Loading
Your legal documents contain some of the most sensitive information in your life. We built SynthCounsel with a simple principle: your data is yours, and no one else's.
These aren't marketing slogans. They're architectural decisions built into the product.
We run limited, event-based product analytics (PostHog) to understand feature usage and improve reliability — no ad pixels, no data brokers, no advertising use. Signed-in activity is linked to a pseudonymous account ID, never your name or email. Your documents, case files, and AI conversations are never sent to analytics. Error monitoring (Sentry) captures crash reports with personal data off and inputs masked.
Your documents, case details, and AI conversations are never used to train AI models. When we send text to AI providers for document generation, we use API configurations that explicitly opt out of training.
Your data is never sold, rented, or shared with advertisers or data brokers. We do rely on a set of named service providers: Supabase, Vercel, Upstash Redis, Stripe, Anthropic, Resend, PostHog and Sentry run the product itself; CourtListener, CFPB, GovInfo and Congress.gov receive the legal-source lookups Counsel makes on your behalf; Clio, DocuSign and LawPay are opt-in firm integrations, and they receive nothing until you connect them. The subprocessor table on our Privacy page is where we list these services and what each one touches.
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Database backups are encrypted. Uploaded documents are stored in encrypted object storage.
No API keys to manage. SynthCounsel covers the cost of every AI request as part of your subscription. We hold the relationship with Anthropic on your behalf and pass through their no-training data terms.
Every table that holds your data has Row Level Security enabled, and your ordinary requests run under your own signed-in session, so Postgres scopes those queries to your user ID. A set of server routes does not work that way — some build the service-role client in the handler, others reach it through a shared helper they import — and we would rather name them than have you find them: signup, account management, case management, document generation, upload and history, wizard PDF generation, AI chat, strategy tools, form fill, wizard analytics, support tickets, billing, professional verification, the firm workspace, firm integrations and the firm API all connect with a service-role key that bypasses RLS. On those routes the boundary is enforced in application code — the route handler, or the helper it calls, scopes what each request reads and writes to your own account or your organization.
We log the actions that change your file: document generation and download, deadline calculations, case creation, deletion and restore, document restores, account deletion requests, form fills, searches, receipts, and billing events. Each row carries a timestamp and the record it touched; generation and download rows also carry the request IP and user agent, and a generation row carries the app and rule-data versions that produced the document. Signing in is not one of those events, because the audit schema has no authentication action at all. The log is kept server-side for security, support and our own compliance record, and the database scopes each row to the account that produced it. There is no viewer for it on a consumer plan today, and this page is not promising one: the audit view and its export ship in the firm workspace.
This page is our security posture document. We believe security through transparency is stronger than security through obscurity. If you have questions, contact us.
When you generate a document, we send the minimum necessary context to the AI provider (Anthropic). This includes your case details and document parameters. We use API configurations that explicitly opt out of model training. Anthropic keeps that content for a limited, published period rather than deleting it the moment your document comes back — that schedule, and the narrow cases where content is held longer, are set out in the "How AI works" section of our Privacy Policy. We do not hold a zero-retention agreement with Anthropic.
Chat messages are sent to the AI provider for response generation only. Conversations are stored in your account (encrypted at rest) so you can reference them later. They are never shared with other users or used for training.
When you upload a document, the AI reads it to classify the document type, extract dates, and identify parties. This happens in a single API call. What Anthropic then does with that content is the same retention schedule as everything else we send — see our Privacy Policy.
How long the AI provider keeps what we send, and the narrow cases where it is kept longer, are stated in the Privacy Policy. That page is the controlling statement — this one summarises it and does not add to it.
Your documents are yours. Download them. Take them to any attorney. File them yourself. SynthCounsel uses no proprietary formats — everything you generate is a standard PDF or DOCX file that works everywhere.
Every generated document downloads as a standard PDF or DOCX. No proprietary viewer, no platform-only format, no export fee.
Export your cases, case details, deadlines, and document metadata as JSON at any time; the generated files themselves you download from Documents. Your data is never held hostage behind a cancellation flow.
The SynthCounsel MCP server is open-core. Use it locally, self-host it, or connect it to your own AI tools.
If you cancel today, you keep every document you generated — as standard files, in whatever folder you saved them to. That's the whole point.
Privacy isn't a feature. It's the architecture. We built SynthCounsel from day one with encrypted storage, row-level security, and limited privacy-first analytics that never touch your legal content. See also: Privacy Policy · UPL & Legal Disclaimer.