Answers you can cite.
Silence you can trust.

1. Contribute

   Attorneys, paralegals, and consultants submit documents through a branded portal. Uploads land in quarantine, are scanned, and have text, parties, experts, dates, and candidate PII extracted automatically.

2. Review gate

   Nothing becomes searchable firm-wide until a reviewer approves its classification and visibility tier. Near-duplicates are flagged; privileged material is structurally blocked from broader sharing — enforced in the schema, not by policy alone.

3. Ask

   Anyone asks in plain language — about an expert, a venue, a standard of care, a prior admission. Scoped to a matter, or across everything they're entitled to see.

4. Authorized retrieval

   The asker's grants — matter membership, role, visibility tiers, ethical walls — are joined into the retrieval query itself, inside the database, before search runs. Material the asker cannot open cannot be retrieved, summarized, or even influence the answer.

5. Cited answer — or “not found”

   Answers stream with inline citations that open the viewer at the exact page and passage. Citations are verified after synthesis; an answer without at least one verified citation is never shown as fact — it renders as “not found,” and feeds the firm's knowledge-gap analytics.

Authorization is not a filter applied to search results. It is the shape of the search itself — enforced in the database, verified continuously.

Authorization before retrieval

Effective access — matter membership, role grants, visibility tiers, minus ethical walls — is computed per user and joined inside the retrieval SQL, ahead of similarity ranking. Revoking access is effective on the very next query.

Tenant isolation

Every tenant's data is separated by database row-level security that the application role cannot bypass, keyed to the verified session and request domain. A session minted on one tenant's domain is rejected on another's and logged as a security event.

Ethical walls

Per-matter screens override every other grant, including reviewer roles. A walled user cannot retrieve walled material at any visibility tier — the platform answers them with “not found,” never with a redacted hint.

Privilege safeguards

Documents flagged privileged are hard-blocked from network sharing by a schema constraint, not just application code. Review gates keep drafts and work product out of firm-wide search until a human approves tier and classification.

Append-only audit

Logins, uploads, reviews, views, downloads, and queries are logged content-free to an audit trail that rejects edits and deletions at the database layer.

Hostile-input boundary

Ingested documents are treated as untrusted input. Extraction runs with structured output only; answer synthesis has no tools and cannot act on instructions embedded in documents.

Continuous verification

An automated permission-probe suite runs synthetic users against questions answerable only from material they are barred from — cross-tenant, cross-wall, cross-tier. Any leak fails the build before it ships.

Retrieval quality is scored against a citation-accuracy evaluation set: for every question, did verified citations point at the documents that actually support the answer? Every change to retrieval must move that scorecard. Weak matches are cut before synthesis, so an off-topic question produces an honest “not found” rather than confidently cited noise.

Expert intelligence

Experts are extracted at ingestion and resolved into living profiles: credentials, specialty, typical side, jurisdictions, challenge history, and every appearance across your corpus — each appearance linked to the underlying document, and visible only to users entitled to open it.

Knowledge-gap analytics

“Not found” is a signal. The platform clusters unanswered questions by topic, expert, and jurisdiction into a ranked list of what your organization keeps asking for but hasn't preserved — a preservation agenda, not a guess.

Contribution culture

Dashboards show which offices are building the asset and which are letting it walk out the door: submissions, review latency, matters closed with and without knowledge preservation.

Your brand, not ours

White-label to the ground: your domain, your colors, your terminology — “matters” for a firm, “claims files” for an insurer — applied per tenant at request time.

Inside the boundary

The platform deploys within an AWS environment: private networking, encryption in transit and at rest, per-tenant encryption keys for content. Model inference runs through Amazon Bedrock, so customer content is processed inside that boundary rather than sent to third-party model APIs.

No training on your content

Customer content is used to answer your users' questions. It is not used to train or fine-tune models, and it is never shared across tenants.

Health information

Built on HIPAA-eligible services, with a Business Associate Agreement available for engagements involving protected health information. Candidate PII and PHI are flagged at ingestion for human review. No software product is itself “HIPAA certified”; compliance is a shared program between the platform's safeguards and your own policies and workforce practices.

Retention & holds

Per-tenant retention policies, legal-hold flags that suspend deletion by matter, and logged, certificate-producing destruction.