An ethical wall nothing can step around.
Who may see something and who is screened off are decided separately, and the screen always wins. This page sets out how the wall, the roles, retention and the audit trail work, and where Datum stops.
The wall is applied last, to everyone.
An ethical wall keeps the people on one side of a matter from seeing the other. Most systems enforce it with a setting somebody has to remember. Datum enforces it inside every request, and attacks it on every build.
Every request says who is asking
There is no way to read data without an identity, no total that skips the check, and no export route around the side. The unsafe question cannot be asked at all.
The screen always wins
Who may see something and who is screened off are worked out separately, and the block is applied last. No account gets past it: administrator, service account, elevated access, or an AI agent.
Totals are attacked on every build
A screened matter must not be deducible from a count, a group total, a search filter or an export. Datum makes those attempts on itself before every release, the way a penetration test would.
Set-up refuses a firm with no walls
A system with no walls loaded lets everything through, and nothing on any screen would tell you. The handover check refuses to sign off a firm left in that state.
When something is not there, the product says why.
A field blank because you may not see it and a field blank because nobody filled it in look identical on screen. Only one of them is worth ringing the data team about.
Roles named the way your firm names them
A person sees "Data steward", never an internal code. An account panel tells them who they are signed in as, what their role can reach, and which fields are withheld.
It describes; it never decides
Nothing on that panel is consulted when a request is answered, so a mistake in the explanation can never become a hole in the enforcement.
Priya RamanData steward · Northgate Wells LLP
matter.billing_arrangementparty_person.date_of_birth
3 matters in this view. You are told they exist; you are not shown them.
A legal hold beats every schedule, and nothing is destroyed without a signature.
Retention is written as schedules your records manager can read, not as a script someone wrote once and left running.
Schedules, by jurisdiction and matter type
What is due for destruction arrives as a list to work through, not as a discovery. Every schedule is data your records manager can read back.
The legal hold register
A hold is an entry in a register that beats every schedule beneath it. Nothing under hold is destroyed, and the reason it survived is recorded.
Outside counsel guidelines
A client's guidelines are held against that client as data, so an obligation accepted in an engagement letter is enforced by the system, not remembered.
Erasure that works even though history is kept
A system that keeps every version of the truth is the system an erasure request is hardest in. Erasure is a built-in operation, not a delete command someone runs and hopes about.
What did we believe, when did we believe it, and who changed it?
Every change to every field, with the person and the reason attached, on the record itself.
Two clocks, not one version history
Datum tracks when something was true in the world and when the firm recorded believing it, separately. A correction backdated today does not rewrite what the firm knew when it opened the matter.
A change history on every record
"Who set this parent company, and on what basis?" is one click, not a request to the technology team.
Traceable back to the source row
Every stage records what it read and what it produced, field by field. A figure in a board report can be traced to the row it came from.
Datum is not a conflicts system and issues no clearance decisions.
It gives your conflicts system a clean register of parties to search: who they are, their groups, the other names they go by. Better input to the system you already run.
Nothing in Datum works out whether a matter can be taken, stores such a decision, or hands one back. No field could be mistaken for one. The line is drawn in the software as well as in the contract.
What Datum does provide
A clean register of parties your conflicts system can search, through the same controlled route as everything else, with the source of every value.
What it will never provide
A clear-or-not answer, a risk score that reads like one, or any field another system could mistake for one. If a screen looks like it decides whether a matter can be taken, that is a defect.
Ask us to try to break it.
Bring the way you would try to work out what is behind the wall: a count, a group total, an export. We will try it live on the demonstration firm, with two users who differ by exactly one thing.
Questions before booking? Use the contact form.