Does Candle use our emails or matter data to train AI models?
No. Your firm's emails, matter details, and client information are never used to train Candle's models or models for another customer.
Security and trust
Built for firms that can't take chances with client data.
Candle protects privileged client communications with independently audited controls, human approval, and public security documentation.
Ready for your security review
Evidence, not vague assurances.
- Public compliance and control status
- Current subprocessor list and hosting regions
- Supporting documents available through a managed request process
Have a questionnaire? Send it to security@trycandle.ai.
Independent controls. Clear status.
Candle's SOC 2 Type II examination and HIPAA compliance status are backed by the controls published in our Trust Center.
SOC 2Type II
Independent control examination
HIPAACompliant
Controls for protected health information
What law firms ask before saying yes.
Direct answers for partners, IT teams, privacy counsel, and clients reviewing your technology vendors.
Client data and AI
Can Candle send an email or update a matter without approval?
No. Candle prepares drafts and proposed actions for review. A user at your firm must explicitly approve anything sent or filed.
How is confidential client information protected?
Candle encrypts data in transit and at rest, and uses access controls and audit logging around systems that process firm data.
Does Candle replace our inbox or case management system?
No. Candle works inside your existing inbox and connects to supported case management systems. It is not a separate system of record.
Compliance and vendor review
What independent compliance work has Candle completed?
Candle has completed a SOC 2 Type II examination and maintains HIPAA compliance. Current status and supporting controls are published in the Trust Center.
Review the Trust CenterCan our IT or privacy team inspect Candle's controls?
Yes. The Trust Center publishes Candle's control status and provides a managed process for requesting supporting security documents.
Review the Trust CenterWhere is customer data hosted?
Candle hosts customer data in the United States. The current subprocessor list also identifies the service provided and applicable hosting region.
Review the Trust CenterCan we review the vendors that support Candle?
Yes. Candle keeps a current public subprocessor list so your team can review the providers involved in delivering the service.
Review the Trust CenterA narrow footprint, on purpose.
Candle works where your team already works.
Candle runs through a Chrome extension and Outlook add-in, inside the inbox your firm already uses. It connects to supported case management systems without becoming a new system of record.
Drafts and proposed actions remain subject to human review. Nothing is sent or filed without explicit approval from a user at your firm.
Bring your security team.
We will answer their questions, complete your questionnaire, and help scope Candle for your firm.