Security & Privacy
PleadFlow handles court filings, client instructions, case strategies, and confidential legal communications. We take that responsibility seriously. This page explains how your data is protected, who can access it, and what happens when you choose to delete it.
What advocates ask us
Yes. Your case facts, client names, documents, conversation history, and generated drafts are private to your account. No other PleadFlow user — including users from other firms — can access your data. Our system is designed so that each account's data is completely separated from every other account.
Access to user data within PleadFlow is restricted to a small number of personnel who need it to operate, maintain, or support the platform. This access is logged and limited to what is necessary. We do not browse user documents or conversations as a matter of course.
No. Your case facts, client information, uploaded documents, and generated drafts are never used to train or improve any AI system. What you draft in PleadFlow stays in PleadFlow.
Documents and files you upload or generate are stored with encryption and private access controls. They are not accessible through any public URL. Only authenticated users within your account can retrieve them. Connections between your browser and our platform are encrypted in transit.
Within a firm account, access to a matter is limited to team members who have been assigned to it or who are firm administrators. Clerks and associates can only see matters they have been given access to. All access is based on the role assigned to each team member.
Your password is stored as a one-way hash — we cannot recover it, only reset it. Login attempts are rate-limited to prevent automated attacks. If you believe your account has been compromised, contact us immediately and we will help you secure it.
If we become aware of a security incident that affects your data, we will notify you as required by applicable law. We investigate all suspected incidents, contain the impact, and take steps to prevent recurrence. We will tell you what happened, what data was involved, and what we have done about it.
How we protect your data
01
All documents, case conversations, and uploaded files are encrypted when stored and when transmitted between your browser and PleadFlow. Connections use current industry-standard encryption protocols.
02
Files you upload or documents PleadFlow generates are stored privately. There are no public links, no shared access, and no way for another user to reach your files without being explicitly in your account.
03
Passwords are stored using a strong one-way hashing method. Login requests are rate-limited. Sessions are managed securely and can be revoked. Sensitive administrative functions use separate, more restricted sessions.
04
Firm accounts use role-based access — partners, associates, and clerks each have permissions appropriate to their role. Matter access is controlled so team members only see what they need to.
05
Every PleadFlow account — individual, advocate, or firm — is completely isolated. There is no path by which one account's data can be accessed by another, whether by another user or another firm.
06
PleadFlow runs on infrastructure built for sensitive workloads, with DDoS protection, automated backups, and continuous security monitoring.
07
PleadFlow is a legal procedure engine. Your case facts and client information are used only to produce documents for your matters — never to train or improve any AI system.
08
We apply request limits across the platform to prevent automated abuse, brute-force attacks, and API misuse. Known malicious patterns are blocked before they reach application code.
AI & your data
PleadFlow is a legal procedure engine. The court formats, jurisdiction rules, document structures, cause title conventions, and legal corpus are built into PleadFlow. When you draft a petition, PleadFlow applies its own legal knowledge to structure the document correctly for your specific court.
Your case facts and client information are used only to produce documents for your matters. They are not used to train or improve any AI system, and they are not shared with any third party for that purpose.
What you draft in PleadFlow stays in PleadFlow.
The facts, arguments, and legal positions you develop in PleadFlow are used only to generate your documents. They do not improve or influence any AI system.
FIRs, charge sheets, orders, agreements, and any other documents you upload are used only to assist with your specific matter. They remain private to your account.
The structured memory PleadFlow builds from your case discussions is scoped to your matter, visible only to you, and deleted when you remove the matter or close your account.
The court formats, procedure rules, and legal corpus that make PleadFlow accurate are built and maintained by PleadFlow — they are not derived from your data.
Data retention & deletion
You control your data. Here is what happens when you delete something — or when you close your account entirely.
When you delete a document from a matter, it is removed from your workspace and from storage. It will no longer appear in your account or be accessible to you or anyone else.
Deleting a matter removes the matter workspace, all documents associated with it, all case memory, and all AI conversations linked to it. This action cannot be undone.
If you close your PleadFlow account, your personal data, documents, conversations, and case memory are scheduled for deletion. We retain only what is required by law — for example, billing records for GST compliance — and delete everything else.
If your paid subscription lapses or is cancelled, your account reverts to the free plan. Your data is retained and accessible. We do not delete your data simply because a subscription ends.
We maintain backups for disaster recovery. When you delete data, it is removed from live systems promptly. It may persist in encrypted backups for a short period before those backups are cycled. We do not restore deleted data from backups except in the event of a system failure affecting your account.
Security incidents
No system is perfectly immune to incidents. What matters is how we respond when something happens.
When we become aware of a potential security incident — through our own monitoring or through a report — we treat it as a priority and begin investigation without delay.
Where an incident is confirmed, we take steps to limit its scope — restricting access, revoking affected sessions, or isolating affected systems as appropriate.
If your data is affected by a confirmed security incident, we will notify you. We will tell you what happened, what data was involved, and what we have done. We do this because you deserve to know, and because applicable law requires it.
We investigate how the incident occurred and take steps to prevent it from recurring. We do not consider an incident closed until the underlying cause has been addressed.
Legal framework
PleadFlow is an Indian company operating under Indian law. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
Under applicable law, you have the right to access the personal data we hold about you, request corrections, and request deletion. You can exercise these rights by contacting us at care@pleadflow.com.
Our full Privacy Policy explains in detail how we collect, use, and store personal data, and how to exercise your rights.
Found a security issue?
If you discover a vulnerability or a security concern with PleadFlow, please report it to us directly and responsibly. We take all reports seriously and will investigate promptly.
Please do not disclose the issue publicly until we have had the opportunity to review and address it.