Data processing agreement

This agreement applies when a firm, chambers or individual (the customer) uses Specter and puts personal data into it, such as clients' details, case files and notes. The customer is the controller of that data and Specter is its processor. We process it only on the customer's documented instructions, which are the terms of service, the service's settings and the customer's use of it.

The data the customer uploads or enters, to provide research, document reading, matters and the diary to the customer's users. We do not use it for any other purpose and we do not use it to train models. Documents a customer uploads stay inside that customer's matters and are never added to the public law library Specter searches.

Everyone at Specter who can reach customer data is bound by a duty of confidence, and has access only as far as their work needs.

Each customer's data is kept apart from every other customer's, enforced in the database as well as in the application. Documents are stored encrypted under a key for each firm, which can be rotated. Uploads are scanned for malware and a file that cannot be scanned is refused. Data is encrypted in transit. Names and identity-card numbers are masked in logs and error reports. Access uses sign-in with optional two-step verification, and a firm's owners and admins manage who has access. Our security page describes the measures in more detail, and we review them as the service changes.

We use sub-processors to deliver the service, such as hosting, sign-in, and language and document-reading models. The customer authorises them. We give a current list on request and before onboarding, bind each in writing to protect the data as this agreement does, and give 30 days' notice of a new sub-processor so the customer may object.

We help the customer to respond to requests from people about their data, and to meet its security and breach-notification duties, taking into account the nature of the processing.

We tell the customer without undue delay, and within 72 hours, after becoming aware of a breach that affects the customer's data, with what we know about it, what data is affected, and what we are doing.

Where customer data is processed outside Pakistan we do so only with providers that are bound to protect it to the standard of this agreement, and we tell the customer where it is processed on request.

We make available the information needed to show we meet this agreement, and allow the customer, on reasonable notice and no more than once a year unless there has been a breach, to check it.

When the agreement ends, we return the customer's data on request and then delete it within 30 days, unless the law requires us to keep it.

If this agreement conflicts with the terms of service on the processing of personal data, this agreement applies.