Security
Original documents never leave the attorney's workstation. SafeIdea's cloud services handle authentication, license verification, and usage metering. None of them touch client content. The breach that exposes confidential client information cannot happen, because the data was never in a place it could be breached.
What stays local
Region 01 · Local
Region 02 · SafeIdea cloud
None of those touch client content. SafeIdea's cloud services do not see prompts, documents, masked content, masking dictionaries, or session records.
Region 03 · Cloud AI provider
Only what the attorney approves.
The patent-pending Masking Engine detects and replaces confidential entities across 11 Entity Types before any content leaves the machine. The AI provider sees masked content, never originals.
Access
Access to SafeIdea requires authenticated credentials. Each license is a seat managed by the Firm Administrator, who assigns the email address that uses each seat. The Firm Administrator can reassign at any time. Reassignment automatically terminates the previous email's access.
One seat supports the assigned attorney's multiple personal computers. The standard pattern is an office machine and a home machine, both authenticated against the same seat. Each install is a data island; matter dictionaries, audited session records, and compliance receipts stay on the machine where the work was done. SafeIdea does not sync those artifacts across the attorney's machines, by design.
When an attorney leaves the firm, the Firm Administrator reassigns the seat. The departing attorney's local artifacts remain on their previous workstation and are subject to the firm's normal device-management policy. SafeIdea is not the mechanism by which firm property leaves with a departing employee; the firm's existing device controls are.
For solo practitioners, the attorney is the Firm Administrator. No additional setup.
Seat assignment
What crosses the wire
SafeIdea's cloud services for authentication, license verification, and usage metering use TLS 1.3 in transit. API keys are encrypted at rest with AES-256-GCM. Cryptographic keys live in the operating system keychain; they are never hardcoded into the application and never exported.
Client documents, prompts, and chat history never reach SafeIdea servers; the encryption detail applies to the metadata traffic that handles licensing and billing.
The masked prompt that travels from the attorney's machine to the chosen cloud AI provider travels over the AI provider's transport, on the attorney's existing account. SafeIdea does not interpose its own transport between the attorney and the provider; the masking happens before transmission and the transport is the provider's standard one.
This page will be updated as the SafeIdea security program matures and additional detail can be stated with confidence.
On SOC 2
SOC 2 audits an organization's controls over the customer data it handles. That is a meaningful answer for cloud SaaS vendors who hold customer data on their servers. SafeIdea is built so that the data that matters most never reaches SafeIdea in the first place. Original documents, real client names, deal terms, and case numbers stay on the attorney's machine.
SafeIdea's cloud services handle authentication, license verification, and usage metering. They use industry-standard encryption in transit. None of them touch client content. A SOC 2 audit of those services would document controls over the wrong layer for the confidentiality problem.
The load-bearing protection is in the inventory and access sections above. SafeIdea answers Rule 1.6 with architecture, not with audit.
Original documents stay on the attorney's machine. SafeIdea's cloud services handle authentication, license verification, and usage metering. The cloud AI provider sees only masked content. The architecture is built to make the security review short rather than long.
Charter Customer access by application for a limited time. 30-day money-back guarantee on admission. No seat minimums.
If your security review needs detail this page does not cover, contact us. We respond directly.