The Full View page describes how Ross handles your files twice: once in plain English, and once in the language your IT reviewer, your carrier, or an opposing expert will want to see. This page defines every term in the technical version.
Nothing here is a new claim. Each entry explains a word that already appears on that page, says what it is by comparison to something in a law office, and closes with why it matters to the firm.
Words about where a document sits and what has to be true before any of it travels.
On the Full View page this appears as “runs locally, on-premise”.
The reading happens on the same computer the file is already stored on. Nothing is uploaded in order to be read. The office comparison is a paralegal reading a file in the file room rather than couriering it to an outside vendor and waiting for a report. Why it matters: a document that never travels cannot be intercepted, retained by a third party, or subpoenaed from one.
On the Full View page this appears as “exactly one module in the codebase”.
Software is written in separate files, each responsible for one job. A module is one such file. Saying that exactly one module may transmit a document is the software equivalent of saying there is one door to the file room and the other walls have no doors - it is a statement about the building, not about a policy someone has to remember. Why it matters: it is checkable. Anyone auditing the code can read that one file rather than trusting a promise about all of them.
On the Full View page this appears as “build flag, environment setting”.
A setting fixed when the software is installed on your system, not something toggled from inside the running product. Closest office analogue: a lock that was never installed on that door rather than a key someone chose not to turn. Why it matters: nobody signed in to Ross - including us - can switch this one on from a screen.
On the Full View page this appears as “a key exists, API key, credential”.
A long secret string that an outside service requires before it will answer at all, much like an account number plus password for a service the firm subscribes to. If the firm has not supplied one, the outside service is simply unreachable. Why it matters: no key, no possible transmission, regardless of any other setting.
On the Full View page this appears as “attested by name that a BAA is in place”.
The HIPAA contract that has to exist before a vendor may handle protected health information on the firm's behalf. Ross does not infer that one exists - a named attorney records in the system that it has been signed, and that attestation is stored with their name and the date. Why it matters: the person who made the representation is identifiable afterwards, which is the difference between a compliance record and a checkbox.
On the Full View page this appears as “that individual client is not on hold, held back”.
A per-client switch that excludes one matter from any outside transmission while leaving every other matter working normally. The analogue is sealing one file, not closing the file room. Why it matters: a client who objects, or a matter under a protective order, can be carved out without the firm losing the tool.
On the Full View page this appears as “write-ahead, a send that failed to record does not happen”.
The log entry is committed first; only then does the send occur. The office comparison is signing the mail log before the envelope leaves, not after it comes back. Why it matters: a crash, a power loss, or a network failure halfway through still leaves evidence behind. There is no ordering of events in which something left and no entry exists.
Words about what an intruder would find if they reached the records themselves.
On the Full View page this appears as “scrambled version, fingerprint”.
A one-way calculation that turns any text into a fixed-length string of characters. The same text always produces the same result, and the result cannot be worked backwards into the text. Think of a notarised fingerprint of a document: it proves you have the same document, and it tells a reader nothing about the contents. Why it matters: it lets Ross verify a password, or detect an altered log entry, without ever holding the original.
On the Full View page this appears as “passwords are stored with scrypt”.
A particular hash designed to be deliberately slow and memory-hungry. An ordinary sign-in pays the cost once and nobody notices; an attacker trying millions of guesses pays it millions of times, which is what makes bulk guessing impractical. It is the current recommended family for storing passwords, alongside bcrypt and Argon2. Why it matters: if the password table were stolen outright, the passwords in it would still not be readable.
On the Full View page this appears as “a per user salt”.
A unique random value mixed into each user's password before hashing, so two people who happen to choose the same password produce different stored values. Why it matters: an attacker cannot crack one password and get everyone who reused it, and cannot use pre-computed tables of common passwords.
On the Full View page this appears as “checked in constant time, gives nothing away”.
