Encrypted vault
LiveDocuments stored in AWS Mumbai with server-side encryption, over TLS, scoped to your organisation.
- ✓Object storage in AWS ap-south-1 (Mumbai), server-side encrypted
- ✓TLS in transit
- ✓Virus scanning on every upload, including each member of a ZIP
- ✓Application-layer encryption for stored third-party credentials
What it is.
Documents go to object storage in the AWS Mumbai region (ap-south-1), written with server-side encryption using a managed key. Transport is TLS. Every read is scoped to your organisation — retrieval, search and the citation resolver all filter on your tenant and there is no shared-content bypass on your own documents.
Credentials we hold on your behalf — integration tokens and the like — are separately encrypted at the application layer before they reach the database, which is a different control from document storage and worth not conflating.
Three steps.
End to end.
Drag a file into your vault. It is virus-scanned, then written to storage.
Objects are written with server-side encryption under a managed key, in the AWS Mumbai region.
Retrieval is filtered to your organisation at the query, not at the presentation layer.
What you get.
- ✓Object storage in AWS ap-south-1 (Mumbai), server-side encrypted
- ✓TLS in transit
- ✓Virus scanning on every upload, including each member of a ZIP
- ✓Application-layer encryption for stored third-party credentials
- ✓Organisation-scoped retrieval with no cross-tenant path
Quick answers.
Object storage in AWS ap-south-1 (Mumbai) is the configured default. Sub-processor outbound — model inference and error monitoring — is set out in the DPA and the sub-processor list, which is published and generated from live configuration rather than maintained by hand.
We are not going to quote a retention window we cannot evidence. Our on-premise deployment chart ships a backup schedule with defined retention; for the hosted service, ask us directly and we will tell you where that stands rather than print a number here.
More in Contracts & Documents.
Per-document share links with an expiry, a view cap, granular permissions, and recipient-tagged watermarking.
Chain successive drafts of a contract together, and compare any two clause by clause.
Every upload is a document with a category — agreement, evidence, court order, correspondence, identity — and the category decides what runs. Nothing is analysed unless you ask.
A contracts dashboard where every figure states its basis, and a request desk where triage is decided by your rules, not a model.