# BriefAuthority security & privacy: where your brief goes (nowhere)

> What BriefAuthority sends over the network and what it never sends: your brief stays in the browser tab. Exact data table, architecture, and a test to run.

*Updated: 2026-09-24*

**The short answer:** BriefAuthority is designed so your brief never leaves your computer. The PDF or Word .docx is opened by your browser, read and indexed by JavaScript running in that tab, and the finished Table of Authorities is written as a .docx in memory and saved to your Downloads folder. There is no upload endpoint for the brief: the site's only server routes are the early-access sign-up and a Markdown copy of our own public pages, and neither accepts a file. What does cross the network is ordinary website traffic: page loads, optional Google Analytics with Google signals and ad personalization turned off, and the email address you type if you join early access. This page lists each of those exactly, explains the processing architecture, and gives you a test to verify it yourself. BriefAuthority is pre-launch, so the document-processing part is the specification as designed, confirmed at launch.

**Fast facts**

- Document content (file bytes, extracted text, citations, page numbers, the generated table) is designed to stay in your browser tab. It is never sent to BriefAuthority or any third party.
- The site has two server routes today: `/api/waitlist` (early-access email sign-up) and `/api/md` (Markdown versions of our public pages). Neither accepts a file upload.
- Google Analytics 4 loads only when it is configured for the site, with Google signals and ad-personalization signals off. It records page views, scroll depth and button clicks, not documents.
- Early access stores your email, an optional role, the page you signed up from, and first-visit referral data (referring site, UTM tags, landing page, date) in a Supabase database.
- No advertising trackers, no account needed to process a brief, no browser extension or Word add-in to install.
- BriefAuthority has no SOC 2 report yet and is not a law firm. This page is information, not ethics advice.
- Security or privacy questions: hello@briefauthority.com.

## What leaves your browser, and what doesn't

The table below separates two things that are easy to blur. **Document content** is anything that comes from the brief. **Ordinary website traffic** is what any website generates when you visit it. The left-hand category is designed never to leave the tab; the right-hand category is listed in full so you know exactly what we and our providers can see. The right-hand column is derived from the site's current code, not from a marketing summary.

**Document content vs. ordinary website traffic**

| Document content: designed to stay in the browser tab, never sent | Ordinary website traffic: what does cross the network |
| --- | --- |
| **The file itself:** the PDF or .docx bytes you open, including its file name and size | **Page loads:** HTML, JavaScript, CSS, fonts and images served by Vercel through Cloudflare. Like any web host, they receive your IP address, browser user agent, the URL requested and the referring page, and keep standard request logs. |
| **Extracted text:** every page of the brief as read by PDF.js, or the document text inside the .docx | **Google Analytics 4, if enabled:** page views plus our own events: scroll depth (25/50/75/90%), clicks on buttons and email links, and early-access form start/submit/error with the form's location, the optional role, and the first-visit referral source. Google signals and ad personalization are turned off. |
| **Citations and page references:** the authorities detected, the pages they appear on, your merges, *Id.*/*supra* links, categories and exclusions on the review screen | **First-visit attribution in your browser:** a `localStorage` entry (`ba_attr`) holding the referring site, UTM tags, landing page and first-visit time for 30 days. It stays on your device unless you submit the early-access form. |
| **The output:** the formatted Table of Authorities .docx, or the .docx with Word TA field codes written into it | **Early-access form, only if you submit it:** a POST to `/api/waitlist` with your email, optional role, the form location and page, and the attribution fields above. Stored in Supabase; your IP address is used only for an in-memory rate limit and is not saved with the sign-up. |
| **Anything about the matter:** party names, record cites, quotations, sealed material | **Server logs:** Vercel function logs record each early-access sign-up (the same fields as the form) and any server errors. There is no third-party error-tracking script on the site. |

> **Common assumption:** “it's a website, so the file must go to a server.” **What's actually true:** a browser can read a local file and run the processing itself with JavaScript. Where the processing happens is a design choice, and it is testable. For the general method of checking any browser tool, see [Table of Authorities without uploading](/table-of-authorities-without-uploading).

