Conflion features list for IT
Conflion is a conflicts-checking and new business intake system for law firms. This page lists what it does and how it is built, for the people who would install, secure and support it. Each integration and control says plainly whether it is built and tested, or still unverified against the real system.
Status: Conflion is a working prototype, not yet run at a firm. It has about 1,100 automated tests, all on fictional data. It has not had an independent penetration test and holds no certifications, including SOC 2.
Where AI is used, it suggests or helps draft, and a person reviews and decides. By default the AI model runs on the firm's own hardware.
Deployment options
All four options run from the same code.
| Option | What it is | Data store |
|---|---|---|
| Firm server | Node.js 22 server in a Docker image (distroless, no shell), run with docker compose behind the firm's own HTTPS proxy (Caddy, nginx or a cloud gateway). Binds to 127.0.0.1 by default. | PostgreSQL 16 |
| Desktop app | Windows, macOS and Linux app. It either connects to the firm server or runs everything on one computer. Supports silent install and an IT policy file that fixes settings for every user. | Firm server, or an embedded Postgres on that computer |
| Hosted | One separate install per firm, in a chosen data region, with start-up checks that refuse a mismatched region. | PostgreSQL per firm |
| Browser demo | A single web page with fictional data, for evaluation only. | The browser's local storage |
In production mode the server refuses to start with unsafe settings and says which setting to fix.
Sign-in, sessions and access
Single sign-on
- Microsoft Entra ID through OpenID Connect, with PKCE, state and nonce, and token signatures checked.
- Multi-factor and device rules are left to Entra Conditional Access.
- Each account is bound to its Entra identity at first sign-in. Automatic account creation is off by default.
Sessions
- Random session tokens; only their hashes are stored. Cookies are Secure, HttpOnly and SameSite.
- 12-hour absolute and 30-minute idle limits.
- Disabling an account or changing its role ends its sessions at once.
Roles
- Requester, secretary, lawyer, approver (practice leaders, finance, general counsel), conflicts analyst and administrator, each with its own view.
- Every change is checked on the server against the person's role and what they may see. The browser's view is never trusted.
Web protections
- Strict Content Security Policy, CSRF defences, and rate limits per user and per address.
- The page makes no third-party requests in server mode; fonts are bundled.
- CSV exports are protected against spreadsheet formula injection.
Ethical walls and confidentiality
Enforced in what the server sends
- A screened person's browser never receives the walled matter, its files, notes, searches or audit lines. This server-side filter is the security boundary, not the screen.
- Automated tests scan everything a screened user receives for walled names and numbers.
- Blocked attempts are logged, and there is a "who saw what" access log.
Confidential clients, matters and searches
- Normal, confidential and highly confidential levels, with named access lists.
- Others whose search matches a hidden record are told only that there is a confidential match and to contact the conflicts team.
- Confidential searches can be seen only by the searcher and designated conflicts staff.
Wall workflow
- Exclusionary and team-only walls over single matters or whole clients.
- Acknowledgments and periodic re-acknowledgment, notices and fee exclusion.
- Deny-list exports for the document system and time entry.
Waivers and approvers
- Waiver drafts and summaries warn when they name someone the recipient is not cleared to hear about.
- An approver with a disclosed interest in a party is routed around to an alternate, and both are told why.
Data protection
- All firm data stays on infrastructure the firm chooses. Nothing is sent to the vendor.
- Attachments are encrypted by the app with AES-256-GCM before they are stored on disk or in S3-compatible storage. Each file's checksum is verified on every download.
- Uploads are checked by their content, not their name. Programs, scripts, archives, macro-enabled and password-protected Office files are refused. ClamAV virus scanning is optional.
- The database relies on disk or managed-database encryption. Field-level encryption was left out because it would break search.
- The backup script refuses to write an unencrypted dump. Restore steps are documented and were drilled.
- In server mode the browser keeps no firm data in local storage.
- Support without firm data: an administrator can save a support bundle in which names are replaced by placeholders. A leak check against every value in the database blocks saving if any firm data slipped through.
Audit trail
- Every change is an entry in an append-only log. Database triggers refuse edits and deletions.
- Each entry's hash covers the one before it, keyed with a secret held apart from the database, so the chain cannot be rebuilt by someone who only has the database.
- The server checks the whole chain at start and every 15 minutes, and stops writing if it fails. A daily anchor kept outside the database shows if the newest entries are deleted.
- Searchable by text, person, action and date. Every search run has its own number with who ran it, when and what it covered.
AI: on the firm's own hardware by default
What it helps with
- Suggesting which hits are likely the same entity, with a one-line reason. The analyst decides.
- Suggesting parties from a pasted email. The requester confirms each one.
- Helping draft memos, waiver first drafts and file summaries for a person to edit.
- Suggesting column matches when importing data. An administrator confirms them.
How it is contained
- The model runs locally through Ollama or any compatible local server. A model outside the private network is refused unless an administrator allows it.
- The model has no tools and no network access. Outputs must match a fixed format, and names it returns must appear in the source text.
- Each use is logged with the model name. Prompts and answers are not logged.
External AI is off by default
- Turning it on needs IT to configure it on the server and an administrator to accept a data-handling notice. Both steps are audited.
