Why this approach is safe

The clearest way to explain how VaultScribe protects client data is to follow one client call from the moment it starts until the day its key is destroyed. Then the threats, the encryption, and who holds the keys.

Josef LongOctober 17, 20267 min read

The short version

Client data stays on the firm's own machines, so there is no vendor copy to breach. Everything stored is encrypted with 256-bit keys, with a separate key for each matter, recording and voiceprint, and the firm holds the keys. Anything that leaves goes through one door and is logged. Deleting a record means destroying its key, and the proof is a signed certificate.

One client call, start to finish

Take a Tuesday call with a client, and follow what happens to it.

  1. 10:00

    The call starts

    VaultScribe asks on your computer whether to transcribe. No bot joins, and no third party is in the room.

    on your machine
  2. 10:00

    The recording is encrypted as it is written

    The matter's key protects it from the first second. The capture process is designed not to write a plaintext file.

    the matter's key
  3. 10:42

    Notes and a deadline are drafted

    The speech and AI models run on your computer, in a sandbox with no network access. They produce a summary, next steps and a proposed deadline.

    no network
  4. 10:50

    A lawyer reviews

    The notes stay marked as AI-generated until a lawyer signs off. The deadline stays a proposal until it is confirmed.

    a person decides
  5. 10:58

    You click Send

    The follow-up email goes out through your own account. One line is added to the log: when, where and why, never what was sent.

    one door, logged
  6. Two years later

    The retention period ends

    The matter's key is destroyed. The data becomes unreadable wherever a copy might sit, including backups.

    key destroyed
  7. Same day

    A certificate is issued

    It records what was destroyed, why, and that no legal hold covered it. It is signed, so anyone can verify it.

    signed record

The boundary around your data

Everything in that story happens inside one boundary. The firm's computers, and optionally a firm server, hold the data and the keys. One door leads out, and every request through it is logged. VaultScribe, the company, sits outside the boundary and holds no client data.

YOUR FIRM Computer KEY IN THE CHIP Computer KEY IN THE CHIP Firm server OPTIONAL RECOVERY HELD BY THE FIRM Data and keys stay inside. ONE DOOR OUT AND LOGGED OUTSIDE Connectors OPT-IN Cloud AI OFF BY DEFAULT VaultScribe NO CLIENT DATA
The boundary: data and keys inside, one logged door out, and no vendor copy.

What happens if something goes wrong

The same attack looks very different depending on where the data lives. In a typical cloud service, many firms' recordings sit in one place, so one breach reaches all of them. Here there is no vendor-run central store to breach, and each firm's files are encrypted under that firm's own keys, on the firm's own machines or its own server.

A TYPICAL CLOUD SERVICE Firm A Firm B Firm C Firm D Vendor servers EVERYONE'S DATA IN ONE PLACE One breach exposes every firm. VAULTSCRIBE Firm A OWN KEYS OWN MACHINES Firm B OWN KEYS OWN MACHINES Firm C OWN KEYS OWN MACHINES Firm D OWN KEYS OWN MACHINES No central copy to breach.
Where a breach lands. Left: one vendor store holding every firm's data. Right: separate firms, separate keys.

The threats, one by one

The threatCloud AI service, oftenVaultScribe
A breach of the vendor's serversMany customers' recordings and transcripts sit in one place to steal.The vendor holds no client data, so there is nothing at the vendor to steal.
A lost or stolen laptopDepends on the disk and the user's settings.Content is encrypted at the application level whether or not the disk is. The top key sits in the security chip, and an idle lock wipes keys from memory.
A curious person inside the firm, or an administratorOften able to read everything the tool holds.Matter walls are enforced by keys and policy. Administrator roles do not include matter content.
A document or email that tries to instruct the AIThe text may be followed as if it were an instruction.Outside text is read in a quarantined step that cannot write or send. Anything that sends data out waits for a click.
A tampered update or a swapped AI modelThe customer trusts the vendor's delivery.Releases, updates and models are signed and verified before they run.
Someone editing the logs afterwardLogs can often be changed by an administrator.The audit log is chained and signed, so an edit or deletion shows.

The encryption, method by method

Stored content, including audio, video, transcripts, notes, the search index, caches and temporary files, is encrypted at the application level, whether or not the disk is also encrypted. These are published standards that outside reviewers already know how to assess.

