Developer platform · Legal & compliance

CAILegal API policies

These policies apply to any application, integration, or organization calling the CAILegal Public API (/v1) using an API key. They supplement — and do not replace — the general Terms of Service and Privacy Policy that apply to all CAILegal products.

Data retention

  • • Request/response content sent to /v1 endpoints is retained for up to 30 days by default, solely to diagnose abuse, debug failed calls, and support your account.
  • • Usage metadata used for billing and rate-limiting (endpoint, timestamp, token/credit counts, status code) is retained for the lifetime of your account plus the statutory period required for financial records.
  • • Content is never used to train CAILegal's or any third-party model.
  • • You may request early deletion of retained request/response content by contacting support.

Zero-retention option

  • • Enterprise customers processing privileged or otherwise sensitive matter data can request a zero-retention (ZDR) flag on their API key or organization.
  • • With zero retention enabled, request/response content is not logged beyond the minimum in-memory processing needed to serve the call — only non-content billing metadata (call count, cost) is retained.
  • • Mirrors the zero-data-retention option offered by upstream model providers (e.g. Anthropic's ZDR), extended through to CAILegal's own logging layer.
  • • Available on Enterprise-tier keys — contact sales to enable it for your organization.

Acceptable Use Policy

  • • No representing API output as a substitute for advice from a licensed lawyer, or marketing it as "certified legal advice."
  • • No reselling, sublicensing, or offering CAILegal API access as a hosted service to third parties without a signed partner agreement.
  • • No automated scraping, credential sharing, key pooling across unrelated customers, or attempts to circumvent rate limits/metering.
  • • No submitting content that is unlawful, infringing, or that you do not have the right to process (e.g. data obtained without consent where consent is required).
  • • No reverse-engineering, benchmarking for competitive publication, or bulk-extracting the underlying model/corpus without written permission.
  • • Violations may result in rate-limiting, key revocation, or account termination, at CAILegal's discretion.

No unauthorized practice of law

  • • The CAILegal API provides legal research and drafting assistance — it does not create an attorney-client relationship and does not constitute the practice of law.
  • • You are responsible for ensuring your own use of the API — and any product you build on it — complies with the rules on unauthorized practice of law (UPL) in every jurisdiction you operate in.
  • • Applications built on the API must not represent themselves as a law firm, a lawyer, or as providing legal representation, unless a licensed lawyer is genuinely supervising the specific advice given.
  • • Output must be reviewed by qualified legal counsel before being relied upon for any binding legal action, filing, or decision.

Legal disclaimer

  • • Every /v1 response carries the same disclaimer shown throughout the CAILegal web app: it is legal research assistance for enterprise workflow triage and must be reviewed by qualified legal counsel before final legal reliance.
  • • CAILegal makes no warranty — express or implied — as to the completeness, accuracy, or currency of any output, including citations.
  • • Laws change and jurisdiction-specific nuances may not be fully captured; always verify against primary sources for anything consequential.

API security

  • • API keys are shown once at creation and stored server-side only as a salted hash — CAILegal cannot recover a lost raw key; revoke and re-issue instead.
  • • Treat your API key like a password: never commit it to source control, never embed it in client-side/browser code, and rotate it if you suspect exposure.
  • • All API traffic is served over TLS; per-key scopes and rate limits contain the blast radius of a leaked key.
  • • Report a suspected key compromise or security issue to support immediately — we will revoke and help you re-issue a key on request.
Questions about these policies?
Contact CAILegal support — enterprise customers can also request a signed Data Processing Addendum (DPA) or zero-retention configuration through their account team.