What happens to your documents
You are about to upload a contract to a website. That deserves a straight answer rather than a badge, so here is what the software actually does — and what we do not claim.
Encrypted in transit
Every upload, result and download goes over HTTPS. Plain HTTP is redirected, not served.
Never used to train a model
Your contract is read to answer your question. It is not training data, and it is not for sale.
Deleted on a schedule, not on request
Where a file is held at all, deletion is automatic and timed — not something you have to ask for.
The tools keep nothing
All 25 converters, OCR and e-signing process your file in memory. There is no copy to leak.
Retention, part by part
Different parts of the site need different things from your file, so they keep it for different lengths of time. This is the whole picture.
| Where | Stored? | For how long | Why |
|---|---|---|---|
| The 25 document tools | No | — | One request in, one file out. Nothing is written to disk. |
| Document workspace | Yes | ~2 hours after your last change | So you can make several changes without uploading again. |
| Free analysis (no account) | Yes | Up to 24 hours | So you can sign up and claim the result without a second upload. Deleted when claimed. |
| Documents in your account | Yes | Until you delete them | So you can come back to a review. Deleting removes the file. |
The workspace and the free analysis both delete on a timer that runs on the server, not on a job we hope fires: expiry is also checked every time a document is read, so a stalled cleanup cannot turn into a document served past its retention.
What we do not claim
We are not SOC 2 audited. We do not hold ISO 27001. We have not been through a GDPR or CCPA compliance assessment, and we do not offer an uptime SLA. We have no measured accuracy figure for the analysis, and any number you see elsewhere claiming one would be invented.
If your organisation requires a certified processor, we are not it yet — and you should not take a vendor's word on any of this without the paperwork. What we can tell you is precisely what the software does with your file, which is everything above.
Third parties
The analysis runs through a third-party language model provider, and payments run through Stripe — we never see your card details. Nothing else receives your documents.
Found a problem?
Write to support@legalvalidate.ai. If you have found a security issue, say so in the subject line and we will treat it before anything else in the queue.
Security and privacy — questions
Do you store my documents? +
It depends which part of the site you use, and we would rather say so than claim more. The 25 document tools store nothing — your file is processed in memory and gone when the response is sent. The document workspace holds your upload while you work and deletes it about two hours after your last change. A free analysis keeps the document up to 24 hours so you can claim the result by signing up. Documents inside an account stay until you delete them.
Are my documents used to train AI models? +
No. Your document is sent to the model to answer your question and for nothing else. We do not train on customer documents, and we do not sell or share them.
Who processes the analysis? +
The analysis runs through a third-party large language model provider. Your document text is sent there to be read and the result comes back to us; it is not retained by us beyond what is described above.
Is the connection encrypted? +
Yes. Every request and every download travels over HTTPS. There is no plain-HTTP path to the site — the server redirects it.
Do you have SOC 2, ISO 27001 or a GDPR compliance certificate? +
No, and we will not claim otherwise. We are a small team and have not been through those audits. What we can tell you is exactly what the software does with your file, which is what this page is for. If your organisation requires a certified processor, we are not it yet.
Can I delete a document? +
Yes. In an account, deleting a document deletes the stored file. In the workspace there is a delete button that removes it immediately rather than waiting for the two-hour expiry. The single-purpose tools have nothing to delete.
What do you log? +
Ordinary web server request logs, and the IP address of a free analysis so the daily limit can be enforced and abuse investigated. The IP is never returned by the API and is not used for anything else.
Is an AI review confidential in a legal sense? +
No. Using LegalValidate does not create a lawyer-client relationship and nothing here is privileged. If a document is subject to privilege, treat this the same way you would treat any other software vendor.
The formal versions: privacy policy, terms of service, user agreement.