Security and data handling

This page describes Descrybe's current public security and data-handling practices. For the broader set of information used to evaluate Descrybe, visit our Trust page. Our Privacy Policy explains how we collect, use, disclose, and retain information.

Security overview

• Named-user access: Legal Engine access is tied to an individual Descrybe account and OAuth authorization. Shared credentials and pooled access are not supported.
• Focused connector boundary: Descrybe receives the specific Legal Engine request an assistant sends, not general access to the assistant account, tenant, email, workspace, or files.
• No Descrybe model training: Descrybe does not use customer prompts, files, or research history to train Descrybe-owned models.
• Encryption: Data is encrypted in transit using HTTPS/TLS, and DigitalOcean-managed database and object-storage services provide encryption at rest.
• Restricted production access: Production customer-data access is limited to authorized technical operations personnel on a need-to-know basis.
• SOC 2 readiness: Control implementation and evidence collection are in progress in preparation for an independent SOC 2 examination.

Legal Engine connector data boundary

When a user invokes Descrybe Legal Engine from a supported AI assistant, Descrybe receives the specific tool request the assistant sends, the account and authorization context needed to confirm access, and limited operational metadata used to route, secure, and troubleshoot the request. A tool request may include text that the assistant places in its arguments, such as a legal question, citation, quoted passage, or requested jurisdiction.

Connecting Legal Engine does not by itself give Descrybe access to the user's entire assistant conversation, documents, email, tenant, workspace, or files. The assistant provider determines what context to send in a particular tool request and applies its own terms, privacy commitments, and administrator settings. Descrybe processes the request it receives, performs the requested legal research work, and returns legal information and sources to the assistant.

The Legal Engine gateway's application logs and analytics record operational information such as tool name, status, timing, request or session identifiers, provider, and authorization status. They do not record complete tool-argument values. The current public connector toolset does not provide a file-upload tool, although an assistant may include relevant text from the user's current task in a tool request.

Identity and organization access

Organization access is designed around named users. Each lawyer authenticates through an individual Descrybe account, and Descrybe applies entitlement, operational identity, and usage controls at the account level. Different assistant sessions or integrations connected to the same Descrybe account do not create a separate identity or usage allowance. Firms and legal departments can arrange centralized billing while retaining individual user authentication.

The organization's AI provider controls whether Descrybe is enabled in its environment. Provider administrators may apply their own connector, role, retention, audit, and data-governance settings. Each user then connects the Descrybe account authorized for that user.

How connected environments handle firm content

Legal Engine can be used inside several assistant environments. Those environments—not Descrybe—govern access to the user's internal files, messages, applications, and connected systems. This comparison summarizes the documented architecture and control boundaries; it is not a security ranking.

Sources: Microsoft Cowork administration and governance; Anthropic Claude for Legal guide; ChatGPT Work Cloud security; and ChatGPT Work Local security.

Important: This summary is based on publicly available provider documentation reviewed in September 2026. Capabilities and data-handling controls vary by plan, configuration, connected service, and provider updates. It is an architectural overview, not a security certification or contractual commitment. Organizations should review the applicable provider terms and their own security, confidentiality, and professional-responsibility requirements.

User inputs, retention, and training

Descrybe retains account and product data needed to operate the service, which may include user prompts, conversational/research history, generated outputs, metadata, and operational logs.

The only place currently to upload files is our brief review workflow. We read an uploaded document to extract text for analysis and do not deliberately save the original upload as a persistent customer file after extraction. Extracted text and derived review information may remain temporarily in processing systems and may be included in saved review history or operational records.

Descrybe does not use customer prompts, files, or conversational history to train Descrybe-owned models.

Descrybe uses third-party AI providers to process certain requests. Our current, primary LLM provider is OpenAI's API. OpenAI's API documentation confirms that API inputs and outputs are not used to train OpenAI models by default unless the customer opts in. We have opted out. OpenAI may retain API abuse-monitoring logs for up to 30 days.

Retention varies by feature. Within the Descrybe Platform, users can view past searches and delete individual history entries. Descrybe Legal Engine does not provide a customer-facing history view and retains limited request and operational data as described in our Privacy Policy.

Descrybe periodically reviews the information it retains and removes or de-identifies information when it is no longer reasonably needed for the purposes described in our Privacy Policy, subject to backup, security, billing, fraud-prevention, legal, and service-provider requirements.

