Business plan

Executive Summary

Courts now demand that lawyers certify how they used AI, and lawyers have no way to prove it.

According to The Legal Stack’s 2026 judicial response report, as of May 2026 there were 143 individual federal district judge standing orders on AI use, roughly 61 of them requiring affirmative disclosure plus certification, and a newer category, about 15 orders and growing, requiring “the name, version, and provider of any generative artificial intelligence tool used.” Sixteen states have adopted statewide rules. More than 85 judicial opinions have addressed AI errors in filings, against about a dozen in late 2023, and sanctions have run from $5,000 in Mata v. Avianca to $15,000 per attorney in the Sixth Circuit’s Whiting v. City of Athens. The appellate courts are now moving as well: the Ninth Circuit’s published Lnu v. Blanche order binds an entire firm for two years, and the Tenth Circuit has proposed revisions to its signing rule to address generative AI, effective January 1, 2027.

A lawyer signing such a certificate today is attesting to something they cannot demonstrate. They do not know with certainty which model version touched the draft, whether its citations were checked, or whether client details were redacted before any model saw them. Bailment is an attestation company. It records evidence of all three, using AI that runs on hardware the firm owns and a blockchain record no one can quietly rewrite, and it reveals none of the document. The lawyer still certifies personal review; Bailment gives that certification something to stand on.

The product is Bailee: a private AI workspace where a client and their lawyer work together, on hardware the firm owns. Every filing that comes out of it carries a verifiable certificate a court can check independently. That is the wedge. The longer bet is that the same privacy substrate supports things no one can build today, starting with conflicts checking across firms that reveals no client lists.

In use it is one motion of four steps, the same four parts the Technology Demo on the website runs end to end: the client and lawyer work and notarize, the lawyer certifies, the record is published in a batch, and a court verifies. Everything between those steps happens without anyone asking, and the document never leaves the firm.

The mechanism is two channels with opposite defaults. The Client Communication Protocol is where a client and their lawyer actually work: uploads, questions, drafts, advice, and AI the two of them use together. It is privileged, the firm edits it freely, and it leaves no per-document trace anywhere. Document Record is the deliberate act of notarizing one document, taken when a lawyer decides a specific item should be provable to someone outside the privilege. Identifiers are stripped on the firm’s own appliance before any model sees anything, and what reaches the chain is a salted commitment, never text, names or vectors.

Three things make this buildable in 2026 rather than 2028. Confidential AI became practical at a price a mid-market firm can bear, because a box estimated at about $12,000 can now run a model good enough for redaction and retrieval without anything leaving the building. Midnight reached mainnet in the first half of 2026 as a Cardano partner chain with a working zero-knowledge contract language, Compact, which is what makes selective, deliberate provability possible instead of all-or-nothing. And the legal AI category acquired a credible open-source anchor in MikeOSS, which already speaks MCP and already integrates CourtListener, so the workflow layer can be integrated rather than rebuilt.

The company is Bailment and the product is Bailee. A bailment is the legal doctrine covering delivery of property to another party for a specific purpose, without transfer of ownership. The bailee is the party who receives it: it holds and safeguards the property, owes a duty of care over it, and never owns it. That is exactly the job of the system the firm runs. It holds the client’s documents on the firm’s hardware, on the client’s behalf, and gives them back on demand. Bailment, the vendor, is not the bailee and holds nothing. Throughout this plan, Bailment is the actor in any sentence about what the vendor does or cannot do, and Bailee is the system a firm runs. Trademark clearance is an open item. Because bailee is an ordinary legal term, the mark is likely to be treated as descriptive and will need a distinctive logo or pairing with the company name to be protectable.

How the business works. Priced the way OpenAI and Anthropic price: usage for anyone and a seat contract for the enterprise, and none of it is access to a client’s documents. Every certification costs $0.10 and every notarization made while drafting costs $0.01. A lawyer certifies each document made with AI, about 100 a month, with about five notarizations behind each one: $0.15 a document and about $15 a lawyer a month at every firm size. USDM on Cardano is charged there and then from a prepaid balance; dollars through Stripe are metered and invoiced at month end. Firms under 50 lawyers pay as they go; large firms buy an Enterprise seat at $15 per lawyer per month for that usage, pooled, with a 50-seat minimum. A 30-lawyer firm comes to about $5,400 a year and a 300-lawyer firm to about $54,000.

Why the substrate matters more than the wedge. Certification gets Bailment inside firms with a regulator creating the demand. What keeps it there is the class of products that only a privacy substrate can support: conflicts checking between firms that reveals neither client list, and blind industry benchmarking that no firm would otherwise contribute to. Those are clearinghouses with increasing returns rather than vendor relationships, and they are the reason this is built on Midnight rather than on a timestamp service.

The ask. A seed round of $1.8M, enough to reach profitability in 2029 on the base case: a contracted build with two independent audits, an audited contract on Midnight mainnet, two design partners, and an Apache-licensed reference implementation. The founder takes no salary until the company is profitable.

Company Description

Bailment is an attestation company. It certifies how AI-assisted legal work was produced, using AI that runs on hardware the firm owns and a blockchain record that anchors each attestation. Its purpose is to make confidential collaboration between a client and their counsel safe to conduct with AI, and provable only where a firm chooses. Its product is Bailee.

Legal form. A Delaware C corporation holding the commercial hosting business and the trademarks, paired with a separate non-profit foundation that holds the protocol specification. The reference code is copyright of the founder and the chief developer and licensed Apache 2.0, so anyone may use it and nobody can close it. This is the pattern used by Solana, Sui, and Cardano itself, and it matters here because law firms will not standardize on a protocol whose specification a single vendor can change unilaterally.

Open-source posture. Apache 2.0 for the protocol, the Compact contracts, the x402 facilitator, and the client SDKs. Apache rather than MIT because of the express patent grant, which general counsel at large firms will ask about. The commercial layer is a separate hosted control plane: managed facilitator, managed indexer, GPU capacity brokerage, SOC 2 evidence, and support. Firms who want to run everything themselves can, and some will, which is the point.

What we are not. Not a legal AI model vendor: models are swappable and the firm picks them. Not a document management system: Bailee integrates with iManage and NetDocuments rather than replacing them. Not a law firm, and not a source of legal advice, which is why nothing the software produces reaches a client without a lawyer sending it. And not a custodian: Bailment holds no client documents, no identities and no vectors, which is the constraint every other decision in this plan is built around.

The split is the point. A firm can run every open row itself and many will. What it cannot self-issue is the attestation, for the same reason a self-signed certificate is worthless.

Problem and Market Opportunity

Lawyers are already using AI on privileged material, courts are now demanding they certify how, and nobody can prove anything.

An associate with a deadline pastes three paragraphs of a client’s declaration into whatever model is open in the next tab. Nobody logged it, nobody approved it, and the firm cannot say afterwards what left the building. Then the filing goes out under a certificate saying the attorney disclosed their AI use and verified every citation, and that certificate is, in practice, a guess.

The regulatory pressure is real and measurable, which is unusual for a legal technology market.

These figures come from The Legal Stack’s 2026 report, as of May 2026. The count of standing orders has since been matched by a second source; the others still need an independent count before any investor meeting, and the report’s method for classifying orders should be stated beside them. One precision on Whiting: the Sixth Circuit fined each lawyer $15,000 in March 2026 for more than two dozen fabricated or misrepresented citations, but it never found that AI produced them, because the lawyers would not seriously answer its order asking whether they had used it. The case shows what false citations cost, not that AI caused them.

