Privacy and SecurityCopy Anchor Link

Law firms and enterprise teams handling sensitive documents need clear answers on where data is processed and what controls are enforced. This page summarizes the current Claira architecture and data-handling controls.

Deployment regionsCopy Anchor Link

Claira is deployed in three independent regions. Each customer's data stays in the country of the deployment they use: there is no replication between deployments and no transfer of customer content from one deployment to another.

• Canada: Google Cloud northamerica-northeast1 (Montreal). Reached at https://nuix-ca.claira.to.
• Australia: Google Cloud australia-southeast1 (Sydney). Reached at https://nuix-au.claira.to.
• Germany: Google Cloud europe-west3 (Frankfurt). Reached at https://nuix-de.claira.to.

Each deployment runs inside its own Google Cloud Assured Workloads workload, which enforces its location limits at the platform layer:

• Canada: a Canadian control package, with Claira's resources further restricted to the Montreal region.
• Australia: the Australia Regions and Support control package.
• Germany: the EU Regions and Support control package, with an additional location policy that restricts Claira's resources to German regions.

The URL your team uses determines the region you connect to. For media scan staging workflows, Claira additionally enforces a regional allowlist at the application layer before any file can be staged.

EmailCopy Anchor Link

Email is the one exception. To deliver the emails Claira sends, and to manage mailing-list subscriptions, Claira uses email service providers in the United States, whatever your deployment region. They receive each recipient's name and email address, their language, the region they use, and the content of the email itself, such as a case name or a plan change. The emails Claira sends to your team never contain document content or AI answers.

How Claira processes model requestsCopy Anchor Link

Claira sends each model request to an AI model provider inside your deployment's country. The model chosen for the case in Model Selection decides which provider handles a scan, and the flag beside each model shows the country it runs in. For the providers that serve your region, contact support@claira.to.

Model provider policiesCopy Anchor Link

Every model provider Claira uses must meet these policies:

• Your country only. Requests are processed inside your deployment's country. Claira refuses to send a request to a model that is not approved for your deployment. If a model is busy, Claira reports the error so you can choose another model. If you have turned on automatic model routing, Claira answers with another approved model in your country instead. Either way, it never sends your documents abroad.
• No training. Your documents, prompts, and results are never used to train or improve a provider's models.
• No retention. Providers do not log, cache, or store your content once they have returned a response. Claira turns off every content logging and caching option a provider offers, with one exception it controls: during a bulk scan with a very long prompt, Claira may keep that prompt (never the documents) with the provider until the run ends, in your country and encrypted with Claira's own key. How We Choose AI Providers has the details.
• No sharing. Providers do not pass your content to anyone else. Only the provider running the model that handles a request receives it.
• Secure connections. Every request is encrypted in transit, and Claira connects with its own credentials, limited to what it needs.

How Claira selects providers and reviews them against these policies is described in How We Choose AI Providers.

Models you connect yourselfCopy Anchor Link

Claira Private is the one exception, and it is under your control. On a case activated on Claira Private, someone on your team connects your organization's own model endpoint to the case (the shared connection), and the document text and prompts for that case's AI features are sent to that endpoint at your direction, wherever you host it. Claira's residency guarantees stop at that endpoint: what its operator does with the content is governed by your agreement with that operator, not by Claira. On Claira's side, the connection must use HTTPS with a publicly trusted certificate, the endpoint's API key is stored encrypted in your deployment region and never written to logs, and Claira records only metadata about each request: timing, status, and token counts, never content. A Claira Private case never uses one of Claira's own models: scans, Agent Mode, Insights, Case Context, Revise with Agent and the Prompt Generator all run on your model, and the connection can be revoked at any time.

With a local model, document content never leaves the reviewer's machine for inference. When a reviewer on a Claira Private case turns on a local model, their browser sends each document straight to a model running on their own computer or network and reads the answer back. The document text is not sent to Claira's servers to be scanned, and it is not sent to any other model provider. While the local model is on, Claira makes no model call of any kind for that reviewer on that case: there is no quiet fallback to another model.

Be precise about what that does and does not mean:

• Inference is local. Storage is unchanged. Claira stores what it stores for every case: your prompts and the operational metadata described below. A local model changes where the model runs, not what Claira keeps, and on any model Claira keeps no copy of your documents or of the answers.
• The endpoint address and its optional key never leave the browser. There is no server-side copy and no shared secret. Claira records only that the local model was turned on or off, the endpoint's host name, and the model name, for your audit trail.
• It is per reviewer, per case. A colleague in the same case who has not turned it on keeps working on the case's shared connection.
• Results go to your Nuix field. The answer the local model produces is written to your Nuix field, exactly as with any other model. Claira keeps no copy of it.
• Claira cannot vouch for the local model. What that software does with the text on that machine is governed by whoever installed it, not by Claira.

Per-request processing flowCopy Anchor Link

Each scan follows a request-response workflow:

1. Claira sends document text (and, for a media scan, the document's source file) to the model provider for the selected model, inside your deployment's country. If that model is busy and automatic model routing is on, the request goes to the provider of another approved model, still inside your deployment's country.
2. The model returns a response.
3. The response is saved to your Nuix field.

Claira keeps no copy of the document text or of the response: the response lives in your Nuix field. Claira does not use your customer content to train Claira-owned models.

Data stored by ClairaCopy Anchor Link

Claira stores operational metadata needed to run and support the product, such as scan records, billing state, and case-scoped configuration. This metadata is stored in the Claira service database in your deployment region.

