Security

Held in confidence.

Client work is privileged. Here is what Diemir does to keep it that way, exactly what it reads from Microsoft 365, and what we can't claim yet.

Role · Billing

One of 34 permissions, in 4 groups

View organization audit log activity.

Audit logEntries can't be edited

Figure · Flip one permission and the audit log records it. Example data.

The controls

Read-only Microsoft 365: Diemir reads your calendar, mail, files and notes to show your day. It never sends mail, moves files or changes your calendar.
Roles with 34 permissions: Owner, admin, timekeeper and billing roles to start, and your own custom roles. Each permission is a separate switch, from seeing rates to approving discounts.
Two-factor sign-in: Each person can turn on two-factor sign-in with an authenticator app or an email code, with backup codes for a lost phone. [FIRM-WIDE REQUIREMENT: NOT YET AVAILABLE]
Submitted days lock: Once a day is submitted, its entries refuse changes until someone unsubmits them. Approved and invoiced time stays locked.
An audit log you can't rewrite: Changes are recorded with who made them and when. Entries can't be edited, and only people with the permission can read them.
AI only when you choose: AI is off until your firm sets a monthly spending limit and chooses who may use it, and each lawyer turns it on for themselves. The firm can choose among Claude, GPT and Gemini models. [AI PROVIDER DATA TERMS: VERIFY]
Agents can't submit your day: An AI assistant connected over MCP signs in with your consent and can read, draft and propose. Submitting or unsubmitting a day is refused to every agent, in code.

These are the exact permissions Diemir requests when you connect Microsoft 365. Every one of them is read-only.

Scope	Why
openid, profile, email, User.Read	Who you are, to sign you in to the connection
Calendars.Read	Your calendar events, to place them on your day
Mail.Read	Mail you send and receive, to show it beside your time
Files.Read.All, Sites.Read.All	OneDrive and SharePoint file activity
Notes.Read	OneNote pages you work in
offline_access	Staying connected without asking you to sign in each day

No SOC 2 report yet: Diemir hasn't been through a SOC 2 audit, and we won't say otherwise until it has.
No single sign-on: People sign in with their own password, and two-factor if they've turned it on.
Hosting and subprocessors: Diemir runs on Convex and Vercel, and renders invoice PDFs on Google Cloud. [HOSTING REGION AND SUBPROCESSOR LIST: VERIFY BEFORE LAUNCH]