Security for legal and financial professionals

Joint controller under GDPR Art. 26 for the matters you bring onto the platform. We co-determine purposes for the platform-managed parts of the workflow (audit logging, retention floors, security controls); you remain the controller for client-instructed processing. Roles, decision rights, and the data-subject contact points are set out in the Data Processing Agreement.

AI work runs on infrastructure we operate ourselves rather than a commercial AI provider, and there is no automatic fallback to one. Content delivery and object storage run on a commercial edge and object-storage provider with EU buckets available, and our community forum is hosted in Germany.

Only the sub-processors on our published list, which names each one, its purpose and its location. Accounting and mail accounts a practice connects itself (Xero, Outlook mail or Gmail) are not on that list, because they are the practice’s own suppliers under its own terms. We ask them for read-only access and send them none of your client data.

Yes. Ask for the Data Processing Agreement when you apply, and raise any changes your practice needs before you onboard.

In October 2024 the UK’s Competition and Markets Authority asked will-writing providers for clear pricing, cancellation and complaints routes, and warned against providers appointing themselves. Your fees, cancellation terms and complaints route sit on your public profile, and the platform never names itself or us as executor or trustee in a will it generates.

You export your client data (matter records, will drafts, audit trails) in standard formats. We keep regulatory minima (audit logs for the legally required retention period) and delete the rest.