Ask Oria your questions. Give it a document, and it summarizes it. It also writes a draft, which the professional corrects. It is a generative AI, or GenAI, and a chatbot. All of Oria’s features are in the specifications.
You start Oria at your office and connect it to your computers. Then you lock its master switch with your password. From then on, your machine is a vault, cut off from the internet and from all outside access. The connection stays in the office, between Oria and your computers.
See how a local AI works in an office
You stay in control
The master switch is the vault door. You protect it with a password you choose. Once closed, this door cuts Oria off from the internet, and no other button can open it again. The AI cannot access the master switch or the big button that takes Oria offline. Only a person can click these two buttons.
Offline, you open Oria from each computer, tablet or phone linked to the office network. Your texts and calls go through the cellular adapter, with our own system, without the internet. Remote maintenance goes through an office computer, and only while the person at that computer keeps the bridge open. That person sees everything in a mirror view.
If you open the vault door to take Oria online, you control each of the six features that use the internet. You can also hide the office computers and drives from Oria.
Can the CLOUD Act reach your files?
No, not the ones that stay on Oria, in your office. Providers covered by the CLOUD Act do not have them. Only what you send to an online service yourself can end up in their hands.
The United States enacted the CLOUD Act in March 2018. It covers providers of electronic communication services or remote computing services, such as online hosting. When American law requires it, these providers must keep their customers’ data or hand it over, even if that data is outside the United States. That applies to everything they hold or control.
Here is the text of the law:
“A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”
Source: 18 U.S.C. § 2713, added by the CLOUD Act on March 23, 2018. The U.S. Department of Justice also dates the law to March 2018.
The law protects professional secrecy
In Quebec, professional secrecy is a human right. The Charter of human rights and freedoms puts it in these words:
“Every person has a right to non-disclosure of confidential information.
No person bound to professional secrecy by law and no priest or other minister of religion may, even in judicial proceedings, disclose confidential information revealed to him by reason of his position or profession, unless he is authorized to do so by the person who confided such information to him or by an express provision of law.
The tribunal must, ex officio, ensure that professional secrecy is respected.”
Source: Charter of human rights and freedoms, s. 9.
The Professional Code also requires every professional to respect this secrecy:
“Every professional must preserve the secrecy of all confidential information that becomes known to him in the practice of his profession.
He may be released from his obligation of professional secrecy only with the authorization of his client or where so ordered or expressly authorized by law.”
Source: Professional Code, s. 60.4, paras. 1 and 2.
The Barreau du Québec has a guide on generative AI
The Barreau du Québec wrote its Guide pratique pour une utilisation responsable (practical guide for responsible use) in French. The 2nd edition came out in 2025. We translated the passages we quote from this guide and from the Barreau’s insurance policy. The French original of each passage comes right after its translation. The guide speaks of professional secrecy. Entering protected information into a system open to the public is already a breach. A closed system that keeps data in-house offers better protection. Here are its words:
“The mere act of entering information protected by professional secrecy into such an open system (that is, a system accessible to the public and whose data is not stored internally) constitutes a breach, even without actual reproduction or disclosure (see note 5). On the other hand, closed systems, developed and deployed within an organization and keeping data internally, reduce these risks.”
Original French
« Le simple fait d’entrer des informations protégées par le secret professionnel dans un tel système ouvert (c’est-à-dire un système accessible au public et dont les données ne sont pas stockées en interne) constitue une violation, même sans reproduction ou divulgation effectives (voir note 5). En revanche, les systèmes en circuit fermé, développés et déployés au sein d’une organisation et conservant les données en interne, réduisent ces risques. »
Source: Barreau du Québec, Guide pratique pour une utilisation responsable, 2nd edition.
With Oria, your files stay in-house, on the machine in your office.
The guide also asks you to talk openly with your clients about AI, and to judge when to get their consent in writing. It asks you to keep your exchanges with the AI for at least 7 years after the file closes. With Oria, your conversations stay on the machine, in the office, and the backup tool copies them.
See what else the guide asks for, point by point, and the mandatory training
What the Barreau’s insurance policy covers and does not cover
In its 04‑2026 edition, the professional liability insurance policy of the Barreau du Québec talks about “information assets”. Artificial intelligence platforms are among them. Its section 1.15 defines those assets this way:
“INFORMATION ASSETS: Any information or communication technology, computer system or infrastructure, computer equipment or peripheral (including mobile equipment), network, operating system, software, website, technology platform, including those based on artificial intelligence, Data and mobile application, whether they belong to the Insured or to third parties.”
Original French
« ACTIFS INFORMATIONNELS : Toute technologie de l’information ou de communication, système ou infrastructure informatique, équipement ou périphérique informatique (incluant les équipements mobiles), réseau, système d’exploitation, logiciel, site internet, plateforme technologique, dont celles basées sur l’intelligence artificielle, Données et application mobile, qu’ils appartiennent à l’Assuré ou à des tiers. »
Under section 2.04, the policy does not cover damages or costs caused by unlawful access to these assets. It also does not cover those caused by harm to their integrity, availability or operation. The same goes for damages or costs caused by fraud or social engineering. Social engineering is when someone manipulates a person to get access or information.
The policy still covers damages caused by the loss or theft of an external storage medium or of a digital device, such as a computer, a tablet or a phone.
Here is the text:
“This contract does not apply to a Claim or part of a Claim: (…)
m) arising from damages or costs caused by:
i) any unlawful access to an Information asset,
ii) any breach of the integrity, availability or operation of an Information asset,
iii) any identity theft, unauthorized use of an identifier or any other fraudulent process involving the use of or access to an Information asset,
iv) any act of social engineering,
regardless of the cause or nature of the faults that may have contributed to it directly or indirectly, in whole or in part.
However, Damages resulting from the loss or theft of an external data storage medium or of a digital device, including computers, tablets and smartphones, remain covered.”
Original French
« Le présent contrat ne s’applique pas à une Réclamation ou partie d’une Réclamation : (…)
m) découlant de dommages ou de frais occasionnés par :
i) tout accès illicite à un Actif informationnel;
ii) toute atteinte à l’intégrité, la disponibilité ou au fonctionnement d’un Actif informationnel;
iii) toute usurpation d’identité, utilisation non autorisée d’identifiant ou tout autre processus frauduleux impliquant l’usage ou l’accès à un Actif informationnel;
iv) tout acte d’ingénierie sociale;
et ce, quelle qu’en soit la cause ou la nature des fautes ayant pu y contribuer directement ou indirectement en tout ou en partie.
Demeurent cependant couverts les Dommages résultant de la perte ou du vol d’un support externe de stockage de données ou d’un appareil numérique, dont les ordinateurs, tablettes et téléphones intelligents. »
Source: Fonds d’assurance responsabilité professionnelle du Barreau du Québec, policy 2026‑2027, ed. 04‑2026.
Your files stay out of the internet’s reach. One click on the big button cuts off the internet, and only a person can use that button.
What Quebec’s Law 25 requires
In 2021, Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector. Section 3.1 of the amended Act makes each business responsible for the personal information it holds. It requires a privacy impact assessment when you buy, develop or overhaul a system that handles that information, under section 3.3. It also requires one before you send personal information outside Quebec, under section 17.
With Oria, the AI answers you from the machine, in your office. It sends nothing outside.
See Law 25, section by section
Who to write to at Agent Oria
Write to info@agent-oria.com. The person in charge of protecting personal information at Agent Oria will reply to you. Our privacy policy explains what information the site collects and why. It also explains how long the site keeps that information.