Security
Updated 13 August 2026 · Vocket is operated by Esforge
You are a lawyer, so you will want the limits as well as the promises. Both are on this page.
Vocket hears only what you choose to say into it, files nothing to Clio until you confirm it, and never sends your words to a model that trains on them. It is a filing instrument, not an assistant: it does not draft your documents and it will never hand you a citation.
The five promises
These are the same five sentences that appear inside the app, on the Security & Data screen. They are kept word-identical on purpose, and a check in our build fails if they ever drift apart.
Only your voice, only your words.
Vocket never records clients, courts, or calls. It transcribes what you say when you press the button, and nothing else.
Your data never trains a model.
All AI processing runs through APIs under zero-training contract terms.
Encrypted in transit and at rest, and yours to remove.
Export everything or delete everything, any time. Every proposal and confirmation is kept in an audit trail you can read.
Nothing autonomous.
No entry, task, or email exists until you confirm it. Drafted emails are never sent for you.
No AI drafting of legal documents. No AI legal research.
Vocket structures what you said. It does not write your work, and it will never hand you a citation.
What we do not claim
Each of these is something a security page could easily imply and we have not earned. We would rather you read it here than discover it later.
We are not SOC 2 certified.
We are keeping the evidence a Type I audit needs — access logs, change management, a written architecture — but no audit has been performed, and we will not imply one has.
No third-party penetration test has been done.
Planned before general availability. Until it is finished and the findings are fixed, treat this as untested by outsiders.
Vocket is not zero-knowledge, and cannot be.
Structuring what you said requires reading what you said. Your transcript is processed in plaintext, by our server and by the providers named below. Any product that both understands your words and claims zero knowledge of them is telling you one of those two things untruthfully.
Where your words actually go
One capture touches four systems and no others.
| System | What it receives | Terms |
|---|---|---|
| OpenAI | The audio of your capture, to transcribe it. | Commercial API terms: data submitted through the API is not used to train their models. The audio is deleted once a transcript exists — Vocket does not keep it. |
| Anthropic | The transcript text, to structure it into proposed entries. | Commercial API terms: inputs and outputs are not used to train their models. |
| Clio | Only the entries you confirmed, exactly as you confirmed them. | Your own Clio account, under your existing agreement with Clio. We connect through Clio's official OAuth and hold a token you can revoke from either side. |
| Vocket | Your captures, transcripts, proposals, and the record of what you filed. | Encrypted in transit and at rest. Your Clio tokens are additionally encrypted with AES-256-GCM before being stored, and are never included in an export. |
Controls you can check yourself
- Nothing files without a confirmation. Enforced on our server, not only in the app: there is no code path that writes to Clio without one, and no setting that turns it off.
- Undo is real. Taking an entry back deletes it from Clio by its id. It is not a local dismissal, and the app tells you which record it removed.
- An audit trail per capture. Heard, proposed, edited, answered, filed, undone — with timestamps, readable in the app.
- Anything uncertain becomes a question, never a guess. If a number cannot be matched to your own words, that entry is held back until you correct it — and dismissing the question does not release it.
- Notifications carry counts, never names. On a lock screen in a courthouse corridor, Vocket says "2 items ready for review" and never a client or a matter.
- Export everything, delete everything. Both from inside the app, without asking us. Records already written to Clio stay in Clio — they are yours, in your system.
- Audio is not kept. The recording is deleted once transcribed. The only audio that persists is a capture that has not reached us yet, held on your phone so that no signal never means lost words.
Your professional obligations
ABA Formal Opinion 512 asks you to understand the tools you use, protect client confidences, and supervise the work. Vocket is built to make that possible rather than to do it for you: you see every proposed entry before it exists, in your own words, with the evidence for any number it took from your speech.
We are not your compliance department. If your jurisdiction, your firm, or a particular engagement restricts sending client information to third-party processors, those restrictions apply to Vocket too — the table above is there so you can make that judgement properly.
Reporting something
If you find a security problem, write to hello@tryvocket.com with what you found and how to reproduce it. We will confirm receipt within two business days. We will not pursue anyone who reports a vulnerability in good faith and does not access other people's data while doing so.