What protects a firm’s documents, and what is still missing.
Each point below comes with the fact behind it. Harald holds no security certificate and has had no external penetration test. We say what we have and what we do not. Written on 12 November 2026.
The firm’s computer
The contracts, the database, the table and the audit trail are kept here. The app’s server answers only to this computer.
Our model server
Receives the passages a question needs, the question and the licence. Whole contracts are not sent.
The model provider
Reads the passages and hands back an answer with a quote. Code on the firm’s computer then checks the quote.
What Harald does
Facts are things the code does today. Limits are stated beside them, not at the bottom of the page.
- The files stay on the firm’s computer
- Harald is a desktop app with its own database.
- Fact. The app’s server answers only on the loopback address, and each request must carry a loopback Host header.
- What goes to the model
- The passages a question needs, the question and the instructions. Whole contracts are not sent.
- Fact. A spending cap is checked in code before each call.
- Every quote is checked by code
- A cell is shown as verified only when its quote is one continuous passage of the contract. A quote that joins two passages with an ellipsis is refused.
- Limit. The check compares words, not meaning, so a person still decides the cells marked for review.
- Roles
- Every person is a viewer, a reviewer or an admin.
- Fact. Every route of the app is in one table, and a route that is not in it answers 403.
- Matters and ethical walls
- A person behind the wall of a matter reaches nothing of it: not the contracts, not the table, not a draft or a search result made from it.
- Fact. A refused request gets the same answer as one for something that does not exist.
- Sign-in
- Passwords are stored as scrypt hashes. Five wrong tries for one email, or a hundred from one source, within 15 minutes stop further tries until that window has passed. A person can add a time-based code from an authenticator app, and a firm can require it. Sessions end after an hour without use and after twelve hours in any case.
- Limit. Single sign-on through OpenID Connect is built and was never tried against Entra, Okta or Google.
- An audit trail that cannot be rewritten quietly
- Runs, decisions, account changes, sign-ins and refused requests are recorded with the time and the person. Each entry carries the hash of the one before, the table refuses edits and deletes, and an admin can check the chain from the app.
- Limit. Someone with owner rights on the database can rewrite it, so the last hash should be kept elsewhere.
- Logs hold no contract text
- Each request writes one line: method, route pattern, status, duration and request id. Never a body, a cookie, a token, a password, an email or contract text.
- Scans are read on the computer
- A scanned page is recognised by the app itself. The files that do it ship inside the app; no page goes to a recognition service.
- Keys are kept in one place
- The model keys live on our model server and nowhere else, so the desktop app holds none. Each licence has a monthly budget there, and every provider call is written to a ledger without any passage or answer.
- Backups
- A backup made with the server commands is encrypted with a key file the firm keeps, and a backup without a key is refused unless you ask for one.
- Limit. Harald does not schedule a backup or keep a copy elsewhere.
- Software we add
- Every dependency is locked, a new release must be seven days old before it is installed, and an install script runs only when it was approved by name.
What we do not have yet
A firm that needs any of the following today should not buy Harald yet.
- No certificate
- Harald holds no SOC 2 report and no ISO/IEC 27001 certificate. We keep a table of our controls against both and describe them as in line with those frameworks, never as certified.
- No external penetration test
- Two reviews of the code, one of the access rules and one of the model server, were done by AI agents on our instruction, and their findings and fixes are written down. They are not an outside test.
- Not encrypted at rest by Harald
- The database and the audit trail are not encrypted by the app. They rely on the disk encryption of the computer, which the firm controls.
- The model server is not hosted
- It is written and tested against a fake provider. It has never run on a host or called a real model provider, and the licence server is not hosted either. It can route to Anthropic, OpenAI and Google; no agreement is signed with any of them.
- Connectors never tried on a real system
- The connectors for SharePoint, iManage Work, NetDocuments and WebDAV import Word, PDF and text files and were tested against stand-ins on our own computer only. They leave out a PDF with a scanned page, and they cannot save anything back.
- The Mac app is not signed
- The build is unsigned and not released, and the Word pane was never opened in a real copy of Word.
- No company yet
- One person builds, reviews, merges and releases. There is no second approver, no staff, no insurance and no uptime promise.
- Deletion has limits
- An admin deletes a whole contract set, or one contract of it, with its answers and drafts. A single run or a person cannot be deleted, and the audit trail keeps its entries.
Report a vulnerability
Write with what you saw, the version and the steps. Please do not send real contract text or personal data; a description is enough. We aim to answer within three working days and to tell you when it is fixed.