Security & data protection
Your files never leave your firm.
Written for the person your firm asks to check this before you buy. If you need something that isn’t here, ask and we’ll answer properly rather than send you a brochure.
Where your data lives
CONVEYi is an Outlook add-in, not a portal. Your emails, documents and the Excel tracker stay in your own Microsoft 365 tenant — the mailbox and OneDrive you already pay Microsoft for. We do not copy your document library onto our servers, and we do not need you to migrate anything to start.
What we do store, in our own database, is the case record that makes matching work:
- Matter records — reference, address, parties, stage, key dates and figures
- Email metadata and extracted facts for messages matched to a matter
- Search index chunks derived from matter documents and emails
- An audit log of every action taken, for your own accountability trail
- Your Microsoft sign-in tokens, so the add-in can act on your behalf
What we ask Microsoft for, and why
Least privilege is the design, not an afterthought. Every permission below is delegated — CONVEYi can only ever do what the signed-in user could already do themselves.
| Mail.ReadWrite | Read the thread you have open and create a draft reply. There is no permission that lets CONVEYi send on its own. |
| Mail.Send | Only used when a human clicks Send in the pane, or for a rule your firm has explicitly switched on. |
| MailboxSettings.ReadWrite | Create and colour the triage categories (Reply / Action / Delegate) in your mailbox. |
| Files.ReadWrite | Your own OneDrive — the matter folder and Excel tracker. Scoped to /me only. |
| User.Read | Your name and email, to sign you in. |
| Team.ReadBasic.All, ChannelMessage.Send | Optional: post a matter summary to a Teams channel. Unused unless you turn it on. |
Deliberately not requested:
- Files.ReadWrite.All — we cannot see other people’s files
- Sites.ReadWrite.All — we do not touch SharePoint
- Mail.Read.Shared — we cannot read other people’s mailboxes
- Directory or admin-level permissions of any kind
It drafts. It does not send.
By default every reply CONVEYi produces lands in your Outlook Drafts for a human to read, edit and send. Automatic sending exists, but it is off unless your firm turns it on, is configured rule by rule, and can be switched off at any time. Nothing goes to a client without someone at your firm deciding it should.
Sub-processors
These are the third parties that may process your data, what for, and where. AI providers process content in the United States; if that is a problem for your firm, tell us before you buy rather than after.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Anthropic (Claude) | Drafting, summarising, triage classification | Email content and matter facts for the message being worked on | USA |
| Groq | Call-note transcription; AI failover if Anthropic is unavailable | Call audio you record; email content only when failover is active | USA |
| Voyage AI or OpenAI | Embeddings for case-file search | Chunks of matter documents and emails | USA |
| Microsoft | Outlook, OneDrive and Excel via Microsoft Graph | Stays inside your own Microsoft 365 tenant | Your tenant’s region |
| Supabase | Application database (Postgres) | Matter records, extracted facts, audit log | EU |
| Vercel | Application hosting | Request data in transit | EU/US edge |
| Stripe | Subscription billing | Billing contact and payment details — we never see card numbers | USA / EU |
| Resend | Transactional and waitlist email | Email address and message content we send you | USA |
If you bring your own Anthropic API key, that firm’s drafting runs against your Anthropic account rather than ours.
Separation between firms
Every record carries the firm it belongs to, and every query is scoped to the signed-in user’s firm. One firm cannot see another firm’s matters, documents or audit trail. AI prompts are built from a single firm’s data at a time — your files are never used to train a model, and never form part of another firm’s answer.
Leaving, and getting your data out
The awkward question first: if you stop paying, what happens to your files? Very little, because the files were never ours. Your matter folders, saved emails, drafts and Excel trackers are already in your OneDrive and stay exactly where they are.
Ask us to delete your account and we remove your firm’s records from our database — matters, extracted facts, search index and audit log. Deleting a single matter cascades to its documents, facts and triage records the same way.
Paperwork your firm will want
- Data Processing Agreement — available on request; we will sign yours or provide ours.
- Cyber insurance — certificate available on request.
- Security questionnaire — send yours over; we complete them rather than refusing.
- Company — AIFTRC LTD, registered in England & Wales, no. 17313284.
- Privacy policy — the full UK GDPR notice, including your rights as a data subject.
If you are Lexcel-accredited, your supplier due-diligence obligations are exactly what this page is written to satisfy. Ask for anything missing.
Ask us something
Security questions get a real answer from someone who has read the code, usually the same day. Get in touch and say what your firm needs.