Enterprise-grade security for in-house legal teams.

Wordsmith is SOC 2 Type II certified, GDPR compliant, and built on infrastructure trusted by the world's most security-conscious enterprises. Your data is encrypted, isolated, and never used to train AI models.

Trust center

Legal professional reviewing documents at a desk

The Gold Standard, Coded.

Customer logos including Multiverse, Trustpilot, Belron, BT, and Canva

Trusted by the best in-house teams.

The most security-conscious legal teams choose Wordsmith because security isn't an add-on - it's the foundation everything is built on.

Padlock badge illustrating encryption at rest and in transit for legal data

Encrypted, always.

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+), making it unreadable to unauthorized parties.

Database icon illustrating isolated, customer-specific data storage

Your data is yours alone.

Your data is kept completely separate from other customers. No co-mingling, no cross-contamination.

Graphic illustrating that customer data is not used to train AI models

We don't train on your data. Period.

We have a contractual, zero-data-retention commitment with our AI providers. Your data is never used to train their models.

Handshake graphic symbolising trusted cloud infrastructure and data residency

Built on a foundation of trust.

Hosted on AWS, with EU data residency by default and US available. Either way, your data sits on infrastructure certified to ISO 27001, SOC 1/2/3, PCI DSS Level 1, and more

Key icon illustrating customer control of access, SSO, and authentication

You hold the keys.

Access to your data is strictly controlled. We support Single Sign-On (SSO) to give you full control over user authentication, and our internal access policies follow the principle of least privilege.

Independently certified. Continuously verified.

SOC 2 Type II

Independently certified

GDPR

Fully GDPR compliant.

Customer data

We don't train on customer data.

Explore Security Portal

AI INFRASTRUCTURE

Multi-provider AI. Zero data retention across every provider.

Wordsmith operates across multiple leading AI providers. All are engaged under contractual zero data retention terms. Prompts and outputs are not stored, logged, or used for model training by any provider.

OpenAI

Zero data retention under API Data Usage Policy.

Anthropic (Claude)

Zero data retention under Commercial Terms.

Google (Gemini)

Zero data retention under paid API Gemini Terms.

FAQ SECTION

Frequently asked questions

We've compiled the most important information to help you get the most out of your experience. Can't find what you're looking for? Contact us.

What data security measures does Wordsmith have in place?

Wordsmith is SOC 2 Type II certified and GDPR compliant. All data is encrypted in transit (TLS) and at rest (AES-256). Data is hosted on AWS with EU data residency by default and US available. Annual independent penetration testing is conducted.

How does Wordsmith protect attorney-client privilege?

Wordsmith is designed to maintain attorney-client privilege. Client data is never used to train AI models or for any purpose beyond service delivery. Wordsmith's architecture aligns with ABA Formal Opinion 512. Upon completing security due diligence, legal teams can use Wordsmith for confidential work with the same confidence as any enterprise-grade tool in their stack.

Which AI providers does Wordsmith use, and do they train on customer data?

Wordsmith uses OpenAI, Anthropic (Claude), and Google (Gemini) via paid enterprise APIs. All three operate under contractual zero data retention policies. Customer data is never used to train their models. Provider policies are available in our Trust Center.

Where is customer data stored and processed?

Customer data is stored on AWS infrastructure. EU data residency is the default, with US available, based on their compliance requirements. Data is encrypted at rest and in transit. Wordsmith does not transfer data outside the customer's chosen region without explicit consent.

Does Wordsmith support Single Sign-On?

Yes. Wordsmith integrates with enterprise identity providers including Okta, Azure Active Directory, and Google Workspace. SSO is supported via OIDC and SAML 2.0. Multi-factor authentication and role-based access control are available to all enterprise customers.

Is customer data used to train Wordsmith's AI?

No. Wordsmith does not use customer data to train its AI models or improve the platform for other customers. Zero data retention agreements with all underlying LLM providers ensure this at the infrastructure level as well.

How does Wordsmith handle data retention and deletion?

Customers retain full control over their data. Data can be permanently deleted at any time. Upon contract termination, all customer data is permanently deleted from Wordsmith's systems. Custom retention policies can be configured to align with internal data governance requirements.

What compliance certifications does Wordsmith hold?

Wordsmith currently holds SOC 2 Type II certification and is GDPR compliant. Annual independent penetration testing is conducted. ISO 27001 certification is in progress. Full documentation is available in our Trust Center.

Are legal professionals required to disclose AI use to clients?

Disclosure obligations vary by jurisdiction and bar association. Some recommend disclosure for substantive AI use; others do not require it for internal tools. Legal teams should review ABA Formal Opinion 512 and applicable local bar guidance. Wordsmith supports professional legal judgment, not replaces it.

What is Wordsmith's data breach notification process?

Wordsmith maintains a formal incident response plan. In the event of a confirmed data breach, affected customers will be notified within 72 hours, or as required by applicable law, with full details and remediation steps. The incident response plan is available in our Trust Center.

BOOK A DEMO

Ready to transform your legal department?

See how the world's leading legal teams are building the future of in-house legal.

Book a demo