Data Security & AI

TRYX uses AI for one job: turning rough notes and voice dictation into clean, professional billing entries and suggesting the right UTBMS code. None of that data trains a model — ours or anyone else's.

• On-device first.On iPhones with Apple Intelligence, note formalization runs entirely on your device using Apple's on-device Foundation Models. The note never leaves the phone.
• API-only processing for everything else. When on-device AI isn't available, TRYX sends only the note text to OpenAI through its business API. Under OpenAI's API policy, data submitted via the API is not used to train OpenAI's models. That is contractually different from consumer ChatGPT.
• No prompt warehousing. TRYX does not store AI prompts or responses anywhere except the time entry you choose to save. We keep no separate corpus of your notes, and we never will.
• Minimal context.AI requests contain the note text and the task-code list — not your client list, your rates, or your firm's history.

Every table in TRYX is protected by Postgres Row Level Security. Access policies are enforced inside the database itself — not just in application code — so a user can only ever read or write rows belonging to their own firm. Notes on draft entries are private to the lawyer who wrote them until they are submitted for review.

• All traffic is encrypted in transit with TLS.
• All data is encrypted at rest (AES-256) in our database and storage provider, Supabase.
• Expense receipts live in a private storage bucket. They are served only through short-lived, firm-scoped signed URLs — there are no public links.
• Payments are processed by Stripe. Card numbers never touch TRYX servers.

• Firm admins can hide client names app-wide (show matter IDs only) or require Face ID to reveal them — including on widgets and the watch app.
• The iOS app supports biometric app lock (Face ID / Touch ID).
• Sign-in, sign-up, and password-reset endpoints are rate-limited.

Export your entries at any time as CSV or LEDES — the same formats your billing systems already speak. If you delete your account, your firm's authentication records and data are deleted with it. We don't hold your hours hostage.

Security questions, disclosure reports, or due-diligence requests: support@tryxapp.com. We answer these personally.