Robot, Robot, & Human

Security & Data Practices

100% private by design. Your documents never train AI models, and every provider boundary is documented.

Security Features

Encryption in Transit and at Rest

Customer data is encrypted over internet-facing connections with TLS 1.2+, including TLS 1.3 at the public edge, and at rest with AES-256.

Zero AI Training

Your documents never train any AI model. We enforce that boundary through commercial/API provider tiers and review their terms.

SOC 2-Mapped Security Program

Our documented controls are mapped to the SOC 2 Trust Services Criteria. We have not yet completed an independent SOC 2 examination.

AWS Infrastructure

Hosted on AWS with managed network and storage controls.

Matter-Aware Isolation

Tenant- and matter-aware authorization controls access to legal data.

Access Controls

Role-based access and audit records support accountability.

AI Provider Data Use

Your documents never train AI models. We use commercial/API tiers that do not use API-submitted data for training of general-purpose models. Provider terms and limited retention for abuse monitoring or service integrity still apply; retention is not training, and our Privacy Policy documents the boundary.

OpenAI

Terms reviewed

Commercial/API data-use terms

API-submitted data is not used to train general-purpose models. Limited service-integrity retention remains subject to provider terms.

Anthropic (Claude)

Terms reviewed

Commercial API data-use terms

API-submitted data is not used to train general-purpose models. Limited service-integrity retention remains subject to provider terms.

Google (Gemini)

Terms reviewed

Commercial/API data-use terms

API-submitted data is not used to train general-purpose models. Limited service-integrity retention remains subject to provider terms.

TrustedRouter

Terms reviewed

Contractual production routing boundary

Production configured-router chat-completion and embedding requests pass through contractual data-processing and no-logging obligations that flow through to approved underlying providers.

OpenRouter

Terms reviewed

Intermediary and provider terms

Routed requests remain subject to both intermediary and underlying provider terms, including service-integrity retention.

ElevenLabs

Terms reviewed

Enterprise · BAA · Zero Retention

Optional deposition-prep voice synthesis sends question or session text only after the production Zero Retention vendor guard passes.

Non-AI subprocessors—including Google Analytics for sanitized, credential-free page views, Google Workspace for Mike email ingress, and CourtListener for legal-research queries—are listed in our Privacy Policy.

Security & Privacy Practices

Encryption in transit and at rest
Role-based access controls
Tenant- and matter-aware authorization
Provider data-use posture documented and reviewed
Incident response procedures
Privacy requests handled under the published Privacy Policy
Using RRH does not, by itself, waive attorney-client privilege or work-product protection
Security documentation available during enterprise review

Questions About Security?

We're happy to discuss our security practices, provide documentation for your firm's security review, or answer specific questions about data handling.

For security inquiries, contact:

security@robotrobotandhuman.com

Contact Security Team Read Privacy Policy