Claira does not store the content of your documents or the answers its scans produce. Each answer is written to your Nuix field, and that is the only copy. Claira's logs record identifiers, timings and error codes, never document content or answers. Claira keeps content only where you choose to keep it with Claira: feedback you send on a response, your Agent Mode chats, the Insights and Case Contexts you create, and the early case assessments you run. An Insight keeps the field values it was generated from, as Claira read them from your Nuix fields when you generated it, so it can show its sources and every revision works from the same values. Deleting the Insight deletes them. An early case assessment keeps its overview and the statistics it was built from: the counts for each field together with their values (custodian and sender names, for example), the document dates, the import history and a sample of document titles. Deleting the assessment deletes them.

Working notes. To improve your experience of Claira, Claira keeps internal working notes about how people and organizations use it: the kinds of tasks each person does, their role in a case (for example, whether they set cases up or review documents), how colleagues work together in Claira, and the kind of work in a case, recorded only as fixed categories such as "privilege review" or "employment". The notes never contain case names, document content, field values, answers, or the text of prompts or chats. To choose the categories, a model in your deployment's country reads the instructions people type (their prompts, including Insight prompts and requests to the Prompt Generator, and what they ask the Agent) when the notes are built, and keeps nothing it reads. Work done on a local model is never read. Claira does not show these notes or use them in any feature today, and no model is trained on them. They are deleted with the case. Your organization can ask support@claira.to to switch them off, and switching them off deletes them.

Media scan staging (when used) is encrypted with keys that Claira controls, held in your deployment region, and access-controlled. Files staged for a scan that runs in your browser are deleted after processing. Files your browser uploads for a background image, audio, video or Auto scan are kept only for that run: they are deleted when the run finishes or is cancelled, when an unfinished run expires, or when the case is deleted, and in any case after at most 14 days.

External processorsCopy Anchor Link

Depending on enabled features, Claira may use external processors for specific functions:

• AI model providers, which run the models Claira offers inside your deployment's country under the model provider policies. Contact support@claira.to for the providers that serve your region.
• A model endpoint your own organization connects to a Claira Private case as its shared connection, a processor you choose and contract with directly.
• No external processor at all for work a reviewer runs on a local model: the model runs on their own machine, so there is no third party in the inference path.
• Payment processing through Stripe for billing workflows.
• Email service providers in the United States, which deliver Claira's operational, billing and getting-started emails and manage mailing-list subscriptions. See Email.

Core security controlsCopy Anchor Link

Authentication and accessCopy Anchor Link

Claira runs as a Nuix Discover extension and validates signed UI extension authentication tokens on backend API routes. Claira authenticates to every model provider with its own credentials, which are either short-lived or kept in a managed secret store in your deployment region, and never stored in code.

EncryptionCopy Anchor Link

Traffic between clients, Claira services, and configured providers is encrypted in transit. Sensitive secrets are injected at runtime from managed secret stores. Every deployment encrypts the Cloud SQL database and the media scan staging bucket with keys that Claira controls, rather than the cloud provider's default keys; the keys are stored in that deployment's region.

AuditabilityCopy Anchor Link

Claira records operational and billing events to support audit and troubleshooting workflows.

Regulatory alignmentCopy Anchor Link

AustraliaCopy Anchor Link

The Australia deployment is structured to align with the Australian Privacy Principles (APPs) and the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. Region pinning and the use of Claira-controlled encryption keys are enforced by Google Cloud Assured Workloads, and model requests stay in Australia under the model provider policies. This is regulatory alignment, not an explicit certification.

CanadaCopy Anchor Link

The Canada deployment keeps all customer content and operational metadata in Canada. Its Google Cloud resources are restricted to the Montreal region, and every model Claira provides there processes requests in Canada. The one exception is email: see Email.

GermanyCopy Anchor Link

The Germany deployment keeps all customer content and operational metadata in Germany. Its Google Cloud resources are restricted to German regions, and every model Claira provides there processes requests in Germany. The one exception is email: see Email.

Summary for client communicationsCopy Anchor Link

• Claira is deployed in three regions: Canadian Google Cloud (northamerica-northeast1), Australian Google Cloud (australia-southeast1), and German Google Cloud (europe-west3). Each customer's data stays in the country of their deployment.
• Email is the one exception to in-country processing: Claira's emails are delivered by providers in the United States, which receive recipients' names and email addresses and the content of each email. Emails to the customer's team never contain document content or AI answers.
• Model requests go only to AI model providers inside the deployment's country, and those providers may not train on, keep, or share customer content. The providers for each region are available on request.
• API access is protected by signed Nuix extension tokens and claim checks.
• Customer content is processed per request and is not used to train Claira-owned models.
• Claira keeps no copy of customer documents or scan answers: each answer is written to the customer's Nuix field. Content is kept only where the customer chooses to keep it (feedback, Agent Mode chats, Insights, Case Context, early case assessments).
• On a Claira Private case, where the customer has connected their own model endpoint (a shared connection), content sent to a model goes to that endpoint at the customer's direction; Claira's residency guarantees end there.
• Where a reviewer on a Claira Private case uses a local model, document content is never sent anywhere for inference: the model runs on their own machine. Claira stores the prompts and metadata it normally stores, and no document content or scan answers.
• Operational metadata is stored to support billing, troubleshooting, and audit requirements.
• Claira keeps internal working notes about how people use Claira (the kinds of tasks they do, their role in a case, and how colleagues work together), to improve their experience. The notes are metadata only and never contain case or document content.
• Additional subprocessors may be used depending on your enabled features and deployment configuration.

---

Need help? Contact us at support@claira.to.