Private by construction
Causius handles legal letters. Each guarantee below is a property of the public code. None asks you to trust us.
Models are not told who
Before text goes to a model, personal details become placeholders, restored only after the answer returns. Detection is good, not perfect: check what is hidden.
- Found automatically: names, addresses, postcodes, emails, phone numbers, IBANs, AHV numbers, references, birth dates.
- Your own words to hide are always added.
- In the quick check this happens in your browser.
- Web searches go out with placeholders too.
- The exception is your voice: a recording goes to a speech service and cannot be hidden first. Causius does not store it, and typing never involves it.
Sealed at rest
Each matter has its own data key, sealed by a master key that is never in the database.
- AES-256-GCM, a fresh nonce per value, bound to its matter and purpose.
- Titles, messages, facts, deadlines, decisions and document text are sealed; only dates, statuses, sizes and the jurisdiction code are clear.
- Without the master key, a copy of the database is noise.
Nothing kept that is not needed
An upload is reduced to its text. A letter checked without an account is not stored.
- No users table, no passwords: only an OrangeCat account id.
- Logs record which model served a turn, never what was said. No analytics. The only extra script is the optional feedback widget.
A locked-down browser
Every page carries a strict content security policy.
- Scripts run only with a per-request nonce, and a page may talk to Causius and nothing else.
- No framing, no referrer, HSTS.
- API answers are never cached.
Only you decide
A matter opens only for the people in it. Anyone else gets the answer a missing matter gets.
- Actions that leave the matter are proposals only its owner can approve.
- Limits per account protect the shared models.
- Deleting a matter deletes all of it.
If it went wrong
What each party would hold if the worst happened.
A stolen database
Ciphertext, account ids and dates. No names, no letters. Deadline dates are readable.
A model provider's logs
Placeholders where the people were: [NAME-1], living at [ADDRESS-1].
Us, the operator
We run the server holding the master key, so we could be compelled. Keys only you hold are on the roadmap; until then, that is the honest limit.