Security, confidentiality and privacy
What Iurefficient does to protect your information and your clients', stated precisely: what it does, how it does it and what you decide.
Last updated: October 2026 · Iurefficient 4.104
Summary
Your case file, wherever you decide. Iurefficient runs in our cloud or installed on your organization's infrastructure. Either way, each organization has its own instance, files are encrypted with a per-matter key, and the AI answers with citations you can verify.
Key points
One instance per organization
Your organization runs on its own instance, with its files, search indexes and data kept separate from other customers'.
Files encrypted per matter
Every file is encrypted with AES-256-GCM on upload, with a different key for each matter.
The AI doesn't train on your data
We use AI providers' enterprise APIs, which don't train their models on what they receive. Or a local model, if you prefer.
Verifiable answers
Every answer comes with numbered citations to its documents, a confidence indicator, and a notice when the case file isn't enough to answer.
Compared with public AI services
Understand the difference between using ChatGPT or Claude.ai directly and using Iurefficient
| Feature | ChatGPT / Claude.ai | Iurefficient |
|---|---|---|
| What the AI reads | Whatever you paste into the conversation | The matter's documents, with permissions |
| Training on your data | Depends on the plan and settings | No: enterprise APIs or a local model |
| Answers | No source | With numbered citations to document and passage |
| Who sees the information | Each user on their own | Your organization's roles and permissions, per matter |
| Record of what's done | Audit log with user, date and IP | |
| Where it runs | Provider's servers | Our cloud or your infrastructure |
Data security
Encryption
- In transit: TLS 1.2 and 1.3, with HSTS.
- Files: AES-256-GCM on upload, with a derived key for each matter. They're decrypted automatically on download; any tampering with the file is detected.
- Passwords: stored with bcrypt, never in plain text.
Access
- Short sessions: sessions expire after one hour and renew automatically while you work.
- Two-step verification (2FA) with an authenticator app, optional per user, plus lockout after failed attempts.
- Sign in with Google or Microsoft, if your organization enables it.
- Roles and permissions: built-in Administrator, Collaborator and Assistant roles, plus custom roles with permissions by resource and action. Each person sees the matters they're part of.
Audit log
Key actions are logged with user, date and time, IP and device. Administrators can view it from the user menu → Audit logs.
Confidentiality and isolation
🏢 One instance per organization
- Its own containers, files and search indexes.
- Its own database or schema, separate from other customers'.
📁 Each matter, its own index
- Each matter's documents are indexed separately.
- A matter's chat answers only from that matter's documents. The general chat searches only the matters the user has access to.
🔗 Sharing and signing with third parties
- Share links with a password, expiration (1 to 365 days), an optional access limit, a log of every access and instant revocation.
- E-signature by link: the signer doesn't need an account; they verify their identity with a one-time key or an email code, and sign the document exactly as it was when sent.
- Client portal for sharing matters and documents without back-and-forth emails.
Attorney-client privilege. Your organization's administrators can see all of its matters; the rest of the team sees only their own. If your practice requires that no one outside your organization have technical access to the information, install Iurefficient on your own infrastructure.
Privacy and artificial intelligence
To answer questions about a case file, the AI needs to read passages from it. Here's what happens to them.
No training
We use the enterprise APIs of OpenAI, Anthropic, Google and others, whose policies exclude training on the data they receive.
Only what's needed
The full case file is never sent: only the passages relevant to your question.
Your own model, if you prefer
Iurefficient connects to a local model (Ollama, vLLM or another compatible one) so nothing leaves your infrastructure.
Verifiable citations
Every statement points to its document; if the case file isn't enough to answer, the AI says so.
How does AI in Iurefficient work?
- Indexing. When you upload a document, its text is extracted (including from photos and scanned PDFs) and split into passages. Each passage is turned into a vector by an embeddings service and stored in the matter's index, inside your instance.
- Search. When you ask a question, Iurefficient searches the index for the most relevant passages, combining semantic and keyword search.
- Answer. Those passages and your question are sent to the configured AI model. The passages may contain matter data, such as the parties' names.
- Verification. The answer comes with numbered citations and a confidence indicator (excellent, high, moderate or low). Iurefficient checks that each citation matches a real passage.
If your organization can't send information to third parties, indexing and answers can run on local models on your infrastructure.
Where it runs
Two ways to use Iurefficient
On your infrastructure
It's installed on your servers or your private cloud and run by your IT team. Information never leaves your organization, especially when combined with a local AI model.
In our cloud
We operate your instance on Google Cloud (data center in the United States), with HTTPS access and managed updates.
Practices
Your rights (ARCO)
Mexico's Federal Data Protection Law (LFPDPPP) gives you the right to access your personal data, correct it, cancel it or object to its processing (ARCO rights). Write to [email protected]; the procedure and timelines are in the Privacy Notice.
If your organization uses Iurefficient to handle its own clients' data, your organization is the data controller and we process that data on its behalf. You can export your documents at any time.
Frequently asked questions
Can the AI make up information about my cases?
It answers from the documents in the matter, cites every statement and tells you when the file is not enough to answer. It is still an assistant: check the citations before using an answer in a filing.
Are my documents sent to external servers?
In our cloud, your instance runs on Google Cloud. To answer a question, the relevant excerpts are sent to the configured AI provider. If nothing may leave your organization, install Iurefficient on your own infrastructure with a local model.
Can OpenAI or Anthropic train on my data?
No. We use their enterprise APIs, whose policies exclude training on the data they receive. Each provider keeps data for a limited time according to its policy.
Can I use Iurefficient for highly sensitive information?
Yes, with an installation on your own infrastructure and a local AI model, so neither documents nor excerpts leave your network.
What happens if there is a security breach?
If a breach significantly affects your rights, we notify you immediately, as Mexican data protection law requires: what happened, which data were affected and what we did about it.
How do I know who viewed or changed something?
Administrators can review the audit log, with user, action, date, IP and device. Shared links also keep their own access log.
Are my files encrypted?
Yes. Each file is encrypted with AES-256-GCM on upload, with a key derived for its matter, and decrypted only when downloaded.
📧 Have more questions?
Write to us at [email protected]. If your IT team needs a security questionnaire or a technical review, we'll work through it with them. See also our Privacy Notice.
To report vulnerabilities: [email protected]
Shall we review it with your IT team?
We'll show you the instance, the audit log and the AI configuration, and answer your security questionnaire.