How client work is protected.

Security is treated as a build requirement rather than a launch task. Early development and private beta may involve real client documents in controlled environments, so the controls have to exist before that work, not after it.

The list below is what the architecture is held to today. Where something is not yet in place, this page says so rather than implying it.

• Data is encrypted in transit and at rest.
• Accounts support multi-factor authentication. Sessions can be expired and revoked.
• Client work is scoped to an organisation and its matters, and stays inside that boundary.
• Access to and export of matter files is recorded in an audit log available to the organisation.
• Matter data is backed up on a regular schedule, with a tested restore path.
• Environment separation and access control apply between development, staging, and production.
• Matter-scoped workflows only run when you explicitly invoke them.
• No formal ISO 27001 certification is claimed. The architecture is built so that it is not blocked later.

Hosted services run in Europe, and hosted data is intended to remain there.

Early development and private beta may involve real client documents in controlled environments. Security and audit controls are a build requirement for that work, not a cleanup task after launch.

• If personal data is transferred outside the UK or EEA, appropriate safeguards (such as UK IDTA / EU SCCs) apply unless a UK GDPR exception applies.

Client uploads and matter outputs stay in organisation-scoped matters. They are not published into the open legal search index.

Phase 1 relies on curated public corpus ingestion, retrieval and ranking over that corpus, and per-matter product state. It does not silently learn from client matter data. Weight-changing fine-tuning, if used at all, belongs to a later, explicitly governed phase.

• Retrieval for assisted features is intended to run over the trusted public corpus first.
• Matter-scoped workflows only run when you explicitly invoke them.
• You remain responsible for professional review of any model output before relying on it.

Redact uses an open detection model as a component, not as a complete legal redaction solution on its own. Detection proposes spans; you review and decide what leaves the file.

Desktop-local redaction will be the preferred sensitive path in product policy: detection will run on your machine and the document content will not go to hosted infrastructure. Hosted redaction may exist for web flows, but it is policy-controlled and clearly distinguishable from the local path.

• Legal-specific policy rules and human review paths are required.
• PDF sources export as a redacted PDF with marks burned into each page and no recoverable text layer. OCR for scanned documents and desktop-local detection are not finished.
• The audit record keeps the label, offsets, decision, reviewer and time for each span, plus a hash of the original text rather than the text itself.

If you believe you have found a security vulnerability, email security@useobiter.com. Please include enough detail to reproduce it. We will acknowledge your report and tell you what we intend to do about it.

Please do not test against live client data, and do not run automated scanning that would degrade the service for others. We will not pursue action against good-faith research that follows those two limits.