Data Security and Confidentiality

Last updated: October 6, 2026

We know that the information you put into Vellor often includes confidential client information, and that your duty of confidentiality extends to the vendors you use. This page explains how we handle that data. It is part of our Terms of Service.

Your data is yours

  • You own the documents, client information, and content you submit ("Customer Data").
  • We process Customer Data only to provide, maintain, secure, and support the Service, and on your instructions.
  • We do not sell Customer Data.
  • We do not use Customer Data to train our own or any third party's general-purpose AI models.

Confidentiality

  • We treat Customer Data as confidential and limit access to personnel who need it to operate and support the Service, under confidentiality obligations.

Security measures

We use administrative, technical, and physical safeguards designed to protect Customer Data, including:

  • Encryption in transit (TLS) and at rest;
  • Access controls, authentication, and least-privilege access;
  • Logging and monitoring;
  • Secure, reputable cloud infrastructure (Vercel) and database hosting (Supabase);
  • Regular backups and other measures. No system is perfectly secure, but we work to protect your data using industry-standard practices.

Sub-processors

We use a limited set of vetted providers to deliver the Service. Current sub-processors include:

  • Stripe — payment processing.
  • Vercel — application hosting and infrastructure.
  • Supabase — database and storage.
  • Anthropic — AI processing of the inputs you submit to generate output. Under Anthropic's commercial terms, it does not use these inputs or outputs to train its models. We currently use Anthropic and may add or change AI providers and models over time, updating this statement accordingly. For Research, Anthropic's web search runs search queries through third-party search providers that Anthropic engages.
  • Resend — transactional and account email.
  • Deepgram — speech-to-text, used only when you choose to dictate. Audio is sent for transcription and is not retained after the transcript is returned, and is not used to train its models. See "Voice input" below. We will maintain this list and provide notice of material changes.

Voice input

Dictation is optional. Nothing is recorded unless you press the microphone button, and your browser will show its own recording indicator for as long as it is active.

  • When you stop recording, the audio is sent to Deepgram for transcription and the text is placed in the message box for you to read and edit. Nothing is sent to the AI, saved, or acted on until you press Send.
  • We transmit every request with Deepgram's model-improvement programme switched off, so the audio is retained only for as long as it takes to produce the transcript and is never used to train their models.
  • Vellor does not store the recording. The audio exists in memory for the length of the request and is never written to our database, our file storage, or our logs.
  • We do not use the browser's built-in speech recognition. In most browsers that feature sends audio to the browser's maker — Google in Chrome, Apple in Safari, Microsoft in Edge — under terms we do not control and cannot extend to you. Routing dictation through a named sub-processor is what lets us make the commitments above.

How AI processing works

When you use AI features, the inputs you provide are sent to our AI provider, currently Anthropic, to generate output, which is then returned to you. Anthropic processes these inputs to provide the service and, under its commercial terms, does not use them to train its models. We do not use your inputs or outputs to train any AI models.

Research

Research is an optional feature on plans that include it. A firm administrator can turn it off for the firm.

  • What it does. Research answers legal-research questions using web search. Searches are limited to an approved list of official and reputable legal sources, and every answer lists the sources it relied on.
  • What leaves Vellor. The question you type is processed by our AI provider, currently Anthropic. The search queries generated from it are run by Anthropic's web search, which uses third-party search providers engaged by Anthropic. Search queries are handled under those providers' terms, which we do not control.
  • What does not. Research does not receive your matters, client records, leads, documents, or other Customer Data. It runs separately from matter and lead chat, which do not use web search.
  • Identifier check. Before a question is sent, Vellor checks it against the client and lead names on file in your account and for common identifiers (Social Security numbers, email addresses, phone numbers, dates of birth) and asks you to rephrase a question that appears to contain one. This check is a safeguard, not a guarantee. Do not include client-identifying details in research questions.
  • Records. The search queries run and the domains cited are recorded in your account's activity log. Vellor reviews only aggregated, de-identified research usage — volumes, topics, and costs — to operate and improve the Service. Vellor personnel do not review the content of your research questions or answers.
  • Verify before relying. Research output cites third-party sources. It may be incomplete, out of date, or misread a source. Verify against the primary source before relying on it.

Data retention and deletion

  • Customer Data is retained while your account is active.
  • On termination, we make Customer Data available for export for 30 days, then delete it within 90 days, unless a longer period is required by law or to resolve disputes. Backups are purged on a rolling basis, generally within 90 days.
  • You may request deletion of specific Customer Data at support@ellisaitech.com.

Breach notification

If we become aware of a security incident affecting your Customer Data, we will notify you without undue delay and consistent with applicable law, and provide information to help you meet your own notification obligations.

Data Processing Addendum (DPA)

A Data Processing Addendum is available for customers who require one for their compliance and professional-responsibility obligations. Contact support@ellisaitech.com to request the DPA.

Your responsibilities

  • Confirm you have the rights and client authorizations to submit Customer Data.
  • Use strong, unique credentials and keep them confidential.
  • Configure access for your personnel appropriately and supervise their use.

Contact

Ellis Tech LLC — 1125 West St., Ste. 581, Annapolis, MD 21401 — support@ellisaitech.com