Security incident response

Descrybe maintains procedures to identify, contain, investigate, remediate, and document suspected security incidents. Response may include restricting access, preserving relevant records, coordinating with service providers, correcting affected systems, and evaluating whether customer or regulatory notice is required.

If Descrybe determines that a security incident requires notice, Descrybe will provide notice as required by applicable law or an applicable written agreement. The timing and content of a notice may depend on the investigation, law-enforcement requirements, and the information reasonably available at the time.

Legal requests for customer information

Descrybe reviews legal demands for customer information for validity, authority, and scope and seeks to limit disclosure to information legally required. Where legally permitted and reasonably practicable, Descrybe will seek to notify the affected customer before disclosure so the customer may pursue available legal protections. Descrybe may be prohibited from providing notice or may need to delay notice.

Independent assurance

Descrybe is actively completing SOC 2 readiness work, including control implementation and evidence collection, in preparation for an independent SOC 2 examination. Descrybe has not yet completed that examination and does not currently claim a SOC 2 report or ISO 27001 certification.

We currently rely on infrastructure and service providers with their own security/compliance programs. Our providers, DigitalOcean (hosting), Clerk (user authentication management), and Stripe have SOC/security documentation.

AI model provider

Descrybe currently uses OpenAI API models for AI-generated summaries and research-related outputs. The exact model may vary by feature. We may update models over time for quality, safety, performance, or reliability. We do not currently provide user-by-user notices for every model update unless the change materially affects our terms, privacy posture, or data processing commitments.

Geography and account segmentation

We limit our storage of customer data, but it is stored on DigitalOcean servers, all in the New York City, New York region. Descrybe is structured around individual user accounts, not shared organization workspaces. A user's saved searches, history, and related product data are associated only with that user's own account. Access is protected through application and database access controls. We do not currently offer shared organization workspaces, matter-based workspaces, or separate file/vault permissioning. Our cloud infrastructure runs on provider-managed multi-tenant infrastructure, not physically dedicated hardware per customer.

Encryption

Data is encrypted in transit using HTTPS/TLS. For our DigitalOcean-hosted storage/database services, DigitalOcean indicates encryption in transit and encryption at rest for managed databases and Spaces object storage.

Employee, partner, and third-party access

Production customer data access is tightly restricted to authorized technical operations personnel on a need-to-know basis. Access is used only for operations, support, security, debugging, legal/compliance obligations, or customer-requested assistance. Descrybe does not sell customer data. Third-party service providers may process data as needed to deliver infrastructure, authentication, payments, analytics, support, and AI processing.

Provider security documentation

OpenAI (API)
OpenAI maintains SOC 2 Type 2 compliance, covering their API and Enterprise services. Their documentation confirms that, by default, data sent to the API is not used to train their models. They also hold ISO 27001, 27017, 27018, and 27701 certifications.
Link: OpenAI API data controls
Trust Portal: OpenAI Trust Portal

DigitalOcean (Infrastructure & Trust)
DigitalOcean is SOC 2 Type II and SOC 3 Type II certified. Their Trust Platform provides downloadable audit reports. They also maintain CSA STAR Level 1 and use data centers that are ISO 27001 and PCI-DSS compliant.
Link: DigitalOcean Trust

DigitalOcean Spaces (Object Storage)
Spaces is included in DigitalOcean's SOC 2 Type 2 report. The documentation outlines the shared responsibility model, noting that data is encrypted at rest and in transit via SSL/TLS.
Link: DigitalOcean Spaces shared responsibility model

DigitalOcean Managed Databases
Managed Databases are also covered under DigitalOcean's SOC 2 report. Security features include end-to-end SSL encryption, daily backups with point-in-time recovery, and network isolation via VPC and firewalls.
Link: DigitalOcean security

Stripe (Payments)
Stripe is a PCI Level 1 Service Provider (the most stringent level) and is SOC 2 Type 2 compliant. They use AES-256 encryption for data at rest and require TLS 1.2 or higher for all communications.
Link: Stripe security

Clerk (Authentication)
Clerk is SOC 2 Type 2 and HIPAA certified. Their security framework includes regular third-party penetration tests, source code reviews based on OWASP standards, and compliance with the EU-U.S. Data Privacy Framework. They use enterprise-grade encryption and provide built-in protections against brute force and credential stuffing attacks.
Link: Clerk authentication
Security Documentation: Clerk security overview

Security and procurement review

Organizations evaluating Descrybe may contact [email protected] to discuss security questionnaires, data-protection requirements, procurement review, or organizational access.