← Back to home

Vendor disclosure

Last updated: August 31, 2026

This page exists so a firm can put a copy of it in its file. ABA Model Rule 5.3 makes nonlawyer assistance the firm’s responsibility to supervise; supervising a vendor means knowing what the vendor does, what it holds, and what it has been told not to do. Everything below is stated plainly for that purpose rather than written to reassure.

1. Who we are

Northstack LLC, 1209 Mountain Road PL NE #12611, Albuquerque, NM 87110, United States. getboxagent is our product. The service is operated by one person, working remotely from Turkey. No employees, contractors, or offshore intake staff handle your inquiries; there is no call center and no human reads a write-up in the ordinary course.

2. What we do

We ask the intake questions your firm has approved, in the order your firm approved them, and record the answers as a written intake summary (a “write-up”) in your panel. That is the whole service.

3. What we do not do — and are instructed not to do

We ask for less than we could, on purpose. Comment [4] to Rule 1.18 tells a lawyer weighing a new matter to limit the initial consultation to only such information as reasonably appears necessary for that purpose — because what a firm learns from a prospective client can disqualify it under Rule 1.18(c) even where it declines the matter and no representation ever begins. Intake is built to that: it asks your approved question set and nothing beyond it, it accepts no file uploads, and it opens by telling the inquirer to answer only what is asked and not to volunteer more. If your firm would rather condition intake on the informed consent described in comment [5], that agreement has to be in your own words and is yours to draft — send it to us and we will put it in front of every inquirer before the first question is asked.

4. What we hold

For each inquiry, only the fields in your question set. In the default set that is: matter type, jurisdiction, incident date, injuries and treatment, whether the inquirer already has counsel, the opposing party, the inquirer’s name, their contact details, and the page on your site the inquiry came from. Plus the time it arrived.

We do not hold your case files, your client list, your calendar, your email, or anything else belonging to the firm. Nothing we run has access to your systems.

5. No generative AI in written intake

Where an inquiry reaches us in writing, the intake runs a fixed question set in the inquirer’s own browser. Their answers are not sent to OpenAI, Google, Anthropic, or any other generative AI provider, and no model is used to write, summarize, or rephrase a write-up. The write-up is what the inquirer typed, in your field structure. That is the whole of Managed Intake, and it is the written half of Everything.

This section used to say the same thing about the service as a whole. It cannot any more, and we would rather narrow it in writing than leave you relying on a sentence that has stopped being true: on the plans where we answer a telephone line, a model is in the path. Those are exactly the separate, separately disclosed plans the old wording promised. They are described in section 5a, and no firm is moved onto one without buying it.

5a. The voice line: what answers it, and what it keeps

This section applies only to the plans on which we answer a routed telephone line — After-Hours Cover, Full Intake Desk, and the voice half of Everything. None of it applies to Managed Intake, which is written intake and is covered by section 5. If your firm buys Managed Intake alone, no telephone line, no recording and no voice provider is involved in your account at all.

A machine answers, and it says so. The line is answered by an automated voice system, not by a person. Before it asks anything, it tells the caller that they are speaking with an automated intake system for the firm, that it is not a lawyer and cannot give legal advice, that the call is recorded, and that nothing said on the call creates an attorney-client relationship. We do not let that notice be removed, shortened or contradicted, and we will not configure a line to imply that a person is on it. The same commitment is written into clause 5 of our Terms of Service, where it binds your firm as well as us.

Who runs it. The voice system is provided by Retell AI, Inc. Retell in turn uses a speech-to-text provider, a text-to-speech provider, a large language model provider, and a telephone carrier. Those are chosen per agent, so rather than list every vendor we might pick, we name the exact set that will be in your path, in writing, before your line goes live. Ask for it as part of the question set sign-off in section 12.

Training is switched off, deliberately. Retell’s default terms let it process call data for the development, training and improvement of its models. We turn that off per agent. That opt-out is a required step in setting up a line, not a default we inherit, and a line does not go live without it. Retell also publishes a Business Associate Agreement and a Data Processing Addendum that a pay-as-you-go customer can self-sign at click-agreements.retellai.com, and states there is no additional fee to sign them (Retell, Compliance). We sign both.

What is kept, and for how long. A call produces an audio recording and a transcript at Retell, and the transcript is what fills in your fields. Retention for your agent is set to one day — the shortest period Retell offers, against a maximum of two years — and it covers the recording, the transcript and the logs alike. Access to a recording inside that day is through a signed, expiring URL rather than a public link. No call audio and no raw transcript is copied to us or into your panel. What reaches your panel is the write-up: your fields, filled in with what the caller said. Once the day is out, that write-up is the only record of the call that exists anywhere, and it expires on the schedule in section 6.

