The Managing Partner PacketAnother new vendor, another week of security back and forth.

The standard vendor security questionnaire your ops team would send anyway, already answered for Irys.

The symptom, as lawyers describe it

What it looks like

You already have Irys approved on your end. Then it still triggers the same week-long questionnaire cycle: send it, wait, chase, clarify, resend.

The week is the whole delay, and the next vendor starts the cycle over again.

The record

The standard vendor security questionnaire, answered for Irys

Question	Answer
Do you train any AI model, yours or a third party's, on our data?	No. Customer content is not used to train Irys or any third-party foundation model, unless a firm expressly agrees to that in writing.
Are you SOC 2 Type II attested? Do you hold ISO/IEC 27001:2022 certification?	Yes. Irys maintains SOC 2 Type II attestation and ISO/IEC 27001:2022 certification, and its data-protection program complies with HIPAA, GDPR, and CPRA. Current reports and certificates are available under NDA on request.
What is the current SOC 2 report period?	Available through our Trust Center on request.
What is your ISO 27001 certificate number and expiry?	Available through our Trust Center on request.
How is our firm's data isolated from other tenants?	Customer content is logically segregated by organization. Irys is designed so one customer's content is not intentionally pooled with another's.
Is that isolation cryptographic, separate keys per tenant?	Not claimed here. Isolation is organizational and logical, not a per-tenant encryption key architecture, unless your contract states otherwise.
What is your data retention policy after contract termination?	See /legal for the current retention and subprocessors table. That page is the disclosure of record; this page does not restate a figure that could go stale.
Which subprocessors do you use?	Named by role, location, and retention at /legal. This packet does not restate that table.
What encryption do you use, at rest and in transit?	Available through our Trust Center on request.
Do you have a signed DPA covering the training and retention answers above?	Available through our Trust Center on request.

Sources

Irys Trust Center

Why some answers point to the Trust Center

What changes

Four answers above point to the Trust Center instead of a number here: the SOC 2 report period, the ISO certificate expiry, the encryption specifics, and the DPA clause on training and retention.

Request them there once, then send that answer along with this table.

Advice from another lawyer

“The managing partner is mixing three different risks into one sentence: (1) the vendor trains on your uploads, (2) the vendor retains your uploads, and (3) your matter data leaks to other customers. Those are separate contract terms. [...] For the proof pack your partner wants from vendors: (a) signed DPA language on training and retention, (b) whether human reviewers can see customer content, (c) data residency options if you need them, (d) an admin audit log of who uploaded what to which matter. If they cannot produce those four, walk.”

- A practising lawyer, on a law firm forum

Quotes are verbatim public posts by practitioners, reproduced without attribution to the individual.

Keep going

Pick the next fix

does AI train on our data, for the training question in more depth.