Security, confidentiality and privacy
Everything about how we protect your information and your clients'. Unlike generic AI services, your information never leaves your control.
Last updated: January 2026 | Document version: 1.0
Executive summary
Security commitment. Iurefficient is designed from its architecture up to protect the confidential information of professionals and their clients. Unlike generic AI services, your information never leaves your control.
Key security points
Your data is yours
Every document, conversation and analysis stays in your infrastructure.
No AI training
Your information is never used to train artificial intelligence models.
Isolation per case
Each case has its own isolated knowledge base. No mixing of information.
Full encryption
Encryption in transit (TLS 1.3) and at rest (AES-256) for all information.
Comparison with public AI services
Understand the difference between using ChatGPT or Claude.ai directly and Iurefficient
| Feature | ChatGPT / Claude.ai | Iurefficient |
|---|---|---|
| Data location | Third-party servers (USA) | Your private infrastructure |
| Training on your data | Possible (depends on settings) | Never, processing only |
| Knowledge base | General public knowledge | Only your documents (local RAG) |
| Data isolation | Shared among users | Isolated per case and client |
| Conversation retention | Per provider policy | Fully under your control |
| Audit and traceability | Limited | Complete, with detailed logs |
Data security
Encryption and protection
- In transit: TLS 1.3 with valid SSL certificates
- At rest: AES-256 for documents, database and backups
- File encryption (v4.5.0+): AES-256-GCM with unique derived keys per case
- Tokens and credentials: bcrypt-hashed passwords, short-lived JWT
- Encryption keys managed securely and separately
Access control
- Strong authentication: short-lived JWT, OAuth 2.0 support
- MFA available: optional multi-factor authentication
- Roles and permissions: granular system (Admin, Lawyer, Assistant, Read-only)
- Full audit: every action logged with timestamps
- Immutable logs for regulatory compliance
Backups and recovery
- Automatic backups every 6 hours
- 30-day retention (90 on the Enterprise plan)
- Encrypted, geographically distributed backups
- Monthly restore tests
- RTO under 4 hours; RPO under 6 hours
Monitoring and detection
- 24/7 infrastructure monitoring
- Anomaly detection with machine learning
- Automatic alerts on suspicious activity
- Annual penetration tests and a bug bounty program
Audit log. You can open the full log from Settings → Audit logs: every action in the system with precise timestamps.
Confidentiality and isolation
How we guarantee that each case's information stays completely separate.
🏢 Multi-tenant architecture
- Each organization has its own isolated instance
- Separate database per tenant
- Isolated document storage
- Independent search indexes
📁 Isolation per case
- Each case has its own RAG collection (knowledge base)
- The AI chat only accesses documents of the active case
- Technically impossible to "leak" between cases
- Granular permissions per case and user
Professional secrecy. The design respects attorney-client privilege: not even system administrators can access document contents without explicit, logged authorization.
Sharing documents securely
- 🔗 Temporary links with configurable expiration
- 🔑 Optional password protection
- 📊 A log of every access to the shared document
- ⏰ Instant revocation of access when needed
Privacy and artificial intelligence
When you use ChatGPT or Claude.ai directly, your conversations are sent to third-party servers and may be used to improve their models. Iurefficient works differently: your information is processed locally, and only processed queries are sent to the AI APIs, never full documents or sensitive data.
No external training
Your documents and conversations are NEVER used to train third-party AI models such as OpenAI, Google or Anthropic.
Isolated processing
Each AI query is processed in an isolated environment. Data is removed from memory immediately afterwards.
Private servers
All infrastructure runs on dedicated private servers, in line with applicable data protection regulations.
No retention
We do not store the content of your AI queries beyond the time needed to process them and show you the answer.
How does AI work in Iurefficient?
- Local indexing. Your documents are processed and stored in a vector database inside your infrastructure. Embeddings are generated locally or through APIs that retain no data.
- Local semantic search. When you ask a question, the system searches your knowledge base for the most relevant fragments. This search happens entirely on your server.
- AI query with limited context. Only the relevant fragments, with no client identifiers or direct sensitive data, are sent to the AI API together with your question.
- Answer with citations. The answer includes references [1], [2]… to the original documents so you can verify the source of every statement.
