Numo is case and document software for UK family law practice. It runs a matter from intake to final order, holds the facts, dates, money and documents in one place, reviews documents against the firm's own playbook, and records that a named qualified person approved anything that leaves the firm.

Does Numo cover Scotland and Northern Ireland?

Yes. It holds a separate knowledge pack for England and Wales, Scotland and Northern Ireland, resolves which one governs a matter from the connecting factors at intake, and blocks another jurisdiction's vocabulary from reaching an outgoing draft.

Is client data used to train an AI model?

No. Content is sent to the model provider's commercial interface for the length of a request and is not used to train their models under those terms. The provider is named on the sub-processors page.

Can the assistant send an email or file a document on its own?

No. It prepares. Service, filing and sending each need a named person's decision recorded against the exact version, and every action in a connected account is asked for separately in a card showing exactly what would happen.

How much does Numo cost?

It is priced per firm rather than per fee earner, starting at £59.99 a month plus VAT for a sole practitioner, with tiers for practices up to seven, up to fifteen, and firms of any size.

What happens to a document that contains instructions aimed at an AI?

It is quarantined before any model reads it and listed so a person knows it exists and reads it themselves. Text inside a document is treated as evidence about the matter, never as a command.

Trust

The questions your COLP asks on the first call

Family material is special category data under the UK GDPR, it frequently includes criminal offence data, and it almost always concerns children. Everything here is designed to be answered in writing, not reassured about verbally.

Where the data sits

Where the case file actually sits

Hosted in the United Kingdom and the European Union, with the parts that hold a key kept apart from the parts that draw a screen.

SupportedHosted, in one region: Managed Postgres in the European Union, with Article 28 processor terms, a sub-processor register and a breach notification timetable. Daily backups.
SupportedThe desktop application: macOS and Windows, in its own signed window, with deep links and notifications. It is the same product in a frame of its own rather than a second copy of the case file on a laptop.
SupportedNo key in the applications: Every secret lives in a server function's own store. The applications hold two public values and nothing else, and a test fails the build if a key ever appears in them.
SupportedAccess decided by the database: Row-level security on every table. Who may see a matter is settled by the database, not by which screen somebody opened, so a bug in a page cannot widen it.
SupportedImpact assessment: A completed DPIA template ships with the product, written for family matters rather than adapted from a generic one.
SupportedPortability: The firm can export its entire case file in an open format at any time, with no exit fee. That is in the contract, not just in a sales call.
Blocked by the productTraining on your matters: Client data is never used to train models. There is no tier where that changes.

Regulatory position

Why this is straightforward to buy

Numo Law performs no reserved legal activity, and it is built to stop a user using it in a way that would.

The Legal Services Act 2007 reserves six activities in England and Wales, and only an authorised person may carry them out. None of them is a thing software does. Numo Law prepares work product; a named authorised person reviews it, signs it and files it.

Scotland and Northern Ireland are stricter on document preparation by unqualified persons, which is the main reason the product is sold to regulated professionals and public bodies rather than to the public.

Blocked by the productExercise of a right of audience: Software does not appear before a court. It prepares the advocate’s papers.
Blocked by the productConduct of litigation: It never goes on the court record, never issues, and never files as the party’s representative. It builds the filing pack; the authorised person files it.
Blocked by the productReserved instrument activities: Property instruments arising from a financial remedy are gated to the named authorised person responsible for execution.
Blocked by the productAdministration of oaths: It prepares statement of truth and affidavit wording. A person authorised to do so administers the oath.
SupportedSupporting your compliance: The audit trail and approval ledger are designed as the evidence a firm shows its regulator or its insurer. The firm remains responsible; the product makes that responsibility discharge-able.

This page describes how the product is built. It is not legal advice, and it does not replace your own regulatory judgement about the tools your firm adopts.

Controls

What is in place, and what is scheduled

Stated plainly, including the things that are not done yet.

SupportedEncryption in transit: TLS on every connection: to the application, to the database, to the model provider, to the mail provider and to every connected account. Nothing this product does travels in the clear.
SupportedEncryption at rest: The database, the file storage and the backups are encrypted at rest by the platform. That is the floor, not the story: three things are encrypted again, by us, under keys the applications never hold.
SupportedThe vault: Per-object content keys, wrapped by a vault key derived from a passphrase with Argon2id, sealed with an authenticated cipher. Filenames live inside the encrypted payload rather than beside it, because a list of sealed filenames is itself disclosure. Nobody here can open one.
SupportedDrawn signatures: A signature is somebody’s hand. Each one is sealed with AES-256-GCM under a key held only in the signing function’s secrets, so a copy of the storage bucket yields ciphertext. The application asks that function for the picture when it builds the signed PDF, and the function checks first that the person asking may see that matter.
SupportedConnection tokens: The tokens for a connected Gmail or Drive account are wrapped before they are stored, with a key only the connector function holds. A database copy on its own opens nothing.
SupportedSigning links: Only the hash of a signing link is stored, so the table cannot be turned back into links. A document is read over the link rather than sent as an attachment, because a link can be withdrawn and an attachment sitting in somebody’s mailbox cannot.
SupportedNo secret in the applications: The applications hold two public values and nothing else. Every key lives in a server function’s own secret store, and a build that contains one fails its own test.
End-to-end encrypted email: Not offered, and we will not claim it. Mail leaves over TLS and arrives however the recipient’s server accepts it, which is why anything confidential goes as a link into the product rather than as an attachment.
SupportedAccess control: Least privilege by role and matter-scoped. Access to one matter never implies access to another, and safeguarding material can be restricted inside the firm.
SupportedAudit trail: Hash-chained and append-only, covering every action and approval.
SupportedProfessional user gate: Every account is held by a regulated professional or someone supervised by one, with regulator and roll number recorded and re-attested annually.

Matter data, files and the audit trail are held in Ireland. One transfer leaves the EEA, to the model provider, named on the sub-processors page.

Client matters used to train a model, on any tier.

Art. 28

Processor terms, sub-processor register and breach timetable.

100%

Actions written to a hash-chained, append-only audit trail.

Send us your due diligence questionnaire

We would rather answer it before a demonstration than after one.

Get in touch