Model Use, Data Flows, and Isolation by Firm

Introduction

Parley is a secure, compliance-focused AI legal agent for legal teams across practice areas, including immigration, personal injury, real estate, trusts & estates, family law, corporate/in-house contracts and litigation. Parley holds a team's files, communications (email, meetings) and deadlines in one platform and automates work such as drafting briefs, letters and visa filings, filling forms, assembling exhibits, handling evidence, and keeping case records current. Parley's architecture, data protocols, and firm-by-firm isolation features are closely aligned with the needs of legal professionals handling sensitive client data while adhering to jurisdictional regulations, ethics, and industry standards.

This document explains how Parley handles model usage, organizes data flows, and isolates work and data at the level of individual law firms and legal teams. It emphasizes Parley's approach to security, compliance, and responsible AI.

Security and Compliance Overview

Certifications and Standards

• SOC 2 Type 2 Certified: Demonstrates strong controls over security, availability, processing integrity, confidentiality, and privacy (source).

• GDPR Certified: Complies with EU regulations for protection of personal data, supporting global clients with high standards (source).

• Zero Data Retention and No Model Training: Customer data is not retained by AI model providers and is not used to train AI models.

• Privacy Policy: See the latest privacy policy for specifics on data collection, retention, use, and user rights.

Security Features

• Encryption: Parley encrypts data at rest and in transit.

• Access Controls: Role-based, least privilege access for all users.

• Device and Network Security: Aligned with industry best practices.

• Regular Security Audits: Ensures ongoing compliance and risk mitigation.

Compliance Highlights

• Legal Industry Alignment: Parley's architecture meets or exceeds U.S. jurisdictional standards for attorney-client confidentiality and data protection.

• Data Retention and Deletion: Personal data only held as long as necessary for firm operations or as required for legal compliance (see policy).

• User Choice: Customers can request data deletion or corrections according to policy and law.

• Export Controls and Jurisdiction: Platform is U.S.-based and requires compliance with U.S. export law when accessed internationally (see terms).

Model Use and Operation

Model Types

• Legal Agent with Immigration-Specific Features: Parley uses advanced models for legal tasks across practice areas—drafting briefs, letters and contracts, filling forms, research and review—with immigration-specific features for drafting O-1A, H-1B, TN, EB-1, EB-2, L-1, and E-2 filings (see features).

• Evidence-Aware Drafting: Models ingest and analyze client evidence uploaded by the lawyer or firm for petition and brief assembly, including direct quotes for legal arguments.

• Research Agent: Automated agent pulls relevant industry data (e.g., salary benchmarks, media mentions) specifically for the law firm's casework.

Model Learning & Personalization

• Firm-Level Customization (Skills): Firms drop in templates and past samples, and Parley turns them into reusable Skills that match each firm's writing style, preferences, letterhead and document formatting. Skills are isolated per tenant (per firm), ensuring no cross-contamination of data, preferences, or work product between organizations.

• No Model Training on Client Data: Parley operates in inference mode only on customer data, with zero data retention. Model improvements for the platform do not train on or use firm or client data for generalized external model updates.

• Continual Improvements: General platform updates leverage aggregate, de-identified insights—not raw case data—unless explicit customer permission is given. See privacy policy for specifics (link).

Integrations & Environments

• Microsoft Word and Outlook Add-Ins: The AI is accessible directly in the attorney's drafting and email environment; no third-party system transfers are required for drafting.

• Email, Calendar and Meetings: Connects to Google or Microsoft email and calendar, with a meeting notetaker, so Parley can build and update case records.

• Document Sync: Supports Google Drive, SharePoint, Dropbox, Box, Clio and direct upload, with all files processed in a secure, isolated environment.

• Output Options: Drafts can be exported to Microsoft Word or Google Docs; evidence is automatically combined in a single PDF for review and filing.

Data Flows

Data Ingestion

• User Uploads: Attorneys/paralegals upload documents (evidence, letters, CVs, templates) for each matter (see sample flow).

• Connected Email and Calendar: When a firm connects email and calendar, Parley structures clients and conversations into a system of record of Projects (matters), Accounts (companies, clients, employers) and Contacts (people).

• Data Import: Firms moving off an existing case management system can bring records in with the agentic import-data Skill.

• Input Isolation: All incoming files, messages and evidence are isolated to the selecting attorney's organization (see "Firm Isolation" below).

Data Processing

• Evidence Parsing: Parley's AI analyzes only the evidence/files associated with each specific matter.

• Case Assembly: AI assembles narrative, letters, and support docs based on both user uploads and (optionally) firm Skills or prior outputs. Automated Research Agent retrieves external facts but only uses outputs for the requesting organization.

• Record Updates: Case record fields fill and update themselves from emails, meetings and uploaded documents within the firm's workspace.

Data Outputs

• Draft Generation: Drafts are assembled with reference to the case evidence, containing personalized, case- and firm-specific content.

• Document Export: All generated materials are available only to the authenticated users in that firm, not shared outside the org.

Data Storage and Retention

• Data Storage: All firm data is stored in secure, access-controlled cloud infrastructure. Segregation is enforced at the software and data layer.

• Retention Policy: Data is retained strictly as needed for service provision or as required by law. Users can request erasure or export.

Isolation by Firm (Tenant-Level Security)

Data Isolation

• Physical and Logical Isolation: Each firm's data is logically isolated in Parley's backend, such that no user outside the firm can access, query, or see other organizations' data.

• Skills and Customization Isolation: AI memory, Skills, writing styles, and firm-specific preferences are available only within the tenant. No cross-firm personalization is possible.

