COIxist Documentation

Installation

COIxist ships as two components that run entirely on your firm's infrastructure — no cloud account or internet connection is required for core functionality.

1. COIxist Server — installed once on a central machine on your LAN. It owns the PostgreSQL database, runs the conflict-checking engine, and serves a web-based setup wizard for first-time provisioning.
2. COIxist Desktop — installed on each attorney's computer. It connects to the server over HTTPS. Attorneys never touch the database directly, and admin management happens inside the desktop app's Admin section.

System Requirements

COIxist Server (One Machine on Your Network)

COIxist Desktop (Each Attorney's Computer)

How It Works

COIxist uses a central server so that every attorney's conflict checks search the firm's complete record set, and database credentials never leave the server machine.

1. Your IT team installs the COIxist Server on one machine — a file server, domain controller, or dedicated server. The installer registers it as a native service (Windows Service, launchd, or systemd) so it starts automatically.
2. The server runs a setup wizard on first launch. IT walks through it in a browser to provision the PostgreSQL database, create the first admin user, and configure TLS encryption.
3. Attorneys install COIxist Desktop on their computers. On first launch, they enter the server URL provided by IT and verify the TLS certificate fingerprint. From then on, the app connects automatically.

Step 1: Install the COIxist Server

Download the server installer for your platform:

Run the installer. The COIxist Server will start automatically as a background service, running under a dedicated low-privilege OS user.

Step 2: Install COIxist Desktop

1. Download the desktop installer for each attorney's platform:

2. Launch COIxist. You'll be prompted to enter the server URL (provided by IT).
3. On first connection, the app shows the server's TLS certificate fingerprint. Verify it matches what IT distributed, then click Trust & continue. This trust-on-first-use (TOFU) fingerprint is pinned so a future certificate mismatch blocks the connection with a clear warning.
4. Log in with the credentials your admin created during server setup.

Server Setup

The COIxist Server needs a PostgreSQL database. You can install PostgreSQL on the same machine as the COIxist Server or on a separate database server — either way, the server setup wizard handles the provisioning.

Step 1: Install PostgreSQL

If PostgreSQL isn't already running on your server machine, install it:

Step 2: Run the Setup Wizard

On first start, the COIxist Server runs in unconfigured mode and serves a setup wizard. Open a browser on any machine that can reach the server and navigate to:

http://<server-address>:3141/setup

The wizard walks you through six steps:

1. Welcome — an overview of what the wizard will set up.
2. Database Connection — Enter the PostgreSQL host, port, admin username, and password, then click Test Connection to verify.
3. Database Provisioning — The wizard creates the coixist database, a dedicated coixist_app role, and runs all schema migrations (advisory-locked so concurrent starts can't collide).
4. TLS Configuration — Choose one of three modes:
   • Self-signed (recommended) — the server generates its own certificate. You'll distribute the SHA-256 fingerprint to attorneys so they can verify on first connect.
   • Bring your own — upload your firm's existing TLS certificate and private key (PEM format).
   • HTTP only — no encryption. Not recommended except for testing.
5. Create Admin User — Set a username, display name, email, and password for the first admin account.
6. Review & Finalize — The wizard writes an encrypted configuration file and asks you to restart the server process. After restart, the server runs in configured mode with full HTTPS.

Step 3: Distribute the Server URL

Share the following with each attorney:

• The server URL: https://<server-address>:3141
• If using a self-signed certificate: the SHA-256 fingerprint displayed during the TLS step (e.g., AA:BB:CC:DD:...)
• Their login credentials (provisioned by your admin)

Each attorney enters the URL on COIxist Desktop's first launch. The app shows the certificate fingerprint for verification — once they confirm, it's pinned and they won't be prompted again.

IT Admin: Headless Bootstrap

For automated deployments where a browser-based wizard isn't practical, the COIxist Server includes a CLI bootstrap command that runs the same provisioning steps interactively in the terminal — useful for scripted infrastructure or containerized environments.

License Activation

COIxist is licensed with an offline, cryptographically signed license (Ed25519). No license server or phone-home is involved — the signature is verified locally on the server every time the license is checked.

Activating Your License

1. Open the Activation screen and paste your license key, or click Load License File to select your .coixist-license file.
2. COIxist displays a preview of your license: firm name, seat count, expiration date, and enabled features.
3. Click Activate to confirm.

License Details

Your license determines:

• Seat count — the maximum number of active user accounts your firm can create.
• Expiration date — when the license expires (shown as "Never" for perpetual licenses).
• Enabled features — which modules are available.

Admin Account & Recovery Codes

The first administrator account is created during the server setup wizard (the "Create Admin User" step). Additional users are provisioned afterward by an admin (see User Management).

Save Your Recovery Codes

COIxist supports 8 one-time recovery codes per account in XXXX-XXXX format, stored only as secure argon2 hashes — COIxist cannot retrieve the plaintext for you. Code generation is performed via the server's API today (an in-app surface is planned); if codes have been generated for your account, they are the way back in if the password is forgotten.

Account Recovery Options

• Recover with a code — from the login screen, enter your username, one of your saved recovery codes, and a new password. The code is burned after use.
• Reset with license — as a nuclear last resort, pasting the active license key resets the password of the firm's first (active) administrator account. It cannot target an arbitrary admin.

Both login brute-force and recovery-code brute-force are rate-limited and locked out after repeated failures, and every recovery action is written to the audit trail.

Logging In

Enter your username and password on the login screen. By default, sessions have a 24-hour absolute lifetime and a 30-minute idle timeout (both configurable by your server operator); the server is the source of truth for session validity, and deactivating a user immediately revokes their live sessions.

Forgot Your Password?

Use the Forgot password? link on the login screen and choose one of the two recovery paths described in Admin Account & Recovery Codes — a saved recovery code, or (for admins) a license-based reset.

Running a New Check

Conflict checks are the core workflow in COIxist. Each check searches your connected systems and databases for potential conflicts of interest related to a new client, matter, or engagement.

Starting a Check

1. Click New Check from the dashboard or navigation.
2. Select a form type (grouped by category) that matches your check — e.g., New Client New Matter, KYC/AML, Lateral Hire, OCG Review.
3. Optionally upload one or more documents — COIxist auto-extracts party names and key fields.
4. Fill in the required fields: client name, matter details, and the parties involved. Fields can carry validation rules, default values, and help text configured by your admin.
5. Add parties with their roles and any known identifiers.
6. Click Run Conflict Check to start the search.

Adding Parties

Each party requires a name and a role. You can also specify an entity type and identifiers.

Party Roles

Beyond these base roles, COIxist ships with detailed party positions (risk-bearing categories such as Adverse Party, Potentially Interested Party, or lateral-specific positions like Portable Client with Open Matters) and roughly 200 descriptive relationship roles that appear as dropdown options on intake forms. Firms can extend both lists via the server API.

Entity Types

• Company — a business entity, organization, or firm
• Individual — a person

Identifiers

Adding identifiers improves match accuracy. Supported identifier types:

• DUNS Number — Dun & Bradstreet identifier
• CIK Number — SEC Central Index Key
• EIN — Employer Identification Number
• Patent Number (issued) and Patent Application Number
• Trademark Name, Trademark Serial Number, and Trademark Registration Number
• Matter Number
• Custom — any other identifier type

Form Types

COIxist ships with 32 system form types organized by category. Each form type defines the fields and workflow appropriate for that kind of check. Administrators can also create and customize their own form types.

Categories

Risk-Screening Questions

Primary intake forms include a bank of reusable yes/no risk-screening questions — flags for situations like changing counsel, mergers & acquisitions, cannabis, cryptocurrency, third-party payers, litigation funding, HIPAA/PHI data, and foreign transactions — so the conflicts team can spot elevated-risk intakes and route them accordingly.

Administrators can create custom form types and configure which fields appear on each. See Form Configuration.

Document Upload & Extraction

COIxist can automatically extract party names, roles, and key fields from uploaded documents, saving you from manual data entry. You can upload multiple files at once.

Supported Formats

• PDF — engagement letters, intake forms, court filings
• DOCX — Word documents (legacy .doc files should be re-saved as .docx)
• XLSX — Excel spreadsheets (legacy .xls files should be re-saved as .xlsx)
• CSV — comma-separated value files

How It Works

1. Drag and drop one or more files onto the upload zone (or click to browse).
2. Files are parsed sequentially with per-file status; regex-based field extraction and NLP entity recognition pull out parties, client info, and matter details.
3. The Extracted Data panel shows what was found across all uploaded documents — parties are de-duplicated, and scalar fields fill in only where blank.
4. Review the results and correct any inaccuracies before running the check.

The Search Process

When you run a check, COIxist simultaneously searches all of your enabled integrations using multiple matching strategies, then post-processes the results with layers of compliance intelligence.