The precedential case. In Lnu v. Blanche, No. 24-4790 (9th Cir. June 3, 2026), a published opinion, the Ninth Circuit sanctioned two attorneys whose immigration briefs cited fabricated authority and misattributed quotations, and who denied using generative AI at oral argument before conceding it was possible. The court held that “a competent and diligent attorney must do more than prompt generative AI” and check citations; they must also “read” and “reason.”

The discipline matters more than the holding. The court fined each attorney $2,500, suspended both from practice before it for six months, and referred them to the State Bar of California. It then ordered them, and every other attorney at their firm, to include in all future filings for two years a statement under penalty of perjury saying whether generative AI was used, naming the tool, and certifying that the signing attorney personally reviewed the filing and that every citation and quotation refers to existing authority. That is a sworn duty on a whole firm. Bailee records evidence for two of its four elements outright, whether a model was used and which one, and for a third, that the citation check ran against the retrieval log. The fourth, personal review, belongs to the lawyer alone. Bailee cannot prove a person read a document and does not claim to. What it gives the lawyer is recorded evidence behind the sworn statement, where today there is only a signature.

It is worth noting the counter-current. The Fifth Circuit considered a formal rule amendment on AI use in filings and declined to adopt it in June 2024, and the Eleventh Circuit issued non-binding guidance rather than a rule. The Second and Ninth Circuits have amendments pending. If the appellate courts continue to decline circuit-wide rules, the patchwork of individual standing orders persists, which makes the fragmentation worse rather than better and strengthens the case for a product that resolves it.

The Tenth Circuit has since opened public comment, through October 18, 2026, on revisions to 10th Cir. R. 46.5, its rule on signing briefs and other papers. The court’s memo says the changes are meant to address the increased use of generative AI by lawyers and pro se litigants, and they take effect January 1, 2027. Press coverage describes the proposal as requiring a certification of human review. The final text is due by November 30, 2026, and should be read before this plan relies on that description.

Three further pressures sit underneath it:

• The disclosure question has no good answer yet. Privilege protects communications between a client and their lawyer. Text pasted into a third party’s model has been shown to a third party. Whether that waives anything is unsettled, and no firm wants to be the case that settles it.
• Clients are auditing their firms. Corporate legal departments send AI questionnaires alongside outside counsel guidelines, and they get more specific every cycle.
• Supervision duties do not scale by trust. A partner is responsible for how associates use these tools and currently has no way to see it. Shadow AI is invisible by construction.

Two things make the certification requirement a market rather than a nuisance. It is fragmented, so a litigation firm appearing before many judges cannot track the applicable rule by hand, and it is unverifiable, so even a scrupulous firm signs a certificate it cannot substantiate. The first is a database problem others are already solving. The second is a cryptography problem, and it is the one nobody has solved.

The firms feeling this hardest are not the largest. An AmLaw 50 firm funds a private deployment and hires people to run it. A 60-lawyer litigation firm cannot, and appears before the same judges.

Market sizing. These are working estimates to be validated with design partners, not sourced figures.

The beachhead is narrower than the serviceable market: US firms between roughly 60 and 300 lawyers, where an appliance is an ordinary capital purchase and an IT contractor already exists, working in practice areas where the client is itself regulated and already demands answers. Healthcare, financial services, immigration and government contracts. Below about 20 lawyers the hardware is a genuine obstacle rather than a line item, which is discussed under go-to-market.

Product and Technology

The architecture exists to make one artifact trustworthy: a certificate a court can verify without seeing the document. Everything below is what has to be true for that certificate to mean anything. The sections run in the order a document travels, starting with the certificate itself and then working backwards through the channels it can take, where it is computed on, what it is retrieved against, how people and AI work on it together, and who is allowed to do any of that.

1. The certificate a court can check

This is the lead product, and everything else in this section exists to make it credible.

When a filing leaves the firm, Bailee emits a certificate carrying four claims and a verification URL:

The working demo on the website is candid about how far this has come: it measures the third claim live, looking up every citation and flagging the false ones. The other three are recorded as the caller states them, then signed. The build closes that gap so that every claim rests on an artifact recorded by the appliance itself.

The court receives the certificate and a verification link. Anyone, including opposing counsel, can check it against the public, append-only registry of approved pipeline versions. The document is not revealed, and neither is the client, the matter, or which of the firm’s lawyers acted. What the certificate shows is the process, not the content, which is the shape of what a standing order asks for.

A certificate is worth only as much as the pipeline behind it. Bailment’s signature proves that Bailment issued the certificate under a live license, and that the recorded pipeline was on the approved list. It does not by itself prove that pipeline behaved correctly. That is why the rest of the architecture matters more than the signature: signed model manifests, a reproducible and audited pipeline, a human gate that cannot be bypassed, and a registry a third party can check. It is also why a competitor that does not control the pipeline cannot ship this as a feature. A certificate about a black box says nothing about what happened inside it.

The fragmentation problem is handled alongside it. Bailee maps the applicable rule to the court and judge, so the certificate produced matches what that judge actually requires rather than a generic form. Other vendors are building rule trackers and some are good; the tracker is table stakes and the proof is the product.

2. Two channels with opposite defaults

Privileged material and work product have opposite requirements, so they get separate mechanisms rather than one configurable one.

The defaults are inverted against risk deliberately. Document Record is opt-in because it has consequences; the Protocol is automatic because it has none. A lawyer only makes a judgment call when they want notarial proof, and forgetting to classify fails safe. Two separate contracts also make it much harder to push a privileged document through the notarial path by accident, which matters because notarizing cannot be undone.

The Protocol publishes nothing about count, content, firm or matter, for three reasons. It is batched, so no count of communications is ever published, and the count is the dangerous leak: a privilege log is prepared by the firm and already contested in discovery, and a chain that independently counts communications hands opposing counsel a way to attack it. It is shared, so every firm’s root lands in the same tree and an observer cannot attribute a change to a matter, a firm or a client. And it publishes on a fixed cadence whether or not anything happened, so the presence of a write says nothing. That covers what is published. It does not cover traffic analysis: an observer watching network traffic, submission timing, or a firm’s own infrastructure could still learn something, and a small network is easier to watch than a large one. Those are operational risks, and the risk register treats them that way.

What this buys the firm is an unusual asymmetry: it can prove a document existed on a date by producing a Merkle path, and nobody else can even tell the document exists. Evidence the holder may choose to use, without evidence that can be used against them.

Either party may notarize. A client who wants proof their own submission was not altered does not need the firm’s permission, and the firm cannot block it. The attorney-client privilege belongs to the client, who can waive it, so a client may notarize their own privileged communications over the firm’s objection. Work product is different. In many jurisdictions the lawyer holds an independent protection over their own mental impressions and strategy, so the client’s right to notarize covers what the client wrote or received, not the lawyer’s internal drafts and notes. The product enforces that default: a client can notarize what is in the client’s own view of the thread, and nothing else. Where exactly the line falls varies by jurisdiction, needs counsel review before launch, and belongs in the engagement letter.

