Built to carry privileged work.

Our everyday analysis of how the product is used, and the alerts our automated safeguards raise, work against a stable pseudonymous reference rather than your name or email. The database access we use for that analysis is set up so that it cannot see your name, email, sign-in tokens, IP address, billing identifiers or professional-registration details. Those are available to the systems that run your account, and to a small number of administrators who need them for account administration and support.

Research goes to our AI model providers under contract. Standard research is held on the provider's systems for at most a provider-mandated 30-day window, then deleted. Brief and document analysis runs under zero-data-retention terms — nothing is stored once the response is returned — and a zero-data-retention research mode is available on every paid plan. The zero-data-retention mode does not run on the provider's most capable model.

Nothing you research, upload or draft is used to train AI models — whether it is retained for 30 days or not retained at all. That is the standing arrangement with our model providers, and it applies to every request, on every tier.

Traffic between your browser and Barrister AI is encrypted in transit with TLS. Data is encrypted at rest at the infrastructure level, which guards against theft of physical media or backups.

Add a rotating six-digit authenticator code on top of your password — it works with any authenticator app and takes under a minute to set up in Settings. Opt-in, with single-use backup codes for when your phone isn't to hand. The authenticator secret is sealed under its own encryption key, so a database read alone cannot produce your codes.

Automated safeguards watch for abuse and probing across the product. The operational alerts they generate identify you only by a pseudonymous reference — never your name or your email.

A deletion request revokes access and billing immediately. After a short review window, a purge removes your identity and the data attached to it.

When you choose a password — at sign-up, when you change or reset it, or when you join a firm's account — we check it against passwords exposed in public data breaches and refuse one that appears there. If you sign in on the website with such a password, we ask you to change it; you are never locked out for it. The check sends only a short fragment of a one-way fingerprint of the password, which matches a large group of unrelated passwords. The password itself never leaves our systems. If the check cannot be completed at that moment, we let you continue rather than hold you up.

Every five minutes we look across all accounts for failed sign-ins: a burst of failures spread over many accounts, or one network failing against several of them. Either raises an alert to us. The alert carries counts and network ranges only — never a name or an email address. It does not lock or sign out any account; a person decides what happens next.

Every page of the service tells your browser which scripts it may run and which addresses it may connect to, and your browser refuses anything else. That limits what a stray script, or a link or image slipped into generated text, could do with your work. When you download a document, links to anywhere other than our own site, the courts and tribunals, recognised case repositories and the official legislation registers are turned into plain text.

We keep a record of each sign-in, each failed sign-in or authenticator code, and actions taken in our administration tools. It holds the network range rather than your full address, and never any question, brief, document or case you work on. It is kept for up to 400 days, including after an account is deleted, so that a suspected account takeover can be investigated, and it is withheld from the access we use for everyday analysis.

An automated check runs every five minutes over how documents and brief files are being read, looking for bulk reading and for attempts to reach files that belong to another account. It works from counts and scrambled account references, never document content, and it applies fixed rules rather than an AI model. It alerts us; it never blocks a customer. Alerts go to a person, who decides what to do.