Your data stays in your country.
Never used to train our models.
This page says where Gotham keeps your data, who can see it, and what the AI does with it. Each statement describes how Gotham works today.
Stored in your country. Encrypted everywhere.
Your files, databases, and backups stay in your own country. For customers in India, that means India. All stored data is encrypted at rest. All traffic between your browser and Gotham is encrypted in transit.
- Your browserTLS 1.2 or higher
- GothamYour country
- Your files and dataYour country · AES-256
- BackupsYour country · encrypted
- AI model providersZero data retention
Each customer's data is stored in their own country. Every AI subprocessor is on zero data retention: nothing is kept, and nothing is used for training.
Only the people in your workspace.
Checked on the server
The server checks every request against your workspace membership. One firm cannot open another firm's matters.
Tested on every change
Automated tenant-isolation tests run on every code change before it ships.
One way in
Our API accepts traffic only through our edge network. Requests from anywhere else are refused.
Your office only, if you want
Workspace admins can restrict access to an allowlist of IP addresses.
Single sign-on
Sign in through your firm's identity provider with SAML single sign-on.
Automatic provisioning
Add and remove users from your directory with SCIM. Leavers lose access the moment you remove them.
The AI works for you. You approve what it changes.
- We do not train models on your matters.
- Every AI subprocessor is on zero data retention. Nothing is kept after the answer.
- Your documents are indexed by a model that we host in our own cloud account.
- An AI action that changes your data waits for your approval.
- Each action you approve is written to your audit log.
A tamper-proof record of every change.
Gotham records each change to a matter, a document, or its sharing, and each AI action you approve. Each entry is chained to the one before it, so any edit or deletion shows. Workspace admins can review the full log at any time.
Certified, and ready for your review.
Independent auditors test our controls. We share the reports with your security team on request.
Every AI subprocessor is on zero data retention. We share the full list on request.
Request the listSend us your firm's questionnaire. We answer it in writing.
Send the questionnaireFound a security issue? Tell us.
Write to us with the steps to reproduce it. Please do not access other people's data while you test.