Is CueCrux suitable for legal teams?

Law firms and in-house teams face a specific pair of anxieties about AI agents: confidentiality on the way in, and accountability on the way out. Where does privileged material go, and if a court, client or regulator later asks what the AI did to a piece of work, can you answer precisely? CueCrux addresses both with architecture rather than policy.

Confidentiality is structural. The Crux Daemon runs locally on hardware you control, with no account and no default cloud path, so matter context and agent memory never leave your environment unless you deliberately opt into hosted services. Retrieval, both lexical and graph-fused, runs on the same machine, and dense retrieval uses an embedder you host yourself. The question every engagement letter now prompts, whether client material is used to train someone's model, has a short answer: the material does not leave.

Accountability is receipted. Every state change an agent makes is signed and hash-chained, and resolves back to which agent acted, under which grants, in which session. When the question is whether AI touched a particular work product, and increasingly it is asked in disclosure, in client audits and in professional conduct contexts, the answer is a verifiable trail rather than a recollection. The trail verifies offline, so it can be examined by an opposing expert or an auditor without access to your systems.

Retention and erasure fit legal practice. Scoped forget with dry-run supports defensible deletion under GDPR Article 17: preview what goes, execute, keep the receipt. For output provenance, C2PA output attestation is available behind a default-off flag where teams choose to mark agent-produced material.

The boundary is worth stating plainly: CueCrux governs the agents; it does not give legal advice, and nothing it records substitutes for professional judgement.