Guide
BriefAuthority security & privacy: where your brief goes (nowhere)
On this page6 sections
The short answer
BriefAuthority is designed so your brief never leaves your computer. The PDF or Word .docx is opened by your browser, read and indexed by JavaScript running in that tab, and the finished Table of Authorities is written as a .docx in memory and saved to your Downloads folder. There is no upload endpoint for the brief: the site's only server routes are the early-access sign-up and a Markdown copy of our own public pages, and neither accepts a file. What does cross the network is ordinary website traffic: page loads, optional Google Analytics with Google signals and ad personalization turned off, and the email address you type if you join early access. This page lists each of those exactly, explains the processing architecture, and gives you a test to verify it yourself. BriefAuthority is pre-launch, so the document-processing part is the specification as designed, confirmed at launch.
What leaves your browser, and what doesn't
The table below separates two things that are easy to blur. Document content is anything that comes from the brief. Ordinary website traffic is what any website generates when you visit it. The left-hand category is designed never to leave the tab; the right-hand category is listed in full so you know exactly what we and our providers can see. The right-hand column is derived from the site's current code, not from a marketing summary.
| Document content: designed to stay in the browser tab, never sent | Ordinary website traffic: what does cross the network |
|---|---|
| The file itself: the PDF or .docx bytes you open, including its file name and size | Page loads: HTML, JavaScript, CSS, fonts and images served by Vercel through Cloudflare. Like any web host, they receive your IP address, browser user agent, the URL requested and the referring page, and keep standard request logs. |
| Extracted text: every page of the brief as read by PDF.js, or the document text inside the .docx | Google Analytics 4, if enabled: page views plus our own events: scroll depth (25/50/75/90%), clicks on buttons and email links, and early-access form start/submit/error with the form's location, the optional role, and the first-visit referral source. Google signals and ad personalization are turned off. |
| Citations and page references: the authorities detected, the pages they appear on, your merges, Id./supra links, categories and exclusions on the review screen | First-visit attribution in your browser: a `localStorage` entry (`ba_attr`) holding the referring site, UTM tags, landing page and first-visit time for 30 days. It stays on your device unless you submit the early-access form. |
| The output: the formatted Table of Authorities .docx, or the .docx with Word TA field codes written into it | Early-access form, only if you submit it: a POST to `/api/waitlist` with your email, optional role, the form location and page, and the attribution fields above. Stored in Supabase; your IP address is used only for an in-memory rate limit and is not saved with the sign-up. |
| Anything about the matter: party names, record cites, quotations, sealed material | Server logs: Vercel function logs record each early-access sign-up (the same fields as the form) and any server errors. There is no third-party error-tracking script on the site. |
The processing architecture
Every step below runs on your computer, inside the browser tab. Specification as designed; confirmed at launch.
From your file to a finished table, step by step
- You choose the file. The browser's File API gives the page read access to the one file you picked. Nothing is sent when you pick it.
- The document is read locally. A PDF is parsed page by page with PDF.js, Mozilla's open-source PDF renderer, running as JavaScript in the tab; page labels, including roman-numeral front matter, come from the PDF itself. A .docx is a zip archive; it is unzipped in memory and its document XML is read directly.
- Citations are detected by a JavaScript parser. Cases, statutes, regulations, court rules, constitutional provisions and other authorities are matched with deterministic rules. No AI model is called and no text is sent to one.
- You review everything. The review screen shows each authority with its pages. Your edits live in the tab's memory.
- The .docx is written in memory. The Table of Authorities (or the .docx with Word TA field codes inserted) is assembled in the browser as a file object.
- You download it. The browser saves the file to your computer. Close the tab and the in-memory copy is gone; nothing about the brief was stored on a server because nothing was sent to one.
Verify it yourself
You don't have to take this page's word for it. When BriefAuthority launches, run this test with a non-confidential PDF first. It takes about five minutes in Chrome or Edge; Firefox and Safari have equivalent tools.
The network test (seven steps)
- Open BriefAuthority and open developer tools: ⌘⌥I on a Mac, Ctrl+Shift+I on Windows. Click the Network tab.
- Tick Preserve log, then clear the list so you only see what happens from here on.
- Filter to Fetch/XHR. This shows requests made by the page's own code, which is where an upload would appear. Also glance at WS (WebSockets) and All.
- Open a test PDF of known size (say 2 MB) and let it process through to the review screen, then export the .docx.
