Zero training
No customer data ever trains an AI model — neither ours nor our providers'. This commitment is contractual.
Security & compliance
Your case files are covered by professional privilege.
So is our architecture.
Every technical choice in Themis follows one simple rule: what enters your firm never leaves it. Here are our commitments — and what they mean in practice.
Our commitments
Seven commitments, enforced by architecture.
No vague promises: each commitment maps to a specific technical or contractual safeguard your teams can verify.
Zero retention
Models run in EU regions: the model provider retains neither your queries nor your documents.
EU hosting
Database, documents and AI processing are hosted and operated in the European Union, under the GDPR.
Encryption
Your data is encrypted in transit (TLS 1.2 minimum) and at rest (AES-256).
Professional privilege
Built for it: contractually-bound GDPR processor, fine-grained role-based access control, audit log.
Vetted sub-processors
A short, documented chain of sub-processors — each covered by an impact assessment (DPIA).
Reversibility
Your data stays yours: documents and invoices downloadable at any time, and 30 days after the contract ends to export everything.
Everything is documented.
Sub-processor list, impact assessments (DPIA) and data processing agreement (DPA) available on request.
Request the DPACompliance posture
Our compliance, in full transparency.
A factual, documented status for each area. Here is exactly where we stand.
GDPR
Compliant
Compliant
Records of processing, per-processor impact assessments, DPA on request.
ISO 42001
Certification in preparation
Certification in preparation
Our AI management system follows the ISO 42001 standard; we are preparing for this certification.
E-invoicing
Format ready
Format ready
Every validated invoice is a Factur-X (EN 16931), FEC export built in. Connection to an approved platform in progress.
Sovereignty architecture
Your data is hosted and processed in the European Union.
Data travels a short, encrypted and auditable path through Themis — from document upload to the assistant's answer.
European Uniondata residency · eu-west
01
Your data
Case files, documents and pleadings remain the firm's exclusive property.
origin · law firm02
Encryption
Encrypted in transit and at rest, on ISO 27001-certified infrastructure.
TLS 1.2+ · AES-25603
Zero retention
No logging and no lasting storage at the model provider.
retention = 0 · training = offStorage, database and AI inference all stay in an EU region.
Contractual guarantees
Never a consumer API
Only contracted enterprise infrastructure, in European regions — no transfer to services intended for the general public.
No data stored
The model provider neither logs nor stores your queries and documents: retention is disabled by contract and by configuration.
No training data
Nothing that passes through Themis feeds the training of any model — neither ours nor a third party's.
Frequently asked questions
The answers your firm is entitled to expect.
Straight answers, no jargon — the ones we give the firms that audit us.
Is my data used to train AI models? +
No, never. Neither your documents, nor your queries, nor your conversations with the assistant are used to train any model — ours or our providers'. This guarantee is contractual and architectural: we exclusively use enterprise AI offerings where training on customer data is disabled.
Where is my data hosted? +
In the European Union. The database and document storage are in Paris, with backups in Ireland, and AI model inference runs in a European region, under the GDPR.
Which AI models do you use, and where do they run? +
State-of-the-art models hosted in data centres located in the European Union. We never use consumer APIs: only enterprise infrastructure under contract, in EU regions.
What retention applies at the model provider? +
No storage. The model provider does not log your queries and stores neither your queries nor your documents: only an in-memory technical cache remains, cleared within 24 hours. This is governed by contract.
How is professional privilege protected? +
By design. As a contractually-bound GDPR processor, your data is encrypted in transit and at rest and hosted in the European Union. Access is finely controlled by role within the firm and logged, and no data is ever used to train a model.
Who are your sub-processors? +
A short, documented list: hosting, AI infrastructure and technical services, each covered by an impact assessment. The full sub-processor list and our DPA are available on request.
Is my data encrypted? +
Yes, systematically: in transit and at rest. Encryption comes on top of role-based access control and the audit log.
Can I get my data back if I leave? +
Yes. Your documents and invoices can be downloaded at any time. At the end of the contract, your data stays accessible for 30 days to export it, with our help on request. Reversibility is a contractual commitment: your data is never captive.
Are you compliant with the GDPR and the European AI Act? +
GDPR: yes — EU hosting, records of processing, impact assessments and DPA. AI Act: our compliance programme is structured and tracked; we are preparing the corresponding ISO 42001 certification.
Does the lawyer stay in control? +
Always. The AI assists — it researches, prepares, structures and cites its sources — but it never decides. Every output can be verified reference by reference, and remains under the lawyer's control and responsibility.
DPA · security questionnaire · DPIA
Your teams have questions?
Ours have the answers.
Send us your security questionnaire, or request our DPA and sub-processor list — answered within 24 business hours.
DPA ON REQUEST · DOCUMENTED SUB-PROCESSOR LIST · REPLY WITHIN 24 BUSINESS HOURS