Deliphi data handling
A one-page sheet for a firm's intake or ethics review, in the order lawyers ask: what is held, whether it trains AI, who touches it, where it lives, how long it stays, how to delete it, and how it is protected.
This sheet restates two pages Deliphi publishes: the Deliphi Privacy Policy (effective and last updated 2026-10-02) and the Deliphi Trust page. Checked 2026-10-16. Those pages control if anything differs.
| Question | Answer | Source |
|---|---|---|
| What data Deliphi holds | Account details (name, email, firm name, plan, seat details); for Deliphi for Justice applications, organization name, EIN, website, work email and eligibility-check results; your content (matters, documents, notes, questions you ask 360, messages, signatures); billing identifiers from Stripe (customer and subscription IDs, plan, payment dates); hashed single-use sign-in tokens; standard server logs (IP address, browser type, pages requested, time). | Privacy Policy section 1 |
| Is my content used to train AI? | No. Deliphi does not use Your Content to train AI models, and the policy states it. | Privacy Policy section 4 |
| Does my content go to an outside AI model provider? | Deliphi does not currently send your content to an outside AI model provider. 360 answers from the authorities on file in your matter. If an AI model provider is enabled, it is listed in the policy first and your content stays out of model training. | Privacy Policy section 5 |
| Where is data stored? | In the United States, with Deliphi's US-based web hosting company. | Privacy Policy section 5 |
| Who else touches data (service providers)? | Stripe (payments, subscriptions, customer portal). The web host (app, database, server logs). Email over SMTP on the host (sign-in links and service email). Caselaw Access Project (citation text alone, to mark citations). IRS, ProPublica Nonprofit Explorer and Legal Services Corporation (organization name or EIN, for Deliphi for Justice checks). Public archives (the research question text, when you run a research look-up). Your browser maker (spoken audio, when you tap the mic, under the browser's policy). CourtListener citation checks are off today. | Privacy Policy section 5 |
| How long is data kept? | Your content: while your account is open. When you close your account, or an unpaid trial has been in view mode for 30 days, your export stays available for 30 days and your content is then deleted within 90 days, except sealed audit records the law requires. Billing records: as long as tax and accounting laws require. Sign-in tokens: 15 minutes. Session cookie: 1 day. Server logs: the host's set retention period. | Privacy Policy section 7 |
| How do I delete or export? | Export all work as JSON or CSV with one button, any time. To delete, email admin@delithiuslabs.com; content is deleted on the schedule above. | Privacy Policy section 8; Trust page |
| How are firms kept apart? | Each firm sees exclusively its own matters, and this is tested on every build. | Trust page; Privacy Policy section 6 |
| How is the record protected from change? | Every answer, pull, message and signature is sealed into one hash chain per matter, so a change breaks the seal. | Trust page |
| What security controls exist? | HTTPS, security headers, signed session cookies, hashed sign-in tokens and passwords, single-use sign-in links that last 15 minutes. | Privacy Policy section 6; Trust page |
| Is there a security certification? | Deliphi holds no SOC 2 report or other security certification yet, and does not claim one. | Privacy Policy section 6; Trust page |
| What happens after a breach? | If a breach affects your personal information, Deliphi notifies you as the law requires, including under the North Carolina Identity Theft Protection Act. | Privacy Policy section 6 |
| Who is responsible for client information? | Your firm decides what goes in and carries its duties to clients. Deliphi processes client information solely to provide the service to your firm. If your firm requires a written data processing agreement, email admin@delithiuslabs.com. | Privacy Policy section 9 |
| What about voice? | The microphone is used solely when you tap the ring. Speech-to-text uses your browser's built-in service; Deliphi receives text, and stores no audio. Read-aloud uses your browser's voice on your device. | Privacy Policy section 2; Trust page |
| Items on the roadmap | Citations are not citator-checked until the CourtListener connection is on. Client trust (IOLTA) money stays outside Deliphi. E-signatures are not legal e-signatures until the consent wording is approved. | Trust page |
Questions for a person
For anything this sheet does not answer, such as a data processing agreement or a firm security questionnaire, write to admin@delithiuslabs.com. A person replies.