Security & data control
Keep core client data off our servers—and understand what that changes
Usus starts from a simple premise: we should not need a copy of your core practice database. Local-first storage reduces vendor-cloud exposure, while leaving your firm responsible for securing its devices, accounts, backups, and physical environment.
Local-first, in plain terms
Your database, on your disk
Usus stores matters, contacts, calendars, and notes in an embedded database on your own computer. Core local workflows do not require an Usus cloud account holding a second copy of those records.
Your documents, in your folders
Usus works with the files and folder structure you already have on disk, rather than forcing uploads into a proprietary cloud store. If you stopped using Usus tomorrow, your documents are exactly where they always were.
Fully functional offline
Core local workflows are designed to remain available without an internet connection. Features that deliberately use an external service will be identified separately and will require a connection.
Nothing leaves without your say-so
Sending, syncing, or sharing practice data outside your machine is designed to require an explicit action or an optional service you enable. Before release, we will document every networked feature and its data flow.
Optional team synchronization
Encrypt on the device before data reaches the service
The planned team service uses a firm-controlled key to encrypt records and files on an authorized device before synchronization. The service stores and routes ciphertext between firm devices; it is not designed to receive the plaintext working record or the key needed to read it.
Key creation, recovery, device authorization, member removal, metadata exposure, conflict resolution, and backup behavior are security-critical details. They will be documented and tested before the service is presented as available.
End-to-end encryption can reduce vendor access and some forms of third-party exposure. It does not make a firm immune from lawful process, endpoint compromise, disclosure by an authorized user, or mistakes in key management.
Professional duties
Designed around Rule 1.6, not retrofitted to it
Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized access to information relating to a client. Every cloud tool you adopt adds a third party — and that third party's employees, subprocessors, and breach history — to your confidentiality analysis.
Usus simplifies one part of that analysis by subtraction. For its core local database, there is no Usus-hosted copy, no Usus employee access path, and no Usus cloud storage terms governing those records. Other tools used by the firm—email, backup, file sharing, or optional sync—still require their own assessment.
Field-level confidentiality controls are part of the product plan: selected matter and contact fields can be marked for more restrictive handling. The exact behavior and release status will be documented before lawyers are asked to rely on it.
This is design intent, not legal advice — your own jurisdiction's rules govern. Our plain-English guide to Rule 1.6 and cloud storage covers the analysis in depth.
Shared responsibility
What local-first does—and does not—protect
Risks the architecture reduces
- An Usus-hosted database breach exposing core practice records
- Usus employees or subprocessors accessing that local database
- Loss of core local access during an Usus cloud outage
- Vendor lock-in around documents already stored in your folders
Controls your firm still needs
- Full-disk encryption and strong device authentication
- Tested, encrypted backups with a recovery procedure
- Operating-system and application security updates
- Protection against phishing, malware, theft, and unauthorized users
A compromised laptop can expose a local database. Usus cannot make an insecure device secure, and we will not market local storage as a substitute for ordinary law-firm cybersecurity.
AI & confidentiality
AI research without shipping your case file to a chatbot
The ABA's Formal Opinion 512 warned lawyers about feeding client information into generative AI tools — particularly ones that learn from what you type. Most legal AI products answer this concern with contractual promises.
Usus is being designed with a local-model optionso sensitive material can be analyzed without sending the prompt to an external model provider. Model downloads, updates, and any optional external integrations will be documented separately.
And because AI output is only as good as its verification, Usus runs research through independent passes, structured deliberation, and an adversarial red-team review to surface weak authority and hallucinated claims — with you, the lawyer, reviewing everything before it's used.
Questions you should ask any legal tech vendor — including us
We think every vendor should answer these in writing. Here are ours.
Where is client data stored?
On your computer, in a local database and your own file folders. Not on our servers.
Who can access it?
You, and the people you give access to your machine. Usus the company cannot access your client data — we don't hold it.
Is client data used to train AI?
No. The local-model path is designed so prompts are not sent to Usus or used to train an Usus model. Any future external-model option would be optional and separately disclosed.
What happens if Usus disappears?
Your documents remain in your folders. Before release, we will publish the database export formats and test the exit path rather than asking customers to trust a promise.
What about backups and sync?
Planned team sync and backup will be optional and end-to-end encrypted, with keys you hold — never a silent default.
What do you collect about me?
The product is being designed not to collect client content. Before release, we will publish the exact diagnostics collected, their defaults, retention, and how to disable them.
Want the full checklist for evaluating vendors? Read How to vet a legal tech vendor's security claims.
Founders program
Help validate the security model before launch
Join the founders program to discuss threat assumptions, data flows, device controls, migration, and what your firm would need to verify.