In Compact, the public ledger holds only commitments, role bindings and dispositions. Document text, redaction maps and the identity of the acting individual are private state supplied through witnesses. disclose() is required to move anything from private to public, which makes every leak an explicit, reviewable line of code.

One practical note on the ledger underneath both channels. Midnight reached mainnet in the first half of 2026 as a Cardano partner chain. Fees are paid in DUST, a shielded, non-transferable resource that regenerates from held NIGHT. That matters commercially: a firm’s per-transaction cost is bounded by a capital holding rather than a volatile spot price, and Bailment can hold NIGHT and subsidize client transactions to zero.

3. Settlement and the long-horizon anchor

Cardano L1 does two jobs. It is where money actually moves, in USDM or ADA, and it is the long-horizon anchor. Midnight state roots periodically checkpoint to Cardano, so a matter’s evidentiary record survives independently of Midnight’s own history. For a records-retention obligation measured in decades, that separation is worth the extra hop. The checkpoint protocol is not yet specified: what is committed, how often, in what transaction format, who submits it, what happens when a submission fails, and how a verifier matches a Midnight root to its Cardano checkpoint. That specification is a named open item before testnet.

4. What gets metered, and what does not

x402 is back at the centre of billing, because every certification and every notarization is now a priced event. The Protocol still batches to one root per period and the appliance still publishes it with Bailment not in the path. What is metered is the two deliberate acts, never the traffic, so there is still no per-call chokepoint to become a metadata honeypot.

Two rails, one price. A firm paying in USDM on Cardano is charged there and then: an x402 top-up funds a prepaid balance, and each certification or notarization is debited from it the moment it happens. One on-chain payment per ten-cent event would not work, because the Cardano fee on each payment, about 0.17 ADA, is as large as the charge. A firm paying in dollars through Stripe is never asked to buy crypto: Bailment runs the transactions for it, keeps the ledger in Stripe metered billing, and invoices at the end of the month. DUST for every chain transaction is generated from the NIGHT treasury and is not passed on.

The mechanics, where it is used: the gateway returns a 402 Payment Required with a payment requirements object naming the scheme, the network (cardano-mainnet), the asset and the exact amount. The client signs through a CIP-30 wallet, resubmits with the payment header, and a facilitator verifies and settles through Blockfrost before the resource is released. Masumi has published exactly this as a Flask resource server plus facilitator against USDM on Cardano, and the Cardano Foundation has released a facilitator that has settled a real end-to-end payment on the preprod test network, which removes most of the invention risk. Neither has yet settled a real mainnet payment, so the first one is a milestone before any firm pays in USDM, not an assumption. x402 is Apache 2.0, with official SDKs in TypeScript, Python, Go and Java, and the exact scheme specification covers Cardano alongside the EVM and SVM chains.

Seats are not metered per event. A seat includes 100 certifications and 500 notarizations a month, pooled across the firm; usage beyond the pool is billed at list. Everything else, including the entire Client Communication Protocol, is never metered per event.

5. Where the compute lives

The GPU business is split by data class, not by hosting model, and that is what allows a central GPU product and a no-custody promise to coexist.

Redaction, template generation and matter embedding run on an appliance the firm owns. Bailment ships it, configures it and monitors its health, never its contents. Models are swappable behind a single OpenAI-compatible interface, so a firm can run Llama or Qwen locally for privileged work and route nothing at all outward if it chooses.

Crucially, the vendor does not touch the document at all: Bailment never hashes anything. Hashing takes plaintext as input, so a vendor that hashes for the firm holds the unredacted document at the worst possible moment. Instead Bailment ships a signed, versioned hasher and redactor; the appliance runs it; Bailment attests that an approved pipeline produced the commitment. The license enforces a minimum artifact version, which gives Bailment a way to push redaction improvements without ever touching data.

How redaction actually works: the template and the vault. A document is split into two things that are stored and protected differently. The template is the document with every identifier replaced by a stable placeholder, and it is what gets embedded, indexed, handed to a model and, if ever notarized, committed. The same person gets the same token everywhere in a matter, so a model can reason about one party across forty pages without learning who they are. The vault is a small, sealed map from token back to value, and it never touches a model or an index.

A hash cannot refill a template, so the vault uses two primitives for two jobs: an HMAC derives the deterministic placeholder, scoped to one matter key, and reversible sealing recovers the value. Production uses AES-GCM in an HSM. A root over the salted vault entries, committed together with the template, proves the vault was not swapped later; section 10 sets out how the names are put back for a judge, and why the vault need not be a second copy of private data. Refilling a template is a disclosure event and is recorded as one, which turns the weakest point of the design into its best compliance artifact.

Two limits are worth stating plainly. Named-entity redaction is necessary and not sufficient, because legal documents re-identify from quasi-identifiers: a docket number, a property description, an unusual occupation in a small county. And tokens must be keyed per matter, or an adversary holding the template corpus can link the same person across unrelated files.

Firms that refuse to own hardware need confidential computing, which takes two separate layers working together. On the CPU side, a trusted execution environment, AMD SEV-SNP or Intel TDX, protects the virtual machine from the host. On the GPU side, the confidential computing mode of an NVIDIA H100 or H200 protects data in GPU memory. Both layers must attest remotely, and a verifier has to check both. Encryption at rest does not help here, because data must be decrypted in memory to be computed on, and whoever holds root on an ordinary host can read that memory. That tier is unscoped. An ordinary hosted GPU tier is sellable, but the no-custody promise cannot be made on it.

The home-access problem is solved with WireGuard plus mutual TLS and short-lived certificates, not a shared VPN credential. A client at home connects to the portal over the public internet; the portal holds no plaintext. The firm user connects into the GPU plane over the tunnel. This is the one place where a conventional, boring answer beats a clever one.

Bittensor was evaluated and dropped. Its subnet model, where miners produce a commodity and validators score it, is a reasonable source of price-competitive inference in general, but it does not fit here. Privileged work can never be sent to anonymous miners, which rules out the only inference workload with volume. The public corpus embedding is a one-time job of a few thousand dollars, far too small to justify a subnet, whose registration cost has no fixed floor: it doubles with each new registration and decays when there are none, and stood at about 1,500 TAO, roughly $470,000, in June 2026. A subnet scoring redaction quality would need documents to score. Carrying it on the roadmap would be decoration.

6. Retrieval: two tiers, in two places

The platform is an MCP client, not a bespoke integration surface. CourtListener already has a working MCP server covering RECAP dockets, opinions, judges, and oral arguments. MikeOSS is an open-source legal AI platform that already speaks MCP and already integrates CourtListener, which makes it a natural integration partner rather than a competitor to route around. Integrating over MCP is the committed path. Building on MikeOSS’s code is a separate decision that waits on a review of its license, governance, API stability and maintainer commitment.

Retrieval is two-tier and the tiers live in different places. The public tier is Bailment’s shared corpus, embedded centrally and served to every firm. The private tier indexes only that firm’s own templates, on that firm’s own appliance. A query joins them at answer time, and every retrieved chunk carries a provenance tag, so a cited answer can always be traced back to whether it came from the client’s file or from public law. Nothing in the private tier is ever transmitted to build the public one.

7. The shared AI thread

Inside the Protocol, client and lawyer work with AI in the same thread. Both see what the other generates, both can iterate on it, and both can cite a notarized Document Record as reference. This is the part of the product people actually touch, and it is governed by four rules that are mechanisms rather than policies.

