We keep your data secure
Legal matters involve some of life's most sensitive information. We take that responsibility seriously.
Your story is not AI training data
Our AI services are governed by commercial terms and data-processing agreements. Model providers are contractually barred from using your content to train their models.
We minimise what we send and use provider retention controls and contractual safeguards.
Encrypted at every step
Everything you share travels over TLS and is stored encrypted (AES-256). Uploaded documents live in private storage that is only reachable through signed, expiring links.
Passwords are hashed, never stored in plain text, and checked against known breaches using k-anonymity, so neither your password nor your identity is shared.
You control who sees what
Access is role-based and limited to people who need it to support your matter. Administrative access is restricted and logged.
You can remove invited members from a matter. Partner and Remedy staff access is limited by role and purpose.
Where we stand
UK GDPR
We are UK-based and handle personal data under UK GDPR, with the ICO as our regulator.
ICO registered
Registered with the Information Commissioner's Office, registration reference ZC031343.
Cyber Essentials
Independently assessed and certified under the NCSC's Cyber Essentials scheme.
CASA Tier 2
Independently security-assessed to Google's CASA Tier 2 standard for handling connected-email data.
Our sub-processors
It takes a village to provide a world-class service. Here's ours, last updated 27 October 2026.
| Provider | What they do | What they get | Where |
|---|---|---|---|
 | AI model provider for the assistant and for drafting call notes from meetings | Chat messages, matter context, document extracts, email content from a connected inbox, and the transcripts of meetings staff ask to turn into call notes, with the names of the speakers and of the people on the client's side of the matter | United States |
 | Reading your documents and indexing text for search | Text and images from the documents we read for you, and the matter text we index | EU for search indexing; document reading is not pinned to the EU |
| File storage | The files you upload | Google Cloud, private bucket |
 | Database | Account, matter, and conversation records | United Kingdom (AWS London) |
| Email access, only if you connect an inbox | Email content and metadata from the connected inbox | Global (Google) |
| Scheduling calls with the Remedy team | Your name and email, the time and any note you add, your phone number when we call you, and — for a call booked from a matter — that matter's Remedy link, written only to Remedy's own calendars | Global (Google) |
| Address autocomplete | The partial address you type | Global (Google) |
| The little site icon shown beside a source we cite | Your IP address, your Google cookies, and the domain name of each source cited in your matter | Global (Google) |
| postcodes.io | Finding council areas and putting directory locations on maps | The postcode on its own, with nothing that identifies you | UK or EU data centres |
 | SMS and WhatsApp messaging, including booking confirmations and reminders by text | Phone number and message content; for a booking text, the Remedy staff member's name, the meeting's title and time, and your link to join it on Remedy Video, the number we'll call, or the place you're meeting | United States |
| Phone calls our staff make to you from your matter, and recording them from when you answer | Your phone number, the call's audio, and its recording; for our staff member, their IP address and their browser's connection and call-quality data. The recording is copied to your matter and then deleted at Twilio, or, if it cannot be copied, kept there until our staff discard it | Ireland |
 | Transactional email, including booking confirmations and reminders | Email address and message variables; for a booking email, a calendar invite with your name and email, the Remedy staff member's name and email, the meeting's title and time, and your link to join it on Remedy Video, your phone number for a call we make to you, or the place you're meeting | United States |
 | Web search | Search queries, which may contain case context | United States |
 | Web browsing for research | Pages visited and text entered during research | United States |
| Langfuse | Monitoring the assistant's conversations | Conversation content, including tool results and document text, and the ids tying a trace back to you | Being confirmed; Langfuse Cloud EU (Ireland) is the region we run |
 | Product analytics, session replay, and error and log monitoring | Pseudonymous usage data, masked session replay, redacted logs, and a pseudonymous mirror of matter and tag records; no names, emails, or phone numbers | EU (Frankfurt) |
 | Security proxy, firewall and bot protection for our API, and bot and abuse prevention on sign-in and booking forms | Everything sent to and from our API as it passes through, with your IP address, requested URLs, browser headers and cookies; for bot checks on forms, your IP address and browser signals | Global edge network |
| Amazon Web Services | App and API hosting, content delivery, bot protection, and video calls our staff hold with you from your matter or a booking | Everything sent to and from our API while it is processed, files while we scan them for viruses, and our server logs; for app delivery and bot protection, your IP address, requested URLs, browser headers and cookies; for a video call, its video and sound as they pass through, never recorded, your IP address and call-quality data, and, while staff record, each speaker's sound, which is copied to your matter after the call and lapses at AWS within 24 hours | United Kingdom (AWS London) for API hosting, app storage and video calls; US and European content-delivery locations, with global bot protection |
 | Marketing website hosting | Requests in transit (IP address, pages visited) | Global edge network |
 | Card payments and invoicing | Account email, the service bought and its price, and billing contact details for invoices; card details go to Stripe directly and are never stored by us | United States / EU |
 | Internal operations alerts | Contact details inside operational notifications | United States |
Signing in with Google or Apple
When you use social sign-in, Google or Apple confirm who you are and share your name and email with us. They act under their own terms, not as our processors.
Partner organisations
When you choose to involve a partner, such as a law firm taking on your case, they receive the relevant matter content under a data-sharing agreement and handle it under their own regulatory duties.
Advertising measurement
If you consent to marketing cookies, we tell an advertising platform when a sign-up followed one of our ads. OpenAI gets only its own click ID. Google also gets a scrambled (hashed) form of your email address, and your phone number if you verified one, which is how it matches a sign-up with no click ID. Neither gets anything about your matter, and both act as independent controllers, not our processors.
Breached-password checks
Passwords are checked against known breaches using k-anonymity (HaveIBeenPwned): only the first five characters of a hash leave our systems, never your password and never who you are.
Most account, matter, document, and conversation data is kept while your account is active and deleted through our erasure process when you close it. Encrypted backups are overwritten on a rolling cycle, and some records may be kept longer where the law requires.
Delete your account from the app settings, or email legal@remedylegal.ai and we'll help. Deleting your account erases it and its associated records through our erasure process; some data may remain briefly in encrypted backups or be retained where the law requires.
You can access much of your data within the app. For a formal copy, email legal@remedylegal.ai and we'll respond within one calendar month, normally free of charge.
Our primary database is hosted in the United Kingdom. Some providers process data in the EU or United States; where they do, a UK transfer safeguard is in place. The public register above lists our sub-processors and their processing locations.
We never sell personal data or allow AI providers to train models on it. If you arrive through one of our ads and create an account, we may send that platform its own click ID, the conversion time, and an opaque deduplication reference; we never send your contact details or matter content for advertising measurement. Where a claim is offered to a partner law firm, we obtain consent where required.
The full pack: our DPIA, retention schedule, appropriate policy document, sub-processor register, and security architecture. Email legal@remedylegal.ai and we will send it over.
Seen something that doesn't look right?
Security researchers, users, and anyone else: if you have a concern about how we handle data, or want to disclose a vulnerability, we want to hear it. Every message to this address is read.