Security & trust
Confidentiality is the foundation.
Legal data is among the most sensitive there is. Here's how Copacetic keeps your clients' information safe.
Encryption everywhere
All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Document shares are individually encrypted.
Authentication
Sign-in uses secure authentication, with support for SSO and two-factor authentication on every account.
UK data residency
Your data is stored in UK data centres operated by ISO 27001-certified providers, and is never sold. Any AI provider we use is contractually barred from training on your data.
Access logging
Every document view, download and share is recorded in an immutable audit log you can review at any time.
Granular access
Role-based permissions and per-matter access keep client confidentiality intact, including for external collaborators.
Compliance
We operate in line with the UK GDPR, the Data Protection Act 2018 and SRA expectations for client confidentiality.
Found a vulnerability? Email security@copacetic.legal — we respond to all reports within one business day. See our vulnerability disclosure policy for scope, ground rules, and safe harbor.
Security headers
Copacetic’s core application — where your firm’s matters, documents, and data live — is independently rated A+ for security headers by securityheaders.com (cross-site scripting protection, strict transport security, and related browser-level controls), as of August 2026. Our public marketing pages, including this one, use a marginally relaxed policy to preserve fast load times for visitors, and are independently rated A. Both are checked on a recurring basis as part of our ongoing security review.
Lutey AI assistant
Guardrails, not promises
Lutey is built for legal work — which means it must be provably constrained, not just told to behave. Five independent enforcement layers sit between a user message and any response, and every guardrail trigger is logged to your audit trail.
Fast pattern matching catches advice-extraction, citation fabrication, and scope-escape attempts before they reach the AI. Free, deterministic, first.
A lightweight model classifies every message. Below a confidence threshold Lutey asks a clarifying question rather than guessing.
Before any legal-information response is returned, the output is scanned for unsourced legal statements. Violations are stripped or regenerated.
Lutey can only call a fixed list of approved tools — no arbitrary code execution, no external API calls, no reads outside your workspace.
Every write action requires your explicit approval before it executes. Lutey inherits your own access entitlements via RLS — it can't touch data you can't.
Independently red-teamed by a separate AI model family. Attack prompts were generated by Anthropic Claude — a different model family from the Gemini models that power Lutey — seeded with known-weak patterns, multi-turn trust-building sequences, and document-injection variants. Using a different model family as the attacker removes the blind spots that come from testing a model against itself. Results are versioned in our internal methodology log; the figures above are sourced from it exactly.