Confidentiality and security
Before you send clients to an outside service, the ethics rules ask you to check how it protects their information.1, 2 This page answers the questions firms usually ask. It describes how Tellbrief works today, and automated tests check it against the code on every update.
To keep a copy for your file, print this page or save it as a PDF.
What it stores, and for how long
| What | Deleted |
|---|---|
| The names for your conflict check: the client’s name, email and company, the other parties they name and the broad type of matter | 45 days after the last step on the check |
| A brief the client sent before you cleared the names | Right away if you decline; 45 days after it was sent if you don’t decide |
| Your copy of a brief, once you clear the names | 14 days after it reaches you |
| Your choices after each first call, such as which questions and issues helped, minutes saved and whether they hired you. Not the client’s answers or anything you type. | 365 days |
| Daily counts of briefs started, sent and cleared, with nothing about who | 2 years |
A job runs every day to delete what has reached its date. Copies outside Tellbrief follow their own rules: emails, PDFs that you or the client download, and our host’s request logs. A client’s answers stay in their own browser tab until they send them.
Who can see it
- Your firm, with your dashboard key. Briefs from your link go only to you.
- Until you clear the names, no one reads the brief, including you. If you decline, it’s deleted unread.
- Each firm’s records are kept apart from every other firm’s and from Tellbrief’s own. Your key opens only yours, and no Tellbrief dashboard key opens your queue or your briefs.
- Tellbrief makes your key when it sets up your link and keeps it in the site’s settings. Ask and we’ll replace it with a new one.
How it’s protected
- Names and briefs are encrypted with AES-256-GCM before they’re stored, in private storage that isn’t reachable from the web.
- Every page and request uses HTTPS.
- Your dashboard locks after 30 minutes without use. After 8 wrong keys, it stops accepting tries for up to 15 minutes.
- Clients don’t make accounts or passwords. Their private link stops working 30 days after it’s issued.
- Pages run only Tellbrief’s own code and load nothing from other sites, so no other company sees what anyone types. There are no ad trackers, analytics scripts or cookies.
AI
AI features are switched off. No client answers, briefs or call notes are sent to an AI model. Fixed rules pick the questions and build the brief.
Other companies that handle it
- Vercel hosts the site and stores the records above. It sees visitors’ IP addresses and keeps request logs under its own policies.
- Resend sends email, when email is turned on: your alerts, which have no names or details in them, and the client’s own copy of their brief.
No one else. Tellbrief doesn’t sell client information or use it for ads.
Privilege
Whether what a prospective client writes in Tellbrief is privileged depends on your jurisdiction and the facts. Tellbrief’s terms and privacy page tell clients that Tellbrief isn’t a law firm and that they shouldn’t assume what they share is privileged. While they answer, they’re asked to leave out messages with a lawyer and confidential documents.
What it doesn’t do
- It isn’t end-to-end encrypted. The site holds the key so it can show you the brief.
- It doesn’t check conflicts for you or decide whether to take a matter. That stays with your firm.
- It doesn’t connect to practice-management software. Names, a summary and the PDF copy into any of them.
- Deletion runs on a daily schedule, not at an exact minute, and it can’t recall emails or downloaded PDFs.
If you stop using it
Your link stops taking new briefs, and what’s already stored is deleted on the same schedule, even after you leave.
If something goes wrong
If we learn that someone got into your firm’s records without permission, we’ll tell your firm within 72 hours of learning of it: what was reached, when, and what we’ve done about it. We’ll also tell the clients affected, as the law requires.
Something we didn’t answer?
Ask, and we’ll answer by email and add it here. Please don’t include client information.
Ask a question Read the full privacy page Back to Tellbrief for lawyers
1. Rule 1.6(c), on reasonable efforts to prevent unauthorized access to client information: as Minnesota adopted it (opens in a new tab). Check your state’s version.
2. ABA Formal Opinion 477 (May 2017), part 7, on checking the vendors that provide your technology: as posted by the Tennessee Board of Professional Responsibility (opens in a new tab).
General information for your firm’s review, not legal advice.