Security & data handling
How DraftAria handles your documents.
Law firms need specifics, not slogans. This page says what is in place today. Where something isn't confirmed yet, we say so.
Data use and AI
Aria's features run on Anthropic's Claude models through Anthropic's API. When you use an Aria feature — generating a template, analyzing a document, or chatting — the text you submit (and, for the AI workspace, files you upload) is sent to the model to produce the answer.
Requests to the model are made only from DraftAria's servers. Your browser never holds an AI key, and AI features require you to be signed in and a member of a firm.
Filing checks against court rules ("Ready to File") are rule-based and do not send your document to an AI model.
TODO: state whether customer documents are used to train AI models — confirm DraftAria's own policy and the training and data-use terms of the Anthropic plan in use, then publish both.TODO: confirm whether zero-data-retention (or another retention arrangement) applies to API requests on the Anthropic plan in use.Retention and deletion
Documents you create, their version history, analyses, AI workspace messages and uploaded files are stored in your firm's workspace so you can return to them. They are kept until they are deleted.
TODO: publish the retention period for documents, AI conversations, uploaded files and audit logs (no automatic deletion schedule is configured today).TODO: describe how a firm requests deletion or export of its data, who handles it and how quickly, and how long backups persist.Encryption
In transit: the site and its API are served over HTTPS (TLS).
TODO: confirm and state encryption at rest for the database and file storage, with the provider documentation it relies on.Hosting location
The website is hosted on Vercel. Application data, sign-in and file storage use Supabase.
TODO: state the data region of the Supabase project and Vercel deployment (e.g. US East), and where Anthropic processes API requests.Access controls and audit log
Firm isolation. Each firm's data is separated in the database using row-level security, so members of one firm cannot read another firm's documents.
Roles. Users have a role within their firm — attorney, paralegal or firm admin. Firm admins manage invitations and members. The shared court catalog can only be changed by DraftAria platform administrators.
Rate limits. AI features are rate-limited per user to prevent abuse.
Audit log. Firm admins can view their firm's audit log. Today it records team invitations; broader coverage (sign-ins, document changes, exports) is on the roadmap.
Not yet available: single sign-on (SAML / Azure AD / Okta) and multi-factor authentication.
TODO: state SOC 2 / ISO 27001 status accurately (no audit is complete today) and the expected timeline, if any.