Encrypted in transit and at rest.
TLS in transit, AES-256 at rest. Each document is encrypted under its own key, wrapped by a key belonging to your company alone. Executed documents are write-once.
Security & trust
Your company's legal record, handled like it matters.
Your formation documents, your cap table, your SAFEs, every employment agreement you have signed. This page is where they go, who can read them, and how you get them back.
Four promises
The four commitments everything else has to satisfy.
If shipping something would break one of these, we don’t ship it.
Never used to train a shared model.
Not training data for us, and not for the model providers we run inference through. Your legal state serves your company and nothing else.
Named subprocessors, least privilege.
Every category that touches your data is listed below, with what it processes and where. Nobody at FinePrint has standing access to your documents.
Export or permanent deletion, any time.
On every plan, including the free one. Take your documents and a machine-readable copy of your Graph, or delete permanently.
The document lifecycle
From your laptop to the Vault, and back out again.
The honest version, in order. Better you find a problem here than in month three.
You upload, or you connect a folder.
Documents move over TLS into your Legal Vault. Nobody reads them on the way in, and nothing is copied to a side system.
They live in your Legal Vault.
One vault per company, isolated beneath the application rather than by a permission check on top of it: no cross-company search, no shared index.
An endpoint reads only what the work needs.
An endpoint retrieves only the documents and facts it requires, each named in the matter record — so you can see afterwards exactly what it read.
What is kept, and why it is kept.
Documents, the facts derived from them, and an audit event for every access — held while your account is open, because that is the product.
What is deleted, and when.
Delete a document and its facts retire with it; the deletion stays in the audit log, which is the point of an audit log. Close the account and everything is destroyed.
Access and control
Who can see what, and who has to say yes.
Two questions, really. What can your own team reach — and what can we?
09:14Priya Raghunathan opened the 2026 board consentowner
09:164 documents read to run /annual-complianceendpoint
11:02Delaware annual report filed — receipt stored in the Vaultexecuted
13:40Data room opened for Rivet Seed Fund II — 12 documents, expires Mar 8approved by owner
16:05FinePrint support access requested and approved by you — read-only, 60 minutestime-bounded
Illustrative access log. Every event is readable and exportable by you, including the ones about us.
Your team's roles.
Owner, admin, member, viewer, plus per-document permissions. The cap table, board minutes and employment files can be restricted to named people.
What FinePrint staff can reach.
No standing access. A support engineer asks, you approve, the access is read-only and time-bounded, and both the request and the approval are logged.
Every legally significant action is logged.
Every open, download, change, execution, filing and approval writes an event to a log you can read and export.
Approvals land on a human at your company.
The software never approves its own work. Signing, filing, issuing equity, binding the company — each routes to a named person with the authority to say yes.
Subprocessors
The five kinds of company that touch your data.
We use subprocessors for the infrastructure it would be reckless to build ourselves. Every category, what it processes, and where.
| Category | What it processes | Region |
|---|---|---|
| Cloud infrastructure | Hosting, storage and backups: your encrypted documents, your Company Legal Graph, and application data. | United States |
| AI model inference | Only the document text and Graph facts an endpoint needs, at the moment it runs — under zero-retention terms, with no training use. | United States |
| E-signature | Signer names and email addresses, and the document being executed. | United States |
| Payments | Your billing contact and card details, handled by the processor. FinePrint never stores card numbers. | United States |
| Email delivery | Recipient addresses and the content of the notifications and approval requests we send. | United States |
The current named list — the company behind each category, its purpose and its region — is in the Data Processing Addendum, available on request and before you sign anything. Material changes are notified in advance.
The never-train promise
Your documents are never used to train shared models.
A headline, not a footnote: your documents and your company’s legal state serve your company, and nothing else.
SENTThe specific document text and Graph facts that endpoint needs, named in the matter recordat run time
NEVER SENTAnything the endpoint doesn't need — and anything belonging to another companynever
PROVIDER RETENTIONZero-retention terms: the provider does not store the request after it answersnone
TRAINING USENot by the provider, not by us, not for a shared model, not evernever
WHAT IMPROVES ITLicensed legal professionals grading prepared mattersevery review
Your AI-Counsel improves the way a legal team does: attorneys review the work, and those gradings raise the standard for what runs as software. The gradings travel; your documents do not.
Legal professionals teach it. Your documents never do.
What we don't claim — yet
No badge on this page that we haven't earned.
A trust page listing certifications it does not hold is worse than one listing none. So, plainly:
In place today.
Everything above this line: encryption in transit and at rest, per-document keys, tenant isolation, write-once executed records, least-privilege access with approval and logging.
Not yet — and we will say so until it changes.
No completed SOC 2 report, ISO 27001 certificate or third-party audit we can hand you today. When one is finished it appears here with its date — not before.
If a completed SOC 2 is a hard procurement requirement today, we would rather tell you now than at the end of a three-week cycle.
Reporting a vulnerability
Found something? Tell us first.
Found a security issue? We want to hear it from you first, and we will treat you like someone who did us a favour.
How to reach us.
Use the contact form with “Security” in the first line. It reaches the engineering team, not a marketing queue.
What we commit to.
Acknowledged within one business day, updated until it is closed — including when the answer is that it is not a vulnerability.
Good-faith research.
Research in good faith, leave other companies’ data alone, and we will not pursue legal action for reporting it.
The legal department every startup should have.
Find your gaps before someone else does.
Four minutes. Free. You keep the report either way.