EvenUp Trust Center
Built for personal injury firms. Designed with trust at the center.
The EvenUp Trust Center provides a transparent view into the security, privacy, and compliance practices that support our platform.
EvenUp’s security and compliance program has been independently assessed through a SOC 2 Type 2 examination and a HIPAA compliance assessment. We support customers handling sensitive information through appropriate contractual, technical, organizational, and compliance measures.
Use this portal to explore our safeguards, controls, and compliance resources, request available documentation, and learn more about how EvenUp handles and protects customer data.
Request access
Compliance
SOC 2 Type 2
HIPAA
CCPA
Monitoring
Continuously monitored by Secureframe
Resources
If you would like to report a vulnerability, please contact [email protected] with a proof of concept, list of tools used, and the output of the tools. Once received, EvenUp will work quickly to reproduce each vulnerability to verify its status before taking the steps needed to address it.
SOC 2 Type 2
HIPAA
CCPA
Vulnerability Disclosure
To report a vulnerability, contact [email protected] with a proof of concept, list of tools used, and the output of the tools. Once received, EvenUp will work quickly to reproduce each vulnerability to verify its status before taking the steps needed to address it.
Exclusions
When reporting vulnerabilities, please consider (i) attack scenario / exploitability, and (ii) security impact of the bug. The following issues are considered out of scope:
- Clickjacking on pages with no sensitive actions
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Attacks requiring MITM or physical access to a user's device
- Previously known vulnerable libraries without a working Proof of Concept
- Comma Separated Values (CSV) injection without demonstrating a vulnerability
- Missing best practices in SSL/TLS configuration
- Any activity that could lead to the disruption of our service (DoS)
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Attempting to compromise our endpoints by brute forcing
- Missing best practices in Content Security Policy
- Missing HttpOnly or Secure flags on cookies
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 versions behind latest]
- Software version disclosure / Banner identification issues / Descriptive error messages or headers
- Public Zero-day vulnerabilities that have had an official patch for less than 1 month
- Tabnabbing
- Open redirect - unless an additional security impact can be demonstrated
- Issues that require unlikely user interaction
AI & LEGAL ETHICS
AI and Legal Ethics FAQs
EvenUp’s AI tools are designed to help personal injury firms work more efficiently while keeping trust, confidentiality, and attorney oversight at the center of legal work. These FAQs address common questions about responsible AI use in legal workflows, including client communication, confidentiality, data protection, attorney supervision, AI-assisted outputs, and billing.
This information is provided for general informational purposes only and does not constitute legal advice. Firms remain responsible for determining how to use EvenUp consistent with applicable laws, court rules, professional obligations, engagement terms, and client instructions.
Do I need to tell my clients that my firm uses EvenUp’s AI tools?
Requirements vary by jurisdiction, matter, engagement terms, client instructions, and how the technology is used. As a practical matter, firms may wish to explain in their engagement agreements, privacy notices, or other client-facing materials that they use technology vendors, including AI tools, to support legal services. More specific requirements may apply to court filings. Some courts and judges require lawyers to disclose the use of AI-assisted tools, certify that filings were independently reviewed, or confirm that factual statements, legal authorities, and citations were verified.
Do EvenUp’s AI tools impact client confidentiality or privilege?
Law firms routinely use technology providers, including EvenUp, to support legal work. The use of EvenUp’s AI tools does not, by itself, determine whether a particular communication or material is confidential, privileged, or protected as work product. The relevant analysis generally depends on how the technology is used, the nature and purpose of the communication or material, whether appropriate confidentiality and security protections are maintained, and applicable law.
Critically, EvenUp is not an open, public AI chatbot. It is an enterprise legal technology platform designed for law firm workflows and for supervision by lawyers. EvenUp maintains security controls, restricts access to customer data, and does not allow third-party AI providers to use customer case files to train models for other customers. We configure these services to minimize data retention and, where available, use zero-retention settings.
Whether privilege or work-product protection applies depends on traditional factors, such as whether the tool was used by or at the direction of counsel, whether the material was created for legal advice or in anticipation of litigation, and whether confidentiality was maintained. EvenUp does not decide or control privilege outcomes for a firm. Each firm and its counsel remain responsible for evaluating privilege, work-product protection, and any discovery requests under applicable rules.
Critically, EvenUp is not an open, public AI chatbot. It is an enterprise legal technology platform designed for law firm workflows and for supervision by lawyers. EvenUp maintains security controls, restricts access to customer data, and does not allow third-party AI providers to use customer case files to train models for other customers. We configure these services to minimize data retention and, where available, use zero-retention settings.
Whether privilege or work-product protection applies depends on traditional factors, such as whether the tool was used by or at the direction of counsel, whether the material was created for legal advice or in anticipation of litigation, and whether confidentiality was maintained. EvenUp does not decide or control privilege outcomes for a firm. Each firm and its counsel remain responsible for evaluating privilege, work-product protection, and any discovery requests under applicable rules.
What safeguards should my firm consider when using technology providers generally?
Customers should consider safeguards across four layers:
- Legal and contractual controls: appropriate confidentiality, data processing, security, and, where applicable, Business Associate Agreement commitments.
