Security & Compliance Overview.

As of the date of this Overview:

• Backend services and database infrastructure — Railway; California, United States
• Provider-managed database backups — Railway; associated with the database region
• Server-side application functions — Vercel; Washington, D.C., United States (us-east-1 / iad1)
• Public website delivery — Vercel; public content may be delivered through globally distributed edge infrastructure
• AI-enabled workflow providers — OpenAI and Anthropic commercial/API services
• Payment processing — Stripe
• Public website analytics — Google Analytics; public Website pages only

Angus may change infrastructure providers, regions, or service configurations as necessary to operate, secure, maintain, or improve the Platform, subject to applicable customer agreements.

Customer Data is stored in managed infrastructure, including managed PostgreSQL database services.

Angus does not currently represent that it applies independent application-level encryption to all stored Customer content.

Storage-layer encryption and backup encryption, where available, are managed by the applicable infrastructure provider. Angus does not currently make a separate public representation concerning independently verified provider-controlled encryption-at-rest or backup-encryption configurations.

Customers with specific encryption, key-management, data-residency, isolated-environment, or deployment requirements should contact Angus regarding an Enterprise agreement, eligible isolated database environment, Bring Your Own Keys arrangement, or Angus Station deployment, as applicable.

Angus4Law associates documents, extracted text, Case Memory, facts, reports, drafts, workflow records, and related work product with the matter in which they are created, uploaded, or used.

For individual/self-service subscriptions, the subscriber receives direct access to the subscriber’s Angus4Law environment.

Firm deployments may be governed by a separate firm agreement and configured to support firm administration, attorney assignments, and matter assignments. In eligible firm deployments, Angus may apply attorney and matter access controls according to the firm’s configured assignments and applicable agreement.

Eligible/dedicated firm deployments may use an isolated database environment.

Feature availability and access-control configuration vary based on plan, deployment architecture, and applicable firm agreement. Customers should not assume that a specific multi-user, role-based, matter-permission, isolation, or administrative control is available unless Angus has expressly agreed to provide it.

Angus does not use Customer Data to train, fine-tune, evaluate, benchmark, or improve Angus models or shared/general-purpose AI models made available to other customers, unless Angus obtains the Customer’s express written authorization for a specific use.

Angus does not use Customer Data for unrelated marketing, public demonstrations, public examples, shared benchmark datasets, employee training, or unrelated product development without express written authorization.

Angus currently uses OpenAI and Anthropic commercial/API services for selected AI-enabled workflows.

Depending on the requested workflow, selected information may be transmitted to an authorized AI provider, including:

• prompts;
• selected document excerpts;
• extracted facts;
• Case Memory;
• research results;
• drafts;
• prior Outputs;
• Custom AI Mode instructions; and
• other task-relevant context.

Angus uses retrieval and context-selection processes intended to provide relevant information needed for the requested workflow. External AI providers do not receive unrestricted access to the entire Angus4Law database merely because an AI-enabled feature is used.

Angus does not currently represent that Zero Data Retention is enabled for all AI-provider processing. OpenAI and Anthropic may retain API inputs and outputs for limited periods under their applicable commercial/API, safety, abuse-prevention, security, legal-compliance, and retention practices.

For more information, see the AI Data Use and No-Training Notice.

Matter Deletion

When an authorized user deletes a matter through available Platform controls, Angus is designed to permanently delete active matter content associated with that matter, including, as applicable:

• extracted document text and document records;
• Case Memory, embeddings, and vectors;
• reports;
• chats and matter-associated transcripts;
• drafts and related drafting conversations;
• citations;
• evidence, timeline, and discovery-workflow records;
• matter-associated Custom AI Mode relationships; and
• related active matter workflow records.

Matter deletion is designed as a transactional process. If the deletion operation fails, the Platform is designed to preserve the matter rather than leave it partially deleted.

Limited billing, accounting, usage, audit, security, legal-compliance, financial, and dispute-resolution records may be retained after matter deletion.

Account-Termination Deletion

After cancellation or termination, Customer Data is generally available for up to ninety (90) days for retrieval or export.

After the applicable retrieval period, Angus will delete or de-identify Customer Data from active systems, subject to limited retention for billing, accounting, audit, security, legal compliance, dispute resolution, enforcement of agreements, and system integrity.

Deleted Customer Data may remain in provider-managed backups for up to ninety (90) additional days under the normal backup lifecycle.

Angus uses third-party service providers to operate the Platform. Depending on the service, these providers may process account data, Customer Data, usage data, billing information, support information, or technical logs.

Key provider categories include:

• hosting and database infrastructure;
• backups;
• frontend/content delivery;
• AI inference;
• payments;
• public-site analytics;
• email and communications;
• security and operational support; and
• customer-authorized legal-research integrations.

Angus may update its providers as its services evolve. Enterprise customers may receive subprocessor information or notification rights under an applicable DPA or negotiated agreement.

Security is a shared responsibility.

Angus is responsible for operating and maintaining the Platform according to its applicable service commitments.

Customers are responsible for:

• managing Authorized Users;
• safeguarding account credentials;
• assigning and reviewing matter access;
• preserving original source documents;
• selecting appropriate content for submission;
• obtaining required client permissions and consents;
• meeting professional and legal obligations;
• maintaining any required external record-retention or legal-hold systems; and
• independently reviewing all generated Outputs.