Confidentiality
The phone should never be a way into the file.
A prospective client’s first call is sensitive long before it is privileged, and a fee-earner’s own line carries live matter detail all day. This page is what WasilX does with both, and, at the end, the three places we have drawn a line instead of papering over it.
Permission flow
Nothing gets shared wider unless a person shares it.
Caller
Known by stated details and confirmed number.
Enquiry
Visible to route and recover the front-door record.
Person
A fee-earner reviews what Cam captured.
Matter
Attached by a human, never guessed by Cam.
Audit
Access and break-glass stay visible.
01
On the phone, Cam takes the call. It does not read your cases to do it.
Cam is not on any matter.
Deciding which matter a call belongs to would mean reading matters. That would hand the AI both access to case content and a standing reason to know it, which is the same content it must never read back to a caller.
So it does not decide. Cam routes the update to a person and attaches at most a contact. The fee-earner attaches the matter. Cam answers from the knowledge the firm configured and the record in front of it, and it cannot read a file back to a caller because it never held one. Ask Cam is different, and narrower: there it reads as the person asking, and only what they can already open.
02
Adding a colleague widens the case, not the confidences.
Access narrows. It never widens.
Matter membership grants the spine of a case: the matter, its members, its updates, the enquiries and tasks linked to it. It does not grant the meeting notes recorded against it. Those keep their own rules, and the two sets of permissions are intersected rather than combined.
If they were combined, adding a colleague to a matter would quietly become sharing every note anyone ever recorded on it. So a colleague who cannot read an attached meeting sees nothing about it: not a redacted stub, not a count, not a date. That a meeting happened at all is information about the firm.
03
Supervision without a back door.
Break-glass access expires, and it is written down.
A firm cannot hold files no supervising partner is ever able to review. File review, COLP and COFA duties are not optional, and a system that made them impossible would be unusable in a real practice.
But a silent partner-sees-everything override is not supervision, it is a back door. So a supervisor joins the matter the same way anyone else does, and it shows. Read-only, time-limited, with the reason written down and an audit entry beside it. Nobody sees a file without the file recording it.
No voiceprints. No guessed names.
Recognising a caller by their voice would be the easy way to make this product feel clever. It would also make every call special-category biometric data under Article 9, collected from people who rang a lawyer for help and were never asked. It fails the necessity test, so we do not do it. Not as an option, not as a setting, not later.
Nor does Cam guess who someone is from the way they sound or the way they spell a name. Identity comes from the caller telling us, confirmed back to them before anything is saved, or from the fee-earner who already knows. A confident guess in a client file is worse than an honest blank.
Four things that never happen to your data.
Never training a model without your say-so
Nobody trains on your calls, transcripts, notes or enquiry records. Not the vendors we buy AI from, and not us. One caveat we would rather state than have you find: the assistant that takes a call runs on a model our carrier contracts, not us. That vendor is named on the register, with the terms it is held to. We may one day offer to tune Cam on your own history, for your own callers. If we do, it stays off until you switch it on, stays inside your own firm's record, is never pooled with another firm, and stops when you say so.
Never a subprocessor you cannot see
The register names every vendor in the call path, what each one sees, and where it processes, and it is reconciled against the running code rather than the architecture notes. It is dated, versioned, and yours before you sign, including the rows where the agreement is still being papered. The list is complete before every agreement on it is signed, and it says which ones are not.
Never more data than the firm has agreed to
A firm can start on contact details, enquiry category, source, and urgency, and no privileged matter content. It widens what Cam can see only when it decides to.
Never kept longer than you set
Meeting audio expires on the firm's own retention setting, and the default is zero days, so it is deleted once the note is written unless you ask us to keep it. Calls are not recorded; the note is built from the transcript.
Three limits we would rather tell you about now.
You would find each of these out eventually. Better here than from a client.
Restricting a matter does not restrict the first call.
The front-door record stays readable across the firm. Routing depends on it.
We are not your system of record.
Your practice management system is. WasilX sits in front of it and hands work over.
We show the number, never a name we inferred.
No voiceprint identification, and caller ID can be spoofed. The approver sees the raw number.
Bring the questions your risk partner would ask.
We would rather work through the awkward ones on a call than have you discover the answer during a pilot. Read the privacy notice first if it helps.
Talk to us about a pilot