1. Overview

This Policy describes how Cliont stores and protects data, including intake content (text, documents, audio, video), and sets retention schedules.

2. Hosting & encryption

Region. Primary hosting is in the United States (customer‑selected regions may be offered contractually).

Encryption. TLS in transit; industry‑standard encryption at rest.

3. Segmentation & access controls

Tenant‑aware data segregation; least‑privilege access; SSO/MFA options; role‑based permissions; logging and alerting; periodic reviews.

Employee confidentiality and security training; background checks where permitted.

4. Backups & disaster recovery

Encrypted backups with tested restorations; documented RTO/RPO objectives.

5. Vulnerability & change management

Regular vulnerability scanning/patching; secure software development lifecycle; change control and approvals.

6. Incident response & breach notification

We maintain a written incident‑response plan with 24/7 escalation. If a security breach compromises PI, we will notify affected customers and/or individuals without unreasonable delay under applicable law and contract.

7. Retention & deletion (defaults)

Retention may be shortened on request or extended for legal holds or active litigation.

Data type | Default retention
Account & billing records | 7 years
Audit & security logs | 24 months
Website analytics | Up to 26 months (then aggregate)
Intake text & documents | Matter life + up to 3 years (or earlier per law‑firm instruction)
Audio/video recordings | Matter life + up to 3 years (or earlier per law‑firm instruction)
Biometric identifiers/templates (if used) | Purpose satisfied or ≤ 3 years after last interaction, whichever is first; publicly posted schedule; no sale/profit.

8. Subprocessors

We use vetted subprocessors under written agreements requiring confidentiality, security, and deletion at end of services. We maintain a list of material subprocessors on request.

9. Data localization & transfers

Primary storage in the U.S.; cross‑border transfers (if any) use appropriate safeguards.

10. Contact

[email protected] | 12 Ericsson St., Suite 201 Boston, MA 02122