We built like the intake conversation is legal work product.

Your data

Strict per-firm isolation

Every conversation, case file, and message is bound to your firm at the database layer. One firm can never see another firm’s conversations or claimants. The database enforces this, not just the app: tables are closed to everyone by default, and each record has to agree with its parent about which firm it belongs to, or the database refuses it.

You own it, and can take it with you

The intake conversations, case files, and evidence collected through your widget and lines belong to your firm. Your firm’s owner can download everything at any time from Settings: one ZIP file with every conversation, case file, and evidence file.

Retention you control

Your firm’s owner sets how long conversations are kept (1 to 7 years, or forever) in Settings. After that window, old conversations are deleted or redacted automatically. A claimant’s deletion request is carried out in one action, by your firm’s owner or by our team on request. The only exception is a narrow, documented hold on data that is active evidence in a billing dispute.

Never used to train models

Your intake data is used to serve your firm: answering, organizing, and packaging it for attorney review. It is not used to train AI models. Our AI providers (Anthropic, and Google’s Gemini API for evidence photos) are used through paid commercial APIs, under terms that don’t allow training on what we send. Under their standard terms they may keep request data for a limited period for abuse and safety monitoring. We don’t claim zero data retention.

One case per AI request

Each AI request contains a single case’s information and nothing else. The chat model has no tools and no database access, so a visitor can’t talk it into revealing another conversation. Nothing a visitor types is ever placed into the model’s instructions.

An audit trail on our access

Any time someone on the Burt team opens one of your conversations, that view is written to an audit log before the transcript is shown. If our support team ever works inside your account, it uses its own separate credential (never your login), the session ends after 24 hours without activity, and every action taken during it is logged. Deletions are logged before they run.

Encrypted in transit and at rest

All traffic is TLS-encrypted, and data and uploaded evidence are stored encrypted at rest by our infrastructure providers. Evidence files live in private storage. Each viewing link for the evidence in your case files is signed and expires after 60 seconds (15 minutes for video).

Hardened access

Visitor session tokens are stored only as one-way hashes, so a copy of the database can’t be used to take over a live chat. Your widget runs only on the website domains you list. Requests are rate-limited.

We are candid about where we are: Burt is early, and we are not yet SOC 2 certified. What we can show you today is exactly how the system is built. There’s a one-page summary for your IT or security reviewer, and we’re happy to walk them through it.

The AI, and the ethics

Burt does not practice law

It does not give legal advice, estimate the value of a case, or promise an outcome. It gathers facts and documents the injury for attorney review. Its intake score is an estimate of intake fit based on the injury, its severity, and how recent it is. It is not a legal opinion on the claim. Your firm keeps the attorney-client relationship, conflicts checking, and every engagement decision.

A person can always take over

Your team can step into any live conversation, and Burt yields — and any billing dispute is reviewed by a person, not the model.

Every word is logged and attributable

The full transcript of what Burt said, under your firm’s name, is retained and reviewable. If a question about a conversation ever comes up, the record is the answer.

Consent and messaging compliance

Text-message follow-ups honor opt-in and STOP/HELP handling, so a claimant can stop messages at any time.

Who processes your data

We use established providers, each receiving only what it needs to do its job:

The full list, with the data each provider handles, is in our Privacy Policy.

Report a vulnerability

Where to send it

Email security@hiburt.com (English or Spanish). Our security.txt lists the same contact.

What to include

What you found and where (the URL, endpoint, or page), the steps to reproduce it, what an attacker could do with it, and how to reach you. Screenshots or a short proof of concept help. Please don’t include real claimant data you may have seen; describe it instead.

What happens next

We acknowledge every report within 2 business days, keep you posted while we investigate and fix it, and tell you when it’s resolved.

Safe harbor for good-faith research

If you act in good faith — you stop once you’ve shown the issue, you don’t access, change, or keep more data than you need to demonstrate it, you don’t disrupt the service or other people’s use of it, and you give us a reasonable chance to fix it before disclosing it publicly — we won’t pursue legal action against you for that research, and we’ll treat it as authorized. Social engineering, physical attacks, and denial-of-service testing are out of scope.

Breach notification

If we confirm a security breach affecting your firm’s data, we notify your firm without undue delay, and within 72 hours of confirming it. The notice tells you what happened, what data was involved, and what we’re doing about it, and we keep you updated as we learn more.