## The processing architecture

Every step below runs on your computer, inside the browser tab. Specification as designed; confirmed at launch.

**From your file to a finished table, step by step**

- **1. You choose the file.** The browser's File API gives the page read access to the one file you picked. Nothing is sent when you pick it.
- **2. The document is read locally.** A PDF is parsed page by page with PDF.js, Mozilla's open-source PDF renderer, running as JavaScript in the tab; page labels, including roman-numeral front matter, come from the PDF itself. A .docx is a zip archive; it is unzipped in memory and its document XML is read directly.
- **3. Citations are detected by a JavaScript parser.** Cases, statutes, regulations, court rules, constitutional provisions and other authorities are matched with deterministic rules. No AI model is called and no text is sent to one.
- **4. You review everything.** The [review screen](/how-it-works) shows each authority with its pages. Your edits live in the tab's memory.
- **5. The .docx is written in memory.** The Table of Authorities (or the .docx with Word TA field codes inserted) is assembled in the browser as a file object.
- **6. You download it.** The browser saves the file to your computer. Close the tab and the in-memory copy is gone; nothing about the brief was stored on a server because nothing was sent to one.

## Verify it yourself

You don't have to take this page's word for it. When BriefAuthority launches, run this test with a non-confidential PDF first. It takes about five minutes in Chrome or Edge; Firefox and Safari have equivalent tools.

**The network test (seven steps)**

- **1. Open BriefAuthority** and open developer tools: ⌘⌥I on a Mac, Ctrl+Shift+I on Windows. Click the **Network** tab.
- **2. Tick Preserve log, then clear the list** so you only see what happens from here on.
- **3. Filter to Fetch/XHR.** This shows requests made by the page's own code, which is where an upload would appear. Also glance at **WS** (WebSockets) and **All**.
- **4. Open a test PDF of known size** (say 2 MB) and let it process through to the review screen, then export the .docx.
- **5. What you should see:** nothing carrying your file. If Google Analytics is enabled you may see a few small `collect` requests to a google-analytics.com address, measured in hundreds of bytes to a few kilobytes, reporting a page view or click. Sort by **Size** to confirm nothing approaches the size of your PDF.
- **6. What you should not see:** a POST or PUT to any address roughly the size of your file, a large WebSocket transfer, or any request whose payload contains text from your brief (click a request and open **Payload** to check).
- **7. Go offline and repeat.** With the page already loaded, choose **Offline** in the Network panel's throttling menu (or turn off Wi-Fi), open the PDF again, review and export. A tool that processes locally keeps working; one that depends on a server shows an error.

If anything you see contradicts this page, email hello@briefauthority.com with a screenshot of the Network panel. We will treat it as a security report.

## What we will publish at launch

- **Subprocessor list.** The providers that handle website traffic and the email list, with what each receives. Today that is Vercel (hosting and function logs), Cloudflare (DNS and content delivery), Supabase (early-access email list) and Google (Analytics, if enabled). None of them receives document content.
- **Retention: none for documents.** We do not receive briefs, so there is nothing to retain or delete.
- **Email list retention.** Early-access emails are used to tell you about launch and pricing. You can ask for deletion at any time at hello@briefauthority.com; the retention period after launch will be stated in the privacy notice.
- **Security contact.** hello@briefauthority.com now; a dedicated security contact and a `security.txt` file at launch.
- **A changelog for this page,** so a firm that approved BriefAuthority can see if anything about data flow changes.

## Ethics context

For lawyers, the reason this matters is the duty of confidentiality. **ABA Model Rule 1.6(c)** requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client,” and states adopt their own versions. **ABA Formal Opinion 512** (July 29, 2024), on generative AI tools, asks lawyers to assess the risk that information entered into a tool is disclosed or accessed and to read the tool's terms. A tool that never receives the brief takes the disclosure question off the table for that step, though your firm's policies still govern which software you may use. The [without-uploading guide](/table-of-authorities-without-uploading) covers this in more depth. This is general information, not ethics advice.