- Technical controls: strong authentication, role-based access, least-privilege permissions, encryption, logging and monitoring, vulnerability management, and secure account administration.
- Workflow controls: attorney supervision, review of AI-assisted outputs, verification against case records, correction before approval, and clear escalation paths for unexpected or sensitive issues.
- Governance controls: internal AI-use policies, staff training, periodic risk review, audit-log review where available, and clear client or court communication practices where required or appropriate.
What other responsibilities does my firm have when using technology providers like EvenUp?
EvenUp’s services are designed to assist legal teams, not replace attorney judgment or legal review. Your firm remains responsible for its professional, legal, and client-specific obligations.
Those responsibilities include supervising attorneys and staff; overseeing AI-assisted outputs and actions, including reviewing outputs before use where appropriate; complying with court and bar rules; configuring workflows appropriately; maintaining internal policies and training; and securing your firm’s own user accounts, devices, and systems.
Those responsibilities include supervising attorneys and staff; overseeing AI-assisted outputs and actions, including reviewing outputs before use where appropriate; complying with court and bar rules; configuring workflows appropriately; maintaining internal policies and training; and securing your firm’s own user accounts, devices, and systems.
AI Agents: Responsible Use and Safeguards
EvenUp uses AI agents to assist law firms with supported legal workflows. Depending on the feature and workflow, agents may process information, use enabled tools, communicate with third parties, or perform other supported actions. EvenUp agents are designed to operate within the capabilities, permissions, and workflows made available to them.
Can EvenUp AI Agents independently add new tools or integrations?
EvenUp agents use tools and integrations that are made available through the EvenUp product. They cannot independently add new tools or integrations.
Can an AI Agent act outside the workflows or permissions available to it?
EvenUp agents operate using the capabilities and permissions made available to them through the applicable product features and workflows. Where an agent is permitted to take an external action, that action is subject to the controls applicable to the relevant capability.
The form of customer direction or authorization may vary by feature. Depending on the workflow, it may occur at the individual-action level or through configuration, enrollment, or other customer-authorized settings.
The form of customer direction or authorization may vary by feature. Depending on the workflow, it may occur at the individual-action level or through configuration, enrollment, or other customer-authorized settings.
How does EvenUp monitor AI Agent activity?
EvenUp maintains logging and monitoring controls as part of its security program. Depending on the applicable feature and workflow, this may include logging of agent communications and other relevant activity for security, monitoring, troubleshooting, and operational purposes.
Potential security incidents or anomalous activity involving an agent are handled through EvenUp’s applicable security and incident-response processes.
Potential security incidents or anomalous activity involving an agent are handled through EvenUp’s applicable security and incident-response processes.
How is customer information protected when AI Agents are used?
AI Agents operate within EvenUp’s broader confidentiality, security, access, and data-use controls. For more information, please read our Security and Compliance FAQs above.
Communication Agents
What are Communication Agents?
Some AI Agents support law-firm-authorized communications with clients and other third parties.
Can a law firm use EvenUp’s Communication Agents to communicate with clients or other third parties?
Law firms can use Communication Agents in the same way that they use other communication technologies to contact clients and third parties. They remain responsible for supervising the use of the technology, protecting confidential information, and determining whether their particular workflows comply with applicable professional responsibility obligations, client instructions or consent requirements, recording laws, call and text rules, and other legal or regulatory requirements.
EvenUp has built safeguards into the Communication Agent to support compliant use. For example, at the beginning of a voice call, the called party is informed that the call will be recorded and transcribed. If the called party indicates that they do not consent to recording or transcription, the Communication Agent does not continue the conversation and politely ends the call. With respect to client confidentiality and privilege, the Communication Agent operates on behalf of and at the direction of the law firm. The use of the Communication Agent should not itself change the ordinary confidentiality or privilege analysis that would apply if the same activity were performed by an authorized individual acting on the firm’s behalf using any other communication technology.
EvenUp has built safeguards into the Communication Agent to support compliant use. For example, at the beginning of a voice call, the called party is informed that the call will be recorded and transcribed. If the called party indicates that they do not consent to recording or transcription, the Communication Agent does not continue the conversation and politely ends the call. With respect to client confidentiality and privilege, the Communication Agent operates on behalf of and at the direction of the law firm. The use of the Communication Agent should not itself change the ordinary confidentiality or privilege analysis that would apply if the same activity were performed by an authorized individual acting on the firm’s behalf using any other communication technology.
Do Communication Agents decide on their own who to call?
No. Communication Agents cannot independently select recipients or initiate calls outside the workflows configured or authorized by the firm. For treatment check-ins, a user enrolls a specific case, matter, or plaintiff and selects how frequently calls should occur. Calls then take place according to that schedule, and upcoming calls can be reviewed and canceled. For other supported outbound calls, the user provides the necessary call information and reviews and approves the call before it is placed. Users may also choose whether to enable intelligent retries and how many retry attempts should be made if a call does not connect.
Billing Back Case Costs
Personal injury firms often use technology and third-party services to support case administration, document preparation, records workflows, communications, and claims processes. Whether and how those costs may be billed to, deducted from, or recovered from clients or case proceeds can raise complex questions under fee agreements, client disclosures, court rules, settlement practices, and professional responsibility obligations.
