How ARTY Protects Confidential Client Information
Enterprise-Grade Security: ARTY’s Confidentiality Architecture
Patent professionals trust ARTY with some of the most sensitive intellectual property in the world: unpublished inventions, prosecution strategy, and attorney-client communications. Security is not a feature ARTY ships with. It is part of how ARTY was designed. This is the second article in a four-part series on ARTY.
Last week, we wrote about how ARTY embeds quality validation throughout the drafting process. This week we want to address the question every General Counsel and IP director asks before allowing outside counsel to use any AI tool on their work. Where does our data go, and who can see it?
The honest answer is that AI tools in the legal market vary widely on this point. Some route prompts through public model endpoints with limited contractual protection. Some store data in or transmit data to jurisdictions clients have not approved. Some retain customer content for model improvement. The variation is real, and the risk is real.
ARTY was designed around a different posture. Data security is a core design principle, not a layer added after the fact. Every layer of the platform, from the database up through the AI inference path, has been built to enterprise standards before the platform reached production.
Three Layers Of Data Isolation
The starting point is isolation. ARTY enforces strict data separation at three independent levels: session, user, and organization. The layers are independently enforced, so that a failure at one layer cannot compromise the others.
At the session level, each work session has a dedicated message manager that filters real-time database subscriptions to that session’s ID. If a message from a different session is received, the event is logged as a critical isolation violation and discarded. The behavior is validated to support multiple concurrent sessions without cross-contamination.
At the user level, sessions and documents created by one attorney are not visible to other attorneys, even within the same organization. This is enforced through Row-Level Security policies bound to the authenticated user’s unique identifier, applied at the database layer rather than in application code.
At the organization level, tenants are isolated with no shared data pathways. Row Level Security policies apply to every database table, and administrative views run under the calling user’s permissions rather than elevated credentials.
“Isolation at the database layer is what makes the rest of the security story credible. If you have not enforced separation at the data layer, you cannot fix it elsewhere. Every other control is built on top of that foundation.”
— Anup Suresh, Security and Compliance Lead, SLW
Encryption At Every Layer
All customer data is encrypted at rest using AES-256 via AWS Key Management Service, applied across the database, document storage, application and audit logs, automated backups, and compute volumes. KMS keys are configured with automatic rotation and full audit logging.
All data in transit is protected using TLS 1.3. The encryption applies to every connection in the platform: browser to application, application to database, application to AI providers, and application to document storage. HTTP connections are automatically redirected to HTTPS through a permanent 301 redirect.
Identity, Access, And The Question Of Who Can Log In
ARTY uses Microsoft Entra ID for single sign-on, with multi-factor authentication enforced for all users through Conditional Access policies. Role-based access control is enforced at the database layer through Row-Level Security policies that validate user role and active status on every query.
User registration is restricted at the database trigger level to authorized email domains, which is enforced server-side and cannot be bypassed through API calls. Every user account is assigned a cryptographically unique identifier that is referenced by all database policies, sessions, and audit entries.
Zero Training On Customer Data
ARTY routes AI requests through foundation models from Anthropic, OpenAI, and Google, with most inference flowing through AWS Bedrock. All AI inference runs in inference-only mode. Customer prompts, documents, and AI responses are not used to train or fine-tune any foundation model.
Additionally, provider credentials are stored as encrypted secrets in our infrastructure, not in source code, and credential values are masked in all application logs.
Where The Data Lives
All infrastructure used to process and store customer data resides within the United States. ARTY is deployed on AWS US-West, including application compute, database, document storage, AI inference, and all audit and log data. Network traffic flows through strictly isolated tiers: a public subnet for the load balancer, a private application subnet, and a private database subnet with no internet access.
For clients with stricter requirements, such as those needing FedRAMP High or ITAR/EAR compliance, ARTY supports deployment to AWS GovCloud as an option.
Inherited Certifications
Compliance certifications that derive from the underlying infrastructure are inherited rather than re-certified at the application layer. ARTY’s AWS infrastructure carries SOC 2 Type II and ISO 27001 certifications. AWS GovCloud carries FedRAMP High authorization, which is available for select deployments. ITAR and EAR compliance is also available through the GovCloud deployment option.
Penetration testing has been conducted on the platform, covering application-layer vulnerabilities, authentication controls, session isolation, and network security boundaries. Detailed information on testing scope and cadence is available on request from our security team.
Monitoring And Incident Response
Continuous monitoring runs across the platform. AWS GuardDuty provides threat detection. CloudTrail captures a full audit trail of API calls. VPC Flow Logs capture network traffic. Every administrative action is logged with actor identifier, IP address, user agent, and timestamp.
If an incident occurs, ARTY’s incident response process moves through six defined phases: detection, formal documentation, risk assessment, customer notification, containment and remediation, and post-incident review. SLW commits to notifying affected customers within twenty-four hours of a confirmed breach.
“Hard rules are not negotiable. No client data enters public AI models without authorization. Every AI-generated work product receives substantive attorney review. Full audit logging on every matter. These are architectural choices we made before the platform existed, not policy disclaimers we added after.”
— Andre L. Marais, AI Adoption Lead, SLW
What This Means For Clients
For Fortune 500 IP departments and corporate counsel offices evaluating outside firms against an AI lens, ARTY can offer a substantive answer rather than a marketing slogan. The platform’s security posture is documented, auditable, and grounded in enterprise-grade infrastructure that meets the same standards the firm’s clients hold themselves to.
A more detailed Data Security and Compliance overview is available upon request, and security questions can be directed to security@slwip.com. The next article in this series will turn to what makes ARTY distinctly built for patent prosecution rather than adapted from general-purpose tools.