The short version, for whoever signs off on vendors.
Ten facts about how Candor handles a firm’s data, a straight answer on certifications, and the documents behind them. The security page explains the design in depth.
What holds today
Encrypted, both ways
Data travels over TLS and is encrypted where it is stored.
The fact, not the content
Candor records that a screen ran and which kinds of details it flagged, never the screened text. Prompts and AI answers are not kept unless the firm turns on conversation history.
Nothing is rewritten
The record is append-only. A correction is a new entry that points to the original, and the chain of entries shows if anything was altered.
One firm, one record
Every record is scoped to the firm that owns it, so one firm’s entries never appear in another’s account.
Screening on the device
The confidentiality check runs in the browser. The text being screened is never uploaded.
Citations travel alone
To look up a case, only the bare citation string goes to CourtListener. Never the text around it, a client name or a matter name.
A click, not a watcher
The browser extension acts when someone asks it to. It never intercepts traffic, watches a session or records which sites people visit.
Walls from your own Clio
With matter walls on, each person sees only the matters their own Clio login can see. No connection means no matters.
Your firm’s AI account
Candor’s workspace runs on the model your firm connects, with its own key, stored encrypted and used only for the firm’s calls.
Hosted in the United States
The Candor software and its database run in the United States.
Certifications
Candor does not yet hold a SOC 2 report or an ISO 27001 certification. The first audit we plan is SOC 2 Type I; no date is set. Until then, we would rather say so plainly than imply otherwise, and we are glad to walk your IT or risk lead through the architecture.
The documents
Data Processing Agreement
How Candor processes the personal data in a firm’s record. Annex III lists the approved subprocessors, and firms get 30 days’ notice before one is added or replaced.
Where data goes
Each outside service Candor or its extension talks to, what is sent, and when.
Privacy
What the website and the software collect, how long it is kept, and how to have it deleted.
Terms
The Cloud Service Agreement a firm signs.
Security
The design choices behind the record, in more detail.
Security questions, or a vulnerability to report: jesse@candor.legal, or the contact page.