Enterprise-grade security. Privilege included.
Beyond industry best practices, we are bound by solicitor-client privilege and Bar requirements.
Privilege
Your exchanges with us are confidential and protected, as with any law firm.
Liability insurance
All our lawyers carry professional liability insurance.
Information walls
Your positions and terms are never used for another client. Only our method improves from one file to the next.
No training
Your data is never used to train AI models.
Infrastructure
The technical foundations that protect your documents.
Encryption
Documents encrypted in transit (TLS) and at rest (AES-256).
Key management
Access to encryption keys restricted to the strict minimum.
Protected network
Segmented network, firewalls and limited access to production systems.
Intrusion detection
Continuous monitoring for suspicious activity.
Logging
Centralized logs, retained and reviewed regularly.
Backups
Encrypted backups with tested restores.
Business continuity
Documented and tested disaster recovery plan.
Access
Only the right people see your files.
Multi-factor authentication
Required for all internal access.
Individual accounts
No shared accounts; every action is attributable.
Least privilege
Access limited to the people assigned to your file.
Access reviews
Periodic review of everyone's rights.
Offboarding
Immediate revocation of access when someone leaves.
Data & AI
AI works for you, not on your data.
No training
Your contracts are never used to train third-party AI models.
Vetted AI providers
Strict contractual terms on data retention.
Information walls
Every client and counterparty is walled off.
Retention
Defined retention periods and deletion on request.
Organization & compliance
Law-firm obligations, not just good intentions.
Privilege
Your exchanges are protected as in any law firm.
Law 25 and PIPEDA
Practices aligned with Quebec and Canadian law.
Training
Annual security training for the whole team.
Staff commitments
Confidentiality agreements and background checks.
Vendor management
Security assessment of every critical vendor.
Incident response
Documented procedure, prompt notice to affected clients.
Change management
Changes reviewed, tested and approved before deployment.