Legal · Data Security

Data Security

Effective: 10 July 2026 · Open to read — no login required

Plain-English summary: Your brief goes only to the legal expert(s) you select — up to 3 if you want a second opinion. It sits on our servers only as long as needed to route it. Encrypted in transit and at rest. Deleted within 30 days. Never shared with anyone else.

The data journey when you send a brief

You paste or attach content

Content is transmitted over HTTPS (TLS 1.3) to our servers. Encrypted in transit.

Our AI search engine packages the brief

A structured summary is generated by Anthropic Claude Haiku. Only the brief content is sent for classification — no email, no name, no persistent identifier. Anthropic does not train on the data.

You approve the packaged brief

You see exactly what the expert will receive before it’s sent. You can edit any field.

You pick your expert(s)

The brief is transmitted only to the expert(s) you select — a single lawyer, or up to 3 if you want to compare opinions. No other expert sees it.

Delivered by email

Sent to the expert’s registered email address. Their reply is sent directly to yours.

Brief content deleted from our servers

Within 30 days. Only routing metadata (who sent it, when, replied) is retained — not the content itself.

Encryption

In transit: HTTPS (TLS 1.3) for all connections between your browser, our servers, and the expert’s email provider.
At rest: Supabase Postgres with AES-256 encryption at the database and storage layers.

Infrastructure

Hosting: Netlify (site & functions) — SOC 2 Type II certified.
Database: Supabase Postgres in EU-West — SOC 2 Type II certified.
Email: Resend — SOC 2 Type II certified. TLS enforced.
Edge / DNS: Cloudflare — ISO 27001 certified.
Routing brain: Anthropic API (Claude Haiku) — no training on submitted content.

Access controls

Only authenticated experts can access their own inbox and profile.
No expert can see another expert’s data.
ailetterbox staff access is restricted, logged, and used only for support incidents.
Service-role database keys are stored as encrypted secrets on Netlify/Cloudflare — never in source code.

Data retention

Brief content (the AI output): Deleted within 30 days of the brief being sent.
Brief metadata (sent, replied timestamps): 24 months.
Expert opinions: Retained while the expert’s account is active for audit and support purposes.
Personal data (emails, names): Deleted on request or on account closure.

What we don’t do

We do not sell your data.
We do not use your brief content to train AI models.
We do not share your brief with any expert other than the one you select.
We do not run advertising or analytics on your brief content.

Incident response

In the event of a personal-data breach we will notify affected users within 72 hours in line with UK GDPR requirements, and report to the Information Commissioner’s Office where required.

Contact

Security concerns: security@ailetterbox.com