Privacy Policy & Data Sovereignty Commitments

1. Sovereign AI Architecture & Legal Privilege Mandate

Enclave Systems (“Enclave Systems”, “we”, “us”, or “our”) engineers sovereign, private cloud infrastructure designed exclusively for law firms, corporate legal departments, and regulated enterprises. We recognize that legal work product, case discovery materials, transaction redlines, and client communications represent sacred professional confidences protected by law.

Our core mission is to uphold the legal industry’s most rigorous professional ethics and statutory standards:

• ABA Model Rule 1.6 (Confidentiality of Information & Technology Competence): All client enclaves are engineered with strict technical controls preventing unauthorized access, accidental disclosure, or third-party exposure of privileged legal data.
• Preservation of Attorney-Client & Work Product Privilege: Client data processed within an Enclave environment is never exposed to third-party consumer tools, public model queues, or unauthorized personnel, ensuring the evidentiary integrity of client privileges is maintained unconditionally.
• Single-Tenant Spoke Isolation: Every law firm tenant operates inside a completely isolated Google Cloud project with dedicated Virtual Private Cloud (VPC) subnets. We maintain zero shared databases, zero pooled multi-tenant vector indexes, and zero cross-tenant network traffic.

2. Zero Model Training & Zero Data Retention (ZDR) Guarantees

A foundational principle of Enclave Systems is our contractual and architectural guarantee regarding AI model training and data persistence:

Zero Data Retention (ZDR) Execution

When prompts or documents are processed through our AI inference pipeline:

• Ephemeral In-Memory Inference: Prompts and context documents reside in memory only for the duration of the computational inference request.
• Zero Provider Logging: All model API calls are routed via enterprise endpoints with upstream vendor logging, caching, and evaluation storage explicitly disabled.
• Zero Residual Artifacts: Once an inference token stream is returned to your firm’s secure workspace, no intermediate state or cached embeddings remain on external inference servers.

3. Cryptographic Custody & Customer-Managed Keys (CMEK)

We enforce cryptographic protection across every stage of the data lifecycle:

Customer-Managed Encryption Keys (CMEK): Production client enclaves leverage Google Cloud Key Management Service (Cloud KMS) with dedicated cryptographic keys. Your firm maintains primary authority over key rotation (enforced on a 90-day automated schedule) and retains the technical capability to revoke key access instantly, rendering all encrypted firm data unreadable even to infrastructure administrators.

4. In-Flight Sensitive Data Protection & PII Sanitization

To protect individual privacy and comply with global data privacy mandates, Enclave Systems integrates Google Cloud Sensitive Data Protection (Cloud DLP) directly into the client application gateway.

• Automated In-Flight Redaction: High-risk personal identifiers—including Social Security Numbers (SSNs), taxpayer identification numbers, bank account numbers, credit card numbers, and protected health data—are automatically identified and scrubbed prior to model ingestion.
• Deterministic Re-Identification Tokens: Where required for document drafting continuity, redaction tokens are maintained strictly within the firm’s private enclave perimeter and resolved locally without exposing the raw identifiers to external model endpoints.

5. Information Collected on the Public Web Portal (`enclave-systems.io`)

This section details information collected when you browse our public website (https://enclave-systems.io) or submit a consultation request.

A. Information You Voluntarily Provide

When you complete our Consultation Contact Form, we collect:

• Full Name (to address and personalize our communication)
• Work Email Address (to deliver consultation responses and scheduling invitations)
• Law Firm / Organization Name (to understand your practice profile and organizational context)
• Practice Profile & Interest (e.g., Solo Practitioner, Mid-Sized Firm, Large Firm Practice Leader, Corporate Legal Department)
• Practice Focus & Workflow Priorities Message (to evaluate technical feasibility and prepare tailored consultation briefings)

No Sale or Leasing of Data: We do not sell, rent, lease, or monetize consultation inquiries or contact information to data brokers, advertising networks, or third-party marketers. Form submissions are used exclusively to evaluate consultation requests and communicate with you directly.

B. Automatically Collected Technical Metadata

When accessing our public portal, our hosting infrastructure may collect standard, non-identifying technical metadata including IP addresses (anonymized), browser user-agent strings, referral headers, and access timestamps to detect malicious traffic, mitigate DDoS attacks, and enforce edge security rules.

6. Cookie & Tracking Technologies Disclosure

We believe in complete transparency regarding cookies and browser storage technologies. Our public website classifies cookies into three distinct categories governed by our interactive consent management engine:

You may adjust or revoke your cookie choices at any time by clicking the button below or using the Cookie Preferences link in the footer of every page:

7. Data Subject Rights (GDPR, CCPA/CPRA & US State Laws)

Depending on your jurisdiction, you may have specific statutory rights under the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and comparable state privacy laws (including Virginia CDPA, Colorado CPA, Connecticut CTDPA, and Texas TDPSA):

• Right to Know & Access: You may request confirmation of whether we process personal data relating to you and receive a copy of that data.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal information.
• Right to Erasure (“Right to be Forgotten”): You may request the permanent deletion of your personal consultation contact data from our records.
• Right to Restrict or Object to Processing: You may object to the processing of your personal data or request restrictions on its use.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format.
• Right to Non-Discrimination: We will never discriminate, charge different rates, or deny service quality for exercising your statutory privacy rights.
• “Do Not Sell or Share My Personal Information”: Enclave Systems does not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, email our Data Protection Officer at patrick.ryan@enclave-systems.io with the subject line “Privacy Rights Request”. We verify and fulfill all verified requests within thirty (30) calendar days.

8. Data Retention, Archival & Disposal Policies

We maintain strict data minimization and retention policies across our services:

• Public Consultation Leads: Contact information submitted through the web form is retained only as long as necessary to engage in active business dialogue, up to a maximum of twelve (12) months following last contact, after which inactive lead records are securely purged.
• Dedicated Client Enclave Data: Data retention within private client spokes is governed entirely by the client firm’s document retention policies and administrative settings. When an engagement terminates, client enclaves are completely destroyed and cryptographic keys decommissioned per our Master Services Agreement.
• Immediate Purge on Request: If you request deletion of your consultation inquiry, we immediately and permanently erase all associated records across our active lead stores.

9. Security Incident Notification SLA

Enclave Systems maintains 24/7 automated monitoring across infrastructure boundaries. In the highly unlikely event of a confirmed security incident or unauthorized access impacting customer data, we commit to notifying designated client administrative and legal contacts within twenty-four (24) hours of confirmation, accompanied by an initial forensic impact assessment and immediate mitigation roadmap.

10. Data Protection Officer & Legal Contact Information

If you have questions, ethical inquiries, compliance audits, or privacy requests regarding this Privacy Policy or Enclave Systems’ data custody standards, please contact our leadership team directly: