Security
Matter content
stays in the EEA.
Clerk& is built for material you can't afford to mishandle. A barrister's practice and a clerk's room hold client confidences, settlement positions, fee data, and privileged correspondence. We treat that seriously, in architecture rather than in marketing.
Principles
What we promise, and how it works
Matter content stays in the EEA
All matter content is processed in the EEA: the database and scanned pages on Supabase, audio recordings and uploaded documents in Google Cloud Storage, and AI on Google Vertex AI in EU regions, including Vertex AI's EU multi-region. Opt-in analytics is EU-hosted. Vertex AI is the sole AI processor, with no fallback provider. We never send matter content outside the EEA. The one exception is a solicitor's name (never the document, client or matter), looked up on the web to find their public office address; that lookup is not EEA-resident. Onward transfers are governed by 2021 Standard Contractual Clauses.
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Encrypted backups in the EEA.
Your data is your data
Your recordings, briefs, fee notes, and matters are never used to train AI models. Not by us, not by Google. Contractually guaranteed.
Row-level access control
Every database query is gated by authentication. Postgres row-level security enforces workspace-scoped permissions on every read and write.
DPA on request
Article 28 GDPR Data Processing Agreement, signed and returned within 48 hours of request. Standard Contractual Clauses where required.
72-hour breach notification
In line with Article 33 GDPR, we notify the Data Protection Commission within 72 hours of any breach likely to result in risk to your rights.
The AI transcribes, tidies and formats your words; it does not write substance. How that sits with the Irish courts' practice directions on generative AI is set out in AI and the courts.
Infrastructure
Where your data actually lives
No surprises. No vague “in the cloud.” These are the systems and the regions.
Application hosting
- Processing region
- EU functions region; US transfers allowed under Vercel's DPA
- Processor
- Vercel, Inc.
- Corporate domicile
- Delaware, USA
Database, storage, auth, backend
- Processing region
- EEA (AWS)
- Processor
- Supabase, Inc.
- Corporate domicile
- Delaware, USA
All AI (transcription, tidying, formatting, classification, vision)
- Processing region
- EEA (Vertex AI EU regions, including the EU multi-region; audio + document storage)
- Processor
- Google Cloud EMEA Ltd
- Corporate domicile
- Ireland (parent: Alphabet Inc., USA)
Subscription billing
- Processing region
- Irish entity; US transfers allowed under Stripe's DPA
- Processor
- Stripe Payments Europe Ltd
- Corporate domicile
- Ireland (parent: Stripe, Inc., USA)
Opt-in analytics
- Processing region
- EEA (PostHog EU Cloud)
- Processor
- PostHog, Inc.
- Corporate domicile
- Delaware, USA
Transactional email delivery
- Processing region
- EEA (France)
- Processor
- Brevo (Sendinblue SAS)
- Corporate domicile
- France
All processors operate under Article 28 GDPR Data Processing Agreements with Leeside Labs Limited and 2021 Standard Contractual Clauses (Module 2) for any onward transfer. Your matter content is processed only by Supabase (database and scanned-page storage), Google Cloud Storage (audio recordings and uploaded documents), and Google Vertex AI (all AI processing), all in the EEA. Current regions are listed on the subprocessors page. It is not sent to Stripe, PostHog, or any analytics, marketing, or advertising processor.
Most of these processors are US-incorporated or have a US parent; Google Cloud and Stripe contract through Irish entities. We rely on 2021 SCCs and supplementary measures (encryption, per-tenant access controls, no AI training on your content) to address the residual US CLOUD Act exposure that follows from US incorporation. See our privacy policy for the full transfer analysis, the subprocessor register for the complete list, and our data processing agreement for the Article 28 terms.
GDPR
Your rights, applied
You can exercise all GDPR rights (access, rectification, erasure, portability, restriction, objection) from inside the application or by emailing hello@clerkand.com. We respond to all requests within one month, as required by Article 12 GDPR.
Controller / processor split. Clerk&is the controller for your account, billing, and analytics data. For client and case material you process through Clerk&, you remain the controller; Clerk& is the processor and acts on your instructions.
Cookies. The marketing site sets no cookies at all, and its analytics, PostHog EU (page views and session replay) and Vercel Web Analytics, stay off until you accept the banner; “Cookie preferences” in the footer lets you withdraw at any time. Inside the app, analytics is strictly opt-in.
Disclosure
Reporting a security issue
If you think you have found a security vulnerability in Clerk&, the website, or the app, please email support@clerkand.com with what you found and how to reproduce it. We will acknowledge your report and keep you updated while we investigate.
Please do not access, change or delete other people’s data, and do not test in a way that disrupts the service for others. Our contact details are also published at /.well-known/security.txt.
Speak to your clerk.
Free 14-day trial. No credit card. Five-minute setup. Whether you’re a sole practitioner or running a busy clerk’s room, Clerk& earns its keep on the first fee note.
Get the app
On a Windows PC? Get Clerk& for Windows