Privacy Policy

Last updated: September 22, 2026

1. Introduction

Proserus, Inc. (“Proserus,” “we,” “our,” or “us”) provides Proserus Legal, a practice-management platform for law firms that runs on the firm's Microsoft 365 tenant together with infrastructure that Proserus operates. This Privacy Policy explains what information we collect, where it is stored, how it is used, and the choices available to you.

It applies to the website at legal.proserus.com, the Proserus Legal application, and the client-facing pages that law firms send to their clients through the platform (payment links, questionnaires, and text messages). Text messages are additionally governed by our SMS Messaging Terms.

2. Roles: Your Firm and Proserus

For the practice data a law firm (the “Firm”) puts into the platform — matters, contacts, time, billing, trust records, documents, and communications with its clients — the Firm is the controller (or “business” under U.S. state privacy laws) and Proserus is the processor (or “service provider”) acting on the Firm's instructions. Our Data Processing Addendum governs that processing.

For information about the Firm's own account with us (who signed up, billing, support correspondence, and website visits), Proserus is the controller.

If you are a client of a law firm that uses Proserus, the Firm decides what information about you is entered into the platform. Please direct questions about that information to the Firm; we will assist the Firm in responding.

3. Information We Collect

  • Sign-in and account information. Proserus uses Microsoft Entra ID single sign-on only; we do not store passwords. When you sign in we receive your name, email address, Microsoft object ID, and tenant ID from your organization's Microsoft account, and we store them to identify you and apply the roles your Firm assigns.
  • Firm practice data. Structured data that Firm users enter or that the platform generates on their behalf: matters, contacts, calendar events, tasks, time entries, expenses, invoices and payment records, trust bank accounts and trust ledger entries, intake leads and questionnaire responses, document metadata, and audit logs.
  • Documents. The files themselves are stored in the Firm's own Microsoft 365 tenant (SharePoint). Proserus reads and writes them through Microsoft Graph using the permissions the Firm's administrator consents to. When a Firm enables document intelligence, we extract the text of documents, split it into passages, and store those passages and their vector embeddings on our infrastructure so the Firm can search and ask questions about its files. When a Firm uses the litigation archive feature, copies of the selected files are stored in Azure Files storage that Proserus operates.
  • AI records. For every AI request we keep a metadata record (who, when, which task, model, token counts, cost). The request and response content itself is kept for the period the Firm configures (Section 6) and then deleted. AI chat conversations and proposed actions are stored so the Firm can review them.
  • Client-facing surfaces. When a Firm sends a payment link, the client's card or bank details are entered directly into Stripe and never reach Proserus servers; we receive a payment status and a Stripe reference. When a Firm sends a questionnaire, the responses are stored as part of the Firm's practice data. When a Firm sends a text message, we store the phone number, the message content, and delivery status.
  • Billing information. Firm subscriptions are billed through Stripe. We store the Stripe customer and subscription identifiers and usage records (for example, AI credit consumption); Stripe stores payment card details.
  • Technical and log data. IP address, browser type, request timestamps and paths, and error reports. When error monitoring is enabled, reports are sent to Sentry with request bodies and cookies removed; tenant and user identifiers may be attached as tags, but email addresses and document content are not.
  • Support communications. Messages you send to us and our replies.

We do not use third-party advertising or analytics trackers on the website or in the application.

4. Where Your Data Is Stored

This is important, and it has changed from earlier versions of this policy. Firm practice data is stored on infrastructure that Proserus operates, not only in the Firm's Microsoft 365 tenant:

  • Proserus-operated database. Structured practice data, AI records, document text passages and embeddings, and audit logs are stored in a PostgreSQL database hosted by Railway in the United States. Each Firm's rows are isolated by database-level row-level security, and the host encrypts data at rest and in transit.
  • The Firm's Microsoft 365 tenant. Documents, email sent through the platform, and Teams collaboration remain in the Firm's own tenant under the Firm's Microsoft security and retention policies. Proserus accesses them through Microsoft Graph with the Firm's admin consent and does not keep standing copies of documents except as described in Section 3 (text passages, embeddings, and litigation archives).
  • Proserus-operated Azure storage. Litigation archive copies, and the Azure Communication Services resources used to send text messages, are hosted in Microsoft Azure in the United States.
  • Transient processing. Document text passes through our OCR service and, for AI features, through the AI providers listed in Section 6, for the duration needed to process the request.

All processing takes place in the United States. If you require processing in another region, contact us before onboarding.

5. How We Use Information

  • To authenticate you and provide the features of the platform to your Firm
  • To process Firm practice data on the Firm's instructions
  • To send messages and payment requests that the Firm directs to its clients
  • To bill Firm subscriptions and meter AI usage
  • To secure the platform, investigate abuse, and keep audit records
  • To provide support and send service notices (maintenance, security, billing)
  • To comply with law and enforce our agreements

We do not sell personal information, and we do not use Firm practice data to train AI models or for advertising.

