Privacy

Matter is software your firm installs and runs. Documents, matter files, notes, the semantic search index, deadline records, time entries and edit history are written to storage your firm controls. None of it is transmitted to us.

Vaults are encrypted at rest. Where a matter is encrypted, the key belongs to your firm: either bound to a Windows account or derived from a firm passphrase we never see. If you enrol a vault in recovery escrow, we hold one half of a recovery key and never the other. Recovery needs an officer of your firm and us acting together, and neither of us can act alone.

Diagnostics and performance logs are written on the machine and are not sent anywhere. Activity capture, which records how someone works and never what they write, is off unless your firm’s policy permits it and the individual turns it on for themselves.

This is the part a reader is most likely to assume does not happen, so it is stated plainly: licensing is not local. Matter contacts our licence service, and sends exactly this:

Activating a computer

• the activation code
• a device identifier, derived from the computer and not from any person
• the operating-system user name of the account that runs the activation
• the computer’s name, which the licence service keeps as the computer’s label
• the application version
• a public key that pins the device

Renewing its licence

• a device identifier, derived from the computer and not from any person

Checking for an update

• the platform
• the installed version
• a device identifier, derived from the computer and not from any person
• your firm’s licence identifier
• the operating-system user name of the account running Matter, or on a computer you signed in, your Mahe account’s identifier instead
• a signature, by the device or on a computer you signed in by that sign-in’s key, with a one-time number and the time
• the device’s public key, or on a computer you signed in, that sign-in’s public key

Downloading an update from inside Matter, in releases that install updates themselves

• the platform
• the installed version
• a device identifier, derived from the computer and not from any person
• your firm’s licence identifier
• the operating-system user name of the account running Matter, or on a computer you signed in, your Mahe account’s identifier instead
• a signature, by the device or on a computer you signed in by that sign-in’s key, with a one-time number and the time
• the device’s public key, or on a computer you signed in, that sign-in’s public key

Fetching the settings a connector signs in with

• a device identifier, derived from the computer and not from any person
• your firm’s licence identifier
• the operating-system user name of the account running Matter, or on a computer you signed in, your Mahe account’s identifier instead
• a signature, by the device or on a computer you signed in by that sign-in’s key, with a one-time number and the time
• the device’s public key, or on a computer you signed in, that sign-in’s public key

Asking for approval to unlock, where your firm requires it

• your firm’s licence identifier
• the operating-system user name of the account running Matter, or on a computer you signed in, your Mahe account’s identifier instead; Matter 0.1.2 sends the user name in both cases
• a device identifier, derived from the computer and not from any person
• the device’s public key, or on a computer you signed in, that sign-in’s public key; Matter 0.1.2 sends the device’s in both cases
• a signature, by the device or on a computer you signed in by that sign-in’s key (by the device in Matter 0.1.2), with a one-time number and the time

Starting a sign-in, in releases that sign in with your Mahe account

• a device identifier, derived from the computer and not from any person
• an identifier of the Windows account, derived from the computer and the account and not from any name
• a public key held for that Windows account on that computer
• the computer’s name, shown to you when you confirm a sign-in, and to you and your firm’s administrators in the portal
• the Windows account’s name, shown the same way
• the application version
• a signature by that key, with a one-time number and the time

Waiting for you to confirm that sign-in

• which sign-in is waiting
• a device identifier, derived from the computer and not from any person
• an identifier of the Windows account, derived from the computer and the account and not from any name
• a signature by that key, with a one-time number and the time

Activating with a code issued to you, instead of signing in

• the activation code
• a device identifier, derived from the computer and not from any person
• an identifier of the Windows account, derived from the computer and the account and not from any name
• a public key held for that Windows account on that computer
• the computer’s name, shown to you when you confirm a sign-in, and to you and your firm’s administrators in the portal
• the Windows account’s name, shown the same way
• the application version
• a signature by that key, with a one-time number and the time

Renewing a signed-in account’s licence

• which sign-in this account holds
• a device identifier, derived from the computer and not from any person
• an identifier of the Windows account, derived from the computer and the account and not from any name
• the application version
• a signature by that key, with a one-time number and the time

Signing out, or closing Matter when you did not ask it to remember you

• which sign-in this account holds
• a device identifier, derived from the computer and not from any person
• an identifier of the Windows account, derived from the computer and the account and not from any name
• whether you signed out or closed Matter
• a signature by that key, with a one-time number and the time

A computer name and a Windows account name frequently identify a person. When you sign in to Matter, we show you both on mahe.one so you can tell whether the computer asking is your own. The licence service keeps them with the sign-in, including after it ends, so that you can see in the portal which computers you use Matter on, your firm’s administrators can see everyone’s, and either can free one. Matter removes invisible, private-use and unassigned characters from both names and keeps each to at most 64 characters, fewer for some scripts, before sending them, and the licence service refuses a name that still carries such a character, because one can make a name look like another.

A computer activated with a code issued to your firm, rather than signed in by a person, is kept by the licence service under the name and OS user name it sent when it was activated. The portal does not list those computers yet; to revoke one, write to hello@mahe.one.

We use the keys and identifiers to check that a signed request comes from a computer and Windows account that signed in or was activated. No document content, no file name, no matter name and no client name is part of any of this.

Accounts exist for the people a firm’s administrators invite, which includes everyone who signs in to Matter, and for our own staff. There is no public signup: an account is created only by invitation. We store your name, email address and role, a hash of your password, and, if you enable it, a two-factor secret. The password itself is never stored, and it never passes through Matter or the licence service: you type it here, on mahe.one. Sessions record a hash of the session token, the browser’s user-agent string and timestamps. A session lasts a week if you choose Keep me signed in when you sign in, and otherwise ends when you close the browser, or after twelve hours at most. Confirming a Matter sign-in asks for a sign-in here within the last 15 minutes.