Two values are compared in a way that takes exactly the same length of time whether they match at the first character or the last. A naive comparison stops early on the first mismatch, and an attacker measuring the delay can learn the secret one character at a time. The analogue is a clerk who reads every line of a document before answering, so the pause before the answer never hints at where the discrepancy was. Why it matters: it closes a real, published class of attack that leaks secrets purely through timing.
On the Full View page this appears as “sign in has a rate limit and a lockout”.
A cap on how many sign-in attempts are accepted in a period, and a temporary freeze on the account once that cap is passed. Same idea as a bank card swallowed after three wrong PINs. Why it matters: guessing at machine speed becomes guessing at human speed, which is no longer a viable attack.
On the Full View page this appears as “two-factor, MFA, a phone code”.
A second proof of identity beyond the password - typically a rotating six-digit code from an app on your phone. Something you know plus something you hold. Why it matters: a stolen or reused password on its own stops being enough to get in, which covers the most common way accounts are actually lost.
On the Full View page this appears as “every access token Ross holds for an outside service”.
When the firm connects Ross to another service - a document store, a calendar - that service issues a token standing in for permission to act on the firm's behalf. It functions like a signed authorisation letter kept on file, and it is as sensitive as a password. Why it matters: these are exactly what an intruder would want, which is why they are stored encrypted at rest rather than in plain text.
On the Full View page this appears as “encrypted at rest”.
The stored form on disk is ciphertext, not readable text. Someone who obtains a copy of the database file, a backup, or the physical drive holds scrambled data and no way to read it without the separate key. "At rest" means sitting in storage, as opposed to "in transit" across a network. Why it matters: a lost laptop or a copied backup is not, by itself, a disclosure.
On the Full View page this appears as “encrypted with AES-256-GCM, which also detects tampering”.
The standard modern encryption method, in a mode that does two jobs at once: it makes the data unreadable, and it attaches a seal proving the data has not been edited. Alter one character of a stored row by hand and decryption fails outright. The 256 is the key length; it is the same algorithm family approved for classified US government information. Why it matters: the failure mode is refusal, not a quiet wrong answer. Tampered data does not come back as something plausible.
On the Full View page this appears as “your signed session, every session that person had”.
The server-side record that you are signed in, referenced by a cookie in your browser. It is the wristband, not the ticket - the browser holds a stub, and the authoritative record of who you are lives on the server. Why it matters: because identity comes from the server's record, it cannot be changed by editing anything in the browser.
On the Full View page this appears as “signed out everywhere on their very next click”.
Change a password or disable an account and existing sign-ins die immediately, rather than continuing until they happen to expire. Many products leave already-open sessions alive for hours, which means firing someone does not actually revoke their access. Why it matters: a departure or a suspected compromise is remediable in one action, with a defined moment when access ended.
Words about how a generated sentence is checked before an attorney ever sees it.
On the Full View page this appears as “it selects an approved template”.
Pre-written wording, approved in advance, with blanks for the specifics. Ross chooses which approved wording applies; it does not compose new sentences for client-facing messages. Form letters with fields, in other words. Why it matters: the language a client receives has been read by a human before it was ever sent to anyone, which is not true of a system that writes freely.
On the Full View page this appears as “a second model checks each claim”.
The artificial-intelligence component that reads text and produces text. Everywhere this page says "model" it means that component, and everywhere it says Ross does something without a model, it means ordinary deterministic code. Why it matters: the distinction is the whole point of the section - a model's output is checked by code, and code does not have opinions.
On the Full View page this appears as “checks each claim against the source, has to quote the passage”.
A second pass that takes each statement in a summary and demands the exact passage in the source document that supports it. The analogue is a cite-check: every proposition must carry a pin cite, and a proposition with no cite does not survive. Why it matters: this is the specific control against a model stating something confidently that the document does not say.
On the Full View page this appears as “confirms the quote genuinely appears”.
A literal word-for-word search of the document for the quoted passage, performed by plain code rather than by a model. It has no judgement and cannot be persuaded - the text is either present or it is not. Why it matters: without it, the checker could invent a supporting quote as easily as the summariser invented the claim. This is what makes the check independent rather than circular.
