Reference 04
The firm owns the machine. Under Seal supplies the software and the proof.
Under Seal does not sell, lease, finance, ship, or take title to hardware. The firm procures a supported system directly or through its IT provider. Under Seal installs the software, validates the environment, trains the team, and supports the approved configuration.
Authority review: August 12, 2026. State rules, local rules, contracts, and matter facts still require firm-specific review.
Important boundary
Under Seal is software, not a law firm, auditor, records custodian, or compliance certification. Local deployment reduces particular disclosure and vendor-access risks. It does not by itself satisfy professional-conduct rules, HIPAA, state privacy law, trust-account rules, discovery duties, court orders, or a firm's own policies.
Pilot deployment gates
Scope
Name the firm, matter, authorized users, supervising attorney, permitted documents, prohibited data, and intended work product.
Environment
Verify supported hardware, disk encryption, identity controls, network policy, local model runtime, backups, power protection, and physical access.
Data custody
Record checksums and page counts, preserve originals read-only, configure retention, and prevent cloud-sync paths from receiving the workspace.
Quality
Run the release suite, real-document evaluation, cross-matter isolation, refusal paths, export blocks, backup, restore, and rollback checks.
People
Train operators and reviewers, name signers, define incident escalation, and document jurisdiction-specific professional-responsibility decisions.
Acceptance
Complete one supervised chronology from intake through review and signoff. Record every coverage gap, correction, failure, and elapsed review minute.
Updates
Every release needs a version, commit, model/runtime combination, supported hardware, tests, known limits, and rollback procedure. No silent model swaps.
Support
Support begins with redacted diagnostics. Matter-content access and remote access are exceptional, firm-approved procedures, not defaults.
Cancellation
The firm retains its hardware, originals, exports, and contractually defined data. The removal procedure must cover software, model files, credentials, support access, and verification.
Not yet a certified configuration
The repository now has an authenticated encrypted backup format and an offline signed-update, verified-launch, and rollback control. Both have successful synthetic developer-machine drills. The public certified hardware matrix, independent signing-key custody, production packaging, target-hardware rollback, firm-specific recovery evidence, and pilot deployment receipt are still release gates. A hardware suggestion or developer-machine test is not certification.