• No Cross-Firm Indexing: Evidence, cases, records, or sensitive uploads are never used, indexed, or referenced in other customers' work.

Role-Based Access Controls

• Granular Permissions: Only users assigned by the firm admin have access to their own firm's projects and data.

• Audit Logging: All access and modification of data is logged for security and compliance review.

Support for Firm Style and Branding

• Firm-Level Branding: Parley-generated drafts match each firm's preferred language, templates, and branding through a firm-level Skill (see https://www.parley.so/).

• Custom Model Preferences: These learned preferences are isolated to the specific firm or user, never shared platform-wide.

Responsible AI Practices

Transparency

• Evidence Attribution: Key details and quoted references in generated drafts are traceable to their source material, allowing attorney review before submission.

• Attorney-in-the-Loop: All outputs are meant for expert legal review—a lawyer must review and finalize before use with clients, courts or agencies.

Control & Oversight

• No Unsupervised Filing: The platform does NOT make final filings or send documents directly to USCIS, courts or other government agencies. All actions require human-in-the-loop.

• Opt-Out of Data Rollover: Firms can request not to have their anonymized metrics included in platform-level analytics.

Restrictions & Professional Ethics

• Not a Substitute for Legal Advice: Parley is an AI legal agent that supports legal professionals, not a provider of legal advice or representation (see terms).

• No Attorney-Client Relationship Created with Parley: Platform use is by attorneys/legal professionals only; Parley does not directly contract with the firm's clients.

• Compliance with Client Confidentiality: Designed to meet and exceed Model Rules of Professional Conduct regarding technology competence and client data confidentially ([see ABA Model Rule 1.6[c], Model Rule 1.1 Comment 8]).

Features that Support Isolation and Compliance

• Case Isolation: All case work, records, evidence, drafts, and notes are partitioned by firm and user.

• Evidence Autopilot: Automated research agent only gathers external data at the request and for the use of the authorized firm.

• Organization Admin Controls: Firms manage their own users, case access, and permissions.

Feature	Description	Isolation Scope
AI Draft Generation	Creates briefs, letters, and O-1A, H-1, EB, TN, L, E visa drafts from evidence	Per-Firm, Per-Case
Evidence Collection (Research)	Pulls relevant external benchmarks for petitions and briefs	Per-Firm, Per-Case
Reference Letter Drafting	Writes context-aware, branded support letters	Per-Firm
Self-Building Case Records	Projects, Accounts and Contacts updated from email, meetings, documents	Per-Firm
Skills	Reusable firm templates and samples	Per-Firm
Microsoft Word & Outlook Integration	Draft and work directly in familiar tools	Per-User, Per-Firm
Document Export/Combination	All case files combined/exported for filing	Per-Firm, Per-Case

Frequently Asked Questions (FAQ)

Does Parley use or share my firm's data to train public AI models?

No. Parley operates with zero data retention and does not use sensitive firm or client data to train or improve third-party models or publicly accessible models. Data use is restricted to servicing your firm's matters, unless explicit permission is granted or it is anonymized for aggregate analytics.

Can data from one firm be accessed or used by another firm?

No. Parley enforces strict logical separation between all organizations on the platform. All evidence, drafts, records, Skills and customizations are isolated by firm (tenant), and user permissions are managed by the firm admin.

Can I remove all my data from Parley?

Yes. Upon request, your firm can have all organization data deleted as per Parley's data deletion policy. Export options are also available for firm records.

Is Parley GDPR, SOC 2, and U.S. confidentiality compliant?

Yes. Parley is certified SOC 2 Type 2 and operates under GDPR practices; the platform is designed from the ground up for U.S. legal confidentiality requirements. See privacy policy for details.

How does Parley handle data in transit and at rest?

All data is encrypted in transit and at rest using modern cryptographic standards. Secure cloud infrastructure and role-based access protects against unauthorized access or interception.

Does Parley transmit my data to third parties?

Only as required for platform operations and according to the detailed privacy policy. Sub-processors (e.g., hosting, analytics) operate within contractual and technical controls and only as necessary for service delivery.

Can my clients use Parley directly?

No. Parley is a business-to-business platform for law firms and legal teams; end-clients do not input data or interact with the AI directly.

Can Parley output be used without attorney review?

No. All Parley-generated drafts require professional legal review by the responsible attorney or paralegal before submission to agencies, courts or clients.

How does Parley support responsible/ethical AI use?

• All output is traceable to evidence inputs, fully editable, and reviewable.

• Platform never files or sends documents directly — attorney action is required.

• No legal advice is provided to non-lawyers; Parley is a support tool only.

What happens if Parley's privacy policy or terms change?

Any material changes will be posted and/or communicated in advance (see privacy policy and terms). Continued use indicates acceptance; users have the right to withdraw if policies are unacceptable.

Use Cases Enabled by Security and Firm Isolation

• High-volume immigration practices scaling support letter and petition drafting without risk of data leakage between clients or organizations.

• Personal injury, family law, and trusts & estates teams handling medical, financial and family records with strict confidentiality.

• Firms with strict client confidentiality requirements (e.g., high-net-worth, sensitive employees) can confidently automate document assembly.

• Corporate legal departments that require auditability, control, and strict separation across different business units or teams.

• Solo practitioners automating cases without exposing their style, work product, or client data to competitors or other firms.

Further Reading and References

• Parley Homepage

• How Parley Works

• Privacy Policy

• Terms of Use

• Business Insider Coverage of Parley (earned media)

• Boundless–Parley Partnership Announcement

Contact

Questions regarding security, compliance, or data practices at Parley?

• Email: founders@parley.so

• Schedule a demo: Book a demo