Security & Confidentiality
What we can see, what we can't, and where your case file lives.
The short version
- 1.Your messages and files are encrypted before they leave your device. We can't read them.
- 2.We hold them only until they're delivered. Then they're gone from our side.
- 3.Your case file lives on your own drive, not ours. It's yours with or without Kacti.
- 4.AI is optional. You choose when it's used, and on which files and conversations.
- 5.Kacti's AI works under a zero-retention agreement. Nothing it reads is stored or reused.
- 6.AI never sends anything to a client on its own. A person at your firm approves first.
- 7.Using Kacti doesn't by itself waive privilege. The usual rules still decide what is privileged.
Encryption
What we promise. Your messages and files are encrypted before they leave your device, and we can't read them.
How it works. Encryption happens on your device, before anything is sent. We carry the encrypted data to the people on the case, and we don't hold the key.
Where it stops. We hold the encrypted data only until delivery is confirmed. Then it's gone from our side. If your client hasn't come online yet, the message waits, still encrypted, until they do.
What we do keep. Your account records, and the minimum needed to deliver a message: who it's from, who it's for, and when it was sent. We keep these for as long as your account exists. In delivery, we never hold readable case content. AI is the one exception, covered below.
Your case file
What we promise. Your case file is always yours to take with you, even if you stop paying.
How it works. Your case file is a folder of ordinary files on a drive your firm already uses, like Google Drive, OneDrive, or Dropbox, or a plain folder on your own computer. You can open, copy, or move the files at any time, with or without Kacti. Your client has a folder of their own, the same way.
If you stop paying. Your access is never held hostage. Reading your case file never runs through us.
When a case closes. Nothing is deleted and nothing needs to be moved. Both folders stay where they are.
If you close your account. We delete your account and delivery records, except what the law requires us to keep for tax and accounting. Case content was never ours to hold.
Where it stops. After delivery, your case file is as secure as your own devices and accounts. If it lives on a drive like Google Drive, OneDrive, or Dropbox, that service's terms govern what is stored there.
AI
What we promise. AI is used only when you choose, on the files and conversations you choose. Nothing an AI drafts is sent until a person at your firm approves it.
Two ways to use it. Your firm can connect an AI tool it already uses, or use Kacti's own agent. Either one works inside a case. It can read what your client sent, including photos, screenshots, and scans, help keep the case file organized, and draft replies.
Kacti's AI. To do its work, Kacti's AI has to read the content you pick. It does so under a zero-retention agreement with our AI provider, Mistral AI: nothing it reads is stored, reused, or used to train models.
Your own AI tool. If you connect your firm's own AI tool, what it reads is covered by your firm's agreement with that provider, not by ours.
Without AI. Sending, receiving, filing, and search all work without it, and search runs on your own computer. The one thing you give up is searching the words inside photos and scans.
Where it stops. The encryption promise covers delivery, for every message and file, whether or not AI is used. What AI changes is this: the content you pick is read, in readable form, by the AI you chose.
Privilege and security
These are two different questions. Is it safe is about encryption and access, covered above. Did sending it this way waive privilege is a professional-responsibility question, and the answer is no: sending case communication through Kacti doesn't waive privilege any more than sending it by email does.
ABA Formal Opinion 477R sets the standard. Lawyers must make reasonable efforts to protect client confidentiality when they use technology, in proportion to how sensitive the information is. A separate channel for each case, with encrypted delivery, is built to support that standard.
AI is a separate question. When you use it, case content reaches an AI provider in readable form, at your direction. With Kacti's AI, that happens under the zero-retention agreement described above, the same footing as a copy service or an e-discovery vendor. With your own AI tool, it happens under your firm's agreement with that provider.
Whether a particular communication is privileged still depends on the usual rules: who is included and what was said. The channel doesn't create privilege, and it doesn't waive it.
What we don't claim
- We don't claim that encryption makes a communication privileged, or that privilege can't be waived some other way.
- We don't claim SOC 2 or ISO certification. We don't have them yet, and we won't say we do before then.
- We don't claim AI never sees readable content. When you use it, it does, for as long as the work takes.
- We don't promise a breach can never happen. We built delivery so that a breach on our side would find encrypted data and delivery records, not case content.
- We don't claim to protect your case file after delivery. It is as secure as your own devices, accounts, and drive.
- We don't ask you to trust us with delivery. Encryption makes that unnecessary. AI is the one place trust comes in, and it rests on the agreements described above.
Have more questions?
If you have questions about anything on this page, we're glad to answer them. Talk to us and we'll walk you through the details.