One client, one vault: per-client memory for AI Interview

AI Interview’s June release changes where intake memory lives. Until now a tenant held its intake briefs in one encrypted store, visible to the intake team as a whole, and a returning caller started from nothing. From this week, each client has a vault.

Summary

• Intake memory is scoped per client. A vault holds the intake brief, transcripts, limitation-period calculations, conflict-check results and any documents the client supplied.
• Each vault is encrypted with a key derived from the tenant key and the client identifier. A session for one client cannot open another client’s vault; the key does not exist in that session.
• Returning callers resume. A client who calls back a week later is not asked for their address again, and is told what Interview already has.
• Linking a vault to a matter is a deliberate action by the firm, not automatic.
• Sealing a vault freezes it and restricts access to a named list. Purging a vault deletes it after a 24-hour grace period, with a logged record that it existed and when it was removed.
• Existing intake briefs have been migrated into vaults keyed by intake identifier. Nothing was deleted and nothing was merged.

Why

Three requests, from different firms, pointed the same way.

The first was continuity. Intake rarely finishes in one call. A caller rings about an eviction notice, is asked to find the tenancy agreement, and rings back two days later. Starting again from the beginning is bad for the caller and bad for the brief, which ends up with two half-versions.

The second was separation. Several firms asked that intake staff working on one prospective client not be able to browse another’s details. A shared intake store made that a permissions problem; a vault makes it a key problem, which is harder to get wrong.

The third was defensibility. A firm that declines a prospective client and later acts against them needs to show that what the prospective client disclosed went no further. Sealing a vault produces a record that it was frozen, who could open it, and that nobody did.

Identity and migration

A vault is opened by a credential, not by a voice. Interview does not use voice biometrics and we have no plans to. When a firm’s intake begins, Interview issues the caller a return code or a link, delivered by the channel the firm has configured, and a returning caller presents it. A phone number is not treated as identity; numbers are shared, spoofed and reassigned.

A caller who returns without their code is treated as new. The firm can merge the two vaults after verifying identity by its own means. Merge is a one-way operation and asks for confirmation twice.

Migration ran over the past fortnight. Every pre-existing brief now sits in a vault of its own, keyed to its original intake identifier. Where the same person clearly called twice before the release, the firm will see two vaults, and can merge them or not.

What to watch for

• Intake staff lose the cross-client view. A new vault list shows metadata only: a reference, a date, a status, the responsible person. Opening a vault is a logged action.
• Conflict-check results now live in the vault, not in a tenant-wide list. Firms that exported that list to their own systems should re-point the export.
• Purge is real. After the grace period the vault key is destroyed and the content is unrecoverable. Zero retention means there is no copy on our side to restore. Firms with regulatory retention obligations should seal, not purge.
• Sealing restricts access but does not stop limitation-period reminders. If a deadline is approaching for a sealed vault, the named list is notified.

Known limitations

• Vaults are per tenant. A client who approaches two firms using ZAAN has two unrelated vaults, and that is correct.
• Vaults do not feed Recall. An intake brief is not precedent and is not indexed as one. Firms that want intake facts in the matter file link the vault to the matter and export the brief.
• The return code is only as safe as the channel it travels on. Firms serving callers without reliable private channels, which includes several Open Bar clinics, may prefer to verify returning callers by a human step.
• Interview remains unavailable in air-gap mode, so vaults do not travel to sealed laptops.

One client, one key, one place. The design is not elaborate, and we think that is in its favour.