Security and data protection

How your clients' data is protected in Avantwerk Legal AI, and how to reach us with a concern.

Your firm controls the case-record vault

The authoritative client file is stored in an encrypted vault controlled by your firm; the browser is a replaceable working surface, not the case-file store. Solo runs the vault service on the solicitor's computer. Practice and Enterprise use a firm-controlled host. Bennovate holds no authoritative matter database. Text needed for an AI step can transit Bennovate's managed broker or browser-BYOK relay after the privilege and pseudonymisation controls and is not stored there.

Current maturity. Solo is built and tested. Practice and Enterprise are built and tested but have not been installed and exercised on a first customer-selected host. Enterprise is currently single-node; active-passive failover and point-in-time recovery are not available.

BYOK key custody

The firm controls its provider key and revocation. A browser-originated BYOK request can forward that key through Bennovate's same-origin relay without storing it there; a customer-hosted vault route keeps the key on that host. The exact provider entity, order, region and contract depend on the firm's own account and configuration.

The privilege boundary is enforced

On the attended UK AI path, protected or unknown material triggers a per-request warning. The attending solicitor can explicitly override it for that request; if nobody answers or they decline, the request is refused. The recorded product decision does not establish client authority or decide whether privilege is waived. Other market routes can hard-block.

Prompt injection: what the product does, and what it does not

A document sent by an opponent or a client can contain text intended to read to an AI not as content but as an instruction: phrases such as "ignore your previous instructions", "TO THE AI:", or "reveal your system prompt". The material most likely to carry such an attempt is the material you did not produce: the other side's statement, a counter-party's contract, a client's upload from a third party. Solicitors processing those documents have, until recently, had no reason to know the risk existed.

The primary protection is delimiter wrapping. Every piece of untrusted text that reaches the model, client documents, transcripts, matter context, opposing-party correspondence, is enclosed in single-use markers generated fresh for each request in your browser. The markers carry a twelve-character random value created at the moment of the request; an attacker cannot know it in advance and cannot write text that appears to close the block early. Within the markers, an instruction in plain English states that everything enclosed is data to be analysed, not a command to obey. This wrapping runs at twelve call sites across the product: the scrutineer, evidence analysis, retrieval grounding, risk proposals, the review grid, intake fact-extraction, and the compliance playbook.

A detector also flags recognisable attempts. The product scans incoming text against twenty patterns across the five languages it serves, in both the familiar and the formal register: because a letter from opposing counsel is drafted formally. When a pattern is identified, you are told in three places: a banner above the chat composer as you type or paste; a flag on each affected document in the evidence list; and a notice in the client-update modal.

What the detector does not catch. The detector recognises crude, obvious attempts only. It is not a full classifier. A subtly phrased or novel attempt may pass undetected. The delimiter wrapping is the protection; the detector is an alert layer for the patterns it knows. A solicitor with reason to believe a document was constructed to manipulate an AI tool should treat it with the same adversarial caution applied to any document from the other side, and should consider obtaining and processing a verified copy through separate means before placing weight on AI analysis of it.

For the purposes of the SRA Code of Conduct, competent use of an AI tool includes understanding its limitations as well as its capabilities. Legal professional privilege attaches to the advice a solicitor gives and the work product they prepare; it does not prevent an opposing party from attempting to influence the analysis of documents submitted to a tool.

Dictation: transcription runs on your machine

Speech dictated into the product is converted to text by a model running inside your browser. There is no network call in the transcription path: your audio is not transmitted to any server, and the product has no speech-to-text sub-processor. The microphone is opened by the browser with your permission; the audio is held in memory and discarded once the text is produced.

The model file is fetched once, then cached. On first use, the product downloads the model file from a public model repository (huggingface.co) over ordinary HTTPS: 238 MB for the Standard model or 724 MB for the High Accuracy model. After that, dictation works with no internet connection. The audio itself is not part of that download; what downloads is the recognition software, not your speech. Clearing your browser's cached storage removes the model; it re-fetches on next use.

No account, no key, no third-party involvement in transcription. No API key, third-party account or subscription is required, and no per-minute or per-character charge is incurred. Because transcription runs entirely on the device, there is no sub-processor for speech-to-text purposes: a material distinction for any firm reviewing its controller-processor chain under UK GDPR Article 28. Where a solicitor dictates advice or correspondence covered by legal professional privilege, the product does not create any additional route by which that audio could reach an external party.

Read what was transcribed before using it. Automated transcription is an aid, not a final record. Accuracy varies with audio quality, microphone characteristics, technical vocabulary and speaker conditions; no accuracy figure is stated or warranted. For the purposes of the SRA Code of Conduct, competent use of an AI-assisted feature includes verifying its output before placing weight on it: the transcription should be read and corrected before the text enters any draft, note or client communication.

Provider use and retention depend on the active account

Bennovate does not use matter content to train models. The exact provider entity, retention, provider-use terms, processing region, DPA and onward-transfer safeguard depend on the current Bennovate account or the firm's BYOK order and configuration. They require current account and contract evidence before procurement reliance; this page does not claim zero retention.

Hosting and transfers

Bennovate's application and relay infrastructure is hosted in Germany. AI-provider processing and onward transfers depend on the active account, provider and configured region; “EU hosting” must not be read as a claim that every downstream processing operation is entirely within the EU.

Customer processors and Bennovate controller-side suppliers

A supplier is a Customer sub-processor only where it processes Customer personal data for Bennovate under the Customer's instructions. Account, contracting, billing, security-mail, analytics and office-service suppliers are generally used for Bennovate's own controller-side purposes and must not be presented as matter-data sub-processors. Enterprise BYOK AI providers are appointed directly by the firm. Exact entities, roles, executed DPAs and transfer mechanisms require current account and contract evidence.

Infrastructure providers (no customer personal data processed): Gitea (self-hosted source-code repository, our VPS), Let's Encrypt (TLS certificate authority), Cloudflare Inc. (DNS resolution only: traffic does not pass through Cloudflare). These are not sub-processors within the meaning of UK GDPR Art. 28.

Authenticated access and delegated assurance

Access is governed by the configured identity layer. Where customer OIDC is used, MFA assurance depends on the customer's identity-provider policy and the AMR/ACR claims actually enforced; a login alone is not proof that MFA ran. Administrative-console controls must be evidenced per service rather than described as universally mandatory.

What we do not yet claim

We do not currently hold ISO/IEC 27001 or SOC 2 certification. No external penetration test, independent security audit or certification audit has been completed, and there is no BSI booking or engagement. Any future timetable will be published only after an approved, evidenced plan exists.

Data protection and security channel

To exercise your rights as a data subject, report a security concern, or raise any data-protection question, contact us. legal@avantwerk.com