Each firm runs its own instance, in its own account.

A firm stands up its own instance of Chandlery, in its own cloud account or cluster. It loads its own people and matters, and keeps everything its people build. The platform costs nothing; the firm pays only for what it runs.

What the firm gets

A workspace in the firm's own name and colours, and the platform beneath it.

Its matters, as each person may see them. Documents to the passage, the order of proof, the chronology, the experts and their opinions, every claim pinned to its source.
A queue of what was proposed. What models and apps propose waits there for a lawyer allowed to accept it.
A conflicts check across every matter, run without reading any document.
Apps, from the firm's own catalogue, and any its people build in plain words and share.
An honest record. A watermark naming whoever is looking, a record of what each person was shown, and exports the firm's IT can check.

What the firm needs

A cloud account or a cluster. Vercel, or any Kubernetes, with Postgres 17 and storage behind the S3 API.
An identity provider that speaks OpenID Connect, so people sign in with the accounts they already have.
The model providers it approves, under its own contracts and keys, which the gateway holds and no app ever sees.
Someone to run it, at the firm or a contract engineer. The deploy scripts and runbooks stand an instance up, and the conformance suite says whether it holds.

Its people and its brand

One file sets the firm's people and their roles, who is staffed on which matter, the walls between them, the watermark, and the brand: the firm's name, colours, mark and heading face.

The workspace carries the firm's name. Chandlery appears once, in the footer.

It's free.

What it costs

Nothing for the platform: no subscription and no seat licences. The firm pays its cloud provider for hosting and its model providers for calls, at their prices and on its own bills. The gateway caps what each run may spend, and records every call.

When a matter ends

A matter is dropped whole: its partitions in the database, with every passage and embedding in them, and its documents in storage. There is no partial delete.

How firms take it on

Complex requirements, or no capacity. A contract engineer builds and deploys for the firm.
Standard requirements and some technical people. The firm deploys the platform and builds its apps itself.
Capacity to build. The firm writes any app over its corpus. An app can still be wrong, which is why what it proposes is reviewed and accepted.