Zero retention

What we store

• Organisation and user accounts
• Subscription / licence status

What we never store

• Case documents or file contents
• AI prompts or completions containing client facts
• Vetting or case-review report bodies
• Connected folder inventories beyond the live session

Where case data lives

A local or synced firm folder the browser is granted (Microsoft Graph OAuth not yet shipped)

AI path: Firm BYOK — browser calls the firm’s provider API directly; HDR Compass does not proxy or retain prompt bodies

Advisory output only. Every criterion and recommendation is reviewable by a fee earner before export.

AI provider setup & firm duties

How to wire OpenAI, Azure OpenAI, Anthropic (via gateway), or a local model — and the firm’s obligations with its AI provider, including the provider DPA and international transfers.