Security and confidentiality by design

To generate answers, Amara uses OpenAI and Anthropic models through their business services: they receive only the information needed for each task and do not use it to train models. List of sub-processors (in Spanish).

• Individual accounts: email and password or Google sign-in. No shared users.
• Permissions by firm, team and user, enforced on the server, not just on screen.
• Firms isolated from each other. In a network, each firm shares only what it decides to share.
• Encryption in transit (HTTPS enforced) and encryption of the database.
• Automatic security scan before each new version of the app is published.
• Protected infrastructure behind Cloudflare’s network against denial-of-service attacks.
• Pseudonymisation and anonymisation of documents before adding them to the library.

For UK firms, the UK GDPR and the Data Protection Act 2018 apply, supervised by the ICO. The UK recognises the EU/EEA as providing an adequate level of protection, so storing data in France does not require additional transfer mechanisms. Amara acts as processor and the firm as controller.

Client confidentiality is the starting point: Amara prepares and proposes, the lawyer reviews and decides, and no firm data is used to train models. ISO/IEC 27001 certification is in progress and we do not present it as obtained.

No. The firm’s matters, documents and notes are not used to train models, by Amara or by the providers whose models it uses. OpenAI and Anthropic are used through their business services: they receive only the information needed for each task and do not use it for training. The firm’s database and files stay in the EU.

Only the people the firm allows. Each lawyer has their own account, with no shared users, and the firm decides who sees each matter. Permissions are set by firm, team and user and are enforced on the server, so a matter hidden from a user is not simply hidden on screen: it is not served to that account.

In a network of firms, each firm keeps its own information and shares only what it decides to share. Firms are isolated from each other, including in the shared library.

Before adding or sharing a document in the library, you choose which one to apply. Our free tools also let you anonymise names, emails, phone numbers and account numbers before you paste a document into any AI. Free tools.

Whichever tool you use, these are the questions worth answering before client information goes into it. They follow from the UK GDPR, the Data Protection Act 2018, client confidentiality and legal professional privilege, and from your own professional obligations as a regulated lawyer (for solicitors, those set by the SRA).

1. Where is the data stored? In Amara: the EU, AWS Paris.
2. Is it used to train models? In Amara: no.
3. Is there a data processing agreement? In Amara: yes; Amara acts as processor and the firm as controller.
4. Who in the firm can see each matter? In Amara: only the users the firm allows, with permissions enforced on the server.
5. Can you check every source? Amara shows verifiable references so you can open each one before relying on it.
6. Who signs? Always the lawyer. Amara prepares and proposes; the lawyer reviews, signs and decides.
7. Does the document need personal data at all? If not, pseudonymise or anonymise it first.

If you find a vulnerability, write to seguridad@amaralegal.ai with a description, the steps to reproduce it and the affected URL. We reply in writing. See also our security.txt.