Security
You are trusting this with privileged client files. Here is how that trust is handled, in plain terms.
Where your data lives
Client files live in an access-controlled database, encrypted in transit and at rest, hosted with established infrastructure providers in the United States: the database with Supabase in the AWS us-east-1 region, the application on Vercel. Uploaded documents sit in private storage in the same region, and every download link is signed and expires.
Backups
The database is backed up daily by the provider and each backup is kept for seven days, in the same region. Uploaded documents are not part of those backups, which is what lets a deletion be final.
Your firm's workspace
Every record carries your firm's identity, and every request re-checks it on the server. Everyone you seat in the workspace sees the firm's whole workload, and another firm cannot reach your files, your templates or your clients.
Your files are not training data
Client answers and documents are never used to train AI models, ours or anyone's. Drafting is a fill of your template with your client's answers and calls no model at all. Where the product does use a model (to match a template's blanks, read a deed, list the people a template names, review an instrument you upload, draft a provision you ask for, or answer a question in the help panel), the one provider we use, Anthropic, is under commercial terms that do not permit training on our traffic.
Draft discipline
Every draft PDF carries a DRAFT watermark, and so does every document in a client's review packet. Clean PDFs exist only after you finalize. The Word file of a draft, which you can download to edit, carries no watermark, so nothing your client sees looks final unless you made it final.
Sign-in
Sign-in runs through Clerk. Multi-factor authentication is not offered yet.
Client links
Questionnaire, review and signing links are single-purpose tokens, rate-limited, and an invalid link reveals no information. A questionnaire link expires after thirty days; a review link lives exactly as long as the matter's documents do. Your client sees their questionnaire and their documents, never your workspace.
Retention and deletion
Your firm chooses a retention period of 7, 30 or 90 days. The clock starts when you download a matter's final documents and confirm the copy is saved, a warning goes out before the purge, and then the documents, the questionnaire answers, the consultation notes and the deed are deleted. What stays is the record of what happened: the activity trail, the client's name and contact details, the matter, its dates and the second person's name, who signed and when, a fingerprint of each final document and the record of each archive downloaded, never the documents themselves. A matter with no confirmed saved copy is never purged. Canceling deletes nothing by itself: the workspace becomes read only, nothing is deleted until you resubscribe, and if you ask us to delete the workspace, we will.
Taking your files with you
Every matter exports as an archive of its final PDFs, and separately of its source files, with the signed engagement letter and any notarized documents in their own folders and a manifest naming every document. There is no single all-matters export yet, so leaving means exporting each matter.
Who at Clause Legal can see client data
Clause Legal staff can open a matter to resolve a support request from your firm, and for no other reason. Every change they make, every document they open or download and every certificate they read is logged in your workspace's activity trail with the staff member's identity, marked as Clause Legal support.
Audits and paperwork
We have not been through a SOC 2 audit. A data processing agreement is available on request, and we will answer a security questionnaire directly, including anything we have not built yet.
Questions we did not answer here? Ask us, and you will get a straight answer.