Encryption in transit and at rest
All connections to Ayansar are served over TLS 1.2 or higher. Data at rest is encrypted at the storage layer with keys managed by the platform.
Home/Security
Security
Privileged data - handled like privileged data.
A firm's matter file carries some of the most sensitive information its clients will ever hand over. Security at Ayansar is stated the way lawyers state their own compliance - specifically, and only where it is true.
Working posture
Stated as it is
No claim of a certification we don't currently hold. Progress toward external audits is described as progress.
What is stored, and for how long
Matter metadata, documents assembled or uploaded through Ayansar, time entries and invoices. Retention follows the firm's configured period; on account closure, data is deleted or exported according to the firm's election.
Access scope, least privilege
Access to a matter is scoped by role - a client on the portal never sees internal notes, a paralegal never sees data from unrelated matters. All access is logged.
Operating principles
Three principles that decide any close call.
- 01
Attorney-client privilege is a design constraint
Because privileged information passes through the product, Ayansar is designed so that firm data is used only to operate the firm's account - not aggregated across customers, not fed into training corpora, not sold.
- 02
No overclaiming on certifications
Compliance posture is stated as it is - not as it might be after a future audit. Where a certification is in progress, it is described as in progress, not asserted as complete.
- 03
Data lives where you'd expect
Storage regions are disclosed on request during procurement. There are no hidden third parties in the primary data path.
A note on training data
Firm data is not used to train shared models. Case metadata, documents and correspondence within an account remain scoped to that account, and are used only to operate the product for that firm.
Procurement
Need our security packet or DPA?
Reach us during procurement and we will share the current security packet, data-processing terms and hosting regions in writing.