Built so a carrier's IT questionnaire is a formality.
Metadata only, by design
No document body, attachment or line of text ever enters the system. There is nothing sensitive to leak, because the sensitive part never arrives.
Deterministic, with no model in the matching path
Nothing is trained on your data, and no probabilistic guess decides whether two documents are the same. The matching is code, and you could audit it line by line.
Isolation that fails closed, tested on every build
Row-level security and client-scoped keys, plus an adversarial cross-tenant test that has to pass on every commit before anything ships.
Hash-chained audit log
Every decision is traceable, and the chain is what makes tampering show.
US-region hosting, full export, month to month
There is no per-gigabyte meter and nothing held hostage. Cancel whenever you like and take all of it with you.
Decisions of record stay human
PriorCall suggests; it never overwrites a coding call. That posture is deliberate, and it comes from FRCP 26(g) and ABA Opinion 512 rather than from taste.
One firm, one client, one vault.
Your carrier clients are sometimes each other's adversaries, so the boundary between them is structural rather than configured. Row-level security that fails closed, composite keys that make a cross-client reference impossible to write, and queries that take client scope as an input.
An adversarial test seeds two clients with byte-identical documents and asserts zero crossover. It runs on every build and has never been allowed to fail. There is no switch to leave off.
