How Voxium Legal handles your client’s medical file
Your case file is your client’s medical record. Voxium Legal is built so that it stays yours: one firm per workspace, nothing pooled, nothing used to train anyone’s model, every AI statement cited to a page you can open, and a delete that actually deletes. The specifics your IT or risk reviewer will ask for are below.
What we store, and why
Your documents. When you upload a file we extract its text (scanned pages are OCR’d), index it for search, and keep the original so you can download it, export the whole case file, or produce a copy for the other side. Everything — original, text, index, summaries, chronology, grid, highlights, Voxie transcript — is tied to your firm’s workspace and to the case you filed it in.
What Voxie writes. Summaries, chronologies, the case grid, answers and drafts are stored with the case so you can review them. They are draft work product: every finding is cited to a document and page, and the citation is a link that opens that page. A citation that cannot be matched to a document in your case stays plain text — Voxium never dresses up an unverified reference as a link.
Account and usage data. Name, work email, title, a salted scrypt hash of your password (never the password), pages processed, voice minutes, questions asked, plan status. Card details are held by Stripe, not by us.
Where it lives
- Hosting and the live database: Railway (United States), on managed, access-controlled infrastructure.
- Off-site backups: nightly, encrypted at rest, on Cloudflare R2 (United States), rotated every 30 days.
- In transit: TLS everywhere, including between our servers and every provider below.
- Production access: limited to authorized personnel with multi-factor authentication; administrative actions are logged.
One firm per workspace
Every query in the application is filtered by workspace identifier — cases, documents, search indexes, chats, highlights, shares. There is no shared pool and no cross-firm view; tenant isolation is covered by the automated test suite that runs before each release. Seats are added by invitation from the workspace owner; invitations are single-use. Passwords are hashed with scrypt and a per-user salt; sessions are HttpOnly cookies over HTTPS, and repeated failed sign-in attempts are rate-limited.
AI processing, and what does not happen to your data
Document analysis and Voxie run through the Anthropic API under our commercial agreement; speech runs through ElevenLabs. Under those agreements, content sent for processing is used only to return the result to you and is not used to train models. Analysis is generated per request from the documents in your case — Voxium does not build a cross-client corpus out of case material.
Voxie’s live research (PubMed, CourtListener, the State Bar of California, the Department of Consumer Affairs license lookup) sends only the search itself — a citation, a name, a license number — never your documents. What comes back is shown as the source returned it, with a link, and dated.
Sharing, on your terms
- Share with another firm creates a link plus an access code, with an expiry you set. You pick the documents; anything marked privileged / work product is listed separately and is never included unless you tick it and confirm by name.
- Production copy is a ZIP of original documents only, in their folders, with privileged documents and all work product (notes, drafts, summaries, chronology, highlights, Voxie transcript) left out — and a README that says so.
- Records intake links let a copy service or provider drop records straight into one case with no login and nothing else visible; each upload is filed, page-counted and logged, and the link can be revoked at any time.
- Every open, download and refused attempt on a share is logged with time, IP address and browser, and the workspace owner can revoke a link at any time.
Deletion means deletion
Delete a document and its original, text, index entries and highlights go with it. Delete a case and every document, summary, chronology, grid and chat message in it is removed. Delete the workspace (owner, typed confirmation) and everything is gone from the live database immediately and from encrypted backups on the 30-day rotation. You can export the full case file at any time before you do.
Who we work with (subprocessors)
Anthropic (language models) · ElevenLabs (speech) · Railway (hosting and database) · Cloudflare (encrypted backups) · Resend (transactional email) · Stripe (payments) · GitHub (source code only, no customer data). All United States. We post changes here and email workspace owners before a new subprocessor handles customer data. Full detail is in the Privacy Policy.
For the risk reviewer
- Built with HIPAA-grade safeguards (the items on this page); not represented as HIPAA-certified. If your firm is a HIPAA covered entity or business associate and needs a signed Business Associate Agreement, ask — available on Firm-plan agreements.
- Breach notification as required by law, including California Civil Code § 1798.82.
- No advertising cookies or trackers; one session cookie, plus a six-hour cookie on share pages that remembers a correctly entered access code.
- No sale or cross-context sharing of personal information.
What this is not
Voxium Legal is document-review software for legal professionals. It is not a law firm, it does not give legal advice, and its output is draft work product for the responsible attorney’s review before it is relied on or filed. AI can be wrong; every finding is cited to a document and page so it can be checked against the source.
Questions from your firm’s IT or risk reviewer are welcome — write to info@voxiumlegal.com and we will answer them directly, not with a form.