Security at Scriptum

Your clients trust you with their deals. This page explains how Scriptum protects the documents you put into it. The binding commitments are in our Terms of Service and Data Protection Policy.

Where your data lives

All customer data is stored in the European Union, in Frankfurt, Germany, and is not kept in a database or document store anywhere else. When an AI feature runs, document text is sent to our AI providers for processing in the United States. It is not stored there, and each transfer is covered by a recognised mechanism under data protection law. See our sub-processors.

Your data is never used to train AI

We do not use your documents, your clause library or anything else you put into Scriptum to train any AI model, and we only engage AI providers on terms that do not let them train on it either.

Each firm is kept separate

Row-level security rules in the database separate each firm's data from every other firm's. Both sides of a deal may use Scriptum. Neither will see the other's data, except what a firm chooses to release to a shared matter.

Lawyers approve every AI output

AI output in Scriptum is a proposal. It only takes effect in a document when an authorised user approves it, and nothing is released to the client or the other side without approval. Clients answer questions inside the app without seeing your negotiation limits.

Security measures

• Encryption. Data is encrypted in transit using TLS and at rest using our infrastructure provider's storage encryption.
• Access control. Authenticated accounts with role-based permissions for users, firm administrators and partners, including senior approval before a change is released.
• Staff access. Internal access to production systems is limited to those who need it, bound by confidentiality, and any access to a customer account through support tools is logged.
• Audit trail. Approvals, releases and matter activity are recorded.
• Provider selection. We carry out due diligence on sub-processors and put written data processing terms in place with them.
• Incident response. We investigate suspected incidents and notify customers as our Data Protection Policy sets out.

Certifications

We are working towards ISO 27001 and SOC 2. Neither certification is complete yet, and we will update this page when they are. If your clients or panels need security questionnaires completed, ask us.

Leaving Scriptum

For 30 days after your agreement ends, your data is available for export in the formats the service supports. We then delete personal data from production systems within a further 60 days, and from backups in the ordinary course of rotation, unless the law requires us to keep it. Your clause library and negotiation history belong to your firm.

Common questions

Where is Scriptum's data stored?

All customer data is stored in the European Union, in Frankfurt, Germany. Document text is processed by AI providers in the United States when an AI feature runs, but is not stored there.

Does Scriptum train AI on our documents?

No. Scriptum does not use customer data to train any AI model, and only uses AI providers on terms that do not allow them to train on it.

Is Scriptum ISO 27001 or SOC 2 certified?

Not yet. Scriptum is working towards both certifications, and this page will be updated when they are complete.

Can the other side of a deal see our data if they also use Scriptum?

No. Each firm's data is separated at the database. A firm only shares what it chooses to release to a shared matter.