Privileged data is the most sensitive material a firm holds
On a multi-tenant platform, the boundary between your matter and everyone else's is drawn inside one shared application and enforced by the vendor's configuration. With Kavarn, your firm gets its own dedicate instance and private network, separated at the hypervisor, with fully dedicated bare metal available on request. This difference enables new high bars to be set for security and privacy.
Updated October 7, 2026
How is privileged data kept separate?
A dedicated instance, not a tenant boundary
Your firm runs on its own provisioned instance and IP address. Matter data is never commingled with another customer's, and it is never stored in the same database as another firm's unless you choose to share a zone with them. Who operates the instance is a fair question to ask first.
Invite-only access
Users join by invitation only. Access is granted per data zone by email invitation, with role-based permissions running from executive administrator down to client staff. Additional security and encryption schemes can be discussed on request.
A tamper-evident audit log
Each tracked action on an item is timestamped and hashed into an immutable audit log and backed up, so the record of what happened to a document is tamper-evident rather than a matter of trust. If custody is challenged, the log can be exported by database or by production. Where a firm runs more than one instance, the log can be cross-verified across them. On a single instance, verifying the log relies on Konvergence's records. The production checklist sets out what to verify before a volume leaves, and every term used here is defined in the glossary.
Backups, with a stated window
Backups run automatically, with a retention window of 24 hours by default on a single instance, configurable to 6 or 12. On decommission, all backups are destroyed within 72 hours, with forensic scrubbing available as a paid option. Where a firm runs more than one instance, patented replication keeps them current in real time. For document sets above 1 TB or 500,000 files, the documents themselves are typically copied within 24 hours of ingestion, while tags, folders, indexes and the audit log still replicate in real time.
Granular access control
Permissions are set per zone rather than for the whole instance, so a contract reviewer brought on for one matter or one database sees that and nothing else.
What the access log records
Each event carries the action that was taken, the document it was done to, the user who took it and the timestamp. The panel filters by event type, by user and by date range, so the question "who opened this, and when" is answered in the interface rather than by a support request. Each action is hashed into an immutable audit log and backed up, so the record of what happened to a document is tamper-evident rather than a matter of trust.
Questions your client will ask you
If your firm is subject to an outside-counsel guideline or a client security questionnaire, these are the items that usually come up first.
| Question | Where we stand |
|---|---|
| Who controls the data? | Your firm is the data controller. Konvergence acts as processor under the engagement agreement. |
| Is a data processing agreement available? | Yes, executed alongside the engagement agreement. |
| Is data commingled with other customers? | No. Each firm runs its own instance, separated at the hypervisor with its own IP address; fully dedicated bare metal is available on request. |
| Who at Konvergence can access matter data? | Konvergence senior support staff hold administrative access to every instance by default, for customer service. We will go through what that access covers on the call. Additional security and encryption schemes can be discussed and quoted on request. |
| What certifications apply? | Konvergence holds none. The data center providers we use typically hold ISO/IEC 27001 and ISO 50001, and certificates are available on request. |
| What happens to data at termination? | Export in agreed formats, followed by documented deletion. |
If an answer above does not satisfy your client's guideline, tell us on the call. We would rather lose the engagement than write a representation we cannot support.
Questions we are asked before onboarding
Is our matter data commingled with other customers?
No. Your firm runs on its own provisioned instance, on your own private network, and your matter data is never stored in the same database as another firm's unless you choose to share a zone with them. The separation is enforced at the hypervisor, between the hardware and the running instances, and fully dedicated bare metal is available where a firm requires it.
Who at Konvergence can access matter data?
Konvergence senior support staff hold administrative access to every instance by default, for customer service. All traffic on your network is encrypted. Additional security and encryption schemes can be discussed on request. Within your firm, access is granted per data zone by email invitation, with role-based access controls.
What happens to our data when the engagement ends?
You may export in the agreed formats, including load files and native originals with metadata intact, and we then delete the data and decommission the instance and its network under a documented process. There is no exit fee and no hostage period.
Go through it on a walkthrough
We will go through every answer above with you, live, on the platform.