A law firm that keeps its records on AttorneyOS is the responsible party for the personal information in them, and AttorneyOS is its operator under section 20 of the Protection of Personal Information Act 4 of 2013. Section 21 requires a written contract between the two. This page is that contract for every firm on AttorneyOS; it forms part of the terms of service and applies from the day a workspace is opened.
AttorneyOS processes personal information only to provide the service the firm has chosen, on the firm's instructions, and never for its own purposes. The firm gives those instructions through the product: what it enters, what it connects, what it shares with a client, and what it exports or deletes.
Every person at AttorneyOS who can reach a firm's records is bound to treat them as confidential (section 21(2)). Support access to a workspace is granted for a stated period, is read-only, and is written to the firm's own audit log.
AttorneyOS secures the information as section 19 requires: encryption in transit and of identity, bank and secret fields at rest; one tenancy per firm; two-factor sign-in; nightly backups with a weekly restore test; and the measures set out on the security page.
AttorneyOS uses the service providers listed in the privacy policy to run the service (hosting, email delivery, payment, encrypted offsite copies), each bound to the same confidentiality and security, and each named with the country it operates from. A new sub-operator is added to that list before it touches any information.
The privacy policy says where the servers and the backup copies are. A firm that may not keep personal information outside South Africa decides for itself whether that suits it before it uses the service.
If AttorneyOS has reasonable grounds to believe that a firm's personal information has been accessed or acquired by an unauthorised person, it notifies the firm's owner by email within 72 hours of becoming aware (section 22(2) read with section 21(2)(b)), with what is known about what was affected, what has been done, and what the firm may need to do. The firm, as the responsible party, decides on notice to the Regulator and to the data subjects, and AttorneyOS gives it what it needs for that.
A request from a data subject to a firm (access, correction, deletion, objection) is answered by the firm; the product gives it the records to do so. A request that reaches AttorneyOS directly is passed to the firm the same day.
A firm can take everything of its own at any time from Settings, Export. When a workspace ends, its information is kept for the period the privacy policy states and then removed, including from backups as those age out of retention.
AttorneyOS's Information Officer is Shephard Dube, reachable at support@attorneyos.co.za. A firm's own Information Officer, or the Information Regulator, writes there.
Last reviewed 13 October 2026.