Security
Your matter data never has to leave your building
The question that stops most legal AI procurements is where the data goes. With MY Legal Desktop the answer can be: nowhere.
Runs on your infrastructure
The platform uses locally hosted language models. Using the product does not require sending matter data to any external model provider — which is what usually makes legal AI impossible to approve.
A database per firm
Tenant isolation is structural rather than a tenant identifier on a shared table. One organisation’s matters sit in a different database from another’s, so a query cannot accidentally cross the boundary.
Identity on every request
Authentication is handled by Keycloak. The resulting token is validated on each individual request, and role and tenancy are read from that token rather than from anything the client sends.
Access control
Roles are defined at the identity layer, not in the interface, so a user cannot see data by navigating to a different URL.
- Individual users see only their own matters.
- Junior advocates see only the matters they are assigned to.
- Senior advocates and firm administrators see every matter in the firm.
A user’s firm is carried as a claim on their token, and the platform routes every database operation using that claim. There is no code path in which a request is served from a tenancy the token does not name.
Data retention
Retention periods are configured per deployment. Where source material is not needed once it has been processed, it is not retained — a government department and a private firm can each hold data for exactly the period their own rules require, rather than for whatever period a vendor decided.
In transit
All traffic is served over HTTPS. This marketing site additionally sends HSTS, so a browser that has visited once will refuse to connect over plain HTTP thereafter.
Questions we expect from procurement
If you are evaluating this for a department or a firm and need to see deployment architecture, data-flow diagrams, or answers to a specific security questionnaire, ask. We would rather work through your questionnaire properly than publish a page of badges.
Send us your security questionnaire
We will complete it and tell you plainly where we do and do not yet meet a requirement.