00
Four minutes, before the long read.
The whole argument walked through end to end: why guessing is a liability in practice, how the three layers are built so the system abstains instead, and what that changes on the page. Everything below is the same thing in detail.
01
Not a better model. Better boundaries.
Every legal AI tool promises accuracy. Certus Law makes two narrower promises, and holds them with code rather than hope. The model proposes. Code decides what is safe to publish.
It abstains when it does not know
Certus does not guess a statute, a deadline or a citation. When the research tiers hold nothing, it says so and marks the gap as a placeholder instead of inventing a figure to fill it.
It does not hallucinate authority
Every citation is looked up before a word of the argument is written. A citation either has a record that carries it or it does not. That test is a predicate over retrieved records, checked by code. There is no probability in it and no model judging its own work.
02
Counsel, the chat that shows its sources.
Counsel is the everyday assistant for drafting, research and document work. The global Assistant handles quick questions and first drafts. Matter chats open inside a matter and already know every document in the file.
Streaming, with tools in view
Replies arrive as they are written. Underneath, a status line names exactly what is running: searching the law, calculating a deadline, verifying the draft in deep mode.
Citations you can open
A citation renders as a chip. Click it and the source opens in the side panel, scrolled to the passage and highlighted, without losing your place. Every recognised South African citation is a link: a neutral citation such as [2000] ZACC 19 opens the judgment on SAFLII directly. A link that leads nowhere is itself a warning.
Turns that survive a dropped connection
Once Counsel starts, the work continues on the server if your phone locks or the network drops. Reopen the chat on any device and the reply resumes where it was. Stop means stop: it ends the turn itself, not just your view of it.
Documents, voice and export
A document side panel saves as you work and downloads to DOCX. Replies can be read aloud sentence by sentence, and dictation types your speech straight into the composer.
03
CertusHD, where verification is arithmetic.
For heads of argument, legal opinions, founding and answering affidavits and particulars of claim, the verified deep mode starts on its own before any drafting. Routine questions do not trigger it. An export of authority-heavy work is refused once if CertusHD has not run, so the second attempt goes through verified or honestly flagged.
// Grounding is a predicate, not a judgement. verified(cite) ⇔ ∃ r ∈ hits(cite) : carries(r, cite) // a case is carried when the record holds its citation key and a party name case: carries ⇔ citationKey(cite) ∈ keys(r) ∧ partyToken(cite) ∈ tokens(r) // a statute is carried when the record holds "N of YYYY" and a short-title word statute: carries ⇔ "N of YYYY"(cite) ∈ r ∧ ∃ w ∈ shortTitleWords(cite) : w ∈ r // a court rule is procedure, cited by number, never treated as authority rule: never verified
Discovery from the corpus
A model that proposes ten authorities and is right about two should not decide the case law. Candidates are retrieved from the research tiers and each one is tested against its record before it can be used.
A code score, not a model judge
A judge model shares the drafter's blind spots and adds its own. A formula has neither, and its weights are on the page for anyone to dispute. An invented case is weighted far more heavily than an invented statute, because a judgment that does not exist is the failure that ends careers.
Corrections that cannot sneak authority back
A revision is accepted only when the score does not rise. "Improving" a draft is exactly how unverified authorities creep back in, so the rule forbids it.
The run card lists every authority it verified and every one it could not find. The failure is shown, not hidden. That list is the product.
04
The Legal Butler, always on.
Separate from the chat and built to work in the background. Ask it to do something and get on with the matter. It hands anything that needs drafting or hard legal reasoning to Counsel, and tells you it has done so.
Hands-free voice calls
Start a call and the Butler listens, thinks and replies out loud. Say "approve" or "yes" to let it proceed. It checks in after two and a half minutes and ends the call after three minutes of silence.
Durable runs
A non-trivial task becomes a durable run that keeps working if you close the tab and resumes when you return. Every run carries a timeout, so nothing works silently and indefinitely in the background.
Approvals you control
Before it reads private data, exports anything or delegates a draft, it asks: allow once, allow this session, or always allow. Standing grants are saved to your account and listed on the Butler page, where each can be removed. On a phone, requests you make are pre-approved, because tapping tiny buttons mid-drive defeats a hands-free assistant. Desktop keeps the full approve and deny flow.