The information below is intended to provide a starting point for understanding complex questions about billing expenses back to clients. Standards vary by jurisdiction, and this information is not intended to be comprehensive or to serve as legal advice. Please consult an attorney licensed in your jurisdiction.
Can a law firm pass EvenUp costs along to a client?
Law firms can typically seek reimbursement for reasonable and necessary expenses associated with a particular client matter, but not for ordinary expenses of operating a law practice. Whether a specific EvenUp cost may be passed through depends on the jurisdiction, the nature and use of the service, and the firm’s agreement with its client.
What is the difference between a case cost and general overhead?
A case cost is generally an expense directly attributable to a particular client matter. General overhead ordinarily includes expenses incurred to maintain the practice more broadly, such as office rent, utilities, or routine office software. Technology costs should be evaluated based on how the service is used, rather than how it is labeled.
How should a firm determine the amount charged to a client?
The amount must be reasonable and should not be used as an additional source of profit. A firm may charge the actual cost incurred or a reasonable amount disclosed and agreed to in advance. For subscription or volume-based services used across matters, firms may be able to reasonably allocate costs across all cases used in connection with the service.
How does EvenUp help firms document matter-specific costs?
Depending on the service, EvenUp may provide documentation showing credits consumed, effective case pricing, the matters for which the service was used, itemized charges, matter-level usage, and usage-based overages.
Should a firm disclose these costs in its client agreement?
Firms should clearly communicate the basis on which clients may be responsible for fees and expenses, preferably in writing and before the charge is incurred. EvenUp cannot provide or approve language for a firm’s retainer or fee agreement. ABA Model Rule 1.5 addresses the communication and reasonableness of fees and expenses.
Where can I learn more?
Requirements vary by jurisdiction, so firms should review both applicable state-level ethics guidance and any local court rules, standing orders, or judge-specific requirements. Many jurisdictions draw from the ABA’s guidance on lawyers’ use of generative AI. The following resources provide a useful starting point:
FAQs
Who can access your case data?
Case data is accessible only to authorized EvenUp personnel and service providers on a need-to-know basis. Access permissions are limited to what is necessary to support your account and provide our services. EvenUp personnel and service providers are subject to contractual confidentiality and data protection requirements, such as data processing agreements and HIPAA-compliant business associate agreements.
How is AI used in connection with your case materials?
EvenUp uses proprietary and third-party AI technologies for a range of purposes, including analyzing case materials, extracting and organizing relevant information, and helping prepare work product for your review and use.
Does EvenUp use case data to train or improve its models or third-party AI models?
We leverage our experience handling thousands of cases to improve our product and help our models recognize patterns in medical records and case outcomes. Our models learn statistical patterns and are designed not to store or reproduce your documents. We do not allow third-party AI providers, including OpenAI and Anthropic, to use your case files to train their models. We configure third-party AI providers to minimize retention and use zero-retention settings where available. Your case files stay with your matters and do not appear in another customer’s work product.
Where is case data stored?
Case data is stored in U.S.-based data centers.
Does EvenUp sell case data?
No. EvenUp does not sell case data to third parties.
How does EvenUp protect case data?
EvenUp maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your data and to help prevent unauthorized access. These safeguards include access controls, encryption both in transit and at rest, vulnerability management, logging and monitoring, incident response, risk assessment, network security, and vendor governance. Our security program is independently assessed through a SOC 2 Type 2 examination and HIPAA attestation. Relevant reports are available to customers and prospects upon request.
How does EvenUp identify and address security vulnerabilities?
EvenUp maintains a vulnerability-management program that includes automated code, dependency, and API security scanning, code review, security testing, and independent third-party penetration testing at least annually. Potential vulnerabilities are evaluated and remediated based on their severity and risk.
How is case data hosted and segregated from other client files?
EvenUp hosts case data in cloud infrastructure and generally does not use a separate, single-tenant environment for each customer. Instead, our multi-tenant architecture uses logical separation, authenticated identities, role-based access, and scoped permissions designed to ensure that users and systems can access only the data they are authorized to access. Case data is encrypted in transit and at rest, and access is logged and monitored.
How does EvenUp handle retention and deletion of case data?
EvenUp stores and processes case data and related records as needed to provide, support, secure, and operate the service. Depending on the workflow, this may include submitted materials, generated outputs, processing artifacts, metadata, operational records, and security or troubleshooting logs. When a customer submits a deletion request, EvenUp honors that request in accordance with applicable law and the customer’s agreement. Deletion may be subject to limited retention where retention is required or permitted for legal, compliance, security, audit, backup, or dispute-resolution purposes. Backup copies, where present, are retained in accordance with EvenUp’s standard backup lifecycle and may be retained for up to one year before deletion.
What happens if EvenUp receives a subpoena or other legal demand for case data?
Unless legally prohibited, our practice is to notify the affected customer promptly so that the customer has an opportunity to review, challenge, or seek to narrow the request. Where disclosure is legally required, we seek to provide only the information we are required to disclose.