The first rule is the one that does the most work, and it is a stronger argument for the appliance than custody ever was. If a client drafts something in a public chatbot and pastes it in, they disclosed it to a third party before it reached their lawyer, and the privilege on that draft is arguable. Run the model on the appliance and it never left the privilege in the first place. Privilege preservation, not just confidentiality, is what the hardware is buying.

The third rule is deliberately smaller than it first appears. A lawyer who sends a message has put their name on it and owns it however it was produced, so a separate adoption step would be ceremony layered on an act that already carries the responsibility. Send is adoption. What has to be enforced is only that model output cannot reach the client without passing through one, which rules out a live shared canvas where generated text streams into both views at once: there the lawyer’s responsibility would attach to something they never chose to transmit. The firm’s side is compose-then-send, and the client’s side can be live, because that is their own work on their own materials.

The thing to prohibit architecturally, because it will be proposed as an obvious efficiency win, is an auto-responder that answers routine client questions instantly. It bypasses send and collapses the model, so there must be no service-account path to the send endpoint at all.

Labels then do what labels are good at, which is telling a client what kind of thing they are reading. They are not a liability shield and do not need to be. A disclaimer reading “AI generated, not legal advice” holds up on a draft, on tool output, and on anything the client generated themselves. It does not hold up on a lawyer, inside an engagement, in the matter thread, discussing that client’s legal problem: competence is not waivable by disclaimer, the disclaimer can cut against the firm in a supervision complaint by documenting that it knew, and most clients will not parse “not legal advice” coming from their own lawyer. The bar guidance on generative AI, ABA Formal Opinion 512 among it, is worth reading directly on this point.

8. Keys, licensing and who is allowed to act

Firms must be able to onboard clients without asking permission every time, and must not be able to operate outside the standard. Those two requirements are met by a three-tier key hierarchy in which the top tier can authorize but cannot read.

The root is an authorization key and never a decryption key, and that distinction is load-bearing rather than fastidious. A vendor who can decrypt privileged material hands opposing counsel a waiver argument in every matter its customers litigate, becomes a subpoena target with no privilege of its own to assert, and gives nobody a reason to self-host. Bailment never holds a firm’s private key: the firm generates its own pair and sends only the public half, so a breach of Bailment cannot impersonate a firm.

Enforcement sits in three places at once, because nothing can stop a firm publishing a contract to a permissionless chain. The contract’s constructor verifies the root’s signature over the license in circuit and sets a licensed flag that every other circuit asserts on, so an unlicensed deployment lands on chain and is inert. The gateway refuses to mint a fee receipt without a live license, and since every state change consumes a receipt, revocation freezes a firm in seconds rather than waiting for the chain. The signed registry of approved verifier keys lets a client’s own software confirm that the matter it is joining runs an approved contract.

Standards compliance is checked, not trusted. Every Compact contract has a verifier key that is a deterministic function of its circuit. Approving a template means signing its verifier key; auditing a deployment means comparing the on-chain key against the registry. A firm that changes one line produces a key that is not in the registry. Firms that need variation get constructor parameters with in-circuit bounds, such as a retention period floor, rather than a fork, which keeps the verifier key constant while the behavior varies.

Licenses run 45 days and auto-renew, so expiry is the ordinary revocation path and there is no revocation list to distribute. When a firm goes dark its matters freeze, but committed history stays readable and provable: a client does not lose their file because their firm lost its license.

Client keys: enrollment links, never emailed keys. Email is not confidential, and a key mailed to a client is held by anyone with access to that mailbox or any backup of it, forever, with no record it happened. It also puts the firm in custody of the client’s private key, which destroys non-repudiation. So nothing secret travels: the firm issues a one-time enrollment link, the client’s own browser generates the keypair and registers only the public half, and the token is single use with a 72-hour expiry. Delivery can be email, post, or read aloud over the phone, because the link is not the secret. Firms issue as many as they like; the license caps matters, not keys.

Retention, legal hold and destruction. Retention is a parameter the firm sets, with a floor enforced in circuit. Bailment must not assert what a jurisdiction requires: periods vary by matter type, by whether a judgment exists, by trust-account rules and by whether the client was a minor, and a vendor that picks the number has made a legal judgment it is not licensed to make. A legal hold, which either party may place, blocks destruction outright rather than delaying it, because scheduled destruction during anticipated litigation is spoliation and an automated policy is not a defense. Destruction itself crypto-shreds the vault key and appends a tombstone beside the commitment. That makes every copy of the ciphertext unreadable, backups included, but only if no copy of the key or of the plaintext survives somewhere else: snapshots, backups of the key store itself, cached or downloaded plaintext, temporary files, swap, logs, and disaster-recovery systems. The key lifecycle is designed around that list, and a destruction report states which copies it reached and which it could not. Nothing on chain is ever modified or deleted, so a permanent ledger and a destruction obligation stop being in conflict: years later a firm can prove a document existed and was destroyed on schedule without having retained it. Multi-stage warnings at 90, 30 and 7 days go to both firm and client and are themselves recorded, and a stale client contact extends the clock rather than triggering destruction.

Subpoena exposure, stated accurately. Shielded contracts remove Bailment as a source of document content. They do not remove it as a party to a subpoena, and those are different problems. A demand for the documents in a matter gets the answer that Bailment does not have them and cannot obtain them, which is structurally true rather than a policy a court could order changed, and that is also what defeats the privilege-waiver argument, since waiver turns on third-party access. But Bailment still holds licensing records, payment records and, where a firm uses the hosted corpus, query metadata. Traffic analysis over that set is a real attack.

The exposure that is easiest to overlook is prospective. A court cannot order the decryption of what cannot be decrypted, but it can in principle order a template approved, an update pushed, or a revocation withheld. The root key is the lever, and it exists precisely because compliance is enforceable. Three things answer it: a threshold root held across jurisdictions and entities, so no single company can be compelled quietly; a public append-only registry with client-side verification, which makes secret compliance technically impossible rather than merely against policy; and collecting less, since firms may run their own facilitator under the open-source license so the traffic never reaches Bailment at all. The claim to make in public is never that the company is subpoena-proof, but that it is not a source of client documents.

9. Proving a document to a chosen reader

Certification answers how a document was made. A second question arrives later and is answered separately: someone is holding a copy and wants to know it is the document that went through the system. Bailee answers that with a signed attestation, and the attestation can be aimed at one named reader instead of the world.

The lawyer’s own key signs a statement a person can read, bound to the document’s fingerprint. Something of the form: the document bearing this digest is the retainer agreement transmitted in this matter on 14 September 2026, and I have compared the copy provided against the record of transmission. The human sentence is what a judge reads. The digest is what the machine checks. Neither works without the other.

Three scope fields sit inside the signature rather than beside it: who the attestation is for, what it is for, and when it expires. A proof handed to one reader for one purpose therefore cannot be quietly reused for another, and a verifier shown the wrong one reports issued to Hon. J. L. Robart, not to you rather than a bare pass.

No private key ever changes hands. Verification uses the signer’s public key and the public chain records, nothing else. A private key would let the holder sign as the lawyer, and any design that asked for one to verify a document would be broken on its face.

