A plain-English account of where Guardian data goes.

Account and workspace information, such as names, business contact information, firm membership, roles, authentication events, and security settings.

Content a firm chooses to place in Guardian, including matter metadata, messages, documents, workflow instructions, approvals, and AI prompts and responses.

Operational information needed to secure and support the service, such as host health, version, error category, audit events, and bounded diagnostic metadata. Support bundles exclude raw prompts and logs by default.

Pilot or sales information submitted through a public form. Guardian does not receive full payment-card numbers; payment processing is handled by the configured payment provider.

To provide the portal, authenticate users, enforce tenant and matter access, queue approved work, generate requested AI output, maintain audit records, deliver support, prevent abuse, and improve reliability.

Guardian does not sell customer content or use it for third-party advertising. A customer remains responsible for deciding what information may lawfully be placed in the service and which users may access it.

The firm chooses either OpenAI or xAI for the host assistant lane. Prompts and relevant context are sent to that selected provider only after the matter policy permits cloud AI. Provider terms and data controls also apply.

Provider OAuth sessions stay in separate Guardian-owned runtime homes on the firm Mac. They are not stored in the Guardian portal database or support bundle.

Google, Clio, Dropbox, email, calendar, and other connectors are disconnected by default. Guardian accesses a connected service only after an authorized user enables and authorizes that connector. Disconnecting Guardian removes its stored connector token; the customer may also revoke the grant directly with the provider.

Portal data is stored with the configured hosting and database providers. The firm Mac stores isolated provider sessions, host identity material, transient attachments when enabled, and operational runtime state.

Public sales leads expire after 180 days by default. A paid pilot record may be retained for up to 365 days. Security, billing, contractual, and audit records may be retained longer when required by law, contract, dispute preservation, or legitimate security needs.

Authorized customers may request export or deletion. A complete deletion includes tenant records, stored objects, connector tokens, and host runtime state, subject to legal holds, backup rotation, and mandatory retention obligations.

Guardian uses role and matter access controls, row-level database policies, signed host envelopes, scoped approvals, encryption, rate limits, security headers, and audit records. No service can promise absolute security.

Customers can limit users, disable connectors, keep outbound actions disabled, choose the model provider, and decline AI processing for a matter. Browser and identity-provider settings control authentication cookies and sessions.