Your case files, strategy and rehearsals are attorney work product. inSession runs on AI providers that are independently audited, never train on your data by default, and keep nothing longer than they need to.
None of our AI providers use business or API data to train their models by default. You keep ownership of what you upload and of what the simulation produces.
Work product is encrypted at rest with AES-256. Our AI providers encrypt data both in transit and at rest on their side too.
Permissions are set for each user and each firm. Our AI providers grant their own staff access on a least-privilege basis.
Our AI model providers delete inputs and outputs within 30 days. Our avatar provider supports zero-retention sessions, where no audio, transcript or recording is stored.
The infrastructure behind every session is independently audited. These certifications belong to our providers. inSession's own SOC 2 Type II readiness is scheduled for Q4 2026.
GDPR
HIPAA
SOC 2
ISO 27001
Powers judges, witnesses, jurors, opposing counsel and scoring
Supporting language and reasoning tasks
Renders photorealistic avatars and voices in real time
These attestations belong to our providers, not to inSession itself, and come from each provider's published trust documentation. inSession's own SOC 2 Type II readiness is scheduled for Q4 2026.
No. Case materials you submit are used only to run your simulations, transcripts, scoring and reports. Our AI providers are not permitted to train their models on case data processed through inSession.
You, and the people you or your firm authorize. Permissions are set for each user and each firm, and an administrator at your firm or school can see the work of users they manage.
Inside inSession, access to production data is role-based and limited to what support, reliability and security work requires.
Each session is transcribed and scored so you can review it, and that record stays in your workspace, encrypted at rest. You can delete it from your workspace.
Our avatar provider supports zero-retention sessions, where it stores no audio, transcript or recording on its side.
Our AI model providers delete inputs and outputs within 30 days, and keep nothing at all where zero retention applies. Our avatar provider runs in zero-retention mode, or otherwise keeps session data for up to 30 days.
Not yet. The providers behind every session hold SOC 2 Type II attestations, but a provider's attestation does not make inSession SOC 2 certified. inSession's own SOC 2 Type II readiness is scheduled for Q4 2026.
We welcome reports from security researchers. Tell us what you found and how to reproduce it, and we will follow up with you until it is resolved.
Request our security documentation, including our providers' attestations, or start your free test drive.