Client, claimant, and veteran documents; C-files; medical records; communications; attorney notes; and AI-assisted case work are restricted case data.
Operating principles
- Use least-privilege access for firm members.
- Keep sensitive case data out of analytics, logs, screenshots, and unsupported tools.
- Use private storage and short-lived authorized access for documents.
- Review AI-assisted output before using it in attorney work product.
- Preserve audit trails for sensitive actions.
- Do not sell, license, broker, or monetize client data, claimant data, veteran data, VA API-derived data, case records, or customer case materials.
Service responsibilities
The service includes the software, hosting, storage, security controls, AI-assisted case features, support workflows, and vendor paths used to operate the product.
Safeguards include tenant isolation, access controls, private document storage, short-lived authorized file access, audit logging, safe analytics, vendor review, and server-side handling of sensitive credentials.
Sensitive AI and OCR workflows run only through provider paths approved for the data being processed. Customer case data is not used to train third-party large language models.
Firm responsibilities
Firms remain responsible for who they invite, what access they grant, what data they submit, and whether their own professional, client-notice, consent, privilege, retention, veteran-record, bar-rule, and vendor-review obligations are satisfied.
Before processing sensitive production data at scale, confirm that the firm has approved Pete for that data class and that any required data processing addendum, data protection agreement, client notice, communication consent, or vendor review is complete.
Vendor boundaries
Specialized vendors support hosting, database, storage, AI, email, SMS, telephony, billing, and analytics. Sensitive-data workflows run only through vendor paths approved for the firm’s data and compliance requirements.
Public trust documentation describes current operating boundaries. It is not a security certification, legal opinion, or substitute for the firm’s own vendor review.
Support and incident boundaries
Support requests should describe the affected surface, time, browser or device, and visible error. Do not include client names, veteran names, government identifiers, medical facts, document contents, claim strategy, or privileged notes unless the support channel has been approved for that data.
Status and incident updates describe affected services, user-visible impact, mitigation, and next update timing. They do not include sensitive case facts.
Public policies
Last modified on August 9, 2026
