Trust & Confidentiality
Understanding how Barrow handles your legal documents with managed processing and ephemeral storage.
What We Do
Barrow processes your uploaded documents to provide:
Structured summaries — Executive summaries and plain-language explanations
Key clause identification — Important provisions highlighted with brief excerpts
Risk flag detection — Potential issues identified with severity ratings
Entity extraction — Parties, dates, jurisdictions, and amounts
Next steps — Surfacing deadlines, required responses, and/or follow-up tasks.
Document-grounded Q&A — Ask questions and receive answers with citations
Export — Output can be exported and refined by the team.
Optional Saved Content
Memo-Style Outputs (Optional)
If enabled by your firm administrator, we save memo-style analysis outputs to your matters:
Executive summaries and plain-language summaries
Risk flags with severity ratings
Key clause highlights
Entity extractions
Brief citations (1-3 sentences max, not full excerpts)
These memo outputs can persist even after the source document is deleted, providing a work product reference without retaining the full document.
Chat History (Configurable)
By default, chat conversations are saved for your reference. Your administrator can disable chat history saving for enhanced privacy ("Private Mode"), in which case conversations are not persisted after the session ends.
Infrastructure & Compliance
Barrow is built on infrastructure providers that meet rigorous, independently audited security standards. Every layer of the stack — from hosting to payments to AI processing — is operated by a provider that has undergone SOC 2 certification.
Hosting & Deployment — Replit SOC 2 Type II certified. Barrow's application runs on Replit's infrastructure with encryption in transit and at rest.
Database — MongoDB Atlas SOC 2 Type II certified. User data and account information are stored in MongoDB Atlas with encryption at rest and network-level access controls.
File Storage — Google Cloud Storage (via Replit App Storage) SOC 2 Type II certified. Uploaded documents are stored temporarily in Google Cloud Storage with encryption at rest and in transit. Documents are automatically deleted within 24 hours by default, or immediately on request.
AI Processing — OpenAI SOC 2 Type II certified. Document text is sent to OpenAI for analysis over encrypted connections. OpenAI does not use Barrow customer data to train its models.
Application-Level Security Controls
In addition to the infrastructure above, Barrow implements the following controls at the application level:
Encryption in transit (TLS) for all connections
Encryption at rest for stored data
Role-based access controls for multi-user accounts
Automatic document deletion (24-hour default retention)
Immediate manual deletion available at any time
Audit logging of document uploads and deletions
Secret management for all API keys and credentials
No client document retention beyond the configured retention window
A Note on Transparency
Barrow does not hold its own SOC 2 certification at this time. Pursuing company-level SOC 2 certification is on our roadmap as we grow. What we can tell you today is that every infrastructure provider in our stack has been independently audited, and our application-level controls are designed with SOC 2 readiness in mind.
If your firm requires specific compliance documentation or has questions about our security practices, contact us at hello@barrow.legal.