Security
Where your data goes. And where it doesn't.
Plain answers for law firm partners.
01 · Where
Where is my data?
On Microsoft Azure, run by the same Microsoft that already holds your firm's email and documents. It stays in the region your firm chooses, and the AI runs there too. Each firm's data is kept apart from every other firm's, encrypted while it moves and while it is stored, and never used to train AI.
02 · What
What does Tokuma look at?
The work apps you use, to tell which matter you're on. Most of it comes straight from the apps themselves. Sometimes Tokuma also takes a picture of the app you're working in, never your whole screen, to fill in the detail. Tokuma reads it. No person ever sees it, and it is deleted once it is no longer needed. Personal browsing is ignored.
03 · Who
Who sees my work?
You see your whole day. Your firm sees how many hours you worked each day, and the entries you submit. Never your screen or your drafts.
04 · Control
Can anything be billed without me?
No. Nothing goes to your firm or onto a bill until you press Submit.
05 · AI training
Is my data used to train AI?
No, never. Your data is never shared with other firms.
06 · How long
How long do you keep my data?
For as long as your firm's policy says.
07 · Pause
Can I switch it off?
Yes. You can pause Tokuma, or switch it off, at any time.
08 · Your own servers
Can we run it ourselves?
Yes. If your firm's policies need it, Tokuma can run inside your own systems, including the AI that writes your descriptions, on a model your firm runs itself.
Who handles your data
Who, what and where.
If we add one, we tell your firm first.
| Company | What for | Where |
|---|---|---|
| Microsoft Azure | Runs Tokuma and stores your data. Also runs the AI that reads the app images and documents to write each description; it keeps nothing and trains on nothing. | The region your firm chooses |
| Microsoft 365 | Your calendar, email, Teams calls and chats, and documents, only if your firm connects Microsoft 365. Your IT connects it once, from your firm's own Microsoft account, and can switch it off at any time. | Your firm's own Microsoft account |
Your professional duties
What Hong Kong's regulators ask about AI. And how Tokuma meets each point.
Hong Kong has no rule written specifically for AI yet. The Law Society and the solicitors' indemnity scheme apply the duties lawyers already have, and the Judiciary has issued guidance for its own judges and staff.
-
The guidance
Understand an AI tool before you rely on it. You stay responsible for the work.
Tokuma
Tokuma only reads the sources it tells you about. Every time entry shows the work it came from.
-
The guidance
Keep client information out of open AI tools; it risks confidentiality and privilege.
Tokuma
Tokuma Time never shares your data. It runs on Microsoft Azure under Microsoft's enterprise data protection terms. Your data is encrypted while it moves and while it is stored, and kept apart from other firms' data. The AI also runs inside Microsoft Azure, and the AI provider never sees your data. Your data is never used to train AI.
-
The guidance
Check everything before it goes out, however it was generated.
Tokuma
Nothing reaches your firm or the client's bill until you have reviewed and submitted your timesheet.
-
The guidance
Have a firm AI policy, train and supervise staff, and audit your vendors.
Tokuma
Our policies follow SOC 2, ISO 27001 and ISO 42001 guidelines. Our team handles your data on a strict need-to-know basis.
Sources: Law Society of Hong Kong, The Impact of Artificial Intelligence on the Legal Profession (opens in a new tab) (Jan 2024); Hong Kong Professional Indemnity Scheme, RME Bulletin No. 15: Generative AI in Legal Practice (opens in a new tab) (Dec 2025); Hong Kong Judiciary, Guidelines on the Use of Generative AI for Judges and Judicial Officers and Support Staff (opens in a new tab) (2024). These bodies do not endorse suppliers, and we don't claim they endorse us.
Last checked October 2026
Your professional duties
What Singapore's regulators ask about AI. And how Tokuma meets each point.
Singapore's Ministry of Law, Law Society and courts have all published guidance on AI. The courts have ordered lawyers to pay costs personally for citing made-up cases produced with AI.
-
The guidance
You stay responsible for AI-assisted work, and you check it.
Tokuma
Nothing reaches your firm or the client's bill until you have reviewed and submitted your timesheet. Every time entry shows the work it came from.
-
The guidance
Use business-grade AI, read its terms, keep client material out of training.
Tokuma
Tokuma Time never shares your data. It runs on Microsoft Azure under Microsoft's enterprise data protection terms. Your data is encrypted while it moves and while it is stored, and kept apart from other firms' data. The AI also runs inside Microsoft Azure, and the AI provider never sees your data. Your data is never used to train AI.
-
The guidance
Check how a tool stores and moves client data before you adopt it.
Tokuma
Your data is stored on Microsoft Azure, in the region your firm chooses.
Sources: Ministry of Law, Guide for Using Generative AI in the Legal Sector (opens in a new tab) (6 Mar 2026); Law Society of Singapore, Advisory on the Use of Publicly Available AI Tools (opens in a new tab) (2 Apr 2026); Supreme Court of Singapore, Guide on the Use of Generative AI Tools by Court Users (opens in a new tab) (Registrar's Circular No. 1 of 2024); High Court, Tan Hai Peng Micheal v Tan Cheong Joo [2026] SGHC 49 (opens in a new tab). These bodies do not endorse suppliers, and we don't claim they endorse us.
