the documentation your IT or compliance team needs.