Morning brief
Overdue to-dos, meetings waiting on a slot, and the labour law news that matters, ready when you sit down.
05
Three research tiers, in a fixed order.
Every legal question moves through the same three tiers in the same order, and the order is the product. Each tier is cleaner and more authoritative than the next, so the open web is consulted last and only to confirm.
Tier one. The Tinman Corpus
South African case law, with labour law in depth, plus the consolidated labour Acts, their regulations and the CCMA rules. Its value is cleanliness, not size: every record is one typed unit, one judgment or one section of an Act, carrying its own citation, court, date and heading. That is why a search returns the provision rather than a page that mentions it, and why a citation can be verified against the record character for character.
Tier two. ActIntel
National legislation as enacted, with statutory definitions and the obligations and penalties each provision carries, including the cross-references that show what relies on what.
Tier three. The open record
SAFLII, the Constitutional Court, the Supreme Court of Appeal, the Labour Court, the CCMA and the Government Gazette. Used last, focused by purpose, and a page counts only if it actually carries the citation.
Search that finds the word and the meaning
Search over your knowledge base, matters and the library is hybrid. A keyword lane ranks with BM25, so an exact name matches exactly. A meaning lane turns each passage into 1,024 numbers describing what it is about, so two passages on reinstatement sit together whether or not they share a word. The two lanes are fused with Reciprocal Rank Fusion, which rewards results both lanes agree on.
06
Figures, deadlines and slots. By code.
A number, a date or a time from a language model is a guess dressed as a fact. Code that is right once is right always. Certus Law never lets the model calculate. It calls Certus Logic and quotes the result.
A deterministic engine
Notice, severance, leave, remuneration bases, statutory caps and referral time limits are computed from the statutory formula and the inputs the lawyer supplies. There is no temperature and no sampling. The same facts return the same answer on every run, in every firm. Selected statutes are additionally formalized in Catala, a language whose core compilation steps are proven correct in the F★ proof assistant.
Deadlines, counted
Court days exclude weekends and public holidays, calendar days do not, and periods a rule excludes are skipped. The result names the rule it applied and lists every day it stepped over, which is exactly what you need when the other side disputes service.
The slot solver
Meeting times are solved, not suggested. The day is laid on a thirty minute grid, a slot is feasible only if it clashes with nobody and breaks no hard constraint, each feasible slot is penalised for every soft preference it bends, and the best three are returned with the reason each was chosen.
07
A matter's life, start to invoice.
A matter is the unit everything organises around. Documents, chats, reviews and time all live inside one.
Conflict check
Before taking a brief, paste in the names involved and the system searches your firm's own matters, documents and chats. A hit means review required, not a conclusion.
Documents that are ready when you ask
Word, PDF, PowerPoint, Excel and more, up to 25 MB each, with scans read by OCR where configured. Text is converted once at upload. Ask about four documents a minute after uploading them and Counsel reads what is ready, reports the rest as pending rather than missing, and cites passages directly.
One clock per lawyer
Start a clock on a matter and any clock already running for you stops and saves. The billable summary splits each matter into billable, non-billable, unpriced and unconfirmed time, in Rand, exportable to CSV over seven, thirty or ninety days.
08
Memory that stays trustworthy.
Counsel and the Butler share one lightweight memory of confirmed facts and preferences, so you never maintain two profiles. The permissions are deliberately unequal, so the memory cannot quietly drift.
| Who | Read | Add | Correct | Remove | Merge duplicates |
|---|---|---|---|---|---|
| Counsel and every persona | Yes | Yes | No | No | No |
| The Butler, as memory manager | Yes | Yes | Yes | Yes | Yes |
| You, on your profile page | Yes | Yes | No | Yes | No |
Memos, to-dos and reminders
Capture a thought without starting a chat, then turn it into a memory note, a to-do or a scheduled reminder in one tap, or ask the Butler to act on it and close it out.
Legal Recall
When your firm switches it on, every member gets exact search over their own chats, notes, memos and to-dos, for precise phrases, section numbers and citations. Each member's material is indexed privately and is never searchable by a colleague.
09
Documents, decks and forms, checked before you see them.
Everything Counsel and the Butler produce is tracked in one registry. Deleting a document removes the file but keeps a record that it existed, so a document's history can never disappear without a trace.
