Security and governance
Built for professional secrecy.And to pass an audit.
Professional secrecy is secured by how the software is designed: isolation, permissions, approvals, encryption and the audit log are visible in the product.
What you will see in Ulpian
Fictitious matter, sample data.
The path of a request
What happens when someone at the firm asks the AI a question. Switch between a local model and an external provider to see what changes.
03 Your keys, your provider and your processing region, or a local model that stays in your infrastructure.
With an external provider, identifiers are pseudonymised before anything leaves, to the provider and region you chose.
Eight rules you can check
Your IT team and your partners can check them one by one in a dedicated session.
Strict isolation per firm
Each organisation has its own boundary: one firm's data is never accessible to another, not even through a faulty query.
An audit log you can read
Sign-ins, changes, AI runs, reconciliations and sensitive actions are logged with their author, context and time.
Human approval where it matters
Anything going to a client or a court can require a decision by a named person. The firm signs off.
Encrypted secrets, kept out of logs
API keys, tokens and secrets are encrypted and never appear in logs, in API responses or on screen.
Seven permission levels
Administrator, partner, associate, trainee, accountant, assistant and read-only: each role stays within its scope.
Document integrity
Hashes, versions, signed links and an access log on your documents, usable in an audit or in proceedings.
Pseudonymisation before the model
Email addresses, phone numbers, IBANs, Swiss social security numbers and company identifiers are replaced with stable tokens before any call to an external provider, then restored locally in the answer. Extended pseudonymisation (names, organisations, places) can be switched on for the whole firm.
An AI policy per firm
A master switch, platform keys, your own keys or a local-only mode (Ollama), and an EU or Swiss region as a preference or a hard block: the policy is set per firm and actually blocks what it forbids. Strictly confidential documents and documents on legal hold are excluded from the AI context by default.
Workflow
From engagement to payment, without a break.
Each step feeds the next on the same base: no re-export, no parallel version of the truth.
Matter
Engagement, parties and documents as the single reference.
Agent
Action plan published before execution.
Approval
Human review of sensitive outputs.
Output
Documents and summaries attached to the matter.
Evidence
Log, fingerprints and signed links you can rely on.
Payment
Time linked to invoices, bank reconciliation and payment reference.
Designed for sensitive legal frameworks
GDPR, UK GDPR and FADP
Hosting in Switzerland, which the EU and the UK recognise as providing adequate protection, a data processing agreement available, and support for your data protection officer with Enterprise.
Professional secrecy
Isolation, pseudonymisation before the model call and confidentiality safeguards, designed to follow the guidance of the Swiss Bar Association (2024) and the CCBE (2025) on lawyers' use of AI.
The AI of your choice
Your own keys (Claude, Gemini, GPT, Ollama or any compatible endpoint) or a dedicated model. A local model, a dedicated cloud or AI on your infrastructure with Enterprise.
Exportable audit log
A readable log for the team, the partners, auditors and reporting obligations.
No training on your data, no identifiers in clear text
Each request goes through the provider you choose (your keys, a local model or an enforced region), with identifiers pseudonymised before it leaves. The logs kept by Ulpian serve the firm's internal audit.
Real-time pseudonymisation
Email addresses, phone numbers, IBANs, social security and company numbers are replaced with tokens before the external call, then restored in the answer, even while it is being displayed.
Confidentiality safeguards
Strictly confidential documents and documents on legal hold are excluded from the AI context by default; work product and client confidentiality can be configured. Refusals are logged just like approvals.
Infrastructure
An isolated database per organisation, in Switzerland. Your files stay with your storage provider, and backups are encrypted and kept in a second Swiss data centre.
Data sovereignty
Platform hosted in Switzerland by a Swiss provider, out of reach of the US CLOUD Act. The AI models of your choice, a local-only model (Ollama), or a deployment in your own cloud or on your premises with an Enterprise quotation.
Everything stays visible
AI runs, approvals, sign-ins, changes and exports appear in the audit log.
Access, accountability and clarity
Security that is useful to the firm: who sees what, who approves what, and what record remains for the partners and for external reviews.
Identities and seats
Named accounts, simple revocation and no shared accounts by default.
AI policy
Your keys (Claude, Gemini, GPT, Ollama or a compatible endpoint), your provider, your limits, your pseudonymisation level and your processing region, with a log of requests for internal audit.
Application secrets
Encrypted tokens and connections, absent from the responses sent to the browser and from the logs.
A view for management
Readable summaries for partners and compliance, and not only for IT.
For legal management and IT
An hour to answer your architecture questions
Isolation, AI, audit log, hosting, the data processing agreement and private deployment: we answer point by point, against your constraints.
Call
A security question deserves a precise answer
We go through isolation, AI, the audit log, hosting, the data processing agreement and dedicated deployment on a call with your IT team.