Burt · Security overview
For your firm’s IT or security reviewer
Burt is an AI intake assistant for personal-injury firms. It collects accident, injury, treatment, and evidence details from prospective clients and packages them for attorney review. Here’s how that data is handled, in plain terms.
- Certifications
- Not yet SOC 2 certified. We’re an early company and say so. This page lists the controls in place today, and we’ll walk your reviewer through any of them.
- Where data is stored
- In the United States. The database and evidence files are on Supabase (Ohio, AWS us-east-2), and the application runs on Render (Oregon).
- Encryption
- TLS on all traffic. Data and evidence files are encrypted at rest by our providers. Evidence sits in private storage, and every viewing link for case-file evidence is signed and expires in 60 seconds (15 minutes for video).
- Separation between firms
- Every record is tied to one firm, and the database itself enforces it. Tables are closed by default, and a record whose firm doesn’t match its parent can’t be written at all. One firm can’t read another firm’s conversations or claimants.
- Who can see your data
-
- Your team, by role: your firm’s owner and managers see billing, installation, and team settings; agents see the inbox and case files. Data & privacy (retention, deletion, export) and transferring ownership stay with the owner alone.
- Burt staff only when needed. Every time they open a conversation, it’s logged before anything is shown.
- Support work inside your account uses its own credential (never your login). The session ends after 24 hours without activity, and every action in it is logged.
- AI providers and training
- Anthropic (chat and fact extraction) and Google’s Gemini API (describing evidence photos and video). Both are paid commercial APIs, used under terms that don’t allow training on what we send. They may keep request data for a limited period for abuse and safety monitoring. We don’t have zero-data-retention agreements, and we don’t claim to.
- AI safeguards
- Each AI request contains one case only. The chat model has no tools and no database access, and a visitor’s words never reach its instructions. Burt gives no legal advice and no case valuations. Its intake score estimates intake fit from the injury, its severity, and how recent it is. Your served states and practice areas decide whether a case qualifies for you. The score is not a view on the legal merits. Your staff can take over any live conversation.
- Retention and deletion
- Your firm’s owner sets how long conversations are kept (1 to 7 years, or forever) in Settings. After that window, old conversations are deleted or redacted automatically. A claimant’s deletion request is carried out in one action, by your firm’s owner or by our team on request. Data that is active evidence in a billing dispute is held, and deleted once the dispute closes. Every deletion is logged before it runs.
- Export
- Your firm’s owner can download everything at any time from Settings: one ZIP file with every conversation, case file, and evidence file.
- Text messaging
- Each firm texts from its own verified toll-free number, never a shared one. STOP and HELP are honored automatically. Messages we start respect quiet hours, and there are per-person and per-firm daily send limits.
- Providers (subprocessors)
- Anthropic, Google (Gemini API), Supabase, Render, Twilio, Resend, Stripe (billing only; card numbers never reach us), and Netlify (marketing website only). The full list, with what each one handles, is in our Privacy Policy.