™The rulebookcame first.
George was governed before it was launched. Six volumes and 25 policies set how it handles data, security, AI and legal content. Accountability first. Deployment second.
AI between
public trust
and the judiciarydeserves caution.
We're an early-stage organization operating between AI, public institutions, and public trust.
We recognize the caution required of the judiciary and institutional partners to engage emerging technologies and private entities; such caution is essential to preserve the integrity, neutrality, and public trust in courts.
This Governance Framework and Policy Library is our substantive response to that reality. It is intentionally designed to exceed our legal obligations and to establish documented, auditable accountability consistent with the standards public institutions rightly require. An organization operating in proximity to the judiciary bears a heightened responsibility to govern itself accordingly.
Access to justice remains a complex and enduring challenge. While technology alone can't resolve it, responsible and carefully governed innovation will contribute meaningfully. We're committed, with humility and reverence, to be a steward worthy of the trust placed in us.
David Gibson, FounderGeorge Legal Technologies, PBCGovernedin the open.
Virginia's statutes are the floor. George's governance library is designed to exceed them, and we'll prove it: every partner receives access to our governance and compliance register and dashboard.
Readthe rulebook.
Six volumes. 25 policies. 180 pages. Adopted effective July 30, 2026. Each policy carries a review date of July 30, 2027.
Each summary gives a policy's purpose and why it stands as its own document. The full text of each policy governs in all cases.
Volume 1Corporate Governance4 policies · 4 internal
Governance Charter
The apex governance document for George Legal Technologies, PBC, a public benefit corporation, establishing the organization's mission, values, decision-making authority, and the complete policy hierarchy. It defines reserved decisions requiring Ownership approval, establishes the roles and responsibilities of the founding director across all governance functions, and sets the standards for risk management, conflict of interest, and government contracting integrity. Every other document in the Policy Library is subordinate to the Charter, and the Charter is the first document a judicial or government reviewer will consult to understand how George is governed.
Full text available to partners.Code of Ethics
Establishes the personal conduct standards, confidentiality obligations, conflict of interest requirements, and reporting expectations for all Covered Persons, including employees, contractors, and advisors. It reflects George's position as a public benefit corporation operating in the Commonwealth of Virginia, with obligations to SRLs, partners, and the Commonwealth that go beyond ordinary commercial standards. The Code includes a whistleblower protection provision and an annual acknowledgement requirement, so that ethical obligations are actively renewed each year.
Full text available to partners.Compliance Management Policy
The operational framework through which George identifies, tracks, escalates, and remediates its compliance obligations across its obligation sources: Virginia law, corporate law, government contracts, internal governance standards, and public benefit purpose obligations. It establishes a unified Compliance Log and organizes monitoring obligations into a practical cadence: ongoing, monthly, quarterly, annually, and event-triggered. The annual compliance self-assessment produced under this Policy is George's primary certification of its governance posture to Ownership and, when requested, to partners.
Full text available to partners.Advisory Board Charter
Constitutes George's Advisory Board under Article IV of the Bylaws and defines its purpose, composition, limitations, and operating requirements, satisfying the requirement in Section V.G of the Governance Charter that the advisory board be documented and approved by Ownership. It establishes that advisory board members are not directors, hold no fiduciary duties, and cannot bind the corporation, while giving them a substantive role: guidance on mission alignment, legal accuracy, access-to-justice considerations, institutional relationships, and organizational capacity and sustainability.
Full text available to partners.Volume 2Data Governance and Privacy6 policies · 2 public · 1 partner · 3 internal
Privacy Policy
George's public-facing statement of its data practices, SRL rights, and commitments regarding the collection, use, and protection of personal data. Written in plain language accessible to self-represented litigants, it satisfies the transparency requirements of the Virginia Consumer Data Protection Act (VCDPA) and establishes the foundational privacy commitments that all internal governance documents are required to honor. It is the document SRLs likely encounter first and the reference point against which partners assess George's public data protection posture.
Read the full textData Governance Policy
The internal framework governing how George manages data across its entire lifecycle, including the principles of purpose limitation, data minimization, and accountability that apply to every data category. It establishes George's role as a VCDPA data controller, the prohibited uses of SRL data, and the data ownership model that governs relationships with subprocessors and partners. As the backbone of Volume 2, it is the document that ties together the more specific standards in GG-2.03, GG-2.04, and GG-2.05.
Full text available to partners.Data Classification and Handling Standard
Assigns every category of George data to one of four classification levels: Public, Internal, Sensitive, and Restricted. It establishes the specific handling requirements for each: who can access it, how it must be stored, how it may be transmitted, and how it must be deleted. Written as four practical classification cards, it is the document the organization consults to answer a specific handling question and the document institutional partners review to assess whether George's data protection controls are proportionate to the sensitivity of the data it processes.
Full text available to partners.Data Retention and Deletion Standard
Establishes the retention schedules, deletion methods, and verification requirements for every category of data George holds, including session data, uploaded documents, contact information, security logs, and governance records. It implements George's data minimization commitment operationally and establishes the legal hold procedure that overrides normal schedules when litigation or regulatory investigation requires preservation. Partners and the judiciary look to this document to confirm that SRL data is retained only as long as its purpose requires and that deletion is verified.
