A

AttiFin AI

Research, drafting and summarization are the three capabilities AttiFin sells, and each is model driven; there is no document management system, workflow engine or matter database that would still function without the models. Section 2 of the terms of service defines the Service as an AI powered legal assistant optimized for UK law that helps you research, draft and summarize, which is the whole of what is offered. Section 15 treats the models as the company's own intellectual property alongside the software.

The AI Policy at Annex B of the privacy policy states that answers are designed to be grounded in verified UK and client sources, and to be citable and auditable so a reviewer can trace a statement back to its source. The home page repeats that every answer is fully cited and instantly verifiable. No accuracy figure is published, no test set is described, and no retrieval method is set out beyond a claim that the platform indexes UK legal sources.

There is no sample output, documentation or product page showing citations. The AI Policy acknowledges that AI systems can produce inaccurate, incomplete or unrepresentative output, so AttiFin does not claim freedom from hallucination.

The terms of service open by stating that AttiFin is a research and productivity tool and not a provider of legal advice, and that a qualified human professional must review and take responsibility for any work product before it is relied upon. The Acceptable Use Policy separately prohibits giving legal advice from output without human review and prohibits automated decisions that materially affect a person's rights without human supervision.

Section 11 of the privacy policy states that no solely automated decision making within the meaning of Article 22 UK GDPR takes place. The Book a Demo page claims a human review checkpoint before any consequential action is taken. No threshold at which the system stops is published, nothing describes what the product does when it cannot ground an answer, and nothing says what happens after an output is wrong.

AttiFin publishes one testimonial, attributed to a leading UK family law practice, claiming the team's research and first draft time was cut significantly. No customer is named on the site, no figure is attached to the claim, and no date is given. There are no case studies, no customer stories page and no logo strip. The terms of service provide for live paid subscriptions, free trials and signed Order Forms, but nothing published shows production use.

Section 8 of the terms recognizes that customer content may attract legal advice privilege, litigation privilege and the solicitor's duty of confidentiality under paragraph 6.3 of the SRA Code of Conduct. It states that nothing in the terms is intended to waive privilege and that no use in accordance with them should be treated as waiving it. It commits to notifying the customer before any compelled disclosure of material identified as privileged, so privilege can be asserted.

Training is prohibited in the agreement itself, and subprocessors are contractually barred from it. Retention is set by the customer, and deletion runs within 30 days of termination across primary storage and derived search and caching copies. Other than cloud storage providers, subprocessors will not retain or log customer content for human review. Separation is documented at the customer level through logical separation and role based access control, with content processed in the customer's own tenant, and no wall between matters is described for a firm buyer.

The first paragraph of AttiFin's terms says it is a research and productivity tool and not a provider of legal advice, and that output may be inaccurate, incomplete or out of date. Nothing in the Service relieves a regulated professional of duties of competence, supervision and confidentiality. The product is positioned for UK law only: optimized for UK law and trained on UK legislation and case law. The terms are governed by the laws of England and Wales, and the SRA Code of Conduct is named to the paragraph.

The Acceptable Use Policy adds an EU provision prohibiting a judicial authority from using the Service to research and interpret facts and apply the law to a concrete set of facts. There is no surface for consumers, and the product is sold only to regulated professionals and their organizations.

An AI Policy is published as Annex B to the privacy policy and incorporated into the terms by reference. It commits to compliance with UK requirements and the EU Artificial Intelligence Act, cited by regulation number 2024/1689, to AI literacy among staff who develop and operate the models, and to procedures for obtaining rights and licenses in data sets. It also commits to testing that monitors the accuracy, reliability and suitability of output alongside change management processes.

No owner inside the company is named for AI governance, no testing regime is described, and no results are published. The section headed Accuracy, bias and technical measures says nothing about bias, with no testing, findings, populations or matter types considered.

Retention is published as a table with distinct periods in section 10 of the privacy policy. Uploaded documents, conversations and AI generated drafts follow the customer's own retention policy and are deleted within 30 days of termination; demo and inquiry records are kept 24 months and billing records generally six years. Deletion is specific about scope, naming primary storage and derived copies held in search and caching layers, and stating that backup copies are overwritten on the standard backup cycle rather than deleted individually.

