MyOfAI
(786) 520-1462 Book an assessment

Security and oversight

What we set up, what we document, and what we do not claim

Where your data goes

With MyOfAI Box, documents are processed on a server in your office. With MyOfAI Space, they are processed on a server reserved for your firm.

YOUR OFFICE Case filesDMS · PDF · email Your teamSSO · roles · MFA MyOfAI servermodel · search · audit log Publiccloud AI No training on your data · content stays inside Cloud AIservice Content leaves your network · vendor's terms apply
With MyOfAI Box, documents are processed on a server in your office. With MyOfAI Space, on a server reserved for your organization only. Remote support connects only when you ask, with MFA and a recorded session.
With a typical cloud AI service, a document is sent to the vendor's systems to be processed. How long it is kept, and whether it is used for training, depends on the vendor's terms. Read them before you upload sensitive files.

Controls we set up

  • Single sign-on (SSO), role-based access and multi-factor authentication (MFA)
  • Audit logging on at install (off by default in some tools)
  • Matter separation, tested in the pilot
  • No training on your data, verifiable by network audit
  • Encrypted storage and backups
  • Documented patching and model updates, with rollback

What leaves the system

Your documents, prompts and AI answers never leave the system. Optional health monitoring sends only technical metrics (uptime, CPU/GPU load, disk space, service status), never content. You can turn it off; alerts then go to your own email.

Remote support

On request only, with MFA, recorded, and by named staff.

Where AI is strong, and where it is not

Strong

  • Search across your documents
  • Summaries
  • First drafts a professional reviews

Not strong

  • Legal research without a licensed database
  • Anything sent out without human review
  • Facts it cannot find in your documents: AI tools can state wrong information confidently

The Oversight Package: 10 documents

See ABA Formal Opinion 512 (2024) and Florida Bar Opinion 24-1.

ABA Formal Opinion 512 (2024)
Florida Bar Ethics Opinion 24-1 (2024)

  1. 01Description of security measures
  2. 02Data retention and deletion policy
  3. 03No-training and data-flow statement
  4. 04Incident notice terms
  5. 05Remote-access description
  6. 06Model and software license register
  7. 07Liability terms and their rationale
  8. 08Sample engagement-letter language
  9. 09Acceptable-use policy template
  10. 10Security questionnaire and right to audit

For medical practices

We offer a business associate agreement (BAA), signed before any access to protected health information. Our system is designed to support your HIPAA program.

For financial firms

Written incident-notice terms and a right to audit.

Certification status

We do not currently claim SOC 2 or HITRUST certification.

What we do not claim

  • We do not claim that using this system satisfies any ethics rule or HIPAA. That depends on how your whole firm works.
  • We do not claim any system is free of security risk.
  • We do not claim the AI is free of errors. A professional reviews every output.
  • We do not claim AI replaces lawyers, accountants or clinicians.

Use the same checklist on any AI vendor

Get the checklist
Call Book assessment