TokenGrill Security Whitepaper
How the Vault AI appliance is built, what runs on it, what never leaves it, and what is kept. Written for the security reviewer who has to sign off before a legal team can use an AI tool.
This page is the public summary. The full whitepaper, including network diagrams and control mappings, is shared with security teams under NDA.
Architecture in one paragraph
Vault AI is a 5" x 5" x 2" appliance that sits inside your firm. It runs a RAG-enabled, legal-customised local engine built on open-weight Llama 3 and Mistral models, indexes your documents on its own encrypted storage, and answers queries entirely on that hardware. There is no cloud endpoint, no vendor API key to distribute, and no outbound path for client content.
Data handling
- Documents you upload are indexed on the appliance's encrypted local storage and never copied to an external service.
- Prompts, documents and responses are processed by the local engine only — 0 bytes of client content leave the box.
- Working memory for a run is cleared when the run completes.
- What is persisted on the box is your matter index plus execution metadata: which local engine ran, token counts, latency and step timing — never a copy of the content in the log.
- The only outbound traffic the appliance ever makes is an optional, outbound-only pull of signed model and security updates.
Tenancy and access control
- Every matter, execution and audit record on the appliance is scoped to a matter workspace and enforced at the database level, not in application code.
- Only enrolled firm devices can reach the box, over your LAN, firm VPN, or a direct peer-to-peer link. There is no public ingress.
- Audit logs are append-only at the database level — update and delete privileges are revoked, including for the application role.
No provider in the path
There is no model provider in the path. Inference runs on open-weight models that ship on the appliance, so there is no third party to hold your prompts, no retention agreement to negotiate, and no provider outage that can take your firm's AI offline.
What we do not claim
- We are not a law firm and nothing produced by the platform is legal advice.
- We do not claim any certification we have not completed — current status is on the SOC 2 page.
- We do not claim model outputs are correct; the citation-grounding pass flags unsupported claims rather than guaranteeing accuracy.
Need this in writing for your review?
We share the underlying documentation with security and risk teams under NDA, and will walk your counsel through anything on this page.
Request documentation