Workbooks that are checked
Before a spreadsheet is announced as ready, every formula error in it is counted. The alert either confirms every formula evaluates, or says how many cells are wrong and where.
Slides that fit
A model writing slides places boxes by guess. Certus measures text against real character widths and lays it out the way the renderer will, then counts anything that crosses the slide edge or overflows its box before telling you the deck is ready.
Forms and insights
Fillable court, CCMA and regulator PDFs are completed in chat. The Insights page charts your firm's own activity, token use and top workflows from the audit trail, never from what was said.
10
32 personas. 429 workflows. Your own.
A persona changes tone and emphasis, not the underlying legal analysis. Switch mid-chat and the chat remembers it.
Practice-area personas
Litigation, family, employment, tax, property, insolvency, competition, mining and environmental, capital markets, intellectual property, POPIA, the CCMA and more, each tuned to its area's terminology. Use one as it is, or duplicate it and change its tone, avatar and tool access.
Workflow library
CCMA referrals, business rescue, POPIA compliance and section 145 reviews among hundreds of templates. Draft your own and save it for the firm.
11
Privacy by construction.
Built around POPIA, with your firm as the responsible party and Certus acting as an operator under sections 20 and 21. Two pieces of arithmetic sit under every firm's data.
// each firm is a separately encrypted database file (SQLCipher) // its key is never stored: it is derived when needed firmKey = HKDF-SHA-256(platformMasterKey, firmId) // every action is appended to a hash chain hash(n) = SHA-256( hash(n-1) ‖ canonicalJSON(record(n)) ) // alter or delete one record and every hash after it breaks
Content stays in your file
Matters, documents, chats and time entries live in your firm's own encrypted file. Platform telemetry records what happened and when, never what was said, drafted or uploaded. Support staff cannot read your prompts or documents by browsing a database.
Firm keys and data custody
Your firm's database is protected by a key set the platform cannot use alone. Your share is shown exactly once. Without it nobody, including Certus staff, can unlock the firm's data in a recovery, and every access that does occur is recorded for the firm to see.
Search computed on our own server
The vectors behind meaning search are produced by an open model running on the Certus server itself. Nothing is sent to an embedding provider, in South Africa or anywhere else.
The agreement, on the record
The Data Processing Agreement and its annexures, covering the POPIA processing description, security overview and sub-processors, are available to firm owners and administrators to accept in the app.
12
If we are pressured, we still cannot.
The question a partner eventually asks is not what our policy says. It is what happens when someone with authority insists. The answer is set by the architecture above, not by a promise, and it comes down to three things.
One: a key we cannot use alone
Your firm's database is encrypted with a key the platform holds only part of. The other part was shown to your firm once, at setup, and Certus keeps no copy of it. Served with a demand, we can produce the encrypted file and nothing that reads it. That is not discretion on our side; there is no procedure by which we could comply further.
Two: a record that cannot be quietly changed
Every action is appended to a hash chain, each entry sealing the one before it. Altering or removing a single record breaks every hash that follows. So an access your firm was not told about cannot be hidden after the fact, and the check is arithmetic your firm can run itself.
Three: nothing is sent away to be understood
The vectors behind meaning search are computed on the Certus server by an open model. No embedding provider, local or offshore, ever receives a line of your work, so there is no third party who could be asked for it instead. Platform telemetry records that something happened, never what it said.
What this does not claim
Your firm remains the responsible party under POPIA and can always be required to produce its own records, as it could with any filing cabinet. What changes is that Certus cannot be used as the way around you.
13
Ready in a minute.
No password to remember and no app store to visit.
Sign in with a link
Enter your email and open the link that arrives. It expires after ten minutes. The first time, claim your firm's name to become its administrator, or ask a colleague who already has to invite you.
Install it on your phone
Certus Law installs like a native app. Chrome on Android offers it directly, and on an iPhone use Share, then Add to Home Screen.
Under your firm's own name
Once your administrator adds a logo and a short chat name, the header, the browser tab and the installed app's icon all carry your firm's branding, with nothing to rebuild or reinstall.
Your choice of model
Pick the model behind Counsel from those your deployment offers, and bring your own key for supported providers if you prefer. Changing the model changes the engine, never your data, memory or documents.