Product Privacy Notice

This notice explains how Proxara, Inc. (“Proxara”) handles information when a firm uses Proxara (the “Service”). It is written for the firm’s partners, staff, and the clients whose documents the firm works with. The Website Privacy Policy covers visits to redact.proxara.ai.

1. Who is responsible

The firm that uses the Service decides which of its systems are connected, which files are processed and why. The firm is responsible for that information. Proxara processes it on the firm’s behalf, as the firm’s service provider, under the firm’s agreement with Proxara and the Data Processing Addendum.

2. What the Service does

The connector. When someone at the firm asks Claude (or another AI assistant the firm connects) about a client, the assistant asks Proxara. Proxara reads the firm’s own systems, such as Outlook, SharePoint, OneDrive, Teams, Karbon and CCH Axcess, with that person’s own access, and answers with recognized names and identifiers replaced by codes such as P-7KQ2M. The person sees the real names in the Proxara window inside the assistant. A model Proxara runs itself reads the firm’s documents, and Proxara keeps an encrypted record of who each client and related party is, which documents mention them and facts drawn from them. When the assistant proposes an action, such as an email to a client, it runs only after the person approves it. What someone types or attaches in the assistant itself goes to the assistant’s provider directly, under the firm’s agreement with that provider.

Windows Redact adds a Redact command to Windows File Explorer. When someone at the firm selects files and chooses Redact:

The Windows application sends the selected files to Proxara’s redaction service.
The service reads each file and replaces the names and identifiers it recognizes as sensitive with consistent codes, such as P-7KQ2M. The same person or organization is given the same tag each time it is recognized. This is pseudonymization: the copy no longer shows those names, but it still contains the rest of the document, and it is not guaranteed to be anonymous.
The service checks the copy and sends it back. The application saves it beside the original. The original is not changed.

When the person later selects a file that contains these tags, such as a document drafted from a redacted copy, the service puts back the names and values it can verify and returns a restored copy.

The service returns a copy only when the redaction is complete and verified, or when a complete read found nothing to protect. Otherwise it refuses the file. It never sends files anywhere else. The firm’s staff decide whether to give a redacted copy to an AI provider such as Claude. That provider handles the copy under the firm’s own agreement with it.

The Service does not monitor computers, intercept network traffic, or see what staff type or upload in other applications. It handles only the files someone selects.

3. Information processed

Information in the firm’s connected systems that the Service reads: email, files, Teams messages, Karbon records and CCH Axcess returns, which can include the kinds of information listed for files below. Contents are read when needed and not kept; the client record keeps names, identifiers, codes, where they appear and facts, encrypted.
Who uses it: each person’s Microsoft account identifier, name, email and role, and an encrypted Microsoft sign-in token so the Service can read and act with that person’s own access.
Actions and audit: actions proposed and approved, and who asked about which client record and when.
The files people select, including the file names and everything in them. Files may contain names, addresses, government identifiers such as Social Security numbers and EINs, bank and account numbers, and financial and tax information.
Identity records: each protected name or identifier and the tag that replaced it.
Restoration records: the original text or image regions that tags replaced in each returned copy.
Who used it: the Windows account name of the person who selected the files, and the application version.
Usage figures: file type, size, processing time, outcome, and how many values of each kind were protected.
The firm’s redaction policy, if the firm saves one.
Slack settings, if the firm installs the optional Slack app: the Slack user IDs of the firm’s designated leaders and the chosen digest channel.

4. Why it is processed

To answer the firm’s people from the firm’s own systems with codes in place of identities, keep the firm’s client record, run the actions people approve, pseudonymize and restore files for the firm, to keep tags consistent across the firm’s files, to apply the firm’s saved policy, to show the firm’s leaders how the Service is being used, and to operate, support and secure the Service. Proxara does not sell this information, use it for advertising, or use it to train models for anyone other than the firm.

5. Where it is processed

In Proxara’s Microsoft Azure environment in the United States (East US for the application and the model, Central US for the database). The model is an open-weight model that Proxara runs itself. The model’s publisher does not receive any of the firm’s information.

6. How long it is kept

Selected files and returned copies are held in memory only while they are processed, and discarded no later than 15 minutes after the last activity on that job. They are not saved to disk or to a database.
Identity records, restoration records, usage figures, the firm’s policy and Slack settings are kept while the firm uses the Service, because restoring later files depends on them.
Database backups are kept for seven days.
When the firm’s agreement ends, Proxara deletes the firm’s data after the period set in the firm’s agreement, except where the law requires otherwise.

7. Who can see it

The person who selected the file receives the redacted or restored copy on their own computer.
The firm’s designated leaders, if the firm installs the Slack app, see usage figures in Slack: who used the Service (by Windows account name), how many files, how they ended, and how many values of each kind were protected. Slack never receives file contents, file names, protected values or tags.
Proxara personnel who administer the Service’s Azure environment have technical access to it. They use that access only to operate, support and secure the Service.
Microsoft, as Proxara’s hosting provider, stores and processes the data within Azure. See the Sub-processor List.
Authorities, if the law requires disclosure. Proxara will tell the firm first where the law allows.

8. Security

Files travel over HTTPS. Protected values, restoration records, the firm’s policy and Slack credentials are encrypted in the database in addition to Azure’s storage encryption. Details are in the Security Overview. No system is perfectly secure, and redaction can miss sensitive details, so the firm’s staff review each copy before sharing it.

9. Your choices and rights

If you are a client of a firm that uses the Service, or a member of its staff, contact the firm to ask about, access, correct or delete your information. The firm decides how to respond, and Proxara helps the firm do so. If you contact Proxara directly, Proxara will refer your request to the firm.

10. Tax return information

Files processed for accounting and tax firms often contain tax return information. Whether a firm needs a taxpayer’s consent before giving a redacted copy to an AI provider is a question for the firm and its counsel under Internal Revenue Code Section 7216 and professional rules. Proxara does not decide it for the firm.

11. Health information

The Service is not offered for protected health information, and Proxara does not sign Business Associate Agreements. See HIPAA.

12. Changes and contact

Proxara will update this notice when the Service changes and will change the date above. Questions: support@proxara.ai. Security concerns: security@proxara.ai. Post: Proxara, Inc., 28 Geary St. Suite 650 PMB 5328, San Francisco, CA 94108.