Security and compliance

All data transmitted between your browser and our servers is encrypted using TLS/SSL, ensuring your information remains private and secure.

Password hashing with bcrypt and secure session management protect your account from unauthorized access.

Your data belongs to you. We do not disclose your data to third parties for purposes of their own; the processors listed in Section 10 of the personal data processing policy handle it on our behalf, under our instructions and with the data processing agreement each one incorporates into its terms. That Section says, one by one, who they are and what each receives.

Granular permissions ensure that users only access the information they need. The firm owner and its lawyers each have appropriate access levels: a lawyer sees the matters they are assigned to or collaborate on.

Sensitive data (personal information, case notes) is encrypted with AES-256-GCM before storage. Even in case of unauthorized database access, the information remains unreadable.

Custodio Legal processes uploaded originals ephemerally. It retains traceable matter knowledge, and not the file, nor a cloud link, nor a provider identifier.

The relevant actions on personal data are recorded with timestamp, responsible user and change details, and those records survive the erasure of the rest of your data: Section 11 of the personal data processing policy keeps them for the term your country's annex declares, because they are the proof that we comply.

We process your data under the data protection legislation of each country where we offer the service: Ley 1581 de 2012 and Decreto 1377 de 2013 (Colombia), Ley N° 8968 and its Reglamento, Decreto Ejecutivo N° 37554-JP (Costa Rica), the LOPDP and its Decreto Ejecutivo 904 (Ecuador), Ley núm. 172-13 (Dominican Republic), Ley N° 18.331 and its amending Ley N° 19.670 (Uruguay), Ley 25.326 and its Decreto 1558/2001 (Argentina), and Lei nº 13.709/2018 — Lei Geral de Proteção de Dados Pessoais, LGPD (Brazil). What each one says for you is set out by your country's annex to our personal data processing policy. We implement the data processing principles: legality, purpose, freedom, accuracy, transparency, access, restricted circulation, security and confidentiality. For the data of the platform's users we are the data controller; for the data of a firm's clients that live in its matters, the firm is the controller and we are the processor, on the terms of the processing-on-behalf clause of the terms of service.

We handle the rights of access, rectification and cancellation of all data subjects, and that of opposition where the law of the country recognizes it —in Costa Rica it does not exist as a right of its own, and what stands in for it is revoking your consent, as the Costa Rican annex explains; in Uruguay neither objection nor portability exists, and the Uruguayan annex says so instead of promising you a term its law does not set; in Argentina neither exists either, and its law is also the only one in the Service that sets two different terms in two different units for the rights it does recognise, as the Argentine annex transcribes; in Brazil every right of Article 18 of the LGPD exists, portability included, but the only deadline the law sets is the one for access —fifteen calendar days, Article 19, II— and the fifteen days we apply to the others come from Clause 15.3 of Annex II of Resolução CD/ANPD nº 19/2024, which is a contract and not a law, as the Brazilian annex says—. You can also download a structured, machine-readable copy of your account data. You can exercise them from 'My account > Your privacy' or by writing to our privacy team. The term within which we answer, and the reach of each right, are set by the law of the country where you live: Section 7 of our personal data processing policy says how they are exercised, and the annexes for Argentina, Brazil, Colombia, Costa Rica, Ecuador, the Dominican Republic and Uruguay each say how long we take to answer and under which article. This page does not repeat those figures, so that they do not age before the instrument that declares them.

We retain your data only for as long as necessary to fulfill the processing purposes and legal obligations, under Section 11 of our personal data processing policy. After the service ends, data is deleted or anonymized within the following ninety (90) days, unless a legal obligation requires keeping it; the records of authorization, audit and data subject requests are kept as proof of compliance.

When we send data outside the country where you live we do so with the safeguard the law of that country recognizes, and only with it. Which destinations exist and what backs each sending is said, destination by destination, by Section 9 of our personal data processing policy; which safeguard each law recognizes — including which countries its authority has declared to have an adequate level of protection, where it has done so — is said by the annexes for Argentina and Brazil —the two whose destination is backed today by a signed model contract and not by an adequacy finding, and the Brazilian one with a model Article 16 of Resolução CD/ANPD nº 19/2024 requires to be adopted «integral e sem alteração»—, Colombia, Costa Rica, Ecuador, the Dominican Republic and Uruguay. This page does not list them, because what is true today can stop being true with one resolution.