Tier 1 is the default and is meant to be permanent. A filing is public, the certificate attached to it should be too, and a firm that later loses its verification vendor still has a proof that checks out against a public key. The cost is that it cannot be taken back, which is the correct trade for a document already in the record and the wrong one for anything else.

Tier 2 exists because privilege makes production expensive. Producing a privileged document to prove it is authentic can waive the privilege over it, and no amount of cryptography changes that. Sealing lets the lawyer hand the court a proof the court alone can open, which the court can then seal into the record where it stays checkable. The honest limit is stated in the product and in the documentation: sealing is a lock on the door, not a leash. A reader who opens it can forward it.

There is no public key infrastructure, and that is a deliberate commercial choice. Courts do not publish encryption keys and will not start. Instead the reader opens the verification page, it generates a single-use keypair in their browser, and they read out a short public code. The private half never leaves their machine. Bailment runs no directory, holds no reader keys, and has nothing on this path to breach or to be subpoenaed for. The alternative, a key directory, would have recreated the custody problem the rest of the architecture exists to avoid.

Both tiers ship inside the attestation license rather than as separate line items. Pricing the sealed tier above the public tier would give a firm a financial reason to file in the open when it should have filed under seal. The incentive has to point the other way, so the private option is never the expensive one.

An attestation can also cover a partial disclosure rather than a whole document, which matters when only one clause or one page is in dispute. That mechanism is described in the technical documentation and is not a separate product.

Tier 3, designated verifier: built, explained, and deliberately not in the plan. A third construction exists and works. It produces a proof that says either the lawyer signed this, or the reader did. The reader is convinced, because the reader knows perfectly well they did not sign it. To anyone else it is a coin flip, so it cannot be used to bind the lawyer in front of a third party. The intended use is a privilege fight or a settlement discussion, where the point is to show opposing counsel that a document is genuine without producing it and without handing them anything they can reuse later.

It is not in the revenue plan or the pitch, for three reasons, in order of weight. It must never go in a filing, because a proof only one person can believe is not testable by the other side and a court may reasonably refuse it. It needs a bar ethics opinion before it is sold rather than after. And the cryptography behind it is a readable reference implementation, not production code. It stays in the repository as a working demonstration and as something to put in front of design partners, on the bet that the firms most interested in it are the ones worth having.

10. Putting the names back for a judge

Every record Bailee makes is made from the template, never from the original. When a lawyer notarizes, the appliance redacts first, commits a salted hash of the template, and keeps what links the tokens back to the real names on the firm’s own hardware. When a lawyer certifies, the certificate rests on the same template. Neither act ever puts a name on the chain. Sooner or later, though, a judge will need to see the real document, and to be sure the names put back into it are the ones that were there on the day. This section explains how that works, what the firm has to keep for it to work, and what happens when something is lost, destroyed or updated.

What goes on the chain, and what stays at the firm. The chain holds a fingerprint and a date. The firm holds everything the fingerprint was made from. A fingerprint cannot rebuild a document, so the chain on its own proves nothing about content. What it does is make the firm’s copy tamper-evident: if a single letter in the firm’s storage changes, the fingerprint no longer matches the one published on the day, and anyone can see that it does not. The blockchain does not stop a firm altering its own records. It makes an alteration impossible to hide.

How the fingerprint is built. In three layers, each for a reason.

• Each vault entry is hashed with its own random salt: hash(token, value, salt). The salt matters because a bare hash of a name can be guessed. Anyone holding a list of a firm’s likely clients could hash each name until one matched the chain. Including the token proves that PARTY_1 means Jane Roe, not merely that Jane Roe appears somewhere.
• The entry hashes are combined in pairs into one vault root, using the same kind of tree that batches records across firms. One root means the chain never shows how many people a matter involves, and a single entry can later be revealed with its path to the root while every other entry stays sealed.
• The template hash and the vault root are committed together, with a salt: commitment = hash(template hash, vault root, salt). This binds the two, so no one can later pair a template with a different vault, or a vault with a different template. The commitment joins the period’s batch, and the batch root goes on the chain.

Where the real names live. Someone has to keep the real names. To show them to a judge, they must exist somewhere at that moment: cryptography can prove that a revealed name matches the fingerprint, but it cannot recreate a name nobody kept. The only questions are who keeps them and in what form, and Bailee’s answer is that it never needs a second store of private data. There are three ways to arrange it.

• The default: derive, don’t store. A law firm is already required by the professional rules to keep its client file for years: the engagement letter, the pleadings, the correspondence. The client’s name is in that file whether or not Bailee exists. So the firm keeps the template, the fingerprints and one secret key per matter, the vault key, sealed in the appliance’s hardware, and no separate list of names. Every token and every salt is computed from that key. When a judge needs the names, the appliance takes each one from the ordinary client file, recomputes its token and salt, and shows that the result is the entry committed on the day. The vault shrinks to a key. Two conditions come with it. A name must be written exactly as the redactor wrote it, “Jane Roe” rather than “Ms. Roe”, so the redactor records every name in a canonical form under fixed, versioned spelling rules. And once the firm destroys the client file on schedule, the names can no longer be put back, which is the intended result: retention and proof end together.
• The client’s option: the client holds the names. The firm keeps the template; the client keeps the vault, encrypted under the client’s own key, and neither half reveals anything alone. This fits the law, because the privilege belongs to the client and the client decides whether to waive it. The risk is that the client loses the vault or refuses to produce it. Escrow of the client’s key covers the first, not the second.
• For the most sensitive matters: a split key. The encrypted vault can sit anywhere the firm controls, but opening it takes both the firm’s and the client’s key shares, so the firm stores data it cannot read alone.

Keeping only templates does not mean keeping nothing sensitive. A template still carries the facts, and a docket number or an unusual occupation in a small county can identify a person, so the template is protected exactly as a vault would be.

What the firm keeps: the record package. For every notarization and every certification, the appliance writes one sealed record package, in the same click. It contains:

• the template;
• the vault key, sealed in the appliance’s hardware, from which every token and salt is derived (under the client’s option, a reference to the client-held vault instead);
• the commitment salt;
• the record’s path to the published batch root, and the period it belongs to;
• the redactor version and the format version that produced it.

The chain supplies only the date stamp. Without the key, the salts and the path, the root on the chain cannot be matched to anything. The package is therefore the evidence itself, and it must be kept for the full retention period. It is written once and never edited.

Showing it to a judge. Putting the names back is a disclosure, so it is treated as one. It happens on the appliance, it is logged (who, when, which tokens, for which court), and it travels as a Tier 2 sealed attestation for in camera review, never in public. What is sent holds only what the dispute needs: the template, the disputed entries with their salts and paths, the commitment salt and the batch path. The judge’s browser then checks four things:

• each revealed entry hashes up to the vault root;
• the template hash, the vault root and the salt reproduce the commitment;
• the commitment’s path leads to the root published on the chain on that date;
• putting the revealed values into the template reproduces the document the judge was handed.

If all four pass, the names are exactly the ones the firm’s system recorded that day, unchanged since, and nothing else was swapped in. Two limits remain. It does not prove the redaction was right at the time, which stays with the lawyer’s certification. And sealing controls who opens the package, not what they do next, so the protective order does the rest.

