Question 1

Is SwiftLaw a law firm? Are you giving legal advice?

Accepted Answer

No. SwiftLaw is a software platform, not a law firm, and using SwiftLaw does not create an attorney-client relationship. Outputs are tools to assist licensed attorneys and qualified professionals — they are not legal advice and should be reviewed by your counsel before they are relied upon.

Question 2

How does a lawyer stay in the loop?

Accepted Answer

Templated, repetitive work runs autonomously, while clauses that require tailoring or judgment route to a supervising attorney for sign-off. Final legal judgment, sign-off, and the attorney-client relationship remain with your counsel. Many firms use SwiftLaw to reduce billable hours on repetitive work so their attorneys can focus on higher-value strategy.

Question 3

How do you keep outputs accurate and reviewable?

Accepted Answer

Every agent output is citation-backed: the agent shows you the exact source clause or document section it relied on. Outputs are designed to be reviewed by an attorney before they leave your firm, so a human is always accountable for what is filed.

Question 4

Do you encrypt data at rest and in transit?

Accepted Answer

Yes. All client data is encrypted at rest using AES-256 and in transit using TLS 1.2+ (HTTPS). This applies to documents, metadata, and authentication traffic across Amazon RDS for PostgreSQL, Amazon S3, and all API endpoints.

Question 5

How is our data stored and isolated?

Accepted Answer

Fund formation documents (LPAs, subscription agreements, term sheets, side letters) and associated metadata are stored in encrypted AWS infrastructure scoped to your tenant. All data queries are scoped by authenticated user ID for strict tenant isolation. We do not collect Social Security Numbers, bank account numbers, or credit card information, and we never use customer content to train AI models.

Question 6

Where are your servers located?

Accepted Answer

All SwiftLaw infrastructure runs on AWS in the United States — primary region US-East, with disaster recovery replication to US-West. No customer data is stored or processed outside the US.

Question 7

Do you support Single Sign-On and access controls?

Accepted Answer

Yes. Authentication is managed through Clerk with SAML-based SSO support for major identity providers (Okta, Microsoft Entra ID, Google Workspace) and OIDC. RBAC can be enforced based on SAML attributes, MFA is mandatory for all users, and SCIM provisioning is available on enterprise plans. Admins can configure per-matter access scoping, audit log exports, IP allowlists, and session timeout policies.

Question 8

Is SwiftLaw SOC 2 certified?

Accepted Answer

Yes. SwiftLaw has completed a SOC 2 Type I audit, in which an independent third party assessed our controls for protecting client data. We monitor these controls continuously through Vanta, not only during the audit window, and share our SOC 2 report with clients and prospects under NDA on request.

Question 9

How do you monitor for security breaches?

Accepted Answer

We run continuous monitoring across our infrastructure using Amazon CloudWatch for centralized log aggregation, Sentry for application error monitoring (sanitized error data only — no document content), and Vanta for SOC 2 audit log completeness. Access to production systems requires SSO with mandatory MFA, every action is logged in centralized audit trails, and we conduct regular third-party penetration tests. SwiftLaw has experienced no material security incidents, data loss, or breaches.

Question 10

How quickly do you remediate security issues?

Accepted Answer

Critical vulnerabilities are triaged within 24 hours and remediated on an expedited timeline (typically within 7 days). High-severity issues are addressed within 30 days, and medium/low severity within 90 days. Application dependencies are scanned continuously on every code change, and infrastructure is scanned quarterly. Enterprise customers receive direct notification of any incident affecting their tenant.

Compliance, security & data privacy

The attorney-in-the-loop model

Data privacy & isolation

Certifications & monitoring

Need our SOC 2 report or a security review?