SECURITY, DATA & TRUST
Built for data a firm can’t afford to leak.
A zero-knowledge architecture where the vendor structurally can’t read your privileged data — bring-your-own-key inference, edge processing for privileged matters, private tenancy, no public model training, and a full audit trail. Here’s how UpDossier treats your firm’s data, and what we have and haven’t certified yet.
THE STRUCTURAL DIFFERENCE
Zero-knowledge — not a trust-us promise.
Most legal-AI vendors ask you to trust their controls. UpDossier removes the need to: the cloud holds ciphertext and no key, so it is structurally unable to read privileged firm data or inference outputs. Privilege-bearing work runs under your own key, at the edge.
Only ciphertext, a one-way embedding, and a wrapped data-encryption key ever leave your network. The vendor never holds the key that unwraps them. If a privileged surface can’t reach your key, the chokepoint fails closed — it does not silently fall back to a vendor cloud.
DATA PRINCIPLES
Six commitments on your data.
Zero-knowledge by construction
VISION stores ciphertext only and holds no key-encryption key. It is structurally unable to read your privileged data or your inference outputs — not a policy promise, an architectural one.
Bring your own key (BYOK)
Firm, team, or user keys — the firm chooses the mode. Privileged matters are processed under your own key, which the vendor never holds.
Edge inference for privileged matters
Privilege-bearing surfaces — Fractional GC, Contract Review, AI Governance — run inference at the edge under your key. The chokepoint fails closed rather than fall back to a vendor cloud. Only the public-data Regulatory Monitor runs in the cloud.
Your data stays yours
Firm Brain runs in a private per-firm tenant. Your materials are never used to train a public model, and they are not shared across tenants.
Matter-scoped access
Retrieval and outputs are bounded to the matter. Cross-matter isolation pairs with your firm’s existing ethical-wall policies.
Everything is logged
The lane-events audit captures each classification, its rationale, and the source excerpt — scoped to the matter and ready for review.
CERTIFICATIONS — HONESTLY
What’s certified, and what’s on the way.
We won’t claim badges we don’t hold. Here is the current, honest status of our compliance program.
If your procurement process needs specific attestations or a security questionnaire, bring it to the call — we’ll tell you exactly where we stand today and what our timeline is.
COMPLIANCE STATUS
- SOC 2 Type IIOn the roadmap
- ISO 27001On the roadmap
- HIPAA alignmentOn the roadmap
- GDPR data handlingIn design
GET STARTED
Bring your security questionnaire.
A 30-minute review with your risk or IT lead — we’ll walk the data flow, the audit log, and the certification roadmap.