Effective Date: 9 October 2026
This Security & AI Data Handling Policy describes the technical, organisational and AI data-handling practices implemented by Arka Pvt Ltd in connection with the Attorni AI platform. It is intended to provide customers with a practical overview rather than disclose information that would undermine security.
1. Security Principles
-
Confidentiality of legal Customer Content.
-
Least-privilege and role-based access.
-
Tenant separation and permission controls.
-
Secure transmission and storage.
-
Minimisation of unnecessary human access and telemetry content.
-
Controlled use of third-party providers.
-
Traceability of authorised support access.
-
Incident preparedness and recoverability.
-
Data minimisation and defined deletion/retention practices.
2. Customer Content
Customer Content includes case files, pleadings, correspondence, evidence, documents, prompts, instructions, generated work product and matter information. Customers retain ownership of Customer Content. Arka processes it only as necessary to provide, maintain, support and secure the Services, comply with law or perform another authorised purpose.
3. AI Training and Data Use
Arka does not use Customer Content, prompts, uploaded documents or customer-specific outputs to train, fine-tune or improve shared or general-purpose AI models.
For supported document-processing and AI services, Arka enables available enterprise privacy controls such as zero-data-retention and model-training opt-out settings where supported. Arka does not use beta, lab or preview model programmes for Customer Content where those programmes permit provider training on submitted data.
For enterprise AI services, Arka selects commercial configurations intended to prevent Customer Content from being used to train or improve general-purpose provider models without permission. Provider-specific transient processing or in-memory caching may occur where necessary to provide the service.
4. AI Processing Locations
Arka may use global AI endpoints to improve availability. Global AI endpoints may process requests across multiple supported geographic locations and may not provide a jurisdiction-specific inference-residency guarantee. Customers requiring jurisdiction-specific AI processing should contact Arka before contracting so that technical and commercial feasibility can be assessed.
Certain document-processing services are configured with zero-data-retention and training opt-out controls. The specific inference geography depends on the provider endpoint and configuration in use and is not represented by Arka as India-only processing unless expressly agreed in writing.
5. Human Access
Arka does not routinely inspect Customer Content manually. Authorised personnel may access Customer Content only for customer-requested support, troubleshooting, security or fraud investigation, incident response, maintenance requiring access, compliance with law or another customer-authorised purpose. Production access is performed through an authorised support access mechanism and is logged.
6. Authentication and Access Control
Arka uses authenticated user accounts and role-based/permission-based controls to restrict access to organisational workspaces and matter information. Session authentication is maintained using an essential Phoenix/Elixir application cookie.
Arka does not currently advertise MFA or enterprise SSO as available Service features. Security capabilities may be expanded as the product matures, and no such capability should be relied upon unless expressly made available in the product or an executed agreement.
7. Tenant Separation
Customer workspaces are logically separated through application-level tenancy and permission controls designed to ensure that users are authorised only to access Customer Content associated with their organisation and assigned permissions. Arka tests and maintains these controls as part of the application.
8. Encryption and Credential Storage
Arka uses encrypted transport for data in transit and relies on encryption-at-rest controls provided by its cloud, database and storage infrastructure. User passwords are stored using secure one-way password hashing rather than reversible plaintext or password encryption.
9. Infrastructure and Data Locations
Arka uses third-party cloud infrastructure, storage, and technology service providers to operate and secure the Services. Customer Content and personal data may be stored or processed in India and in other jurisdictions in which our authorised service providers operate.
Certain artificial intelligence services may process requests through global or cross-border infrastructure and therefore may not provide processing restricted to a single geographic region.
Arka selects material service providers based on appropriate security, confidentiality, privacy, and contractual safeguards. Information regarding our material AI processing providers and their relevant processing locations is provided on the AI Processing Providers page. Additional information regarding processing locations may be made available to customers where reasonably required for legal, regulatory, or enterprise due-diligence purposes.
10. Telemetry and Monitoring
Arka uses an application-performance and distributed-tracing service for operational observability. Custom Elixir instrumentation is designed to transmit operational metadata only, such as model identifiers, token usage, latency, cost information, trace identifiers and application performance data. Customer prompts, AI-generated responses, uploaded case files and document contents are not intentionally included in telemetry.
Current tracing/event metadata may be processed outside India and is retained for up to ninety (90) days under the current production configuration.
11. Secure Development and Vulnerability Management
Arka uses automated dependency vulnerability monitoring, including Dependabot alerts, to identify known vulnerabilities in software dependencies. Identified issues are reviewed and remediated according to severity, exploitability and operational risk.
Arka does not currently represent that it holds SOC 2 or ISO/IEC 27001 certification or that it performs recurring independent penetration testing unless and until such controls are implemented and documented.
12. Backups and Recovery
The production relational database is backed up daily. Current scheduled database-backup retention is seven (7) days. Database backups do not include uploaded file objects, which are maintained separately.
Uploaded files use a cloud-storage recovery mechanism with a seven (7) day soft-delete period. Object Versioning is disabled and no additional bucket retention policy is configured. This recovery period is intended to protect against accidental or malicious deletion while limiting long-term retention of deleted case files.
13. Deletion
When Customer Content is deleted, Arka removes it from active production use in accordance with the relevant Service workflow. Residual copies may remain temporarily in protected database backups or cloud storage soft-delete recovery systems for up to the applicable seven-day lifecycle. Such residual copies are not used for ordinary Service delivery and expire through the provider lifecycle.
Certain billing, security, fraud-prevention, dispute, regulatory or legal records may be retained for longer where required or permitted by law.
14. Incident Response
Arka maintains an incident-response process designed to identify and validate potential incidents, contain unauthorised activity, preserve relevant evidence, assess affected systems and data, remediate vulnerabilities, notify affected customers or authorities where required, and conduct post-incident review.
Where the DPA applies, Arka’s contractual target is to notify an affected customer without undue delay and within forty-eight (48) hours after confirming a personal data breach affecting Customer Content, unless a shorter period is required by law or an executed agreement.
Where applicable, Arka will comply with relevant CERT-In reporting and ICT-log obligations independently of its application-performance telemetry retention.
15. Subprocessor Security
Arka assesses material providers based on the service performed, categories of data processed, location, confidentiality and security commitments, retention practices, and AI training or secondary-use terms where applicable. A complete technical vendor inventory is maintained internally and is not published as part of this Security Policy.
16. Changes and Contact
Arka may update this document as its infrastructure and security practices evolve. We will not knowingly describe a certification or security capability as implemented unless it is actually in place.
Security enquiries and vulnerability reports: security@attorni.ai
Privacy enquiries: privacy@attorni.ai
Support: support@attorni.ai