A careful path from evaluation to production.
Start with synthetic or fully redacted matters, then complete the security, vendor, and operating review before introducing live client information.
Every fact keeps its source
Illustrative
Start with a controlled evaluation
Pilot evaluations use synthetic or fully redacted matters. Before any live client information is introduced, the firm and product team review scope, product controls, vendor terms, retention, and operating procedures.
Current facts and product requirements.
Clear labels show what applies to the pilot and what must be completed before live client information is used.
HTTPS for public surfaces
CurrentThe marketing site and public pilot preview are served over HTTPS.
Synthetic or redacted evaluation data
Pilot policyThe initial pilot workflow is designed to run without live client files or direct identifiers.
Encryption at rest
Product requirementProduction matter data and uploaded documents must use encrypted storage, with the exact services and key responsibilities documented during diligence.
Firm-level isolation
Product requirementEvery production record must carry a firm identifier, and authorization checks must prevent cross-firm access.
Matter-level permissions
Product requirementProduction access must be scoped by both role and matter assignment rather than broad system access.
Short-lived document URLs
Product requirementPrivate uploads must be delivered through expiring, authorized links instead of permanent public paths.
No sensitive data in logs
Product requirementApplication logs must avoid client narratives, document contents, direct identifiers, and model prompts.
No training on firm data
Product requirementCustomer content must not be used to train or fine-tune models. Provider contracts and configuration must support that commitment before live use.
Export and delete
Contract requirementWritten service terms must define export, retention, deletion, and backup handling before production data is accepted.
Minimum necessary context is the design rule.
Sending client information to a model provider can create confidentiality and supervision questions for a firm. The production design therefore treats each model request as a disclosure that must be justified and minimized.
The system design calls for sensitivity classification, removal of unnecessary metadata, minimum-necessary context, and review status on every output. Those controls must be tested and backed by vendor terms before live client information is processed.
- Classify sensitivity before content leaves the application boundary
- Strip metadata that the task does not need
- Send the minimum necessary context, not the whole file
- Log operational metadata, not sensitive prompt content
- Store every output with a review status attached
AI output review status
generated
Produced, not yet seen by a human
needs_review
Queued for a paralegal or attorney
approved
Reviewed and accepted as-is
edited
Corrected by the firm before use
rejected
Discarded; the source record is unaffected
Access boundaries are explicit in the data model.
A shared workspace needs a firm boundary between client-visible activity and internal legal-team notes. The MatterGraph data model gives attorney notes an explicit visibility field with an internal-only default.
That is a product design safeguard, not a legal conclusion about privilege. Each firm remains responsible for its jurisdictional analysis, vendor diligence, supervision, and any client communication or consent that may be required.
- internal_only: the default; firm eyes only
- attorney_only: hidden from paralegals as well
- paralegal_visible: shared with the working team
- The product model does not expose any of the three to clients
Who can see a matter
- ClientTheir own matter only. Never attorney notes.
- ParalegalMatters they are assigned to.
- AttorneyMatters they are assigned to, plus internal notes.
- Firm adminFirm settings and user management.
Sensitive actions require an audit record.
The system design specifies the events a production audit trail must capture. Completion and independent testing remain part of production readiness.
Access
User invited, user logged in, document viewed.
Matter changes
Matter created, answer submitted, event generated.
Review actions
Event approved, attorney note added.
Data movement
Document uploaded, export generated.
Begin with a representative matter.
Firms can evaluate MatterGraph with synthetic matters or fully redacted versions of closed matters. This provides enough context to assess the workflow while keeping the initial evaluation straightforward.
A later production phase can introduce live client information after written scope, security and vendor diligence, retention planning, and any client communication or consent the firm determines is required.
Test the workflow on a representative matter.
Start with a synthetic or fully redacted matter. An initial evaluation does not require live client data.