Built for trust

Your clients' information is confidential. Here is exactly how Nautilus treats it.

Your data stays in the European Union

Everything we process stays inside the EU:

  • Servers and backups: Hetzner, in Finland and Germany.
  • AI answers: an Anthropic Claude model, run through Amazon Bedrock in EU regions.
  • Reading scanned documents: Mistral AI, in France.
  • Account emails: Scaleway, in France.

No data is transferred outside the EU.

Never used to train AI

We do not train AI on your content: not your questions, not your documents. Neither does our AI provider: Amazon Bedrock does not store your requests and does not pass them to the model maker. If we ever wanted to change that, we would ask you first, separately, and saying no would not change your service.

Built around professional confidentiality

  • For lawyers, you stay in charge of your clients' data. You are the controller; we only process it on your instructions, under a data processing agreement (Art. 28 GDPR), available on request.
  • Access to your content is locked down. Only administrator accounts can open it, and every such access is recorded in an audit log.
  • No sale, no advertising, no tracking. No marketing analytics, no session recording, no advertising cookies.

Jurisdictional access control

  • Your account only covers the legal domains enabled for it (today: Dutch and Montenegrin law). Questions outside them are declined rather than guessed.
  • Every answer is built from the legislation and case law in our database, and shows its sources so you can check them.

You stay in control of your data

  • Download everything we hold about you, any time, from your account settings.
  • Delete your account yourself: it is erased 14 days after the request.
  • Deleted conversations are gone for good after 30 days.
  • Original uploaded files are not stored; only the extracted text, for the conversation it belongs to.
  • Every retention period is enforced automatically, by a scheduled process.

Security, in practice

  • Encrypted connections (TLS) for everything.
  • Passwords stored only as salted hashes; we cannot see yours.
  • Short-lived sign-ins: signing out or changing your password ends all sessions immediately. Sign-in attempts are rate-limited.
  • Accounts by invitation only during the test phase.
  • Server access with keys only, limited to the people operating Nautilus.
  • Daily backups on separate storage.
  • If something goes wrong, we notify the supervisory authority within 72 hours where required, and you without undue delay if your rights are at risk.

Honest about the test phase

Nautilus is in a test phase: access is by invitation, the service is free, and it is operated by its founder as a private individual while the company is being set up in the Netherlands. During this phase, server logs record the full content of requests to and from the AI model, so that we can find and fix errors. These logs are deleted after 90 days.

Read the details

Questions about privacy or security: contact@nautilus.legal

Back to nautilus.legal · Privacy Notice · Terms