Recording, and who has to get consent. The call is recorded, for the one day described above, and the caller is told so in the opening notice before answering a single question. That notice is the consent mechanism, and we run it on every call without exception. What we cannot do is tell you whether it satisfies the law where your callers are: some states require only one party to a call to consent to recording, and others require every party, and which rule applies can turn on where the caller is sitting rather than where your firm is. Deciding whether our notice meets your jurisdiction’s consent requirement is the firm’s call, not ours — it is a question about your obligations to your own prospective clients, and answering it would be giving you legal advice, which is the one thing this whole document says we do not do. Two things follow. If your jurisdiction needs different or longer wording, send it to us and we will read it out verbatim. And if your firm cannot accept the call being recorded at all, do not buy a voice plan: every voice provider we assessed records, one day is the floor rather than a setting we chose to stop at, and Managed Intake takes inquiries in writing with no recording anywhere in the path.

6. Where write-ups live, and for how long

Write-ups are stored in Cloudflare Workers KV and read back only through your panel. Cloudflare states that objects in Workers KV are “encrypted using AES-256… [in] GCM (Galois/Counter Mode)” at rest, and that traffic between a Worker and KV is secured with TLS (Cloudflare, KV data security). Traffic between your inquirer’s browser and us is HTTPS.

A write-up is deleted automatically 90 days after it arrives. That deletion is set at the moment it is stored, not run as a clean-up job later. ABA Model Rule 1.18 treats a prospective client who never becomes a client as still owed confidentiality, which is why we do not keep them indefinitely. If your firm needs a longer or shorter period, say so and we will set it for your account.

You can ask us to delete a specific write-up, or all of them, at any time; we do that within 5 business days and confirm in writing.

Inquiries that get screened out. By default an inquiry that fails your criteria is still written up and kept like any other, because most firms want to see what they turned away. Some would rather not hold it, and there is a reason to prefer that: Rule 1.18(c) reaches information learned from a prospective client the firm never takes on, so a declined inquiry sitting in a panel for 90 days is 90 days of that exposure for no return. Tell us and we will set your account so a screened-out inquiry keeps only the fact that it was screened out and the criterion it failed — no name, no opposing party, none of the facts of the matter. It is one setting, we do not charge for it, and you can change it back.

7. The notification email, and Opinion 477R

When an inquiry is written up, we email the address you nominate. That email contains the firm name, the time, and a link to your panel. It does not contain the inquirer’s name, contact details, or anything they told us.

ABA Formal Opinion 477R concludes that unencrypted routine email remains an acceptable way for a lawyer to communicate about a representation where the lawyer has undertaken reasonable efforts to prevent unauthorized access, and that stronger protective measures, such as encryption, may be called for when the information is particularly sensitive. Ordinary email delivery negotiates TLS only where both mail servers offer it, and neither we nor you control every hop. Rather than argue about whether a given hop was encrypted, we keep confidential content out of the email entirely: the content stays behind your panel, reachable only with your firm’s own key. That is the reasonable effort we are relying on, and it is the same answer whether or not your mail provider negotiates TLS.

8. Who can read your write-ups

The intake endpoint accepts requests only for the domains you list, and is rate limited per address to make bulk abuse impractical.

9. Subprocessors

These are the only third parties involved in delivering the service.

The last two exist only if you buy a plan on which we answer a telephone. On Managed Intake the list is the first three and nothing else.

We will tell you in writing before adding a subprocessor that would see intake content.

10. If something goes wrong

If we become aware of unauthorized access to, or loss of, write-ups belonging to your firm, we will notify you within 72 hours of becoming aware, by email and by phone if you have given us a number, and tell you what we know at that point rather than waiting until the picture is complete. Reporting obligations to clients, courts, or a bar are the firm’s to discharge; our job is to make sure you learn about it early enough to discharge them.

11. Ownership, and what happens if you leave

Your write-ups are yours. They are not our data, and nothing in our terms claims a license to reuse them. Your panel stays readable until the end of the period you have paid for, so take out of it what you want to keep before then. What remains after that is deleted by the same automatic 90-day expiry described in section 6 — nothing is retained because an account closed. Ask, and we delete it immediately instead and confirm in writing.

12. Supervision, and what we ask of you

Under Rule 5.3 the firm remains responsible for the conduct of nonlawyer assistance it retains. We are not asking you to take our word for anything in this document: ask for the question set in writing before it goes live, keep a copy of this page with the date on it, and tell us if any of it is not what your jurisdiction expects of a vendor. If a rule in your state requires something we do not do, we would rather be told than find out from your bar.

13. Contact

Northstack LLC, 1209 Mountain Road PL NE #12611, Albuquerque, NM 87110, United States. [email protected].