Security
A firm build calls Azure OpenAI in the firm’s tenant.
That is one of four deployments. The others are on the machine, an Azure key on the machine, and an Anthropic key on the machine.
- 01
On the machine
Speech is recognized on the computer. A Mac uses Apple’s on-device speech. Windows uses the speech already installed on the PC. The audio is not saved, and it is not uploaded.
Until the lawyer allows a cloud send, the question stays on the machine. A screen capture, when they turn it on, stays in memory for that ask.
- 02
Azure OpenAI, from the machine
The app takes the firm’s Azure OpenAI endpoint and the deployment name. The key is saved in the Mac Keychain or in Windows Credential Manager. It is not written into the app, and the window never reads it back.
The call goes from the machine straight to that deployment, with stored completions turned off. A firm build removes this path, including a call made directly from the page.
- 03
The firm’s Azure
Lawyers sign in with Microsoft Entra, using the device code Microsoft shows. The desktop app is a public client, so there is no client secret on the machine. A firm that blocks device-code sign-in uses an approved browser sign-in before anyone is rolled out. The token stays in memory. Quitting the app ends the session.
The API runs on Azure Container Apps, inside a virtual network the firm controls. Lawyers reach it over the firm’s VPN or ExpressRoute. Off that network, the API does not answer.
The API calls Azure OpenAI with a managed identity. API keys on the model are disabled, and the model’s public network is disabled. The connection is a private endpoint. The deployment is regional Standard. The model version is pinned, and automatic upgrades are off. The API image is pinned to a digest, not a tag.
The request sets store to false, so that completion is not stored. Microsoft’s abuse monitoring for the account and the region is a separate review, and the firm does it before client work is sent. Operational logs are metadata, kept 30 days in Log Analytics. They do not contain the question, the answer, or the screen. There is no database, and the API does not keep the conversation.
- 04
Anthropic, from the machine
The key is saved the same way, in the Keychain or in Credential Manager. The destination is fixed to Anthropic’s API. A firm build removes this path.
If the lawyer asks Lyla to operate the tool, the action needs a one-time approval. That approval is used once, and then Lyla looks again. The ordinary path is a pointer. The lawyer makes the click.