Trustworthy by construction.
A record is only as good as its integrity. Here are the design choices that keep Candor's record trustworthy, written plainly and without vague reassurance.
The design choices
Screening stays on your device
The confidentiality pre-check runs in your browser. The text you screen is not uploaded, not logged, and not stored by Candor. We keep only that a check happened and which categories of sensitive data it found, never the content itself.
Your model, your key
Candor runs on your firm’s own AI account. The key is stored encrypted and used only for your calls. Prompts are screened before they are sent, Candor keeps the fact of each use and not its content, and your data never trains a model.
The record is yours to take
Export everything at any time, without asking. A sealed export restores exactly; a readable one can be checked by hand years from now with no software of ours.
Your case management stays yours
Candor reads your Clio or MyCase matter list when it needs it and never copies your client list. Tokens are encrypted and your firm can revoke them at any time. The one optional write, off by default, adds a note on the Clio matter recording the fact of a use, never a prompt or an answer.
Sign offs say who, provably
Where a firm signs in through its own identity provider, the person recorded on an entry is the person the session proved, not a name typed into a box. If somebody enters a sign off on a partner's behalf, the record shows that too.
We store the fact, not the file
By default Candor records actions, not their contents: a use was logged, a review happened, a check ran. Retaining any underlying content is an explicit choice a firm turns on, never a silent default.
Append only, and provably so
Logs and sign offs are never edited in place. Corrections are new entries that reference the ones before them, and the entries are hash chained: each is sealed with a fingerprint of the one prior, so any edit, deletion, or reordering is detectable. A one click integrity check rechecks the whole record.
Matter walls, from your own system
Turn on matter walls and each person sees only the matters their own Clio login can see. Access comes from your practice management system, not a second permission list kept in Candor, and it fails closed: no connection, no matters. Admins see everything.
Each firm is walled off
Every record is scoped to the firm that owns it. The design goal is that no bug could let one firm's data surface in another's account.
Encrypted in transit and at rest
Data moves over TLS and is encrypted where it's stored. Access follows least privilege: code and people get only what a task requires.
Honest about what we are
Candor is software, not counsel. It doesn't provide legal advice, decide whether you're compliant, or guarantee that any AI output is accurate. It gives your attorneys the record they use to make those calls.
Where we are
We complete a security review before any firm’s real client data is onboarded, and we’re glad to walk your IT or risk lead through the architecture. Questions: jesse@candor.legal. The trust page has the short version and where we stand on certifications, and where data goes lists the outside services the software and its extension send anything to.
Security, in plain terms
How is the record tamper-evident?
Every entry carries a cryptographic fingerprint of the entry before it. Change one line, by editing, deleting, or reordering, and the chain no longer verifies. A one-click integrity check rechecks the whole record.
Can Candor read our client data?
The confidentiality screen runs on your device, and by default Candor records that an action happened, not its contents. Retaining underlying content is a choice a firm turns on, never a silent default.
Can we get our data out?
Any firm can export everything Candor holds for it, at any time. A sealed export restores exactly with the hash chain intact; a readable export can be opened and verified by hand years from now with no software of ours.
A record even we can't rewrite.
Per-firm isolation
No cross-tenant path, even via a bug.
Append-only
Hash-chained, so any edit is detectable.
Your own model
Your key, encrypted. Content is never stored.