Text generation is provided by Nebius B.V., a Dutch company domiciled at Schiphol Boulevard 165, 1118 BG Schiphol, the Netherlands, which operates the Nebius Token Factory service with the GLM-5.3-Flash model. The terms of that service are governed by the law of the Netherlands and its disputes are submitted to the courts of Amsterdam. The provider states that it runs inference in data centres in the European Union, in Israel or in the United States depending on the model.

Zero data retention is enabled in our organization with that provider since September 4, 2026. According to what that provider publishes, with zero data retention enabled the inputs (the text sent to it) and the outputs (the text it returns) are not stored in its systems after each request is processed, are not used for speculative decoding and are not used to train, fine-tune or improve any model, its own or a third party's; the option applies at the organization level and covers all of its projects and endpoints (published Nebius legal guide, «Legal Quick Guide», consulted on September 4, 2026 on the provider's documentation site).

We also tell you, with the same precision, what that guarantee does NOT settle: it is a statement published by the provider and not a control we have audited; it operates going forward and does not reach submissions made before 4 September 2026, over which the default processing of its terms of service continued to apply; its published documents do NOT say whether Zero Data Retention reaches any records the provider may keep to detect abuse of the service, nor whether it applies in the same way to responses delivered as a stream, so we claim neither of those two things; and enabling it is up to us, so if we ever disabled it we would update this page and the privacy policy before doing so.

The vector representations (embeddings) that make semantic search possible are computed by the same provider, Nebius B.V., in the same organization and under the same Zero Data Retention, with the Qwen3-Embedding-8B model, which its catalogue places in the European Union (Finland); according to its published legal guide, Zero Data Retention covers all the organization's projects and endpoints (consulted on September 24, 2026). Until September 24, 2026 they were computed by Voyage AI (United States), with zero-day retention under the opt-out we had active since August 12, 2026.

Who else processes data on our behalf, what each one receives and the safeguard each transfer travels under is in our list of subprocessors, which is reviewed at least once a year.

In the event of a security breach affecting personal data that poses a real risk to the rights and freedoms of data subjects, Custodio Legal will notify:

• (1) The supervisory authority that applies, where your country's law designates one and imposes that notice on us.
• (2) Affected data subjects, without undue delay.
• (3) The controller firm, when the incident affects data of its matters, within the following two (2) business days, so it can meet its own notification obligations.

Which authority applies in each country, and within how many days we notify it and you, is declared by our personal data processing policy in the annexes for Argentina, Brazil, Colombia, Costa Rica, Ecuador, the Dominican Republic and Uruguay — where we also say when the term is set by law and when we set it ourselves, where the Argentine annex says that its regime has no authority to notify and no statutory clock to run, and that what we tell you there we tell you by contract, and where the Brazilian one names the Agência Nacional de Proteção de Dados (ANPD) and the three business days of Article 6º of Resolução CD/ANPD nº 15/2024. This page does not repeat those figures.

The notification will include: the nature of the incident, categories of data affected, likely consequences, measures taken or proposed, and contact details of the controller or the data protection officer. We keep a record of every security incident, including those that do not require notification.

Custodio Legal has appointed as data protection officer, under Articles 48 and 49 of Ecuador's LOPDP, the data controller identified in our personal data processing policy. In Colombia that same controller heads the personal data protection area that Law 1581 of 2012 requires, and in the Dominican Republic it handles data subject queries and complaints, because Ley núm. 172-13 requires no equivalent figure. In Uruguay the figure does exist —Article 40 of Ley N° 19.670 and Article 10 of Decreto N° 64/020— but it is required of public entities, of those processing sensitive data as their main business and of those processing more than 35,000 people: none of those applies today, and the Uruguayan annex says how we watch for it and what happens on the day one does. In Argentina the figure does not exist at all: neither Ley 25.326 nor Decreto 1558/2001 regulates it, and the Argentine annex says so as a statement and not by omission. In Brazil the encarregado does exist —Article 41 of the LGPD— but the duty to appoint one is the controller’s: Article 6º of Resolução CD/ANPD nº 18/2024 declares that «a indicação de encarregado por operadores é facultativa», and the Brazilian annex explains why we do not additionally claim the pequeno-porte waiver of Resolução CD/ANPD nº 2/2022, which is not ours to claim. You can contact it at [email protected] or through the platform at 'My account > Your privacy'. Data subject requests are handled within the legal deadlines of each country, which that country's annex declares.