Security and Trust

Fern™ and its variants give each organization a private workspace for its documents, research and analysis. Your team signs in, uploads files or connects approved folders, and works within the access permissions set for your organization.

Private environments

Each organization has a separate virtual private cloud environment on Amazon Web Services, with its own database, document storage, encryption key and sign-in service. Application services run in private networks. Databases and document storage are not publicly accessible, and one organization cannot access another’s workspace.

Data is encrypted at rest and in transit, including connections between services within the environment. Encryption keys are managed through AWS Key Management Service and rotated. The standard hosted environment stores customer data and backups in the United States. Any different hosting, residency or key-management arrangement must be specified in your customer agreement.

Accounts and access

Access is through individual accounts provisioned for your organization. Fern supports multi-factor authentication and organizational single sign-on. Sessions expire after inactivity or a maximum session length, and repeated failed sign-in attempts trigger account protection.

Roles determine what a person can do. Cases and their documents are visible to their owners and the people they are shared with, subject to your organization’s access settings. These permissions apply to document search and processing as well as the workspace interface. Administrative access does not, by itself, grant access to every case.

Your organization manages who may use its workspace and is responsible for keeping its membership and sharing permissions current. Account removal ends that person’s active sessions.

Documents and connected folders

Authorized users can upload documents directly into Fern and connect supported folders under their organization’s agreement. You do not need a separate order for each upload or analysis covered by that agreement.

Uploaded files are stored, read and indexed in your organization’s environment so they can be searched and used in your work. Folder connections read the locations your organization authorizes. Their credentials are stored in that environment’s secrets service, and the connections do not edit the source files.

You retain your rights in the material you provide. Your organization determines which information it is authorized to use and who may receive it or the work produced from it. Personal health information and other specially regulated data require the applicable contractual and technical arrangements before upload.

AI processing and training

We do not use customer documents, prompts or work product to train or fine-tune AI models. We do not sell that content, publish it or use it for another customer’s work.

Fern uses AI services to perform the work you request. Relevant content may be sent to a model provider permitted by your workspace’s processing policy. This is processing to produce a response; it does not give the provider permission to train on your content. Provider access and retention requirements are part of the processing arrangements for your organization.

Document reading, indexing and search take place within your environment. When private document passages are used by a model, they are handled in a restricted processing step whose tools are limited to the case’s documents. The separate agents researching the public web do not receive those private passages.

Your security team can review the model providers, data flows and retention terms that apply to your deployment. A requirement for no external model processing, a particular region or zero provider retention must be confirmed for that deployment; encryption alone does not establish those conditions.

Operations and recovery

Fern records sign-ins, access changes, document operations and administrative actions. Operational monitoring collects service health, errors and usage without exporting the contents of customer documents into general telemetry. Operator-access events are also copied to a separate protected audit store.

Varosync personnel may access customer content when needed for authorized support or troubleshooting under the customer agreement. That access is restricted to the support purpose and recorded. Varosync operates the hosted environment and has administrative responsibilities for it.

Automated backups cover the database and document storage. The standard backup period is 35 days, and restore tests are scheduled weekly. Monitoring alerts the operator to service failures, failed backups or restore tests, and relevant threat findings. Software releases are versioned and checked before rollout.

Customer-content retention and deletion follow your agreement and workspace policy. Deletion from active systems does not immediately remove every backup copy; backups remain protected until their retention period ends. Legal holds and required records may be retained as the agreement and law allow.

Shared materials

Materials Varosync sends through a separate share link are governed by the Shared Materials Terms. Links can expire or be withdrawn, and an access code is required where one has been set. Anyone with a working link and its required code may be able to open it, so recipients must keep both confidential.

Shared presentations and demonstrations may record viewing activity and session replays, as disclosed on the access screen and in the Privacy Notice. We do not use advertising pixels or session-replay tools inside the signed-in customer workspace.

Compliance and security review

Our security program covers access control, data handling, vendor management, incident response, change management and business continuity. The technical controls described here support institutional security review and our SOC 2 readiness work.

For SOC 2 diligence, we provide the current examination status, scope and available supporting evidence on request. Any audit report applies only to the systems, controls and period it identifies. A cloud provider’s certification or report does not certify Fern or Varosync.

We work with your security and procurement teams on questionnaires, data-processing terms and the requirements of your intended use. Contact [email protected] for the current architecture, applicable providers, control evidence and any deployment-specific requirements. Confidential documents are shared under appropriate confidentiality terms.

Security incidents and contact

Report a suspected security issue to [email protected]. Describe the affected service and what you observed, without including passwords or customer files. We will arrange a protected way to receive further details.

We investigate and respond to security incidents under our incident-response procedures. If an incident affects customer data, we notify the designated customer contact as required by the agreement and applicable law.