How we protect your client data
Law firms entrust us with data that is subject to professional secrecy. This page explains how we handle it, as concretely as possible.
Legal framework
rightflow meets the requirements that apply to software handling client data:
BRAO compliant
As a service provider within the meaning of § 43e BRAO, we are contractually bound to confidentiality. Anything that goes out is approved by a lawyer.
GDPR compliant
Data processing agreement under Art. 28 GDPR, storage in the EU and an external data protection officer from heyData.
EU AI Act
The agents' work is identifiable as such in the case file and logged. A person reviews it before anything leaves the firm.
ISO 27001 certified data centres
rightflow runs in Amazon Web Services data centres certified under ISO/IEC 27001. The certificate covers the data centres, not rightflow as a company.
Where data is stored
In Germany
Case files, documents and the database are stored in data centres in Germany.
Geo-redundant backups
Backups are kept at a second site in the EU. If one data centre fails, your data is preserved.
EU only
Your data is stored exclusively within the European Union.
Separate from other firms
Every firm works in its own environment. Only you and the people you grant access can see your data.
Backup and deletion
As of October 2026, the following applies to all firms:
Continuous backup
Your case data can be restored to any minute of the last 35 days.
Document versions restorable for 35 days
A file deleted or overwritten by mistake can be restored for 35 days.
Predictable deletion
Data you delete on purpose is removed from all copies after 35 days. That lets you answer erasure requests reliably.
Control within the application
- Letters, e-mails and beA messages only go out after your approval
- Payouts optionally under the four-eyes principle
- Every entry in the file points to its source in the document
- Every action by people and agents is logged
- Rules that rightflow derives from corrections only apply once confirmed
- Data is encrypted in transit and at rest
Questions from your data protection review?
We're happy to answer them in the demo. Customers find the current list of sub-processors in the support portal.