If a template is lost or destroyed. Losing a package is losing the record. The chain still shows that a commitment existed on that date, but nobody can show what it said, exactly as with a lost original. Destroying one out of schedule is also visible: the commitment remains on the chain with no tombstone beside it, so a firm cannot claim the record never existed, and destruction during anticipated litigation is spoliation. Destruction on schedule is the ordinary path set out in section 8: the vault key is crypto-shredded, a tombstone is appended, the destruction report lists the copies reached, and a legal hold blocks all of it.

If the firm updates its software or its templates. Updates never break old records, for two reasons. Every package records the redactor version and the format version that made it, and the public registry is append-only, so old versions are marked retired but stay verifiable forever. And checking a record never reruns the redactor: the judge only recomputes hashes from what is stored. A new redactor therefore changes new records only. A firm that re-redacts an old document creates a new record that points back to the old one. It never edits the old one.

Making it effortless for the firm. None of this should depend on anyone remembering to do it. The appliance does it as part of the same click:

• Write once. The package is created with the notarization or certification, and can be added to but never edited.
• Automatic backup. An encrypted copy goes to a second location the firm controls, such as a second disk or the firm’s own cloud account. It never goes to Bailment, because that would be custody.
• An offline copy. A further encrypted, write-once copy sits offline, out of reach of ransomware or a remote intruder. The keys that open it live in hardware: the vault key in the appliance’s HSM, with its recovery shares on separate hardware tokens held by the firm and its escrow. A hardware wallet holds keys, not files, so it protects the lock rather than the records. Because every copy is encrypted under the vault key, crypto-shredding that key reaches the offline copy too, and destruction stays complete.
• Self-checking. On a schedule the appliance re-verifies its packages against the chain and reports anything missing or altered, before a court ever asks.
• Key recovery without a backdoor. The vault key uses threshold recovery between the firm and an escrow holder, so a failed appliance does not mean lost records.
• A second copy by right. The client can notarize their own view of the thread, which gives an independent copy of what they sent and received.

The result answers the question a judge, a client or opposing counsel will eventually ask. The firm holds the words, the chain holds the date, and the two can only be matched through the firm’s own record, which cannot be changed without it showing.

Language choice

There is no single language that spans all of this, and any plan claiming otherwise is wrong. There is, however, a clean two-language answer with three small exceptions.

So: Compact for the two contracts, TypeScript on the chain and browser side, Python for everything on the appliance and the server. The seam between them is HTTP and JSON. Go is a reasonable substitute for Python in the attestation service if throughput ever becomes the constraint, since x402 ships a Go SDK, but it costs the ML ecosystem and there is no reason to pay that yet. Rust appears only if someone ends up writing a custom Cardano serialization path, which is worth avoiding.

Market Analysis and Competitive Landscape

At least one project now offers part of what Bailment sells. LegalSeal is a free, open-source protocol that issues cryptographic receipts linking an attorney’s bar number to a reviewed document, with a SHA-256 hash and a timestamp. That confirms the demand and ends any claim that nobody does this. The difference is what the receipt can know. A receipt issued at the end of the process records that a credential signed off. It cannot say which model touched the text, which version, whether redaction ran first, or where the computation happened, because it does not sit inside the pipeline. Bailee does.

The landscape splits into four groups, and Bailment competes directly with none of them. It competes with the status quo, which is a secure file share plus a vendor attestation letter.

Where the real defensibility is. Not the cryptography, which is mostly other people’s open-source work, and not the models, which are commodities on a six-month cycle. It is the signed registry of approved pipelines, and the schema that goes with it: a standard way to say what was redacted, on what version of what software, who adopted the output, and under whose license. Whoever gets that registry accepted by a handful of corporate legal departments sets the format their outside counsel must produce. That is a distribution problem, not an engineering one.

The honest gap. An appliance estimated at about $12,000 runs a quantized model in the 8 to 30 billion parameter range. Harvey calls a frontier model and drafts better, and a buyer running the two side by side will see it. The privacy story costs output quality. The mitigation is real but partial: local models are strong at redaction and retrieval, which is most of the work, and already-templated content can optionally route to a frontier API as a per-matter judgment, since the template carries no direct identifiers. Quasi-identifiers still leak, so that stays a judgment rather than a default.

The other honest risk. iManage or NetDocuments could ship a weak version of this in a release, on a permissioned ledger with no zero-knowledge layer. Worse product, far easier sale. Speed matters more than depth in the first eighteen months.

Business Model and Pricing

Bailment sells usage and a seat contract, the way OpenAI and Anthropic sell to people and to enterprises, and not one of them is access to a client’s documents.

What a firm pays depends on how much it makes with AI. Court filings are a small share of a lawyer’s work: a federal case carries about 27 docket entries (Free Law Project: some 350 million entries across 13 million cases since 2013), about a third of them one side’s own filings, and a litigator carries a median of about 27 active matters, which puts a litigator at roughly 10 to 15 court filings a month at a mid-size firm and 20 to 30 at a large one. Lawyers make far more documents than they file: of the roughly 26,000 documents a lawyer handles a year, about 300 a month are neither email nor PDF (MetaJure customer data), and the model puts the ones a lawyer writes at 100 to 150 a month. Nobody knows in advance which will reach a court, so a lawyer certifies every document made with AI. The model assumes 100 a month at every firm size, each with about five notarizations taken while drafting.

Certification is the wedge because the demand is mandated. A firm does not adopt this because it finds the argument persuasive; it adopts because a judge it appears before requires a certificate it cannot otherwise produce, and because sanctions in this area have run to $15,000 per attorney. That converts a long consultative sale into a compliance purchase, which is a different and much faster motion. At ten cents a certificate the price is never the objection: certifying becomes a default rather than a purchase decision, and the money is in the seats of the firms that certify every day.

Attestation is the core line, and what makes certification possible. Anchoring a hash costs almost nothing and the code is open source, so a firm could do that alone. What a firm cannot do is self-issue a credible attestation, for the same reason a self-signed certificate is worthless. Bailment vouches that a commitment came from an approved pipeline, running a signed redactor, under a live licence. That makes Bailment a trust root the way a certificate authority is one, a trust service rather than a transaction service: high margin, recurring, and hard for a customer to replace with themselves, because a firm vouching for its own pipeline is the self-signed certificate problem again. The comparison carries the same limit. A signature proves who vouched and under what rules; it does not by itself prove the facts vouched for. That proof comes from the audited pipeline, the signed manifests and the public registry.

The business is also split by data class, not by hosting model, which is what lets a central GPU product coexist with a no-custody promise. Every firm needs the same statutory index, the same case law, the same court forms. That corpus contains no client data, so Bailment can embed and serve it centrally with real economy of scale. Client matter data never leaves the firm’s appliance. Retrieval joins the two at query time with a provenance tag on every chunk.

The public corpus is the line nobody else is building. Fifty firms building the same statutory index fifty times is pure waste. More importantly, it is also the line that makes the product good: a single firm’s own matter index is small and thin, and it is the public corpus that makes an answer useful. So the part that safely centralizes is also the part that drives quality.

Its margin is possible because the underlying data is open. Bulk case law comes from CourtListener and the Free Law Project, statutes and court forms are public records, and there is no data licensing cost to pay. The spend is GPU compute and storage on a corpus built once and served to everyone.

What it costs Bailment to run. The infrastructure is small and, importantly, flat.

