Skip to main content
This page covers the developer API (api.vaquill.ai) and the MCP server, not the Vaquill AI chat product. They are separate systems with separate data handling. The API returns US primary law: statutes, regulations, court rules and related government sources. It keeps as little of your traffic as possible.
  • Not stored. Your query text, request bodies and parameters are never written to a database or log. They stay in memory for the length of the request.
  • Not used for training. We do not train models on your requests or build datasets from them. The Data Processing Agreement commits Vaquill AI and its sub-processors to the same.
  • One sub-processor sees query text. Voyage AI handles embeddings and re-ranking. No LLM provider receives your requests.

What’s stored

Error monitoring runs with personally identifiable information (PII) collection disabled.

Processors and regions

The full sub-processor register is available to customers and their counsel at contact@vaquill.ai. We give at least 30 days’ notice before adding a sub-processor.

Citation extraction

POST /us/statutes/extract-citations takes up to 200,000 characters of your text, finds the statute citations in it and looks each one up. The text is processed in memory, discarded after the response, and never sent to a third party. The API has no document upload or document storage.

Sensitive and regulated matters (HIPAA, client confidences)

We do not sign Business Associate Agreements today. The API does not need protected health information or client facts. A request is a legal research question, such as “Florida statute of limitations for medical malpractice”.
Keep the sensitive part of the request inside your environment:
1

Your user asks a question

The question may contain patient or client details. That stays inside your platform.
2

Your system decomposes it

Your application or agent works out the legal question and strips identifiers.
3

Only the legal question reaches Vaquill AI

You call the API or MCP server to search for the relevant section or resolve a citation.
4

We return the law

No client data reaches our systems.
If that does not work for you, a bulk license takes Vaquill AI out of the query path. We deliver the corpus under contract, and you run search in your own environment under your own BAAs and controls.

Security and contracts

  • Certifications. We do not hold a SOC 2 Type II, HITRUST or ISO 27001 report today. We complete security questionnaires and walk your engineers through the architecture.
  • Breach notification. We notify the account administrator within 72 hours of learning of a breach that affects your data. See section 2.9 of the DPA and section 7 of vaquill.ai/security.
  • DPA. Available at vaquill.ai/dpa.
  • Encryption. AES-256 at rest for the database, TLS in transit.

Multiple clients on one account

Several API keys per account, one key or organization per client, and building a product on the API are covered in Rights and licensing.

What we don’t do (yet)

There is no self-serve control to set a custom retention window or request early deletion of your account’s records. If you need that, or a signed data processing agreement, email support.

Authentication

How API keys work and how to rotate them.

Law Change Alerts

Webhook signing, delivery history, and what a subscription stores.

Bulk data and SQL

Run search in your own environment, outside the query path.

Rights and licensing

What you may build and redistribute with the data.
Last modified on November 11, 2026