What it protectsMethodWhy this one
Notes, transcripts, search indexAES-256The standard for strong symmetric encryption, with a separate key for each matter.
Recordings and filesChaCha20-Poly1305Authenticated encryption: it hides the content and also detects any change to it.
Passwords and recovery codesArgon2idDeliberately slow and memory-hungry, which makes guessing expensive.
Recovery keysHPKEWraps recovery keys to the firm's own escrow key, which can be split among several people.
Releases, updates, models, audit checkpointsEd25519Proves each item came from who it claims and has not changed.
Fingerprints of files and log entriesSHA-256, BLAKE3Any change to a file or a log entry changes its fingerprint.
The top keyTPM 2.0, Secure EnclaveWhere the computer has a security chip, the key lives in it and cannot be copied off.
Anything permitted to leaveTLSWhatever the firm allows out is encrypted in transit.

Who holds the keys

The firm does. A separate key protects each matter, each recording, and each person's voiceprint, which is kept in its own registry. Matter keys are released only by a policy decision for a stated purpose and a limited time. The top key sits in the computer's security chip where there is one. Recovery belongs to the firm, and VaultScribe does not hold it.

Design preview: the Security screen showing the encryption key held by the computer's security chip, unlock methods, and recovery held in the organization's escrow
Security settings: the key is held by the computer's security chip, unlock methods are the firm's choice, and recovery sits in the organization's own escrow. Sample data.

One door out, and proof you can check

Every outside connection needs a configured integration and an allowed host. Each request is written to an append-only log the user can read, and the log can be exported as a CSV or a signed copy. A verification kit lists the hosts an installation may contact, runs a firewall test, and includes a software bill of materials, so the claim can be checked with your own firewall.

Design preview: the egress log listing each request that left the machine, with destination, purpose and size, including one refused request
The log of outside requests. A request to a host that is not allowed is refused and recorded. Sample data.
Design preview: a verification kit showing the hosts the installation may contact, a firewall test with its result, and a software bill of materials
The verification kit: allowed hosts, a firewall test and a software bill of materials. Sample data.

Deleting, and proving it

When a record reaches the end of its retention period, or a client asks for deletion, its key is destroyed and the data becomes unreadable. A legal hold stops that for the matters it covers. The audit log is chained entry to entry, with signed checkpoints, so a firm can prove what happened without keeping the content.

Design preview: a disposition certificate listing what was destroyed, why, the retention policy that applied, that no legal hold covered it, the keys destroyed, and signatures that verify
A disposition certificate: what was destroyed, why, that no hold covered it, and signatures a reader can verify. Sample data.

Software and AI you can trust

What about quantum computers?

This is the question a careful buyer asks, so here is the plain answer, in three parts.

  1. Stored data uses 256-bit symmetric encryption. Quantum computers are widely expected to weaken this kind of encryption far less than they break today's public-key methods, and 256-bit keys are generally regarded as keeping a wide margin.
  2. The public-key parts are the ones to watch. Public-key cryptography, used for wrapping recovery keys and for signing, is the part quantum computers could eventually break.
  3. The practical risk is "harvest now, decrypt later." That means someone records encrypted traffic or stolen data today, planning to crack it years from now. Keeping client data on the firm's own machines, with no vendor copy and no routine uploads, leaves far less to harvest.

Questions

What encryption does VaultScribe use?

Stored content is encrypted at the application level with 256-bit keys, using AES-256 and ChaCha20-Poly1305. Passwords and recovery codes use Argon2id, recovery keys are wrapped with HPKE, and releases, updates and models are signed with Ed25519. Anything permitted to leave travels over TLS.

Who holds the encryption keys?

The firm. The top key is held by the computer's security chip where one exists, and recovery belongs to the firm. VaultScribe does not hold the firm's recovery keys.

Is VaultScribe safe against quantum computers?

Stored data uses 256-bit symmetric encryption, which quantum computers are widely expected to weaken far less than they break public-key methods. The public-key parts, used for key recovery and signing, are the ones quantum computers could eventually break. Keeping data on the firm's machines also leaves far less to harvest.

Can I check these claims myself?

Yes. Every outside request is written to a log you can read, and a verification kit lists the hosts an installation may contact, runs a firewall test, and includes a software bill of materials, so the claims can be checked with your own firewall.

What happens if a document tries to instruct the AI?

Outside text is read in a quarantined step that cannot write or send anything, and any action that would send data out waits for a person's approval.

Where is client data stored?

On the firm's own machines and, optionally, a firm server. VaultScribe, the company, holds no client data.

Questions about security?

Ask me directly. I am looking for a small number of founding design partners, with a non-binding letter of intent and terms agreed on a call.

Ask a security question Become a design partner

Related: Private legal AI and Legal AI agent for law firms. General information, not legal or security advice.