Security & data
Written for the person who has to sign it. Compliance officers, DPOs, COLPs and privacy leads should be able to read this page and find the answer they need without emailing us.
What the AI does and does not do for you
We think it is important to be blunt about this, because it is where firms most often get into trouble.
What we do
- Answer inbound calls and qualify callers
- Book appointments into your calendar
- Send scheduled SMS and email follow-ups
- Collect documents and chase missing ones
- Log every action to a timestamped audit trail
- Generate draft summaries for a human to check
What we do not do
- Give legal, financial or insurance advice
- Replace your judgement or your supervision
- Guarantee compliance with any rule or regulator
- Sign off on anything that goes to a court or client file
- Make a final decision on a client matter
If you are a regulated law firm: AI output remains your responsibility
The Solicitors Regulation Authority published a Warning Notice on the misuse of AI on 17 August 2026, having received 42 reports of potential AI misuse in the twelve months to July 2026. Its position is that “AI has no separate legal personality; solicitors and regulated individuals who use AI in the course of delivering legal services remain accountable for their work and outputs, regardless of how that work was prepared.”
The SRA also treats reliance on an AI output as no defence when incorrect material reaches a court, and warns that entering confidential client information into a tool without adequate contractual, technical and organisational safeguards may breach client confidentiality — with legal professional privilege potentially waived permanently and unrecoverably.
We are a supplier, not a supervisor. That responsibility sits with your COLP and your supervising solicitors. Before deploying any FirstFront component into an SRA-regulated firm, your firm should put the deployment through its own governance approval, have the COLP sign off on the technology, confirm a written data-processing position for client data, put supervision systems in place able to cope with the speed of AI-assisted work, and build a process for verifying anything the platform drafts before it leaves the firm.
We support all of that with a written data-processing position and a signed agreement on request. We cannot take the supervisory role on your behalf.
AI and model policy
- Client data used to train models
- Never. No client data is used for model training, in any region, for any tier.
- Model providers
- Fine-tuned open-source and purpose-built models, hosted in our own environment
- Voice data retention
- Calls transcribed and audio discarded within 30 days unless you ask us to retain them
- Custom model training
- Enterprise tier only, on your own data, under a separate written agreement
- Human oversight
- Output is generated for a person to check. We do not present AI output as a professional judgement
Hosting, encryption and access
- Primary data region
- European Union (AWS eu-west-2, Ireland)
- UK data residency
- UK-resident hosting available on Enterprise tiers
- Sub-region failover
- eu-west-1 (London)
- Encryption in transit
- TLS 1.2+ on all endpoints
- Encryption at rest
- AES-256, KMS-managed keys with scheduled rotation
- Backups
- Encrypted, 35-day retention
- Access control
- Role-based, least privilege, enforced MFA for all staff
- Penetration testing
- Annual third-party test, summary report available under NDA
Retention and deletion
- Client portal data
- Retained for the life of the account
- Audit trail entries
- Immutable, append-only, retained for the life of the account
- Call audio
- 30 days unless you request retention
- Telemetry and logs
- 12 months
- Export on termination
- Complete export within 14 days
- Deletion after termination
- Secure deletion within 30 days
Sub-processors
These providers process client data on our behalf. We will notify you before adding or changing one.
| Provider | Purpose |
|---|---|
| FirstFront | Primary processor — platform, workflows, audit trail and support |
| Amazon Web Services | Infrastructure, storage and encryption key management |
| Underlying platform providers | Delivery layer for messaging and telephony. Named and documented in full during due diligence |
| Model providers | AI inference, running in our own environment with no client-data retention |
How we meet privacy law in your region
We apply the same standard everywhere — GDPR is the floor, not the ceiling. Where a local regime gives more protection, we follow the local regime.
UK GDPR
United KingdomData processing agreements, records of processing, and rights handling under UK GDPR and the DPA 2018.
GDPR
European Union and EEAArticle 28 processor terms, standard contractual clauses for any international transfer, and a European representative where required.
EU–US Data Privacy Framework
United StatesCertified transfer for data received from the EEA and UK. Where we are not certified for a given flow, we rely on SCCs or UK IDTA.
CCPA / CPRA
CaliforniaWe do not sell personal information. Consumer requests are handled within statutory timelines, and we support a customer's own obligation to respond.
PIPEDA
CanadaAccountability for processing, appropriate consent, and safeguards for personal information held in federally regulated organisations.
Privacy Act 1988
AustraliaAustralian Privacy Principles, including APP 8 — we will not transfer personal information offshore without your consent.
Privacy Act 2020
New ZealandPrivacy principles applied as we would under the GDPR, with direct notice to you rather than to individuals for corrections.
Exercising your rights
In practice, most requests are simplest handled through us rather than through a regulator directly. Ask us and we will deal with it.
UK, EU and EEA
Supervisory authority: ICO (UK) or your local Data Protection Authority
One month to respond, extendable by two further months for complex requests. We respond free of charge unless a request is manifestly unfounded or excessive.
United States
Supervisory authority: Your state Attorney General or the California Privacy Protection Agency
We support the customer in responding to verifiable consumer requests relating to personal information we hold on their behalf.
Canada
Supervisory authority: Office of the Privacy Commissioner of Canada
Access, correction and withdrawal of consent, plus complaint lodging rights.
Australia
Supervisory authority: Office of the Australian Information Commissioner
Access and correction requests, and complaint rights. Overseas transfers require consent under APP 8.
New Zealand
Supervisory authority: Office of the Privacy Commissioner
Access and correction, with privacy principles applied consistently with GDPR standards.
The full processor terms — scope, lawful basis, security measures, sub-processors, breach notification, audit rights, transfers, retention and deletion — are set out on the data processing terms page. We sign them in whatever jurisdiction you are in.
Report a security issue
If you think you have found a vulnerability in FirstFront, tell us.
Email support@firstfront.xyz with enough detail to reproduce. We will acknowledge within one business day.