Full text available to partners.Data Processing Addendum
A partner-facing commitment document that extracts and formalizes George's data processing obligations into a single signed instrument delivered to each partner. It makes George's existing internal commitments on processing purposes, security measures, retention, subprocessors, SRL rights, and breach notification externally binding and enforceable by the partner, and it adds no new obligations. It is included because most government and judicial partners require a signed, auditable record of George's data processing commitments before deploying the platform in their facilities.
Delivered to each partner as part of the pilot agreement.Cookie and Tracking Technologies Notice
The public-facing disclosure of how George uses cookies, session technologies, and analytics tools on the Platform and at GeorgeVA.com. Consistent with George's data minimization principle, the Notice limits tracking to three strictly necessary categories: session continuity and security cookies, aggregated performance analytics, and abuse prevention mechanisms. It expressly prohibits behavioral advertising, cross-context tracking, social media pixels, and the sale of personal data, and requires that any third-party analytics or security vendors operate under written data processing agreements that bar independent use of Platform data. The Notice supplements the Privacy Policy, which governs in the event of any conflict, and provides Virginia residents with a complete statement of their VCDPA rights and the process for exercising them.
Read the full textVolume 3Information Security Program4 policies · 4 internal
Information Security Policy
The primary security governance document for George, incorporating the access control and encryption standards as sections within it, reflecting George's cloud-native reality. It establishes security objectives, the risk assessment framework, encryption requirements (AES-256 at rest, TLS 1.3 in transit), access control and credential management standards, secure development obligations, and the annual security review process. Partners and judicial reviewers consult this document to confirm that George's security controls are proportionate to the sensitivity of the personal data it processes on behalf of the public.
Full text available to partners.Incident Response Plan
A seven-step operational procedure designed to be opened and followed during a security incident: Identify, Contain, Assess, Notify, Eradicate, Recover, Review. Every statutory deadline, every required contact, and every decision point is embedded in the step where team members will need it, including the 72-hour partner notification window and the contact address at the Office of the Attorney General of Virginia for breach notification under Va. Code § 18.2-186.6.
Full text available to partners.Business Continuity and Disaster Recovery Plan
Establishes George's recovery objectives (a 4-hour recovery time objective and a 24-hour recovery point objective), backup strategy, and step-by-step procedure for restoring platform availability following an outage, written honestly for a cloud-native platform whose disaster recovery is primarily cloud provider resilience plus documented backup configuration. It includes the partner communication obligations during outages: proactive notification before a partner learns of unavailability from complaints, and annual testing requirements that confirm backups are restorable. It is included because most government service commitment agreements carry service availability expectations that survive cloud provider SLA events.
Full text available to partners.Third-Party Risk Management Policy
Governs how George evaluates, onboards, monitors, and offboards the vendors and subprocessors that process George data or provide services material to the platform, using a three-tier classification scaled to the data access and operational criticality of each vendor. The most rigorous requirements apply to Tier 1 subprocessors, the cloud infrastructure provider and AI API provider, including mandatory written data processing agreements, annual review, and contractual confirmation that SRL data is not used for AI model training. It is included because partners and the VCDPA both require George to be accountable for how its subprocessors handle data, as well as for how George itself handles it.
Full text available to partners.Volume 4AI Governance and Risk Model3 policies · 1 public · 2 internal
AI Governance Policy
The cornerstone AI governance document, establishing how George uses a commercially available large language model responsibly within a decision tree framework designed specifically to constrain outputs to procedural guidance. It covers the framework for unauthorized-practice-of-law risk, the design-level controls and output monitoring obligations designed to keep the platform from producing legal advice, alongside output validation, human oversight, change management for AI configuration, bias and fairness at the scope appropriate for a procedural platform, and the no-training commitment. It is written explicitly from the perspective of an API consumer: George uses a provider's model and operates none of its own.
Full text available to partners.AI Transparency and User Disclosure Notice
A public-facing plain-language document explaining to SRLs that they are interacting with AI, what the platform does and does not do, how their data is handled, and how to exercise their rights. It is written for a self-represented litigant, and the language reflects that purpose. It is designed to meet the transparency standard of Section 5 of the FTC Act and the UPL posture requirement that SRLs understand the platform's informational-only nature.
Read the full textLegal Change Management and Legal Decision Tree Governance Policy
Establishes the monitoring, assessment, and content update process through which George keeps its decision tree logic current with Virginia law, including specific response timelines for different categories of legal change (Immediate: 5 business days; Priority: 30 days) and the validation sequence required before any content update is deployed. It is one of the most operationally consequential documents in the library and is referenced throughout the governance framework as the authority for legal content accuracy obligations.
