Security & trust
Law firms hold some of the most sensitive information there is, and personal injury files add medical records. These are the rules Meruit is built on, and the commitments we're making before we've earned any badges.
AI drafts and suggests; people decide. A demand letter is locked only when a named lawyer approves it, limitation dates count only once a lawyer confirms them, and chronology entries join the file only when your team approves them. Every approval is recorded.
Every AI-suggested chronology entry is tied to a page and a quoted line, and Meruit checks the quote really appears on that page. If there's no source, Meruit says so instead of guessing.
Your clients' information is used only to do your firm's work. It is never used to train AI models, ours or anyone else's.
We only send firm data to AI providers that agree in writing not to retain it or train on it.
Every person at every firm signs in with a second factor, such as an authenticator app or a passkey. It isn't optional, for anyone, including us.
Who did what, on which matter, and when, including what the AI suggested and who approved it. The database itself refuses changes to the log, so nothing in the application can rewrite history.
Every record belongs to one firm, and the database enforces it with a second lock (row-level security), so a mistake in our code returns nothing rather than another firm's files.
Restricted matters are visible only to the team members you name. Everyone else can't open them or find them in search.
Commitments, not certifications
We'd rather tell you exactly where we are than show you a badge we haven't earned.
We'll sign a BAA with your firm before you upload real medical records, and we'll only use hosting, storage and AI providers that sign one with us.
An independent SOC 2 audit is planned. We don't have a report yet, and we won't claim one until we do.
Data is encrypted in transit and at rest. Documents are private, and only reachable through short-lived signed links for people who can see the matter.
Questions
We're building Meruit to handle medical records under HIPAA, and we'll sign a business associate agreement (BAA) with your firm before you upload real medical records. We won't ask you to put real records in Meruit before that's in place.
Not yet. A SOC 2 audit is planned. We'll say so here when there's a report to share, and not before.
In the United States. The database and services run in a US region, and documents are stored encrypted in a US region of Amazon Web Services.
Opinion 512 (July 2024) asks lawyers using generative AI to understand the tools, protect client confidences, check the output and supervise it. Meruit is designed to make that easier: sources on every AI fact, lawyer approval on what goes out, no training on your data, and a record of who approved what. Your duties are still yours; we can't meet them for you.
Something we haven't covered? Email hello@meruit.app and we'll answer in writing.