6. AI Processing

AI features (document summaries, drafting assistance, time-entry suggestions, matter chat, and background agents) are provided through an internal gateway that sends content to a third-party model provider. Depending on the task and the Firm's configuration, the provider is Anthropic, OpenAI, or Azure OpenAI. Only the content needed for the specific request is sent.

  • No training. Our provider agreements require that content submitted through the platform is not used to train the provider's models. Where the provider offers zero data retention for API traffic, we use it, as configured in our provider agreements. Providers may retain content briefly for abuse monitoring where their terms so provide.
  • Bring your own key. A Firm may supply its own Anthropic, OpenAI, or Azure OpenAI credentials. We store them with AES-256-GCM envelope encryption and decrypt them only on the server at the moment of a request. When a Firm uses its own key, the Firm's own agreement with that provider governs the provider's handling of the content.
  • Retention. AI request and response content is retained for the number of days the Firm sets in its AI policy (default 365 days; minimum 30 days) and then deleted automatically. The metadata record of each request is kept as part of the audit trail. A Firm can ask us to purge AI content earlier.
  • Human control. Each AI task has an autonomy level set by the Firm, subject to hard-coded ceilings: outbound communications, court-facing documents, billing finalization, and calendar or task writes always require a person's approval.
  • Consent records. The platform lets a Firm record client consent to AI use at the firm, matter, or contact level. Obtaining any consent that the Firm's professional rules require is the Firm's responsibility.

7. Subprocessors and Sharing

We share information only as follows:

  • Subprocessors. Vendors that host or process data on our behalf, listed with their purpose and location on our Subprocessors page. They are bound by written terms that limit their use of the data to providing their service to us.
  • Your Firm. Firm administrators can see the data of their own Firm, including audit logs of user activity.
  • Microsoft. Sign-in is handled by Microsoft's identity platform, and documents live in the Firm's Microsoft 365 tenant, under Microsoft's terms with the Firm.
  • Legal requirements. We may disclose information when required by law, subpoena, or court order, or to protect the rights and safety of Proserus, our customers, or others. Where lawful, we will notify the affected Firm before disclosing its data so that it can assert privilege or seek protection.
  • Business transfers. If Proserus is acquired or merges, information may transfer to the successor, which will be bound by this policy.

8. Client-Facing Surfaces

Law firms use Proserus to reach their clients. On these surfaces the Firm is the party you are dealing with, and the Firm is responsible for obtaining any consent needed to contact you.

  • Payment links. Card and bank details are entered into a Stripe-hosted form and processed under Stripe's privacy policy. Proserus receives the amount, status, and a reference identifier. Payment pages are rate-limited and accessible only by unguessable link.
  • Questionnaires. Responses go to the Firm that sent the link and are stored as part of the Firm's practice data.
  • Text messages. Sent through Azure Communication Services on behalf of the Firm. See the SMS Messaging Terms for opt-out instructions.

9. Cookies and Local Storage

The application uses browser session storage to hold Microsoft sign-in tokens (via the Microsoft MSAL library) and local storage for interface preferences such as saved views. Stripe sets cookies on payment pages for fraud prevention. We do not set advertising cookies and do not use cross-site tracking.

10. Retention and Deletion

  • During the subscription. We retain Firm practice data for as long as the Firm's account is active. AI content is deleted on the schedule in Section 6. Trust ledger entries are immutable by design and are retained for the life of the account.
  • After termination. The Firm may export its data for 30 days after termination (see the Terms of Service). After that window we delete the Firm's data from our production systems within 90 days, and from backups within a further 30 days, except where we must retain records to comply with law, resolve disputes, or enforce our agreements.
  • Documents in Microsoft 365 are unaffected by termination; they stay in the Firm's tenant.
  • Account and billing records are kept for as long as needed for tax and accounting obligations.

11. Your Rights and Requests

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to not be discriminated against for exercising these rights.

  • If your information is part of a Firm's practice data, please contact the Firm; we will act on the Firm's verified instructions.
  • For information that Proserus controls (your account with us, support, website), email privacy@proserus.com. We will verify your identity and respond within the time required by applicable law (45 days for most U.S. state laws, extendable once).

12. Security

Our technical and organizational safeguards are described on the Security page. In summary: single sign-on only, server-side permission checks on every request, database row-level tenant isolation, audit logging, rate limiting, encrypted provider credentials, allowlisted and audited operator access, and encryption in transit and at rest. If we become aware of a breach affecting your Firm's data, we will notify the Firm without undue delay and within 72 hours of confirmation. Report security concerns to security@proserus.com.

13. Children's Privacy

Proserus is a business application for legal professionals. We do not knowingly collect personal information directly from anyone under 16. A Firm may lawfully record information about minors in the course of its representation; that information is Firm practice data under the Firm's control.

14. Changes to This Policy

We may update this policy from time to time. For material changes we will notify Firm administrators by email or in-app notice at least 30 days before the change takes effect, and we will update the “Last updated” date above.

15. Contact

Proserus, Inc.
Privacy: privacy@proserus.com
Security: security@proserus.com
Legal: legal@proserus.com