Subprocessor notice

Last updated: 24 October 2026.

This page lists every third party that processes data when you use Marshall, and exactly what each one receives. It is written for practitioners handling confidential and privileged material, so it states what actually happens rather than what sounds reassuring.

The model provider

Marshall's answers are generated by a large language model; this is the most significant transmission the platform makes.

What is sent:

• Your research question as you typed it, and the recent turns of the conversation it belongs to, including the answers previously generated.
• Matter context assembled to answer the question: the matter description, the client name and client reference, the parties and opposing parties, the action or file number, and key dates recorded on the matter.
• Document filenames, and text from documents you attach to a matter. Depending on deployment configuration this is either the parts of a document selected as relevant to a question, or the full text of a document read once at upload so later questions are faster. A deployment running the minimum-egress policy (MINIMUM_EGRESS) sends only question-scoped excerpts and never reads a document in full at upload.
• Excerpts of authorities and other sources the platform retrieves to ground an answer.
• The answer the platform has generated, where it is sent back for a further step such as summarising a conversation or drafting a title.

In short: assume that anything you put into a question, a matter or an uploaded document reaches the model provider. If material must not leave Hong Kong, do not put it into the platform.

Email delivery — SMTP2GO

Sign-in and notification emails are delivered through SMTP2GO, a transactional email service. It receives email addresses and the text of those notification emails. No client documents, research content, or matter material is ever sent by email through it.

Card payments — Stripe

Stripe Payments (card payments; not yet enabled — no card data reaches Marshall's servers; Stripe receives name, email and payment details only when a chambers chooses to pay by card through Stripe Checkout).

What search services and legal databases receive

Everything that leaves the platform towards a search service or a legal database is first reduced to derived search terms. The platform extracts, from your question and the recent conversation, the things a legal database can actually match on:

• citations and references — neutral citations, reported citations, chapter numbers, section, article, rule and schedule references, and clause or paragraph numbers;
• the names of cited authorities in their X v Y form, and the titles of statutes and instruments;
• legal terms of art and ordinary subject-matter nouns;
• dates and years;
• for Mainland material, the equivalent Chinese search terms.

The sentence structure of your question, the instruction words in it, and the prompt scaffolding around it are dropped. Capitalised names are dropped unless they are part of a citation, a case name or a statute title, or belong to a fixed list of jurisdictions, courts and public institutions — so a client's name, a corporate party's name and an honorific-led personal name do not survive the reduction. The result is capped at fifty terms and four hundred characters and is re-ordered, so it is never the sentence you typed.

This is a real reduction, not an anonymisation guarantee. Derived terms still reveal the legal subject matter of your question, and a fact pattern's ordinary nouns survive as terms. A search service can infer what area of law is being researched. It cannot see your identity, your client, or any document content.

Web search — Brave Search

When a question calls for a live search, the derived terms are sent to the Brave Search API together with a list of the legal domains the search is restricted to.

Provider-side web search — DeepSeek

The platform can be configured to run its official-source search through DeepSeek's API instead of Brave. This path is dormant unless the operator configures it with a DeepSeek key and endpoint; where it is configured, DeepSeek receives the same derived search terms and the list of permitted domains. Check with your administrator whether your deployment has enabled it.

Official legal databases

The platform retrieves authorities directly from official and institutional legal databases. Each receives the derived search terms as part of the request address — the ordinary way any search of these services works — and nothing else. Which of them is contacted depends on the jurisdiction of the question:

• HKLII — Hong Kong case law and legislation.
• BAILII — British and Irish case law.
• Find Case Law (The National Archives) — judgments of the courts of England and Wales.
• The Singapore Courts’ eLitigation judgments portal (www.elitigation.sg) — the Supreme Court of Singapore’s own free publication of its judgments. It receives the derived search terms in the request address and nothing else. LawNet and the Singapore Law Reports are subscription services and are never contacted; the platform only surfaces their citations as references for you to open yourself.
• AustLII — Australian material. The platform does not fetch or search AustLII content; its links are only surfaced as references for you to open yourself.
• GovHK search (search.gov.hk) and the GovHK estate, including Hong Kong e-Legislation, the Department of Justice, the Gazette and the Judiciary. The GovHK search service is opt-in and is only contacted where the operator has enabled it.
• The National People's Congress national database of laws and regulations, and the China Unicom object store (flkoss.obs-bj2.cucloud.cn) from which that database serves the PDFs of its instruments.
• The Supreme People's Court of the People's Republic of China.
• Kenya Law and AfricanLII.
• Jersey Law.
• Cornell Legal Information Institute.
• The Library of Congress.
• NYU Law Global (GlobaLex).
• The Directory of Open Access Books, and Routledge — commentary and secondary material only, never treated as primary law.

Microsoft — the Word add-in

If you use the Marshall task pane inside Microsoft Word, the add-in loads Microsoft's Office JavaScript library from appsforoffice.microsoft.com, and in Word on the web the pane runs inside a Microsoft-hosted frame (office.com, officeapps.live.com, office365.com, microsoft365.com and cloud.microsoft). Microsoft therefore hosts the surface in which the pane runs and sees the requests for that library. The add-in talks to Marshall on the same origin as the platform; your Marshall content is not sent to Microsoft by the add-in, but the document you are working in is of course already in Microsoft Word.

Hosting — OVH, Singapore

The platform and all stored data — accounts, matters, documents, research history, and the Legal Library — are hosted on infrastructure provided by OVH (OVH SAS, a French cloud provider) on a server located in OVH's Singapore region. Backups are stored offsite, encrypted with restic, on a separate server under the operator's control; see the data retention schedule for how long they persist.

Verified 4 September 2026 against the production host. An earlier version of this page said France; that was wrong. If your obligations turn on where data physically rests, Singapore is the answer.

Platform-operator access

The platform operator's support staff cannot browse your matters, documents, or research history in the ordinary course of support. Two things you submit are, by design, visible to them: screenshots you attach to a feature request, and judgments or other sources you submit to the shared Legal Library. Administrative access to production data is limited to named operators and every access is recorded in an audit log.

Related

• Data retention schedule — how long each kind of data is kept, and what deletion actually removes.
• Personal Information Collection Statement — the platform's PDPO notice.