Law firms handle sensitive information. MandateFlow is designed with security, access control, data protection awareness, and responsible AI use as core product principles, with a GDPR oriented design.
Data ownership and control: Firms retain ownership of their client and matter data at all times. MandateFlow does not use customer data to train models or share it with third parties beyond what is needed to operate the platform.
GDPR oriented design: The platform is built with a GDPR oriented design from the ground up, including records of processing, retention schedules, and data subject request workflows.
Access control: Role based access, granular permissions for admin, staff, and client accounts, and two-factor authentication protect sensitive mandate data.
Auditability and activity history: Every action across the platform is logged, giving firms a clear internal oversight and audit trail.
Security measures: Data in transit and at rest is protected with industry standard encryption, and the platform follows secure coding and access review practices.
Document and matter handling: Client documents and matter records are stored in a structured, access controlled workspace, with version history and retention management built in.
AI data handling: Data used by AI features is processed solely to deliver the requested functionality and is not used to train external models or shared with third parties beyond what is needed to operate the platform.
AI output is not legal advice: AI generated output should always be reviewed by a qualified professional before use in legal work. Final review and responsibility always remain with the qualified legal professional.
Incident response: MandateFlow maintains a documented process for identifying, assessing, and responding to security incidents and data breaches.
Customer responsibilities: Firms remain responsible for how the platform is configured and used, including managing user access and reviewing AI assisted output before relying on it.