Last checked October 2026
Your professional duties
What Japan's bar associations ask about AI. And how Tokuma meets each point.
Japan has no binding rule on lawyers' use of AI. The Tokyo Bar Association and the Japan Federation of Bar Associations have issued guidance for their members that applies the duties lawyers already have.
-
The guidance
Choose AI services that keep your inputs out of training and away from the provider.
Tokuma
Tokuma Time never shares your data. It runs on Microsoft Azure under Microsoft's enterprise data protection terms. Your data is encrypted while it moves and while it is stored, and kept apart from other firms' data. The AI also runs inside Microsoft Azure, and the AI provider never sees your data. Your data is never used to train AI.
-
The guidance
Check AI output against primary sources. The lawyer stays responsible.
Tokuma
Nothing reaches your firm or the client's bill until you have reviewed and submitted your timesheet. Every time entry shows the work it came from.
-
The guidance
Keep client information secure under the JFBA's security rules.
Tokuma
Our policies follow SOC 2, ISO 27001 and ISO 42001 guidelines. Our team handles your data on a strict need-to-know basis.
Sources: Tokyo Bar Association, Guidelines on the Appropriate Use of Generative AI Services in Legal Practice (Mar 2025); Japan Federation of Bar Associations, AI Strategy Working Group notes on the use of generative AI in legal practice (Sep 2025, updated Feb 2026). Both are published for bar members; the Tokyo Bar Association describes them publicly in LIBRA (July–August 2026, in Japanese) (opens in a new tab). These bodies do not endorse suppliers, and we don't claim they endorse us.
Last checked October 2026
Your professional duties
What New York's courts and bar ask about AI. And how Tokuma meets each point.
New York applies its existing professional rules to AI. A court rule in force since June 2026 makes lawyers responsible for checking AI-assisted court papers, and bar ethics opinions ask for client consent before confidential information goes into AI tools that share it.
-
The guidance
Understand what an AI tool can and can't do before you use it.
Tokuma
Tokuma only reads the sources it tells you about. Every time entry shows the work it came from.
-
The guidance
Get client consent before confidential information goes into AI tools that share it.
Tokuma
Tokuma Time never shares your data. It runs on Microsoft Azure under Microsoft's enterprise data protection terms. Your data is encrypted while it moves and while it is stored, and kept apart from other firms' data. The AI also runs inside Microsoft Azure, and the AI provider never sees your data. Your data is never used to train AI.
-
The guidance
Supervise the lawyers and staff who use AI, and check your vendors' terms.
Tokuma
Our policies follow SOC 2, ISO 27001 and ISO 42001 guidelines. Our team handles your data on a strict need-to-know basis.
Sources: New York State Unified Court System, Part 161, Use of Artificial Intelligence Technology (opens in a new tab) (in force 1 Jun 2026); New York City Bar Association, Formal Opinion 2024-5: Generative AI in the Practice of Law (opens in a new tab) (Aug 2024) and Formal Opinion 2025-6 (opens in a new tab) (Dec 2025); American Bar Association, Formal Opinion 512: Generative Artificial Intelligence Tools (opens in a new tab) (Jul 2024). These bodies do not endorse suppliers, and we don't claim they endorse us.
Last checked October 2026
Your professional duties
What lawyers' regulators ask about AI. And how Tokuma meets each point.
Law societies and regulators in Hong Kong, Singapore, Japan, the UK and the US give lawyers much the same advice on AI.
-
The guidance
Check an AI tool before you trust it.
Tokuma
Every entry shows the work it came from.
-
The guidance
Keep client material out of AI training.
Tokuma
Your data is never used to train AI.
-
The guidance
Know how long data is kept.
Tokuma
Kept for as long as your firm's policy says.
-
The guidance
A lawyer checks and signs off everything.
Tokuma
A lawyer checks and submits every entry.
Sources: Law Society of Hong Kong, AI position paper (opens in a new tab) (Jan 2024); Hong Kong Professional Indemnity Scheme, RME Bulletin No. 15 (opens in a new tab) (Dec 2025); Singapore Ministry of Law, Guide for Using Generative AI in the Legal Sector (opens in a new tab) (Mar 2026); Law Society of Singapore, Advisory on the Use of Publicly Available AI Tools (opens in a new tab) (2 Apr 2026); Japan Federation of Bar Associations, AI Strategy Working Group notes (Sep 2025, updated Feb 2026); Solicitors Regulation Authority, Misuse of AI warning notice (Aug 2026); Law Society of England and Wales, Generative AI: the essentials (Oct 2025); American Bar Association, Formal Opinion 512 (opens in a new tab) (Jul 2024). These bodies do not endorse suppliers, and we don't claim they endorse us.
Last checked October 2026
Standards
SOC 2, ISO 27001 and ISO 42001. Following all three.
SOC 2 and ISO 27001 are the main standards for keeping information safe. ISO 42001 is the standard for using AI responsibly. Our policies already follow all three, ahead of certification. We handle personal data under Hong Kong's PDPO, Singapore's PDPA, Japan's APPI and, where it applies, the GDPR.