Security & compliance

Client confidentiality,
guaranteed by technology.

Case data is stored local-first on the lawyer’s desktop, external AI calls can be turned off per matter, and any external send always requires the lawyer’s approval. Designed to comply with Korea’s Personal Information Protection Act (PIPA).

Design principles

Four security principles.

01
Local-first storage

Case materials (PDFs, recordings, evidence) are stored first on the legal professional’s desktop app. Cloud sync runs only when explicitly enabled, on a per-matter basis. Matters can be reviewed and drafts written even offline.

02
Human-in-the-Loop

The AI never sends anything to clients, courts, or outside parties automatically. Every external deliverable (report, brief, contract) passes through an explicit professional approval step. The last click of any automation is always made by a human.

03
Citation-First (no hallucinations)

Citations to case law and statutes are generated only from results pulled directly from official legal databases — in Korea, the Supreme Court, national statute, and constitutional decision sources, with more jurisdictions being added. Answers without a citable basis are refused outright.

04
External-call control · per-firm isolation

Calling an external AI model is optional per matter. Turn on the "Never" sync mode to block external calls entirely and use only local models. Per-firm data isolation applies.

Sync modes

Configured per matter.

Choose a cloud sync policy per matter, based on how sensitive the case is.

Push
Recommended default

Local → cloud, one way. For backup and sharing. The most conservative default.

Pull

Cloud → local, one way. For importing a matter created by another professional.

Mirror

Two-way, real time. For matters worked on as a team.

Never
Maximum security

Fully local. Never goes to the cloud. For highly sensitive matters.

Data flow

What flows where.

Source Destination What is sent
Professional’s desktop MeshLaw gateway (in-country region) Auth token + AI request (includes case context)
MeshLaw gateway External AI model AI inference request (optional per matter; blockable via Never mode)
MeshLaw gateway Official case-law / statute sources Case-law and statute search queries (no case materials)
Court e-filing system Professional’s desktop Filed directly with the professional’s certificate (does not pass through MeshLaw servers)

E-filing is done directly from the desktop with the professional’s certificate and does not pass through MeshLaw servers.

Compliance

Aligned with local standards.

Data residency
In-country region (currently Seoul). Regional data-residency options available on request.
Encryption
TLS 1.3 in transit. AES-256 at rest. Sensitive identifiers (e.g. national ID numbers) get additional column-level encryption.
Access control
Per-organization data isolation (row-level permission separation). Minimized staff access with audit logging.
Certification
Regional certifications in progress — in Korea, KISA ISMS-P (Phase 2 goal). SOC 2 Type II under review (Phase 3).
Contracts
DPA (data processing agreement) template provided. Amendable after legal-team review.
Backup & recovery
Daily snapshots (PITR, 7 days). Per-organization data export available anytime.
Incident response
Notification within 24 hours of becoming aware of a breach. Compliance with applicable breach-reporting obligations (in Korea, KISA).
Review materials

Documents for legal-team review.

We provide the standard documents needed when evaluating adoption. Our sales team sends them when you inquire about adoption.

DPA · data processing agreement template

Standard data processing agreement template. The form can be amended after legal-team review.

Request →
Security white paper · technical document

Details on encryption, access control, audit logging, and incident response. For legal and IT teams to review.

Open white paper →
FAQ

Frequent security questions.

Start your legal-team security review.