Security, confidentiality and privilege # Security and confidentiality by design > Data stored in the EU, encrypted and never used for training, per-user permissions, a DPA, confidentiality and attorney-client privilege. Your firm's database and files are stored in the European Union today, encrypted, never used to train AI and visible only to the people your firm authorizes. US data hosting for US firms is in preparation. [Become a founding firm](https://amaralegal.ai/en-us/founding-firms/) [Try it free for 30 days](https://app.amaralegal.ai/login) - Available in the US today - Data stored in the EU - Never used for training - The attorney always decides **Is it safe to use AI with client data?** It depends on the tool. With Amara, your firm’s database and files are stored in the European Union today, encrypted, never used to train AI, covered by a data processing agreement, and each attorney only sees what the firm allows. US data hosting for US firms is in preparation. 01 ## Where your data lives **Where Amara stores data** | What | Where | | --- | --- | | Database and files: matters, documents, notes and Amara’s memory | Amazon Web Services, Paris (France) | | Automations | Own server, Nuremberg (Germany) | | Document reading | Mistral AI, France | | Website and email | Madrid (Spain) | To generate answers, Amara uses OpenAI and Anthropic models through their business services: they receive only the information needed for each task and do not use it to train models. US data hosting for US firms: in preparation. [List of sub-processors (in Spanish)](https://amaralegal.ai/legal/subencargados/). 02 ## Security controls - **Individual accounts:** email and password or Google sign-in. No shared users. - **Permissions by firm, team and user**, enforced on the server, not just on screen. - **Firms isolated from each other.** In a network, each firm shares only what it decides to share. - **Encryption in transit** (HTTPS enforced) and **encryption of the database**. - **Automatic security scan** before each new version of the app is published. - **Protected infrastructure** behind Cloudflare’s network against denial-of-service attacks. - **Pseudonymization and anonymization** of documents before adding them to the library. 03 ## Data processing agreement, confidentiality and attorney-client privilege Amara acts as processor and service provider under a data processing agreement, and the firm keeps control of its data. Today, the firm’s database and files are stored in the European Union; US data hosting for US firms is in preparation. Confidentiality and attorney-client privilege are the starting point: Amara prepares and proposes, the attorney reviews, signs and decides, and no firm data is used to train models. [ABA Formal Opinion 512](https://www.americanbar.org) (July 2024) reminds attorneys that using generative AI does not change their duties of competence, confidentiality, communication with clients, supervision, candor toward the tribunal and reasonable fees; each state applies its own rules. ISO/IEC 27001 certification is in progress and we do not present it as obtained. 04 ## Does Amara use client data to train AI? No. The firm’s matters, documents and notes are not used to train models, by Amara or by the providers whose models it uses. OpenAI and Anthropic are used through their business services: they receive only the information needed for each task and do not use it for training. Today the firm’s database and files are stored in the EU. 05 ## Who can see a matter inside the firm? Only the people the firm allows. Each attorney has their own account, with no shared users, and the firm decides who sees each matter. Permissions are set by firm, team and user and are enforced on the server, so a matter hidden from a user is not simply hidden on screen: it is not served to that account. 06 ## Pseudonymization or anonymization: which one do you need? **Two ways to handle personal data before adding a document to the library** | Option | What happens | | --- | --- | | Pseudonymization | Names and identifying details are replaced with codes, and only whoever holds the key can re-identify the people | | Anonymization | Identifying details are removed irreversibly and no one can re-identify the people | Before adding or sharing a document in the library, you choose which one to apply. Before pasting a document into a general-purpose AI, anonymize the client’s data to protect confidentiality and attorney-client privilege; our free tools help you do it. [Free tools](https://amaralegal.ai/en-us/tools/). 07 ## A checklist before using AI with client data Questions to answer before client information goes into any AI tool. They follow the duties that ABA Formal Opinion 512 lists for generative AI (competence, confidentiality, communication with clients, supervision, candor toward the tribunal and reasonable fees) and the rules adopted in your state. 1. **Where is the data stored?** In Amara: the EU (AWS Paris) today; US data hosting for US firms is in preparation. 2. **Is it used to train models?** In Amara: no. 3. **Is there a data processing agreement?** In Amara: yes; Amara acts as processor and service provider and the firm keeps control of its data. 4. **Who in the firm can see each matter?** In Amara: only the users the firm allows, with permissions enforced on the server. 5. **Can you check every citation before it reaches a court?** Amara shows verifiable references so you can open each one; the duty of candor toward the tribunal stays with the attorney. 6. **Who supervises the work?** Always the attorney. Amara Work prepares complete pieces of work under the attorney’s supervision; the attorney reviews, signs and decides. 7. **What should the client know?** Consider your duty of communication with clients and the rules adopted in your state. 8. **Does the document need personal data at all?** If not, pseudonymize or anonymize it first. 08 ## Report a security issue If you find a vulnerability, write to [seguridad@amaralegal.ai](mailto:seguridad@amaralegal.ai) with a description, the steps to reproduce it and the affected URL. We reply in writing. See also our [security.txt](https://amaralegal.ai/.well-known/security.txt). FAQ ## Security and confidentiality questions **Where is my firm’s data stored?** Today, the database and files (matters, documents, notes and Amara’s memory) are stored with Amazon Web Services in Paris, France. Automations run on our own server in Nuremberg, Germany. **Will US firms be able to keep their data in the US?** US data hosting for US firms is in preparation. Until it is available, the firm’s database and files are stored, encrypted, in the European Union. **Is the data encrypted?** Yes. Traffic is encrypted in transit with HTTPS enforced, and the database is encrypted. **Is Amara ISO/IEC 27001 certified?** Not yet. ISO/IEC 27001 certification is in progress and we do not present it as obtained. **Does using Amara affect attorney-client privilege?** Amara is designed to support confidentiality and attorney-client privilege: no training on firm data, individual accounts and a data processing agreement. How privilege applies to each matter remains the attorney’s judgment. **Does Amara help me comply with ABA Formal Opinion 512?** Amara is built so the attorney keeps the duties of competence, confidentiality and supervision. Compliance with professional duties remains the attorney’s responsibility under the rules adopted in each state. ## Bring legal AI into the way your firm already works Join our founding firms in the US and follow the arrival of the US legal corpus from the inside. [Become a founding firm](https://amaralegal.ai/en-us/founding-firms/) [Try it free for 30 days](https://app.amaralegal.ai/login) --- Página original: https://amaralegal.ai/en-us/security/ Índice del sitio para agentes de IA: https://amaralegal.ai/llms.txt