Your client data is protected by design.

Data processing

LawKPIs processes customer data to provide the subscribed LawKPIs service, including connecting source systems, storing authorized data, producing intelligence and making it available to permitted users.

Read-only connections

LawKPIs reads data from your connected systems. It does not modify source records or write back to your systems.

• On-premise systems connect through a secured tunnel (Barracuda).
• Cloud systems connect via REST APIs.

Access governance at three levels

• Model level — which AI models a user can access.
• Group level — which content a user can access.
• Role level — feature access and database connection control.

Row-level and column-level restriction is available when you need it.

Application and network protection

CSRF and XSS filtering, with private-network firewalls.

• TLS encryption for all data in transit.
• Databases encrypted with AES-256.
• Secured Amazon S3 buckets for stored data.
• 2048-bit encryption using client-specific private-public key pairs.

Customer data is secured in a LawKPIs private network on AWS.

No model training by LawKPIs

LawKPIs does not train AI models on customer data.

NyxO insights

NyxO uses Anthropic models to generate AI insights. Anthropic’s current API data-use and privacy terms apply to that processing.

Connector requests

The Connector sends only the data the requesting user is already authorized to access, and only when the selected model requests it through a tool call. The Connector currently works with Claude, chosen by the user. Once data reaches that provider, the provider’s current data-use and privacy terms apply.

Retention and deletion

LawKPIs stores customer data only while the customer’s subscription is active. If a subscription is cancelled, LawKPIs deletes the customer data it controls on the final day of that subscription.

Backups and recovery

LawKPIs uses automated backups with point-in-time disaster recovery.

Specific backup frequency and retention periods, recovery time and recovery point targets, restoration guarantees, restoration-testing schedules, monitoring coverage, incident-response timelines and client-notification commitments are not published until each has been verified against the current production configuration and documented commitments.

Infrastructure monitoring

CPU and memory monitoring are configured for infrastructure monitoring.

LawKPIs hosts its application on AWS, using Amazon EC2 for application servers and Amazon RDS for database services.

A subprocessor is an outside company that processes data while helping LawKPIs provide the service. Optional Connector destinations are separated below because the user chooses them.