What protects a firm’s documents.
The contracts stay on the firm’s computer. Every quote is checked by code, every decision is recorded, and each person sees only what their role and their matters allow.
The firm’s computer
The contracts, the database, the table and the audit trail are kept here. The app’s server answers only to this computer.
Our model server
Receives the passages a question needs, the question and the licence. Whole contracts are not sent.
The model provider
Reads the passages and hands back an answer with a quote. Code on the firm’s computer then checks the quote.
How Harald is built
Twelve controls, each in plain words.
- The files stay on the firm’s computer
- Harald is a desktop app with its own database. Its server answers only to the computer it runs on.
- What goes to the model
- The passages a question needs, the question and the instructions. Whole contracts are not sent, and a spending cap is checked before each call.
- Every quote is checked by code
- A cell is shown as verified only when its quote is one continuous passage of the contract. Anything else goes to a person for review.
- Roles
- Every person is a viewer, a reviewer or an admin, and every action in the app is tied to a role. An action with no rule is refused.
- Matters and ethical walls
- A person behind the wall of a matter reaches nothing of that matter: not the contracts, not the table, not a draft or a search result made from it. A refused request gets the same answer as one for something that does not exist.
- Sign-in
- Passwords are stored as scrypt hashes, and repeated wrong tries are locked out. A person can add a time-based code from an authenticator app, and a firm can require it. Sessions end after an hour without use and after twelve hours in any case.
- An audit trail chained by hashes
- Runs, decisions, account changes, sign-ins and refused requests are recorded with the time and the person. Each entry carries the hash of the one before, the trail refuses edits and deletes, and an admin can verify the chain from the app.
- Logs hold no contract text
- Each request writes one line: method, route, status, duration and request id. Never a body, a cookie, a token, a password, an email or contract text.
- Scans are read on the computer
- A scanned page is recognised by the app itself. No page goes to a recognition service.
- Keys are kept in one place
- The model keys live on our model server and nowhere else, so the desktop app holds none. Each licence has a monthly budget, and every model call is written to a ledger without any passage or answer.
- Data on disk and backups
- Data on disk is protected by the disk encryption of the computer, which the firm controls. A backup is encrypted with a key file the firm keeps, and the app restores from one.
- Deletion
- An admin deletes a contract set, a single contract or a run, with its answers. The audit trail keeps its entries.
Report a vulnerability
Write with what you saw, the version and the steps. Please do not send real contract text or personal data; a description is enough. We aim to answer within three working days and to tell you when it is fixed.