Vincent and Clio Operate: Information security management.
Vincent: Type II, audited January 2026.
Vincent: Data residency and right to erasure.
Host your Vincent data in the US, the EU or Australia.
Vincent and Clio Operate
Vincent and Clio Operate run on the same security framework: independent third-party audits, encryption in transit and at rest, least-privilege access, continuous monitoring, and recurring penetration testing by outside firms. Where the controls differ, it is because the products do. Vincent adds zero data retention agreements with every model provider it calls. Clio Operate adds tenant-level isolation and upgrade timing your IT team controls.
Vincent
Vincent is grounded in a legal database of more than one billion that Clio owns. Legal documents are continuously updated and engineered to protect your firm at every layer. Your prompts and documents are never training data, and the model providers behind Vincent retain nothing once they have answered.
Vincent reads your documents and your request to answer the question in front of it, and the loop is complete. The foundation model retains nothing from them. Our contracts with each foundation model provider prohibit training and fine-tuning on client data, and no data mining is permitted.
Requests to OpenAI and Google route through dedicated zero-retention endpoints. Anthropic’s Claude is reached only through AWS Bedrock, a private channel with its own contractual guarantee. Your prompts are discarded after processing.
Choose whether your data and encryption keys sit in the US, Canada, the EU or Australia. Each interaction is secured with envelope encryption under a key unique to your organization, using a FIPS 140-2 compliant suite.
Uploads and conversation history are kept for one year by default, and you set the period. Request deletion at any time, or delete single files in the app. Destruction runs through cryptographic erasure and AWS KMS key deletion.
Vincent answers from retrieved authority rather than model memory, so every output leads back to its source. Immutable, third-party-managed audit logs record all access, and your own roles carry through from your environment.
Vincent connects to NetDocuments, iManage, SharePoint and Google Drive, authenticating each user against your existing permissions. No local copies are made in Vincent on upload. The mobile app and Word add-in inherit the same controls.
Clio Operate runs a multi-tenant architecture in which each firm works inside its own logically separate tenant, isolated at the database level. Your data is never commingled with another firm’s.
Access runs through single sign-on and multi-factor authentication. Permissions are granular and granted on least privilege. Audit logs record each interaction with date, time, user ID and the change made.
Data and backups are encrypted at rest with AES-256, and in transit over HTTPS with TLS 1.2 or higher. Defined recovery time and recovery point targets govern restoration. A DPA and subprocessor list show who handles your data.
Hosting spans multiple Azure and AWS regions, with safeguards against power and data center outage and continuous replication to backup sites. Compute scales with demand. Updates are pulled, not pushed, so you choose when to upgrade.
Incident response follows NIST SP 800-61 and risk assessment NIST SP 800-30. Continuous monitoring flags unusual activity, vulnerability scanning runs constantly, and third parties test the application, network and corporate environment.
Queries and inputs stay isolated to your tenant. Models hold nothing in memory and a forensic audit stream logs every AI output. AI features can be switched off entirely.
Our security management systems undergo independent third-party audits to meet international standards. ISO/IEC 27001 certifies information security for both Clio Operate and Vincent. Clio Operate holds additional certifications for quality management (ISO 9001:2015) and environmental management (ISO 14001). Vincent undergoes annual SOC 2 Type II examinations, validating our controls across security, availability, and confidentiality. Clio Operate’s SOC 2 Type II audit is underway, with completion expected in 2026.
Third parties regularly test both products across application, network, and corporate environments under Governance Committee oversight. Security, Incident Management, Whistleblowing, Anti-Bribery, Anti-Modern Slavery policies, a Code of Ethics, and cyber insurance protect your operations. Download reports from the Trust Center.
FAQ
Full documentation, including SOC 2 and ISO 27001 reports and penetration test results, sits in the Trust Center.
No. Vincent reads your documents to answer the question in front of it and retains nothing from them for training or fine-tuning, and our contracts with each foundation model provider prohibit the same. Analytics in Clio Operate are trained only on your own isolated data. No data mining is permitted in either product.
With Vincent you select the US, the EU or Australia, and both your data and your encryption keys stay in that region. Clio Operate is hosted on Microsoft Azure and AWS with active hosting locations across multiple regions. Tell us your residency requirement and we will confirm the hosting region in writing before contracting.
Vincent retains uploaded documents and conversation history for one year by default, and that period is customizable. You can request deletion at any time without waiting for the period to lapse, and users can delete individual files and prompts in the application. Destruction runs through cryptographic erasure and AWS KMS key deletion, which puts recovery beyond technical reach. Operate retention is governed by your Data Processing Agreement.
Clio Operate places each firm in its own logically separate tenant, isolated at the database level. Vincent encrypts each client’s data with firm-specific keys and separates it logically at the infrastructure level. In neither product is your data commingled with another client’s.
Operate encrypts data and backups at rest with AES-256 and secures data in transit over HTTPS with a minimum of TLS 1.2. Vincent uses a FIPS 140-2 compliant cryptographic suite for both, with envelope encryption: a unique key per conversation, protected by a master key exclusive to your organization.
Internal access is controlled by role-based permissions on least privilege and need to know. Clio Operate access requires single sign-on and multi-factor authentication. Vincent carries your own roles and business rules through from your environment. Access to data is recorded in immutable, third-party-managed audit logs, so the record cannot be altered by us.
Our incident response plan follows NIST SP 800-61, covering detection, containment, remediation and recovery, with root-cause analysis procedures behind it. The Clio security team runs continuous monitoring software to identify and report unusual activity. Risk assessment follows NIST SP 800-30. Our Incident Management policy is available on request.
Yes. Authorized users can request and download SOC 2 and ISO 27001 reports, penetration testing results and our detailed security policies from the Clio Trust Center. If your review needs more than the documents, we will put you in front of the engineers who built these controls.