AI provider policies
- 🟢 OpenAI (API): "We do not train on your business data (data sent through the API)". Enterprise privacy policy
- 🟢 Anthropic (Claude API): "We do not train our models on customer API data". Privacy policy
- 🟢 OpenRouter: a router that honors the privacy policy of each underlying model. Policy
- 🟢 DeepSeek / Qwen: enterprise APIs with no-retention policies.
No-training guarantee. No AI provider used by Iurefficient trains its models on data sent through its enterprise APIs. This is a contractual guarantee from each provider.
Anti-hallucination system
- ✓ Answers based only on your documents, not on general knowledge
- ✓ Numbered citations [1], [2] that you can verify
- ✓ Confidence indicators (excellent, high, moderate, low)
- ✓ Alerts when there is not enough information to answer
- ✓ Automatic validation of answers to detect possible hallucinations
Technical infrastructure
Deployment options
On-premise
Installed on your own servers. Maximum control and compliance with internal security policies.
Private cloud
Deployed in your AWS, Azure or GCP account. Cloud benefits with full control.
Managed cloud
We run the infrastructure with guaranteed security and availability SLAs.
Layers of protection
- 🌐 CDN and WAF: Cloudflare Enterprise with DDoS protection, web application firewall and rate limiting
- 🔒 Load balancer with SSL: TLS 1.3 termination, automatically renewed certificates, HSTS enabled
- 🖥️ Application servers: isolated containers on Kubernetes, autoscaling, zero-downtime updates
- 🗄️ Database: MySQL/PostgreSQL with encryption at rest, real-time replicas, automatic backups
- 📁 File storage: object storage encrypted with AES-256-GCM, geographic redundancy, automatic versioning
Legal compliance
Professional secrecy
Iurefficient is designed to respect the professional secrecy obligations of lawyers, accountants and other professionals:
- ✓ Technical isolation that prevents unauthorized access to case files
- ✓ Encryption that protects information even from system administrators
- ✓ Audit logs to demonstrate compliance
- ✓ Confidentiality agreements with service providers
Your rights
ARCO+ rights (Access, Rectification, Cancellation, Opposition and Portability):
- 👁️ Access: you can request a copy of all your stored personal data.
- ✏️ Rectification: you can correct any inaccurate or incomplete personal data.
- 🗑️ Cancellation: you can request the deletion of your data when it is no longer needed.
- 🚫 Opposition: you can object to the processing of your data for specific purposes.
- 📦 Portability: you can request your data in a structured format to move it to another service.
How to exercise them? Contact your organization's administrator or send a request from Profile → Privacy. We respond within 20 business days.
Frequently asked questions
Can the AI make up information about my cases?
The system is designed to minimize that risk. The AI answers only from the documents in your case, not from general knowledge. Every answer includes verifiable citations and a confidence indicator, and if there is not enough information the system says so clearly.
Are my documents sent to external servers?
No. Your full documents never leave your infrastructure. Only small, decontextualized fragments are sent to the AI APIs when you ask a question. Those fragments contain no client identifiers or information that could link them to a specific case.
Can OpenAI or Anthropic see my data?
The enterprise APIs of these providers have strict no-retention and no-training policies. Data sent through the API is processed in real time and discarded immediately. It is neither stored nor used to improve their models, and this is guaranteed by contract.
Can I use Iurefficient for classified information?
For highly sensitive or classified information we recommend an on-premise deployment with local AI models (no connection to external APIs). This configuration is available for organizations with special security requirements.
What happens if there is a security breach?
We have an incident response protocol that includes automatic anomaly detection, immediate notification to those affected (within 72 hours, as GDPR requires), forensic analysis, remediation of vulnerabilities, and reporting to the authorities when required by law.
How can I verify that my data is safe?
You can review the audit logs at any time to see who accessed which information. We also offer independent security audits and compliance reports on request.
Are my files encrypted on the server?
Yes. Since version 4.5.0 every uploaded file is automatically encrypted with AES-256-GCM, the most secure encryption standard available. Highlights:
- Transparent encryption: files are encrypted on upload and decrypted on download automatically
- Per-case keys: each case uses a unique derived key (HKDF)
- GCM authentication: detects any tampering with the file
- Backward compatible: earlier files keep working normally
Even with physical access to the server, files would be completely unreadable without the master encryption key.
📧 More questions?
Our security team is available to answer any question about how we protect your information: [email protected]. See also the Privacy Notice.
To report vulnerabilities: [email protected]