On the Full View page this appears as “gets marked unsupported”.
The claim is retained but flagged, showing the reader that its cite failed verification. It is not silently deleted and it is not presented as verified. Why it matters: you see both what the model said and that it could not be backed up, which is the information you need in order to judge it.
On the Full View page this appears as “fail closed, rather than as fine”.
If the verification step cannot run at all, the result is reported as unverified instead of defaulting to passed. Software conventionally calls this failing closed - when the check breaks, the door stays shut. The opposite, failing open, is how a broken control silently reports success. Why it matters: "not checked" and "checked and clean" are never confused, so a broken control cannot masquerade as a clean result.
Words about the boundary that keeps your matters separate from every other firm's.
On the Full View page this appears as “every record belongs to one firm”.
One firm's entire world inside a shared system is its tenant. Isolation is the rule that records carry the firm they belong to and are only ever served to that firm. The building analogy is exact: shared structure, separate suites, no connecting door. Why it matters: this is the control that makes shared software acceptable for privileged material at all.
On the Full View page this appears as “comes from your signed session”.
Which firm you are is read from the server's session record, not from the web address, a form field, or anything else your browser supplies. Anything the browser sends can be edited by whoever controls the browser, so none of it is treated as identity. Why it matters: changing a number in the URL cannot make you a different firm, because the URL was never what decided.
On the Full View page this appears as “it says the file does not exist”.
Standard web responses: 403 means "this exists and you may not have it", 404 means "there is nothing here". Answering 403 to a cross-firm request would confirm that a matter with that identifier exists - a small disclosure, but a real one. Ross answers 404, so the response is indistinguishable from a request for something imaginary. Why it matters: an outsider probing identifiers learns nothing at all, not even a count.
On the Full View page this appears as “checked twice on the way in”.
The check runs once where the request arrives and again where the data is fetched. Two independent checks, so a mistake in one does not open the boundary. Belt and braces. Why it matters: single-point controls fail at that single point. Every real cross-tenant leak in the industry has been one forgotten check.
On the Full View page this appears as “ninety two automated checks, regression test”.
A small program that attempts the forbidden thing - one firm reaching for another's record - and fails the build if it ever succeeds. It runs automatically before any change ships, so nobody has to remember to check. Why it matters: the guarantee holds next year, under a different developer, without depending on anyone's diligence.
On the Full View page this appears as “row-level security, where the code cannot forget it”.
Moving the boundary from the application into the storage engine, so the database refuses to return another firm's rows even if the application asks incorrectly. The rule stops being something the code remembers and becomes something the filing system enforces. This is roadmap, not shipped, and is labelled as such on /full. Why it matters: it removes the last category of mistake - the query that simply forgot to ask.
Words about the log, and about why altering it does not go unnoticed.
On the Full View page this appears as “every action lands in an audit trail”.
An append-only record of what happened, when, and at whose hand. Entries are added and never edited - the same discipline as a bound ledger kept in ink. Why it matters: it is the evidentiary record of the system's own conduct, available whether or not anyone anticipated needing it.
On the Full View page this appears as “hash chain, sealed to the one before it”.
Every entry stores a hash of the entry preceding it, so the entries form a chain. Alter an old entry and its fingerprint changes, which breaks the match with the next entry, and every entry after that stops lining up. Deleting a page shows for the same reason. It is the mechanism behind numbered, initialled pages in a bound ledger, applied to data. Why it matters: the log does not merely record - it can demonstrate that it has not been rewritten after the fact.
On the Full View page this appears as “verify the chain”.
Re-computing every fingerprint in order and confirming the chain still holds, on demand, by the firm rather than by us. Why it matters: the integrity claim is verifiable by you. You are not asked to take our word that the log is intact.
On the Full View page this appears as “records what happened without keeping what was said”.
The log stores the hash of a message and how long it was, not the message. That is enough to prove a specific text is the one that passed through, and not enough to reconstruct it. Why it matters: the audit trail does not quietly become a second copy of every privileged communication the firm has ever sent.