If you link a Google or Microsoft account so you can sign in with it, we store which account it is (Google’s account id, or Microsoft’s directory id and object id), the email address the provider shared when you linked it, and when it was linked and last used. We ask the provider only who you are and your email address, never for your mail, files or calendar. An account you have not linked signs nobody in. Unlink it on the Account page and the record is deleted.

Actions taken in the console and the portal are written to an audit log that names the actor and what they did. That includes each Matter sign-in you confirm, with the computer name and Windows account name Matter reported, each one you refuse, with the code it showed, and each computer freed. It exists so that a firm can see who changed what about its own account, and so that we can explain a change when asked.

When someone at your firm reads the legal corpus in the portal, each list, search, lookup, opened document and page of citations is recorded against them in that log, with the time. The record identifies the documents by the corpus’s own keys, and says how many there were and which filters chose them. A lookup by a court’s ECLI that the corpus could not answer records that ECLI instead. It never holds a title, any of a document’s text, or the words anyone searched for. Our staff can see this record. Your firm cannot, and it does not appear on the portal’s Activity page. We keep it because the service that holds the corpus records only that Matter read a document, and cannot say who at which firm asked for it. To hold each person and each firm to the portal’s allowances, we also count how many requests they make in a minute and how many documents their requests could show in a day (a request counts the most it could show, whatever comes back). The counts say nothing about which documents, and are deleted within three days.

We keep a server-side record of requests to this site. It includes the full IP address, the time, the path, the HTTP method and status, the user-agent string, the referring host, and a reverse-DNS lookup of the address. An IP address is personal data and we are not going to describe it as anything else. We keep it to understand who is interested in the product, and to see abuse.

The landing page, and only the landing page, can load Google Analytics, and only if you allow it there. Until you do, it loads nothing and sets no cookie. If you allow it, Google’s script sets its own cookies (_ga, and _ga_ followed by an id) and sends Google a record of each visit: the page, the time, how you arrived, your browser and device, an approximate location Google works out from your IP address, and the identifier in those cookies. Google receives that record and processes it on its own systems, which may be outside the UK and the EEA.

It sends nothing from the sign-in page, the console, the firm portal, an invitation link, a guest channel, a data room, or this page, including when you reach one of them by a link from the landing page. That boundary is enforced in code, because those URLs contain things that should not be handed to an analytics vendor.

You can change your answer at any time, here or with Cookies at the foot of the landing page. Declining stops Google Analytics sending at once, on the page where you decline, and removes its cookies.

These are optional features a firm turns on. When it does, documents and messages reach our infrastructure as ciphertext. The key that opens them is placed in the fragment of the link your firm shares, the part after the #, which a browser does not transmit to a server. The recipient’s browser decrypts locally.

The practical consequence: somebody with complete access to our database, ourselves included, reads opaque bytes. We can see that a room exists, how large its documents are, when they were fetched and through which link, and we can delete them. We cannot read them. Document identifiers inside a room are chosen so that we cannot even tell whether two different rooms hold the same document.

If your firm connects a calendar, a mailbox or a contact directory, it does so with its own consent and, on the recommended path, its own registered application. The permissions requested are read-only: calendar events, mail messages, your profile, your contacts and relevant-people lists. There is no send, write or delete permission anywhere in the product, and a build check fails if one is ever added.

Those connections are made by the application on the firm’s machine, not by us. The access tokens are sealed to that Windows account on that machine, and are never sent to us or handed to the embedded browser. Mail, calendar entries and contacts fetched by a connector are stored in the firm’s own matter files.

Matter’s use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used, transferred or sold to create, train or improve any foundational or generalised machine-learning or artificial-intelligence model, whether ours or anyone else’s, in raw, aggregated, anonymised or derived form.

The models Matter ships run on your own machine, offline. Chat and search run inside the Matter process itself, on weights downloaded to that computer. Nothing is sent to a model provider, and there is no API call for a provider to log or learn from. This is the default, and a firm that changes nothing never sends a word to anyone.

A firm may instead configure a cloud model such as OpenAI, Anthropic or Google, or another of the providers Matter can speak to. If it does, it supplies its own credentials and contracts directly with that provider; Matter holds no account, plan or tier with any of them, and the traffic does not pass through us. Choosing such a provider is the firm’s decision about its own client confidentiality, and we recommend reading that provider’s terms before enabling it.

What may leave the machine at all is decided in Matter’s own compiled code, at the single point every outbound model request must pass through. The sensitivity of a matter is read from the matter’s own record, and the code the restriction applies to cannot supply or alter that value. An unrecognised value, or a request that names no matter, is treated as the most protected kind. A firm administrator can switch cloud models off entirely, for everyone, in a policy file that ordinary users cannot write.

We do not sell personal data and we do not use it to train models. Matter’s AI features run on the firm’s machine by default; where a firm configures a cloud model instead, it uses its own account with that provider and the traffic does not pass through us.

The first three are removed by a scheduled job that acts on a retention date stamped onto each record as it is written, so a record carries its own expiry, fixed on the day it was written.

If you are in the UK or the EEA you have the right to ask what we hold about you, to have it corrected or deleted, to object to how we use it, and to complain to your data protection authority. Where your firm is our customer, your firm is the controller of its own matter data and we act on its instructions; for the account and website data described in sections 3 and 4, we are the controller.

Ask us at hello@mahe.one. Because of how the product is built there is one limit worth knowing in advance: for encrypted vault contents, and for hosted rooms and channels, we can delete what we hold but we cannot produce it in readable form, because we cannot read it either.