- It never receives walled, restricted or confidential records, health information, or clients whose guidelines bar AI.
Limits
- No accuracy study has been run against a real firm's decisions.
- An optional hit order learned from the firm's own past decisions is off by default and never hides or decides a hit.
Integrations and their status
Built and tested means automated tests run it. Unverified means it is written, but only tested against stand-ins, not the real system. Not built means what it says.
| System | What Conflion does | Status |
|---|---|---|
| Aderant (report files) | Reads Entity Manager entities, Expert clients and matters, and billing status from CSV or Excel exports, through a shared folder or upload, and writes import files back for opened matters. Columns are guessed and confirmed by a person. | Built and tested with made-up reports. Billing and party column names still need checking against a real export. |
| Aderant (live API) | Nightly pull of clients, matters and parties; push of opened matters with any billing hold noted. | Unverified: endpoints are assumptions. Sends nothing until switched on. |
| iManage | Files documents, creates each new matter's folders from its records area, and applies walls to workspaces. | Unverified: endpoints assumed, tested against a stand-in. Off until an administrator turns it on. |
| SharePoint and Microsoft 365 | Files documents, creates matter folders, and applies walls through site permissions and group membership. | Unverified: written to documented Microsoft Graph endpoints, not run against a tenant. |
| Outlook add-in | Starts an intake from an email. | Unverified: not run in a real Microsoft 365 tenant. |
| Email (SMTP) | Task, approval, reminder and waiver emails. Requests with health information are named only by number. | Unverified against a real mail server. |
| Company data (GLEIF, SEC EDGAR, OpenCorporates) | Links a party to its public-register record and adds parents, subsidiaries and former names a person picks. Re-checked nightly; changes are listed for a person to accept. | Unverified: tested against recorded answers, not the live services. |
| D&B and S&P Capital IQ | Imports the firm's own exports with column mapping and preview. | Built and tested with sample exports. Live API connections are not built. |
| OFAC sanctions list | Screens parties against the official SDN list file. | Built and tested |
| Data migration | Import wizard with presets for Aderant Expert, Clio and a generic layout. A dry run shows new parties, matches and possible duplicates before anything is written. | Built and tested on sample files. |
| E-signature services | None. Conflion never signs for anyone. Letters and waivers count only when signed copies are uploaded with each signer named. | By design |
Scale
Measured on synthetic firms with invented names, on one server:
- Stores and searches 1,000,000 parties. Name search took 17 ms typically and 167 ms at the 95th percentile.
- After someone else's change, a browser fetches only what changed, about 1 KB, instead of the whole data set. Each person's copy is still filtered so walls hold.
- Saving an intake or opening a matter took tens of milliseconds at 250,000 parties.
- Runs as one server process today. Running several copies for high availability would need a shared rate limiter and event bus.
Operations and support
- An operations runbook covers daily, weekly and quarterly jobs, backups and restores, upgrades and rollback, monitoring, and incident response. The backup, restore, upgrade and rollback steps were drilled with docker compose and Postgres 16.
- A separate test environment lets the conflicts team try rule, form and template changes on a test firm. Only setup moves to live, through a reviewed, audited step.
- Onboarding includes role walkthroughs, a help drawer, a first-week checklist and a practice firm with fictional data.
- Continuous integration runs type checks, tests, the build and an image scan.
What it does for the firm
Conflicts search
- Fuzzy, phonetic, nickname, alias and former-name matching, with rare words weighted more.
- Expansion through corporate families and personal links.
- Single, batch and Boolean search; numbered search runs; earlier searches shown for each party.
- Pending intakes, prospective clients and declined matters are searchable.
Intake
- Quick check that converts into a new business form.
- Guided intake, optional tabbed forms, a public intake form, and a pro bono form with its own numbering.
- Practice area and records area on every new matter.
- A no-code form builder with conditions and answer-based routing.
Review and approvals
- Hits grouped by party, risk-ranked with reasons, one-click and bulk decisions.
- Approval routes from firm rules, alternates, deadlines and overdue flags.
- Finance checks for credit, retainer and rate discounts.
Waivers and letters
- Waiver drafts from templates, reviewed and approved by a lawyer, sent with private response links and reminders.
- Engagement letters from editable templates, exported as Word.
- Outside counsel guideline records with flags the rest of the system follows.
Opening, changes and closing
- Client.matter numbering, special numbers with a reason, and a billing hold until signed papers are in.
- Change forms for lawyers, parties, billing, closing and reopening.
- Closing checks for the final bill and trust balance, with retention dates.
Laterals and compliance
- Lateral hire questionnaire, batch search, screening checks and walls before the start date.
- Tracking for business-associate agreements, joint-representation consents and founder acknowledgments.
- Reports with CSV export and a report builder.
Not yet verified or not built
- An independent penetration test. Only a self-run test has been done, and its one finding was fixed.
- Sign-in through a real Entra tenant behind a real TLS proxy.
- Live Aderant, iManage, SharePoint, Microsoft 365, Outlook and mail server connections (see the table above).
- SOC 2: not certified, and no report exists. A readiness document maps controls to the criteria.
- Code-signing certificates for the Windows and Mac apps.
- Key rotation for file encryption, and more than one server process per firm.
- Politically exposed person and adverse-media screening.