Security & trust

Bar-defensible
by construction.

Compliance isn't a disclaimer at the bottom of the page. It's how the product is built — scope-safe AI, consent captured every turn, and a full audit log you can export any time.

Snapshot
What Fount promises, in one glance
AI scope
Never gives legal advice
Audit log
Every turn logged + exportable
Consent
TCPA + AI + engagement captured
Data
Never trains third-party models
01

Scope-safe AI

The intake assistant never gives legal advice, quotes fees, or predicts outcomes. Every AI output ships with confidence + reason codes so an attorney can trust or override it.

  • ✓System prompt hard-caps scope on every turn
  • ✓Confidence + reason codes on every output
  • ✓High-risk leads escalated before any client-facing action
  • ✓Every model call versioned + logged
02

Consent captured, always

TCPA-compliant SMS/email consent, AI intake acknowledgement, engagement disclosure, and privacy acknowledgement — captured on record before any outbound message or AI-assisted response.

  • ✓TCPA consent for SMS + email
  • ✓AI intake acknowledgement
  • ✓Engagement + no-attorney-client-relationship disclosure
  • ✓Privacy policy acknowledgement
03

Audit log, exportable

Every AI turn, decision, escalation, status change, consent event, and ROI export is timestamped and logged. Download the full audit trail as JSON any time — bar-defensible by construction.

  • ✓Every AI turn logged
  • ✓Every attorney review captured
  • ✓Every escalation reason recorded
  • ✓One-click export as JSON
04

Human review workflow

A queue for high-risk leads, low-confidence AI outputs, and anything an attorney should see before it goes further. Nothing client-facing happens on high-risk items without sign-off.

  • ✓Review queue with priority sort
  • ✓Attorney sign-off required for high-risk
  • ✓Feedback loop tunes scoring calibration
  • ✓SLA alerts on stale review items
05

Data handling

Firm and client data is scoped per workspace with row-level security. Never used to train third-party models. Delete-on-request within 30 days.

  • ✓Row-level security per firm
  • ✓No third-party model training on your data
  • ✓Encrypted at rest + in transit
  • ✓30-day delete-on-request SLA
06

Ship-visibly roadmap

44 W0–W2 features tracked publicly with posture, cost, blockers, decisions, and validation evidence. You see what's shipped, what's next, and why.

  • ✓Public roadmap with decisions
  • ✓Build/buy/partner posture per feature
  • ✓Blockers surfaced, not hidden
  • ✓Validation evidence on shipped items
Data handling reference

The stuff your ops team needs on paper.

Hosting
US-based cloud infrastructure with regional isolation.
Encryption
TLS 1.2+ in transit, AES-256 at rest.
Access
Row-level security per firm; role-based within firm.
Backups
Encrypted daily backups with 30-day retention.
Deletion
Delete-on-request within 30 days. Export available first as JSON + PDFs.
Sub-processors
List available on request. Change notification 30 days before addition.

Questions your compliance officer will ask?

We answer every one on a call — and put anything not covered here in writing. No security theater.