## What we don't claim

- **No SOC 2 report or other certification yet.** We describe the architecture and invite you to test it instead.
- **Not a law firm, and not legal or ethics advice.** Ask your firm's general counsel or your state bar's ethics hotline about your obligations.
- **We can't secure your computer.** Browser extensions can read the pages you visit, and synced folders copy files to the cloud. For confidential work, use a browser profile without third-party extensions.
- **Pre-launch.** The document-processing behavior is the specification as designed, confirmed at launch. The website-traffic column above describes the live site today.
- **Not the only local tool.** Other tools also process briefs in the browser; we say what ours does and how to check it.

> **Where BriefAuthority fits:** BriefAuthority is a pre-launch Table of Authorities generator that works from your [final PDF](/table-of-authorities-from-pdf) or your Word .docx, in the browser, on a Mac or any computer, without uploading the brief. A review screen shows every authority and page before you export. It formats and indexes; it does not check whether citations are good law. Join **early access** at [/early-access](/early-access). Specification as designed; confirmed at launch.

## Frequently asked

**Does BriefAuthority upload my brief?**

No. It is designed to read the PDF or .docx in your browser and never send it anywhere. The site has no upload endpoint for documents. BriefAuthority is pre-launch, so this is the specification, confirmed at launch; you can verify it with the Network-panel and offline test on this page.

**Can BriefAuthority see my brief, its file name, or the citations in it?**

No. The file name, text, citations and [page numbers](/table-of-authorities-page-numbers) stay in your browser tab. Analytics events record which page you viewed and which buttons you clicked, never document content.

**What data does BriefAuthority collect?**

Ordinary website traffic: standard request logs at Vercel and Cloudflare, Google Analytics page views and clicks if analytics is enabled (with Google signals and ad personalization off), and, only if you join early access, your email, optional role, the page you signed up from and first-visit referral data. See the table on this page and the [privacy notice](/privacy).

**Does it work offline?**

It is designed to: once the page has loaded, processing and export need no network connection. Going offline and repeating the process is the simplest proof that nothing is sent.

**Is BriefAuthority SOC 2 certified?**

No, not yet. Because the brief is designed never to reach our servers, the architecture and the self-test on this page are the core assurance. We will publish a subprocessor list and retention details at launch.

**Is it safe to use for a sealed or confidential brief?**

The design keeps the document on your computer, which is the property most confidentiality policies care about. Whether a tool is approved is your firm's or office's decision: run the test on this page, keep a note of the result, and check your policies. This is not ethics advice.

**Related**

- [Table of Authorities without uploading](/table-of-authorities-without-uploading) — Which TOA options send your brief out, and how to check any browser tool.
- [How BriefAuthority works](/how-it-works) — The PDF and .docx paths, step by step.
- [Privacy notice](/privacy) — Early-access sign-ups, analytics and contact.
- [Table of Authorities generator](/table-of-authorities-generator) — From your final PDF or Word file, in the browser.
- [Compare TOA tools](/compare) — Word, add-ins, services and BriefAuthority side by side.

**Sources**

- [American Bar Association — Model Rule 1.6: Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/)
- [American Bar Association — Comment on Rule 1.6](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/)
- [ABA Standing Committee on Ethics and Professional Responsibility — Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf)
- [MDN Web Docs — File API](https://developer.mozilla.org/en-US/docs/Web/API/File_API)
- [Mozilla — PDF.js](https://mozilla.github.io/pdf.js/)
- [Chrome for Developers — Inspect network activity](https://developer.chrome.com/docs/devtools/network)
- [Chrome for Developers — Throttling (including Offline)](https://developer.chrome.com/docs/devtools/settings/throttling)