Security and data handling
AdiletAI signs you in through its own identity provider, encrypts the files you upload and pseudonymises personal identifiers in your typed messages. Here is what each control covers, and where it stops.
Our principles. Each one rests on a control described below
Private to your account
Vaults, chats and court practice analyses are private to your account. You can delete documents, vaults and chats at any time.
Masked identifiers in messages
Personal identifiers that AdiletAI detects in your typed messages are replaced with placeholders before the message reaches the AI model.
Open about third parties
We use third-party AI model and search providers, and we say so plainly. The sub-processor list is available on request.
The lawyer stays in charge
Answers cite the sources they rely on, and the assistant is instructed to note what it could not verify. Output must be reviewed by a lawyer.
Account security
Sign-in runs through AdiletAI’s own identity provider using OpenID Connect with PKCE. You can add a second factor with any authenticator app.
Two-factor authentication is optional
Each user can turn it on with any authenticator app that supports TOTP.
You sign in
On AdiletAI’s own identity provider, adding a code from your authenticator app if you have turned on two-factor authentication.
OpenID Connect with PKCE
The sign-in completes through OpenID Connect, with the authorisation code protected by PKCE.
Tokens stay on the server
Access tokens stay on AdiletAI’s server, never in the browser. Your browser holds only an encrypted, HttpOnly session cookie.
Data protection
Connections between your browser and AdiletAI are encrypted, and so are the files you upload. The web app also uses a strict Content Security Policy, HSTS and rate limiting on sign-in and API endpoints.
- TLS 1.2 / 1.3
Encrypted connections
Connections between your browser and AdiletAI use TLS 1.2 or 1.3. HSTS tells browsers to connect over HTTPS only.
- At rest
Encrypted uploaded files
Files you upload are encrypted at rest and served only through authenticated downloads.
- CSP
Strict Content Security Policy
The app restricts which scripts and resources a page is allowed to load.
- Rate limits
Rate limiting
Sign-in and API endpoints cap how many requests can be made in a short period.
Encryption at rest applies to the files you upload. We go through how other data is stored with your security team directly.
Personal data in your messages
Personal identifiers in your typed messages are pseudonymised before the message reaches the AI model and restored in the answer.
AdiletAI replaces each identifier it detects with a placeholder, then puts the original value back in the answer you see.
Identifiers covered
- IIN
- BIN
- IBAN
- Phone numbers
- E‑mail addresses
- Personal names (best effort)
Scope
Pseudonymisation applies only to the messages you type. It does not cover the text of attached documents or document text indexed for search. Nor does it cover the web-search queries that court practice analysis builds from your dispute description and sends to its search provider.
Names are detected automatically, so some may be missed. Treat pseudonymisation as an extra safeguard, not a guarantee.
- What you type
- A buyer, IIN 000000000000, has not paid for our delivery and does not answer calls to +7 700 000 00 00. How do we recover the debt?
- What the AI model receives
- A buyer, IIN <<PII_3f0b6d18>>, has not paid for our delivery and does not answer calls to <<PII_a91c44e2>>. How do we recover the debt?
- Restored in the answer
- Send the buyer, IIN 000000000000, a written demand for payment and keep a record of your calls to +7 700 000 00 00. If the debt remains unpaid, you can go to court.
Applies to typed messages only. Attached documents, document text indexed for search and court practice search queries are not masked.
Privacy of your workspace
For how AdiletAI processes personal data, see the privacy policy.
Accessible only to you
Your vaults, Assistant chats and court practice analyses are private to your account.
Delete at any time
You can delete documents, whole vaults and chats whenever you need to.
Responsible use. AdiletAI assists lawyers. It does not replace their judgement
Answers cite their sources
The assistant cites the act and article it relied on. Numbered citations open a Sources panel grouped into documents, knowledge base and web.
Notes for the reviewing lawyer
The assistant is instructed to add a note on what it could not verify, so the reviewing lawyer knows where to look.
Citation check before memo export
Before a court practice memorandum is exported, every case number, norm and link in it is checked against the analysis’ own source list, and mismatches are flagged.
The lawyer stays responsible
Output must be reviewed by a lawyer. AdiletAI assists legal professionals and does not provide legal advice.
Security questions
More questions from your security team? Write to support@adiletai.com.
Where is our data processed?
AdiletAI uses third-party AI model and search providers, and some of them process data outside Kazakhstan. The current list of sub-processors is available on request, and we walk your security team through the data flow before rollout.
Is the text of attached documents pseudonymised?
No. Pseudonymisation applies only to the messages you type: IIN, BIN, IBAN, phone numbers, e‑mail addresses and, on a best-effort basis, personal names are replaced with placeholders before the message reaches the AI model. It does not cover the text of attached documents or document text indexed for search. Nor does it cover the web-search queries that court practice analysis builds from your dispute description and sends to its search provider.
Is two-factor authentication mandatory?
No, it is optional. Each user can turn it on with any authenticator app that supports TOTP.
What is encrypted?
Connections between your browser and AdiletAI use TLS 1.2/1.3. The files you upload are encrypted at rest and served only through authenticated downloads.
Can we delete our documents and chats?
Yes. You can delete documents, vaults and chats at any time.
What if we need a dedicated deployment or special data-residency terms?
Talk to us before rollout: book a demo or write to us, and we will discuss your requirements.
Third parties
AI providers and sub-processors
AdiletAI uses third-party AI model and search providers, and some of them process data outside Kazakhstan.
The current list of sub-processors is available on request. Before rollout, we walk your security team through the data flow, from your browser to each provider and back.
Request the sub-processor listNeed a dedicated deployment or special data-residency terms? Talk to us
From your browser to AdiletAI
Over a connection encrypted with TLS 1.2/1.3.
Identifiers are pseudonymised
Before your typed message is sent to the AI model, the personal identifiers AdiletAI detects in it are replaced with placeholders. Attached documents, document text indexed for search and court practice search queries are not masked.
Third-party providers
AI model and search providers process the request. Some of them process data outside Kazakhstan.
Back to you
AdiletAI restores the identifiers in the answer you see.
Preparing a security review?
Book a demo and we will walk your security team through the data flow before rollout. The current sub-processor list is available on request.
Or write to support@adiletai.com