Confidentiality
The phone should never be a way into the file.
A prospective client’s first call is sensitive long before it is privileged, and a fee-earner’s own line carries live matter detail all day. This page is what WasilX does with both, and, at the end, the three places we have drawn a line instead of papering over it.
Permission flow
Sensitive information only widens when a person widens it.
Caller
Known by stated details and confirmed number.
Enquiry
Visible to route and recover the front-door record.
Person
A fee-earner reviews what Cam captured.
Matter
Attached by a human, never guessed by Cam.
Audit
Access and break-glass stay visible.
01
Cam takes the call. It does not read your cases.
The coordinator stays outside the permission graph.
Deciding which matter a call belongs to would mean reading matters. That would hand the AI both access to case content and a standing reason to know it, which is the same content it must never read back to a caller.
So it does not decide. Cam routes the update to a person and attaches at most a contact. The fee-earner attaches the matter. Cam answers from the knowledge the firm configured and the record in front of it, and it cannot read a file back to a caller because it never held one.
02
Adding a colleague widens the case, not the confidences.
Access intersects. It never unions.
Matter membership grants the spine of a case: the matter, its members, its updates, the enquiries and tasks linked to it. It does not grant the meeting notes recorded against it. Those keep their own rules, and the two sets of permissions are intersected rather than combined.
If they were combined, adding a colleague to a matter would quietly become sharing every note anyone ever recorded on it. So a colleague who cannot read an attached meeting sees nothing about it: not a redacted stub, not a count, not a date. That a meeting happened at all is information about the firm.
03
Supervision without a back door.
Break-glass is a row with an expiry, not a policy.
A firm cannot hold files no supervising partner is ever able to review. File review, COLP and COFA duties are not optional, and a system that made them impossible would be unusable in a real practice.
But a silent partner-sees-everything override is not supervision, it is a back door. So supervisor access is a visible membership row: read-only, time-limited, carrying the reason it was granted, written together with an audit entry, and shown on the matter itself. Nobody gains sight of a file without the file recording that they did.
No voiceprints. No guessed names.
Recognising a caller by their voice would be the easy way to make this product feel clever. It would also make every call special-category biometric data under Article 9, collected from people who rang a solicitor for help and were never asked. It fails the necessity test, so we do not do it. Not as an option, not as a setting, not later.
Nor does Cam guess who someone is from the way they sound or the way they spell a name. Identity comes from the caller telling us, confirmed back to them before anything is saved, or from the fee-earner who already knows. A confident guess in a client file is worse than an honest blank.
Four things that never happen to your data.
Never training a model without your say-so
No vendor we buy inference from directly may train on your calls, transcripts, notes, or enquiry records, and we do not train on them either. One caveat we would rather state than have you find: the managed assistant that answers a call runs a model we do not contract with ourselves, because the carrier does. That vendor is named on the register with the terms it is held to. If we ever offer your firm the option of using its own history to sharpen Cam for your own callers, it will be off until you turn it on, confined to your workspace, never pooled with another firm's, and it will stop when you say so.
Never a subprocessor you cannot see
The register names every vendor in the call path, what each one sees, and where it processes, and it is reconciled against the running code rather than the architecture notes. It is dated, versioned, and yours before you sign, including the rows where the agreement is still being papered. You should expect a vendor list to be complete before you expect it to be finished.
Never more data than the firm has agreed to
A firm can start on contact details, enquiry category, source, and urgency, and no privileged matter content. It widens what Cam can see only when it decides to.
Never kept longer than you set
Meeting audio expires on the firm's own retention setting, and the default is zero days, so it is deleted once the note is written unless you ask us to keep it. Calls are not recorded at all: the transcript is what the note is built from.
Three limits we would rather tell you about now.
Every one of these is a thing a firm would eventually find out. Finding it out from a vendor page is better than finding it out from a client.
01
Restricting a matter does not restrict the original enquiry.
The enquiry record stays readable across the workspace, because the inbox, the routing, and Cam all depend on it. Matter confidentiality covers the case spine. It does not retroactively cover the front-door record of the first call, and we would rather say so than let a firm assume otherwise.
02
We are not your system of record.
Your practice management system is. WasilX sits in front of it and hands work over to it. We do not hold your ledger, your conflict checks, or your file retention, and we are not trying to. That is a different product, and pretending otherwise is how firms end up with two half-authoritative copies of the same case.
03
Caller ID can be spoofed, so we show you the number.
Because we refuse to identify callers by voiceprint, an inbound caller is known by their number alone, and a number can be faked. The fee-earner approving an update sees the raw number it came from, never a name we inferred from it. The judgement stays with the person qualified to make it.
Bring the questions your risk partner would ask.
We would rather work through the awkward ones on a call than have you discover the answer during a pilot. Read the privacy notice first if it helps.
Talk to us about a pilot