That is roughly $1,500 to $4,000 a month regardless of customer count, because the corpus is shared, which keeps it a shrinking share of revenue as firms join. Chain fees stay zero to the customer: DUST is generated from held NIGHT, a capital position rather than an operating cost. Stripe costs about 3.6% plus 30 cents per monthly invoice on the share billed in dollars. The real expense is people, and that is what the raise funds.

On the firm’s side: $10,000 to $15,000 for an appliance with one or two 48GB cards, or $4,000 to $6,000 for a single-card build running quantized models, plus $100 to $200 a month in power. These are prototype estimates for the compute alone, not a costed production appliance. A production unit also needs ECC memory, redundant storage and networking, a UPS, backup, secure boot and a TPM, signed images, monitoring, remote administration, and a spare-parts plan. The real figure comes from building one and pricing the complete bill of materials, which is a milestone before the first paid installation.

The appliance is firm-owned hardware, sold and supported through legal-vertical managed service providers, and it is not in the revenue model. A direct sale at about 30% margin would be upside, not plan.

Why two tiers, at usage prices. An Enterprise seat costs what its lawyer is expected to use, so every lawyer comes to about $15 a month whichever way the firm pays, and a pay-as-you-go lawyer who uses less pays less. What the seat adds for a large firm is a predictable bill, usage pooled across the firm, single sign-on and an audit export. A middle tier for mid-size firms would add a price list without adding a reason to buy it, so there is none: every firm under 50 lawyers pays as it goes. Pay-as-you-go firms are nearly pure margin, about 98%, because they need no seat serving; Enterprise seats run near 78% because serving one is modelled at $3 a month. Covering 2028 costs takes about 18 large firms, about 147 mid-size firms or about 880 small ones.

What the firm can tell its own clients, which is the sentence the whole design exists to support: Bailment never holds our documents, our clients’ identities, or our vectors. Those stay on hardware we own. They anchor proofs that the work happened and attest that it ran an approved pipeline. They cannot read our files, and they cannot be compelled to produce what they cannot access. Every clause of that is defensible.

The Multi-Party Roadmap

Certification is the wedge. The bet is on what the same substrate makes possible afterwards, and that bet is the reason this is built on a privacy chain rather than a timestamp service.

Most of the privacy in the product so far comes from the appliance, from salted commitments and from batching, none of which require zero-knowledge proofs. If the company only ever ships the document channel, Midnight is an expensive dependency. It becomes load-bearing the moment two parties who do not trust each other need to learn something together while revealing nothing.

Conflicts is the one worth building first, and it is a bigger business than certification. Every firm runs conflicts checks, the dangerous cases are exactly the ones that cannot be checked today, and a clearinghouse that reaches critical mass in a practice area is very hard to dislodge. The cryptography is the easier half: private set intersection is a well-understood primitive. The hard part is entity resolution, matching names across firms through aliases, misspellings, transliteration, subsidiaries, beneficial owners and common names, without so many false matches that lawyers stop trusting it or so few that it misses the conflict that matters. Add deciding who may query, and blocking inference attacks, where a firm probes the set to learn who another firm represents. Intapp sells into this market without solving the cross-firm case, and entity resolution is a large part of why.

The honest risk is focus. Each of these is a separate product, and a seed-stage company that chases three of them ships none. The sequencing rule is that nothing on this roadmap starts until certification has paying firms, because the clearinghouse needs members and the members arrive through the wedge.

Go-to-Market Strategy

Let the courts create the demand. Close at the firm. Deliver through the integrator.

This is the part the pivot to certification changes most, and it changes it for the better. The earlier plan had to manufacture demand by persuading corporate legal departments to write a clause. That work is slow and speculative. A standing order is a clause someone else already wrote, that is already binding, and that a litigation firm cannot ignore.

So the entry point is a court calendar rather than a boardroom. Identify the judges whose orders require tool name, version and provider, find the firms that appear before them regularly, and lead with the certificate. The conversation is not about privacy architecture; it is about a document the firm has to file and currently cannot substantiate.

The purchase is still unambiguously the firm’s: a $12,000 appliance bought through its managed service provider and usage at about $15 per lawyer per month, with the client buying nothing. And above the smallest firms delivery still runs through a managed service provider, because a firm handed hardware and left alone calls you in six months when it breaks.

The corporate guidelines clause has not gone away. It moves from being the wedge to being the expansion motion, and it gets easier to write once a certificate format exists to point at.

Phase 1, months 0 to 6: two design partners, chosen by docket. One mid-market litigation firm in the 60 to 150 lawyer band that regularly appears before judges with certification orders, and one corporate legal department to author the guidelines clause later. Free, in exchange for reference rights and bi-weekly access. Legal aid organizations were an early candidate and are the wrong first partner: appliance-first makes small organizations the hardest to serve.

Phase 2, months 6 to 12: the certificate format, in public. Publish the certificate schema and the verification tool as an open specification, and take it to court technology committees and the judges already writing these orders. A judge who names a verifiable format in a standing order is worth more than any amount of sales effort. In parallel, recruit two legal-vertical integrators who already sell these firms iManage, ship the reference implementation, and contribute upstream to MikeOSS rather than forking it.

Phase 3, months 12 to 24: the guidelines play and the first multi-party product. Publish the model outside counsel guidelines clause. Work the ACC and state bar technology committees. Target five corporate legal departments citing it by month 24, and stand up the conflicts clearinghouse in one metro with the firms already on the platform.

Sell through managed service providers, not direct, above the smallest firms. Feasibility splits hard by size, and the channel has to split with it.

The MSP channel also solves the support problem that sinks appliance businesses. A firm that is handed hardware and left alone calls you in six months when it breaks, and you either absorb the cost or lose them loudly. An integrator who already has a support contract with that firm absorbs it as part of their existing relationship.

Other channels, in order of expected yield: design partner referrals, the open-source repository, state bar CLE presentations, legal technology conferences, and the Cardano and Midnight ecosystem grant programs, which are a source of both capital and credibility with a crypto-skeptical audience.

How we describe ourselves. Lead with attestation: Bailment is an attestation company that uses AI and blockchain to prove how legal work was produced. Say what the proof does before how it works. The blockchain gets one mention, as the reason no one, including Bailment, can quietly rewrite the record, and it is never the headline. A pitch that opens with the word blockchain reads as crypto to a legal audience, and that costs the meeting.

Outside the U.S., one open technical question. In the EU, a qualified electronic timestamp from a licensed provider is presumed accurate under the eIDAS Regulation, and other countries have their own trust-service rules. If Bailee expands abroad, it should check whether pairing the on-chain anchor with a locally recognized timestamp makes the proof easier to rely on there. It is not a U.S. priority and changes nothing in this plan.

Operations and Open-Source Governance

A protocol that law firms rely on for evidentiary claims has to be governed like infrastructure, not like a startup’s side repo.

