Only the data required to answer a query or run a computation is processed. Client PII inside uploaded documents is never used to train models.

Data is hosted in India. It is encrypted at rest and in transit, and access is restricted by role (RBAC) with MFA/SSO enforced for firm accounts.

Firms can request export or deletion of their data. Deletion requests are honoured subject to statutory retention requirements on audit logs.