- What you should see: nothing carrying your file. If Google Analytics is enabled you may see a few small `collect` requests to a google-analytics.com address, measured in hundreds of bytes to a few kilobytes, reporting a page view or click. Sort by Size to confirm nothing approaches the size of your PDF.
- What you should not see: a POST or PUT to any address roughly the size of your file, a large WebSocket transfer, or any request whose payload contains text from your brief (click a request and open Payload to check).
- Go offline and repeat. With the page already loaded, choose Offline in the Network panel's throttling menu (or turn off Wi-Fi), open the PDF again, review and export. A tool that processes locally keeps working; one that depends on a server shows an error.
If anything you see contradicts this page, email [email protected] with a screenshot of the Network panel. We will treat it as a security report.
What we will publish at launch
- Subprocessor list. The providers that handle website traffic and the email list, with what each receives. Today that is Vercel (hosting and function logs), Cloudflare (DNS and content delivery), Supabase (early-access email list) and Google (Analytics, if enabled). None of them receives document content.
- Retention: none for documents. We do not receive briefs, so there is nothing to retain or delete.
- Email list retention. Early-access emails are used to tell you about launch and pricing. You can ask for deletion at any time at [email protected]; the retention period after launch will be stated in the privacy notice.
- Security contact. [email protected] now; a dedicated security contact and a `security.txt` file at launch.
- A changelog for this page, so a firm that approved BriefAuthority can see if anything about data flow changes.
Ethics context
For lawyers, the reason this matters is the duty of confidentiality. ABA Model Rule 1.6(c) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client,” and states adopt their own versions. ABA Formal Opinion 512 (July 29, 2024), on generative AI tools, asks lawyers to assess the risk that information entered into a tool is disclosed or accessed and to read the tool's terms. A tool that never receives the brief takes the disclosure question off the table for that step, though your firm's policies still govern which software you may use. The without-uploading guide covers this in more depth. This is general information, not ethics advice.
What we don't claim
- No SOC 2 report or other certification yet. We describe the architecture and invite you to test it instead.
- Not a law firm, and not legal or ethics advice. Ask your firm's general counsel or your state bar's ethics hotline about your obligations.
- We can't secure your computer. Browser extensions can read the pages you visit, and synced folders copy files to the cloud. For confidential work, use a browser profile without third-party extensions.
- Pre-launch. The document-processing behavior is the specification as designed, confirmed at launch. The website-traffic column above describes the live site today.
- Not the only local tool. Other tools also process briefs in the browser; we say what ours does and how to check it.
Frequently asked
Does BriefAuthority upload my brief?
No. It is designed to read the PDF or .docx in your browser and never send it anywhere. The site has no upload endpoint for documents. BriefAuthority is pre-launch, so this is the specification, confirmed at launch; you can verify it with the Network-panel and offline test on this page.
Can BriefAuthority see my brief, its file name, or the citations in it?
No. The file name, text, citations and page numbers stay in your browser tab. Analytics events record which page you viewed and which buttons you clicked, never document content.
What data does BriefAuthority collect?
Ordinary website traffic: standard request logs at Vercel and Cloudflare, Google Analytics page views and clicks if analytics is enabled (with Google signals and ad personalization off), and, only if you join early access, your email, optional role, the page you signed up from and first-visit referral data. See the table on this page and the privacy notice.
Does it work offline?
It is designed to: once the page has loaded, processing and export need no network connection. Going offline and repeating the process is the simplest proof that nothing is sent.
Is BriefAuthority SOC 2 certified?
No, not yet. Because the brief is designed never to reach our servers, the architecture and the self-test on this page are the core assurance. We will publish a subprocessor list and retention details at launch.
Is it safe to use for a sealed or confidential brief?
The design keeps the document on your computer, which is the property most confidentiality policies care about. Whether a tool is approved is your firm's or office's decision: run the test on this page, keep a note of the result, and check your policies. This is not ethics advice.
Sources
- American Bar Association — Model Rule 1.6: Confidentiality of Informationamericanbar.org
- American Bar Association — Comment on Rule 1.6americanbar.org
- ABA Standing Committee on Ethics and Professional Responsibility — Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024)americanbar.org
- MDN Web Docs — File APIdeveloper.mozilla.org
- Mozilla — PDF.jsmozilla.github.io
- Chrome for Developers — Inspect network activitydeveloper.chrome.com
- Chrome for Developers — Throttling (including Offline)developer.chrome.com
BriefAuthority · free for small briefs
In development · early access