Full text available to partners.Volume 5Operations and Service Delivery4 policies · 1 public · 1 partner · 2 internal
Pilot Project Terms and Conditions
The master agreement governing the relationship between George and each partner during a pilot deployment, covering scope, permitted and prohibited uses, evaluation measures, data governance, VCDPA compliance, security safeguards, AI disclosures, confidentiality, intellectual property, and breach notification. It is the primary contractual instrument through which George's governance commitments become legally binding on both parties, and it incorporates the Data Processing Addendum (GG-2.05) and the Privacy Policy (GG-2.01) by reference. It is included in the Policy Library because its terms must remain consistent with internal governance standards at all times, and any amendment requires the same governance review as a policy change.
Delivered to each partner as part of the pilot agreement.Terms of Use and Acceptable Use Policy
The contract governing an SRL's relationship with the George platform, establishing the terms under which the platform may be used, the boundaries of acceptable use, George's disclaimers regarding the informational-only nature of outputs, and the consequences of misuse. It complements the Privacy Policy (GG-2.01) and the AI Transparency Notice (GG-4.04) as part of the suite of public instruments that together define the relationship between George and the public it serves.
Read the full textSupport and Escalation Operating Procedure
The operational procedure through which George receives, tracks, and resolves support requests from SRLs and partners, along with internal operational issues, with specific acknowledgement and resolution targets for each request category. It ensures that VCDPA rights requests are processed within statutory timelines, that concerns about the unauthorized practice of law are treated as compliance issues, and that partner escalations receive the priority response their institutional relationship requires. It is included because a governance framework that establishes SRL rights and partner commitments must also establish the operational procedure for honoring them.
Full text available to partners.Change and Release Management Policy
Governs how changes to the George platform, infrastructure, application code, AI configuration, legal content, and governance documents move through a controlled, validated, and documented process before reaching production. Using four change categories (Standard, Significant, Material, Emergency) with proportionate validation and approval requirements, it operationalizes the security obligations in GG-3.01 and the AI change obligations in GG-4.01, and provides for notice to partners of material changes within the contractual ten-business-day window. This policy closes the loop between governance commitments and operational discipline.
Full text available to partners.Volume 6Employee and Internal Controls4 policies · 4 internal
Employee Confidentiality and Acceptable Use Policy
Establishes the confidentiality obligations and system use standards for all Covered Persons with access to George systems, SRL data, or confidential information. It addresses the practical realities of an early-stage organization, including personal device use standards, credential management, and the obligation to report suspected disclosures. An annual written acknowledgement requirement keeps the obligations actively renewed and creates a documented record that each Covered Person understood and accepted them.
Full text available to partners.Security Awareness and Training Policy
Establishes the training and awareness requirements for all Covered Persons, organized as a tiered framework: baseline requirements for everyone, additional requirements for those with system or data access, and further requirements for those working on legal content or AI configuration. At the current stage, training is accomplished through documented annual review of the governing policies, and the program will scale as the organization grows.
Full text available to partners.Background Check Policy
Establishes George's pre-engagement screening requirements for persons who will have access to SRL personal data, production systems, or platform content, using an individualized assessment standard consistent with applicable federal and Virginia employment law. Heightened scrutiny applies to offenses involving fraud, identity theft, unauthorized computer access, or harm to vulnerable persons, given the nature of George's work and the data it handles. It is included because George's position between the public and the judiciary creates a reasonable expectation from institutional partners that persons with access to sensitive platform functions have been appropriately screened.
Full text available to partners.Records Management Policy
Governs the creation, retention, and disposition of George's own internal records, including governance documents, contracts, compliance records, financial records, and employment records, complementing the SRL data retention standards in GG-2.04. A retention schedule table specifies retention periods by record category, from permanent retention for governance documents to three years for general correspondence, with legal hold procedures that override normal schedules when required. Well-maintained internal records are a governance asset that supports accountability to partners and enables the annual compliance self-assessment.
Full text available to partners.Numbers skip where a section is reserved for future use. GG-3.01 carries the access control and encryption standards.
Humans answerfor every output.
Human oversight is accountable for what George produces, and George's AI governance policy provides the assurance. There is no black box. A human is always accountable.
An output that crosses the advice line is a critical compliance issue with same-day escalation. Virginia's Judicial System does not authorize AI that makes a decision without a human decision-maker, and George is built on the same principle.
Kept 180 days.Never sold.
Litigant records are de-identified 180 days after the last visit, and each return restarts the clock. Data is never sold and never used to train an AI model. De-identified conversation traces are retained for quality control and continuous improvement.
- George never asks for a Social Security number or a financial account number.
- Images of uploaded documents are discarded once read.
- Nothing goes to a legal aid program without the SRL's affirmative consent.
- Every SRL has the right to see, correct and delete their data.
- George's data practices comply with the Virginia Consumer Data Protection Act (VCDPA).
Your data. To see, correct or delete your data, or to ask for a copy, write to governance@georgeva.com. George responds within 45 days.
Four policies,in full.
Questions about George's governance go to governance@georgeva.com.
Start withone scenario.
25 minutes, one eviction scenario. We will walk it through George, end-to-end, and talk about a fit for your court or program. George is seeking institutional partners today.
davidgibson@georgeva.com
469.763.0775