Privacy Policy

2.1 Account Information

• Name and email address
• Professional role (attorney, paralegal, partner, staff)
• Bar number (if provided)
• Phone number (if provided)
• Firm affiliation
• Payment information (processed through Stripe -- we do not store card details)

2.2 Usage Information

• AI research queries and conversations
• Documents uploaded for analysis
• Web search queries submitted through the platform (general legal research terms only)
• Technical data: IP addresses, browser type and version, user agent, request timestamps
• Authentication events: login attempts (successful and failed), session activity

2.3 Document Data

• Documents you upload (PDF, DOCX, DOC, TXT, RTF -- 50 MB maximum)
• Extracted text content from uploaded documents
• File metadata: filename, file size, MIME type, upload date, page count, word count
• SHA-256 file integrity hashes
• Vector embeddings generated from document content for search and retrieval
• AI-generated analysis and research results

2.4 Marketing Site Analytics

Our marketing website (atticus-ai.com) uses Vercel Analytics to collect page view and basic interaction metrics. This data is aggregated and does not track individual users across sessions. Vercel Analytics does not use third-party cookies. The application itself (app.atticus-ai.com) does not use analytics tracking.

4.1 Service Providers

• Amazon Web Services (AWS): Cloud infrastructure for compute, database, storage, and AI inference. All data resides in US-East-1 (N. Virginia). We maintain a signed Business Associate Agreement with AWS covering EC2, RDS, S3, Bedrock, and CloudTrail.
• AWS Bedrock (Anthropic Claude): AI model inference for legal research and document analysis. Your document content and queries are sent to Claude for processing via TLS. AWS does not retain your data after processing and does not use it to train models. Covered under our AWS BAA.
• Stripe: Payment processing for subscriptions. Stripe receives your billing name, email, and payment method. Stripe is PCI-DSS Level 1 compliant. Stripe has no access to your legal documents, conversations, or case data.
• Exa AI: Web search for general legal research. Only search query terms are transmitted -- never confidential client information, document content, or personal data. The platform runs automated PII detection on queries before transmission and blocks queries containing personal information. This service is not covered by a BAA.
• Vercel: Hosts the marketing website and collects aggregated page view analytics on the marketing site only. No application data, documents, or conversations are accessible to Vercel.

4.2 Legal Requirements

We may disclose information when required by law:

• Court orders and subpoenas
• Regulatory investigations
• Law enforcement requests with proper legal authority

4.3 Firm-Level Data Isolation

Every database query in the platform is scoped to your firm. There is no mechanism for cross-tenant data access. Your documents, conversations, and account data are completely isolated from other firms and users on the platform.

5.1 Encryption

• In transit: TLS 1.2 or higher with ECDHE-RSA-AES256-GCM-SHA512 cipher suites. HSTS enforced with one-year max-age.
• At rest (storage): Documents are encrypted client-side with Fernet symmetric encryption (PBKDF2-SHA256, 100,000 iterations) before upload, then encrypted server-side with AES-256 on AWS S3.
• At rest (database): AWS RDS encryption with AES-256 (AWS-managed keys).
• Passwords: Hashed with bcrypt. We never store plaintext passwords.
• Sessions: JWT tokens signed with HS256 and stored in HttpOnly, Secure, SameSite=Lax cookies.

5.2 Access Controls

• Role-based access control (RBAC) with firm-level data isolation enforced at the database query level
• Account lockout after 5 failed login attempts (30-minute lock duration)
• Session timeout: 30-minute inactivity threshold, 8-hour absolute maximum
• Rate limiting: 10 requests/second for API calls, 2 requests/second for file uploads, 3 requests/minute for registration

5.3 Infrastructure

• AWS data centers in US-East-1 (N. Virginia) with SOC 2 Type II and ISO 27001 certifications
• Isolated Docker network -- database and cache have no public internet access
• SQL injection and XSS pattern detection via security middleware
• File validation: type whitelist, MIME verification, malware scanning, 50 MB size limit
• S3 bucket versioning and access logging enabled for audit trail integrity

5.4 AI Data Handling

Your data is never used to train or improve AI models. When you submit a query or document for analysis, the content is sent to AWS Bedrock (Anthropic Claude) via TLS for processing. AWS Bedrock does not retain your data after generating a response. This is covered under our Business Associate Agreement with AWS.

5.5 Caching Policy

We use Redis for rate limiting and caching non-sensitive data (user profiles, subscription status, conversation ownership). Document content, chat messages, AI analysis results, client details, and legal document content are never cached.

6.1 Retention Periods

• Audit logs: 7 years (2,555 days) as required by HIPAA
• Documents: Retained until you delete them, or 7 years after account closure for legal compliance
• Conversations and messages: Retained until you delete them, or upon account deletion
• Deletion records: Retained permanently as CCPA compliance proof
• Payment records: 7 years for tax compliance (managed by Stripe)
• Temporary files: Automatically deleted after 24 hours
• Inactive accounts: Soft-deactivated after 180 days of inactivity (data preserved, access suspended)

6.2 Your Control

• Delete individual conversations and documents through the platform at any time
• Request full account deletion: email support@atticus-ai.com
• Request data export: email support@atticus-ai.com

6.3 Account Deletion Process

When you request account deletion, we verify your identity via password confirmation, then:

• Delete all your documents from storage (S3 and database)
• Delete all conversations and chat messages
• Anonymize your personal information (email, name, phone, bar number)
• Deactivate the account
• Create an immutable deletion log for compliance proof

Audit logs are retained for the legally required 7-year period after deletion, with a documented compliance justification. Deletion records are retained permanently as CCPA compliance proof.

We respond to all privacy requests within 45 days.

7.1 All Users

• Access and review your personal data
• Correct inaccurate information
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications

7.2 California Residents (CCPA/CPRA)

California residents have additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected (twice per 12 months)
• Right to Delete: Request deletion, subject to legal retention requirements (HIPAA audit logs, CCPA compliance records)
• Right to Correct: Request correction of inaccurate personal information
• Right to Non-Discrimination: We will not penalize you for exercising your privacy rights

7.3 Other State Privacy Rights

Residents of Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with privacy laws have similar rights. Contact support@atticus-ai.com to exercise your rights.