A federated knowledge platform for law firms. Source binaries stay in your existing DMS — iManage, NetDocuments, Litera. Claims, classifications, and audit are centralised in a German-hosted substrate. A seven-rung disclosure ladder governs what each principal can see of each document.
Every search hit, every cross-silo reference, every external request resolves to a rung on this ladder. Each step up requires more authority — and, often, a steward in the loop.
Caller receives no acknowledgment. The document is not in their universe.
policy default"A document matching your query exists." No metadata, no preview, no facets.
policy defaultClassification facets visible (matter type, jurisdiction, year, sector). No text.
steward · above InternalA machine-generated, identifier-stripped summary. Parties, named clauses, and figures removed.
steward · above InternalDocument with named-entity, monetary, and personal data redacted in-place.
steward · above InternalFull extracted claim text and provenance. No source binary.
role + group authorisationSource binary fetched from the originating DMS, served through Atrium with audit.
step-up auth + auditAtrium implements Model D of a four-model federation taxonomy. Source documents remain in the firm's existing DMS — they are never copied, never re-hosted. Atrium ingests only the claims: extracted assertions, classifications, citations, and provenance metadata.
On a full-document request (L6), Atrium fetches the binary from the originating DMS at request time, through that DMS's own authorisation, with the fetch itself recorded in the append-only audit trail.
iManage, NetDocuments, Litera, and other major legal DMS systems. Documents are read in place; nothing is replicated.
Each DMS's native classification scheme is mapped onto a canonical five-level ladder — Public, External, Internal, Restricted, Privileged.
L2, L3, and L4 disclosures above Internal route through a Silo Steward queue. Approvals, rejections, justifications all logged.
First view of Restricted or Privileged in a session, bulk export, reclassification, and override all require a second factor and are audited.
OPA-compatible policy sidecar (regorus, embedded). Disclosure rules are versioned policy, not application code.
Hash-chained audit log periodically anchored to an external witness — the firm proves the log existed, in this state, at this time.
An independent, source-available WASM module re-verifies any audit segment. Trust the log without trusting the host.
Tenant Admin · Silo Admin · Silo Steward · Group Compliance · Client Relationship Partner. Each has scoped, audited capabilities.
