Security
VSSQ holds pre-release work product for small trademark firms. The architecture assumes malpractice-grade confidentiality: tenant isolation, human-only release, and no silent cross-client access.
| Area | Practice |
|---|---|
| Transport | TLS 1.3 for all browser and API traffic |
| At rest | AES-256 encryption; per-tenant storage prefixes |
| Tenant isolation | Row-level isolation in the database; a link identity resolves to one matter and never joins across clients |
| Outside links | 128-bit tokens, hashed at rest; default expiry; optional email gate; watermark on review links where enabled |
| Model training | No training on firm or client content; provider zero-retention settings |
| Legal | Alignment note with ABA Formal Opinion 512 on generative AI; confidentiality rider; GDPR DPA and SCCs for EU/UK firms |
| Audit | Append-only logs for state changes and guest access; export for client matters on Pro |
AI in VSSQ does not send filings, release deliverables, or approve parts. See pricing for tiers and product overview.
FAQ
- Is client data used to train AI models?
- No. Contractual prohibitions with model providers, zero-retention inference modes where available, and firm instructions gate what enters a prompt.
- How do client and third-party links work?
- Share links use high-entropy tokens stored as hashes at rest. Links are single-matter, expiring, revocable, and access is logged. Revoked or rotated links return gone — not a silent redirect.
- Do you offer a DPA?
- Yes. A standard data processing agreement, subprocessor list, and pre-answered security questionnaire are available for firm review before purchase.