Repository layout. A single monorepo, because the Compact contract, its generated TypeScript bindings, and the Python gateway have to version together or they drift.

bailee/
  contracts/        Compact: matter.compact (Document Record)
                             custodian.compact (Protocol, network-wide)
  sdk-ts/           Midnight.js bindings, DApp connector, portal client
  gateway/          Python: x402 resource server, policy, routing
  facilitator/      Python: Cardano verify + settle (forked from Masumi)
  licensing/        Python: root authority, firm mini key, enrollment
  redactor/         Python: template + vault, PII detection, provenance
  thread/           Python: shared AI thread, attribution, taint tracking
  rag/              Python: two-tier retrieval, MCP client
  portal/           TypeScript: client and firm web app
  appliance/        Images, health telemetry, signed model manifest
  deploy/           Compose and Helm: proof server, node, indexer
  spec/             The protocol specification and test vectors

Licensing. Apache 2.0 throughout. Copyright in the code is held by the founder and the chief developer, and outside contributions come in under a Developer Certificate of Origin rather than a contributor license agreement. Apache’s grants cannot be withdrawn, so every released version stays open whatever the owners later decide, which is what a firm’s general counsel needs to see.

Governance. The foundation controls spec/. Changes to it need two maintainer approvals from different organizations. The code owners control the repository and the company controls the hosted plane. This split is the promise that makes self-hosting credible.

Security cadence. This is not optional overhead; it is the product.

Key management. The hard operational problem, addressed in the risk register below. Clients will lose keys. The architecture must survive that without a backdoor, which means threshold recovery through the firm plus a designated escrow, never a platform-held master key.

Team, Milestones and Roadmap

The rare combination this venture needs is one person who understands both privilege and proving systems. That person is the founder or the company does not work.

Team plan. A contracted build, then four people. The founder is unpaid until the company is profitable.

Advisory board to recruit: a former state bar ethics committee member, a corporate deputy GC who writes outside counsel guidelines, and a practicing ZK cryptographer. The first two matter more than the third.

Milestones.

Three hard gates. Nothing touches a real filing before the external audit, because a defective certificate is worse than no certificate: it is a false statement to a court. That is why the design partners run certificates alongside their work in Q3 and attach them to filings only after the audit in Q4. The offline root ceremony has to exist before the first real licence, because a root cannot be retrofitted into a threshold key once firms depend on it. And nothing on the multi-party roadmap starts before certification has paying firms, because a clearinghouse with no members is not a product.

Financial Plan and Risk Register

The ask: $1.8M seed, about 24 months of runway, priced to reach the audit, mainnet and profitability in 2029.

The corpus line buys GPU compute and storage, not data. Bulk case law comes from CourtListener and the Free Law Project, and statutes and court forms are public records, so there is no licensing bill of the kind Westlaw and Lexis carry. That absence is why the shared corpus costs a few thousand dollars a month instead of a licence fee, and why the platform cost stays flat as firms join.

Four-year model, illustrative. Built bottom-up in docs/financial_model.py from the per-firm figures above and a customer plan by firm size, with costs itemized: the developer contract in 2027, then two developers and two sales and installation staff. The founder is unpaid, so profit is stated before any founder pay. Appliances are left out because managed service providers sell them. Every figure needs design-partner validation.

Breakeven. The plan turns profitable in 2029: recurring gross profit passes operating cost early in the year, 2029 closes about $0.52M ahead and 2030 about $2.6M. The deepest point is about $1.39M of cumulative loss at the end of 2028, which is what the $1.8M seed covers, with the NIGHT treasury and about five months of costs in reserve. At half the assumed volume the deepest point is about $1.51M and 2030 still earns about $1.4M. Costs stay small because the build is contracted and the team is four people. Profit is before any founder salary. Nothing in these figures assumes a dollar from the multi-party roadmap, which is deliberate.

Liquidity. The two payment rails pull cash in opposite directions, and the Enterprise seats settle it. Stripe usage is billed in arrears, so about 32 days of it is always owed to Bailment: roughly $74,000 at the end of 2029. USDM customers prepay, and about $46,000 of balance is held at the same date. Enterprise prepays the year, about $432,000 of prepayment at the end of 2029. Net working capital is positive in every year of the plan, so billing in arrears costs a bad-debt reserve, which the model does not yet carry, and nothing more. DUST is funded from the $72,000 NIGHT treasury and is not a cash cost per transaction.

One variable still dominates: whether the outside counsel guidelines strategy works. If it does, 2029 is conservative by a wide margin, because adoption becomes mandated rather than chosen. If it does not, 2029 is optimistic by about the same margin. That is worth saying plainly rather than hiding in a sensitivity table.

The second-largest variable is appliance attach rate. The revenue model assumes every paying firm runs one, because certification and notarization happen on it; the hardware itself is sold by managed service providers and is not in the revenue. Firms that refuse hardware need the confidential computing tier, which is unscoped and unbuilt, and until it exists those firms are not addressable without giving up the no-custody promise.

Risk register

Sources

1. Compact language reference. Midnight Documentation, docs.midnight.network/develop/reference/compact/lang-ref.
2. How Midnight works: smart contracts. Midnight Documentation, docs.midnight.network/concepts/how-midnight-works/smart-contracts.
3. NIGHT token. Midnight Network, midnight.network/night.
4. State of the Network, February 2026. Midnight Network, midnight.network/blog/state-of-the-network-february-2026.
5. x402: an open payment standard. x402 Foundation, docs.x402.org.
6. x402-cardano-examples. Masumi Network, github.com/masumi-network/x402-cardano-examples.
7. Exact payment scheme on Cardano. x402 Foundation, github.com/x402-foundation/x402/blob/main/specs/schemes/exact/scheme_exact_cardano.md.
8. Cardano x402 facilitator. Cardano Foundation, github.com/cardano-foundation/cardano-x402-facilitator.
9. Create a subnet. Bittensor Documentation, docs.learnbittensor.org/subnets/create-a-subnet.
10. Bittensor subnet registration cost rises 6.5x to 1,500 TAO amid AI demand. Crypto Briefing, cryptobriefing.com/bittensor-subnet-registration-cost-rises.
11. Mike: open-source legal AI platform. MikeOSS, mikeoss.com.
12. Mike OSS: open source legal AI tool “changes the negotiation.” Legal IT Insider, legaltechnology.com.
13. Lnu v. Blanche. No. 24-4790, U.S. Court of Appeals for the Ninth Circuit, 3 June 2026, courtlistener.com/opinion/10869591/lnu-v-blanche.
14. The Legal AI Judicial Response Report 2026. The Legal Stack, thelegalstack.org/research/the-legal-ai-judicial-response-report-2026-how-federal-and.
15. Public Comment Period Open for Revisions to the 2027 Tenth Circuit Rules. U.S. Court of Appeals for the Tenth Circuit, 18 Sept. 2026, ca10.uscourts.gov/clerk/news/public-comment-period-open-revisions-2027-tenth-circuit-rules.
16. LegalSeal: cryptographic attorney attestation for AI legal documents. LegalSeal, legalseal.io.
17. AI Disclosure Requirements by Court. LegalSeal, legalseal.io/ai-disclosure-requirements.html.
18. Sixth Circuit Sanctions Attorneys for Fake Citations: What Does This Mean for Use of AI? Sixth Circuit Appellate Blog, on Whiting v. City of Athens, Nos. 24-5918/5919, 25-5424 (6th Cir. 2026), sixthcircuitappellateblog.com.
19. Federal Cases and Filings. Free Law Project, CourtListener data coverage, wiki.free.law/c/courtlistener/help/data-coverage/federal-cases-and-filings.
20. How Many Cases Does a Lawyer Have at Once. LegalFactPro, legalfactpro.com/how-many-cases-does-a-lawyer-have-at-once (reporting a 2019 ABA survey median of 27 active matters per litigator).