Security & Governance
How your work is safeguarded
This page states what DraftCounsel verifiably does — not a badge. Where we have not completed a formal third-party certification, we say so. Everything below can be checked against the coverage, engine, and DraftBench pages.
Default-deny data access
Every database table runs with row-level security enabled and all access revoked from anonymous and signed-in roles — only the application's service layer reads or writes, and only through code paths that scope each query to the requester. There is no direct client access to the database.
Capability-based access, not guessable URLs
Reviews, drafts, comparisons, matters, and firms are addressed by unguessable capability ids (e.g. RVW-/DFT-/MTR-/FRM-…). Possession of the id is the credential; ids are generated from cryptographic randomness, and cross-tenant reads are scoped out server-side.
Signed sessions
When you sign in, your session is carried in an HMAC-signed cookie the server verifies on every request — a tampered or forged cookie is rejected.
Metadata-only spend ledger
The AI request ledger records what ran — surface, model, token counts, an estimated cost, an error class, and a grounding verdict. It stores no document content, no prompts, and no personal data. Per-matter cost on the firm console is computed from this ledger; the estimate is a guide, the provider invoice is the truth.
Append-only audit trails
Attorney adjudications are written to an insert-only decision log — decisions are never edited in place. The Review Certificate is derived from that log, so it cannot claim a review that did not happen. Authority checks and drift are recorded to their own ledger on a daily schedule.
Grounded-or-flagged answers
Answers on the counsel surface are checked for grounding: a statement the system cannot tie to your document or a cited source is flagged rather than presented as settled. The verification layers, and which are live versus awaiting a key, are disclosed on the engine page.
Spend governor & outage detection
Model spend runs through a governor that can observe or enforce a monthly ceiling and fails safe; terminal model-provider failures are detected and recorded so an outage surfaces instead of silently degrading output.
Brand isolation
DraftCounsel and its sibling platform are separate deployments with separate configuration; the operating brand is fixed at build time.
What we do not claim
We have not completed a third-party security certification such as SOC 2, and this page is not such a certification. It is a factual description of the platform's design and controls. We would rather tell you exactly what is true than display a badge we have not earned. DraftCounsel provides software for reviewing and preparing documents; it is not a law firm and does not provide legal advice.