For Law Firms: Confidentiality

What leaves the device

Sortio is a desktop app for Mac and Windows (Linux builds are also available). When a sort runs with the default cloud AI provider selected, the following is transmitted to Sortio's API and forwarded to our AI provider (OpenAI) for inference:

• Filenames of the files being sorted.
• Source and candidate destination folder paths.
• The user's instruction and our system prompt.
• Only with Analyze contents on: a text excerpt of each file, about 4 KB, taken from the beginning and end of the document's text. For a scanned document, this is the text that on-device OCR recognized from its first pages.
• For the Clio integration, matter metadata: display number, description, client and party names, and assigned attorney.

What does not leave the device

• File contents, by default. Analyze contents (content-based sorting and entity extraction) is off until the user turns it on. Once turned on, it stays on for later sorts until it is turned off in Settings, General, "Analyze file contents". Excerpts are sent while contents are being analyzed, before the preview; Apply controls file moves, not what is sent.
• Scanned images. OCR runs on the device, and only the recognized text excerpt described above is sent, only with Analyze contents on.
• The full matter list. Only the metadata fields above are sent, not custom fields, billing entries, or related documents.
• Long-lived Clio access tokens. They are stored on the user's machine and only seen by our servers at the moment of OAuth callback and during token refresh; they are never used by Sortio's servers to read documents autonomously.
• AI requests, in Offline Mode. With Offline Mode (Ollama or LM Studio) selected, filenames, folder paths, instructions and document excerpts are processed by the model on the user's machine and do not go to Sortio's AI service or to any cloud AI provider.

Scanned documents (OCR)

• On-device. Scanned PDFs and photos of documents are read with OCR on the user's computer: the OCR built into macOS on Mac, and an OCR engine bundled with Sortio on Windows. OCR is not available on Linux.
• Only with Analyze contents on. OCR runs when a sort reads contents. It reads the first pages of each scan, up to about 4 KB of text, which is what the AI step uses.
• Unreadable scans are not guessed. On a content sort, a scan that could not be read is set aside in a _Needs Review folder instead of being placed by guess.
• Can be turned off. Settings, "Read scanned documents (OCR)".

Where the data goes

• Sortio's classifier service: Google Cloud Run and Google Cloud SQL, us-east1 (United States).
• OpenAI: United States. API content is not used to train OpenAI models per their API terms. Retention at OpenAI is short term for abuse prevention.
• Sortio retains classifier prompts for up to 30 days for service operation and debugging. After that window, client names and matter party names are redacted before any longer-term retention.
• Anthropic: only if the firm supplies its own API key via BYOK; data is then processed under the firm's contract with Anthropic.

Confidentiality controls

• Encryption in transit. TLS 1.2 or higher between the desktop app, Sortio's API, and our AI provider (OpenAI).
• Encryption at rest. Google Cloud SQL and Google Cloud Storage default encryption.
• Access control. Least-privilege production access.
• Content reading is opt-in. Document excerpts are sent only when the user turns on Analyze contents, which then stays on until it is turned off in Settings, General, "Analyze file contents". Filenames, folder paths and matter metadata are sent for cloud classification as described above.
• Preview before Apply. Every sort produces a preview that the user reviews; nothing moves until the user clicks Apply. Each applied sort is recorded in the app's Activity view, where the user can review and undo it.

Opt-out paths

• Offline Mode (Ollama or LM Studio). Switch the AI provider in Settings, AI, to Offline Mode. Filenames, paths, prompts and document excerpts then go to the model on the machine. It needs a local model installed, and results can differ from the cloud model.
• Bring Your Own Key. Use the firm's Anthropic or OpenAI API key. Requests then go from the desktop app straight to that provider under the firm's contract, not through Sortio. Filenames, paths and excerpts still go to that cloud provider.
• Rule Builder. Use deterministic, AI-free rules for matter folder routing.
• Analyze contents off. Keep AI sort to filenames and folder paths only.

Deletion

On account deletion or DPA request, Sortio deletes classifier prompts, account records, and Clio tokens within 30 days. Documents previously uploaded into Clio remain in Clio under the firm's account; they are not stored by Sortio.

What we cannot offer

• HIPAA Business Associate Agreements. Sortio is not HIPAA-compliant. Files containing protected health information should not be processed.
• A SOC 2 report. We do not have a SOC 2 report. Our controls are documented in the Security and DPA pages.

Procurement contacts

For procurement, security questionnaires, signed DPAs, and technical security questions: marcus@getsortio.com.