Encryption in transit and at rest, logical separation between customers, role based access control, centrally managed keys rotated on a regular cycle and security monitoring are all described. Breach practice is stated on both sides of the controller and processor line, including notification to the Information Commissioner's Office within 72 hours where AttiFin is controller. Section 6 declines to publish the subprocessor list and offers it only by email request.

Section 13 of AttiFin's terms gives a vendor indemnity against third party intellectual property infringement claims, with named exclusions for customer content, customer breach and unapproved combinations. Section 14 sets a general cap at the total fees paid or payable in the 12 months before the event. A separate Data Breach Cap at twice that figure applies to claims from breach of the data protection or confidentiality obligations that causes a personal data breach of customer data.

Section 12 warrants for paid use that the Service will perform materially in accordance with the documentation and be provided with reasonable skill and care, and places free trials on an as is basis. No insurance position is published on the home page, terms of service, privacy policy or Book a Demo page. The indemnity covers intellectual property only, and section 12 expressly declines to warrant that output will be accurate or complete.

No practice system integration is named on AttiFin's site. AttiFin's home page states that it works alongside existing systems and invites users to connect their documents and existing tools. No document management system, word processor, email client, matter management platform, CLM or ebilling product is identified. The privacy policy names identity, single sign on and file import providers as categories of recipient and describes importing selected files from a connected account.

There is no integrations page, no developer documentation and no help center; the site consists of the home page, a Book a Demo page, the terms of service, the privacy policy with its two annexes, and a cookie policy.

The platform is hosted in the United Kingdom, and all customer data, including uploaded documents, queries and generated content, is stored there. Section 7 of the privacy policy publishes a table of every optional feature that moves anything abroad, naming what is processed and where. Live web search sends only the search query to the United States, with personal data minimized and redacted where possible and uploaded documents never transferred.

Single sign on, document import, transactional email and AI inference hosted in the EEA are each listed with their own scope. Named safeguards are UK adequacy regulations including the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, after a transfer risk assessment. A customer requiring processing in the UK only can disable the optional features and have that confirmed in writing.

Content is processed within the customer's own tenant, with logical separation between customers. Section 7 still carries an instruction to the site owner to delete the box before publishing, with wording intended for when the optional features move to UK hosted providers.

No independent security attestation is published. There is no trust center or trust portal, no SOC 2 or ISO certification is claimed, no auditor is named and no report is offered under any access tier, and the site carries no security badges. Both section 10 of the terms and section 8 of the privacy policy state that further detail on security measures is available under a confidentiality agreement, so the underlying material sits behind an executed agreement rather than a self service request.

The measures themselves, encryption, logical separation, role based access, key rotation and monitoring, are AttiFin's own description rather than a third party's attestation.

Section 6 of the privacy policy names AI model providers as a category of recipient that processes document extracts and queries to generate answers, summaries and drafts. Section 7 states that inference happens in the UK except where a customer configures a model hosted in the EEA, with live web search sending queries to the United States. Change notification is committed in both documents: the terms and the privacy policy each promise advance notice of any intended addition or replacement of a subprocessor, with an opportunity to object.

No model is named and no provider is identified. Section 15 of the terms classes the identity of AttiFin's suppliers as its own confidential information, provided for the customer's evaluation and oversight only, while the home page describes the product as sovereign by design.

No pricing information is published at any level. There is no pricing page, no tier names, no feature split and no unit of charge; the only route to a number is the Book a Demo form. Section 7 of the terms says fees are set in an Order Form, payable in pounds sterling and exclusive of VAT. Section 6 says free trials may be offered with limited features, capacity or duration.

AttiFin's home page addresses UK lawyers and UK legal teams, promises everything your firm needs in one specialist platform, and says drafting is trained for your practice area without naming a single practice area. The only practice area on the site is in the unattributed testimonial, which cites a family law practice. There are no segment pages distinguishing firm size, in house teams, government or legal aid work, and no statement of where the product stops. The one boundary stated is jurisdictional: the product is built for UK law only.