Security
Security and data handling
DALI is used on client matters by regulated professionals. The controls below are implemented in the product today, not aspirations on a roadmap.
Certification
Cyber Essentials certified
DALI Intelligence holds Cyber Essentials certification. Cyber Essentials is the UK government-backed scheme administered by IASME on behalf of the National Cyber Security Centre. It certifies the five technical controls that prevent the large majority of common attacks: boundary and software firewalls, secure configuration, security update management, user access control, and malware protection.
Alongside it we maintain an engineering control register, a record of what is implemented in the codebase, mapped to the control sets a law firm’s security questionnaire works from. It is available to prospective clients on request. Write to contact@daliintelligence.com.
Controls
What is implemented
The AI boundary is the control most relevant to a legal practice, so it is described first and in the most detail.
One governed egress per model provider
Every call to a language, embedding or reranking model passes through a single guard before it leaves the system. There is one auditable choke point per provider rather than call sites scattered across the codebase.
Data classification on every payload
Content is classified before it can be sent anywhere: public corpus material, vault documents, matter documents and free text a user typed are distinguished, and handled differently.
Enforcement, not just logging
An unconsented or untagged confidential payload raises an error and the call fails. The boundary is a gate, not a monitor that records a leak after it happens.
The control cannot silently regress
Continuous integration fails the build if a new model call site is added without registration, or a new confidential column is added without classification. The set of ungoverned paths is only permitted to shrink.
Zero-retention posture with model providers
Client data is not retained or used for training by the model provider, under organisation-level contractual terms, asserted at application startup.
Tenant isolation
Data is scoped per organisation. Matter history, vault contents and review documents are visible only within the organisation that created them.
Encryption in transit and at rest
HTTPS is enforced with HSTS across the application. Uploaded documents are stored encrypted at rest in object storage rather than on ephemeral application disk.
Retention you control
Documents uploaded for review are removed after thirty days unless explicitly saved to matter history, so a one-off review does not become a permanent copy of a client's contract.
Send us your security questionnaire
We would rather answer it properly than have you discover a gap in month three. The control register goes out with it.