Matching Strategies

Additional matching capabilities: d/b/a & f/k/a expansion (a name like "ABC Holdings LLC d/b/a Sunshine Cleaners" is split into variants and matched cross-product), identifier/passport/address screening against sanctions records, document-content matches (when content search is enabled on a DMS/CRM), and transliteration (Cyrillic, Greek, diacritics, and ligatures are normalized so "Muller"/"Müller" or "Газпром"/"Gazprom" still match).

During the Search

A progress indicator shows which sources are being queried. If any source fails to respond, a search warning is recorded on the check so you know your results may be incomplete — a source failure never silently drops a screen.

How Scoring Works

Each match receives a confidence score from 0.0 to 1.0 (displayed as a percentage) and a risk level (HIGH, MEDIUM, LOW, or NONE). Scores are influenced by multiple factors:

Match Explanations

Every match includes a human-readable explanation describing why it was flagged — for example, "3 of 4 tokens matched; token_set_ratio: 85%" or "alias match: IBM → International Business Machines". This helps attorneys quickly assess whether a match is a genuine conflict or a false positive.

Post-Match Intelligence

After scoring, COIxist applies additional intelligence to refine results:

• Previously waived / disapproved awareness — matches are cross-referenced against your archive. A previously waived pair is annotated with its waiver reference; a previously disapproved pair is elevated one risk level so the prior rejection isn't treated as a fresh low-confidence hit.
• Former-client detection — surfaces when the matched entity is a party the firm previously represented (an ABA Rule 1.9 signal).
• Known false-positive whitelist — entity pairs your firm has marked as known false positives are shown but visually de-emphasized.
• Firm blacklist — entities on your firm's restricted list are elevated to HIGH regardless of score (see Firm Blacklist).
• Check-type-specific rules — e.g., "New Matter" checks suppress self-matches, "Matter Maintenance" only shows HIGH-risk matches.
• Transitive conflict detection — HIGH/MEDIUM matches are annotated with related entities discovered from corporate relationships, party affiliates, and the firm's own learned affiliations.
• Ethical wall detection — if an active ethical wall exists for a matched matter, the match is annotated with wall details.
• Jurisdiction rules — your firm-wide jurisdiction (e.g., US ABA, UK SRA) can override the relationship matrix (see Jurisdiction Rules).

Configurable Thresholds

Administrators can adjust the scoring thresholds that determine when a match is classified as HIGH, MEDIUM, or below the floor (filtered out). Defaults: HIGH ≥ 0.90, MEDIUM ≥ 0.75, floor = 0.60. These and other advanced tuning parameters live in the Admin section (see Matching Configuration).

Reviewing Results

After the search completes, results are grouped by the party that was searched. Each match includes:

• Entity name — the matched name from the source system
• Source — which integration found it (Thomson 3E, SEC EDGAR, Local Archive, etc.)
• Match type — how it was matched (exact, fuzzy, corporate affiliate, etc.)
• Match score — confidence level from 0% to 100%
• Risk level — HIGH, MEDIUM, LOW, or NONE
• Relationship detail — matter name, party role, and context

Risk Levels

Annotations

Matches may include special annotations:

• Sanctioned — OFAC/sanctions match (automatically HIGH risk, regardless of score), with program codes, DOB, nationality, addresses, and a link to the Treasury record
• Blacklisted — the entity is on your firm's restricted list
• Previously Waived — this conflict was already approved via waiver, with a reference to the waiver
• Previously Disapproved — this pair was rejected before; risk is elevated one level
• Whitelisted — known false positive, with stored reason
• Ethical Wall — an information barrier is in place for this entity
• Transitive Risk — indirect conflict detected via corporate relationships

Expand any match to see the full raw data from the source system, a plain-language compliance-reasoning panel explaining why the risk was set, and — for public companies surfaced via SEC EDGAR — dedicated signal panels, with the specific filing surface recorded in the audit trail and the exported report. You can also add per-match analyst review notes, plus check-level research findings (source URLs, titles, notes).

Filtering & Action History

On large result sets, a filter panel narrows matches by risk level, source, or annotation — and the filter state persists in the URL so a filtered view can be shared. An action history panel on the same page shows the check's full chain of custody: quick searches run, near-miss promotions, exports, and decisions.

Near-Miss Review

COIxist doesn't silently discard borderline matches. Candidates that score below the match floor but above a configurable near-miss threshold are collected and surfaced separately, so nothing genuinely relevant is thrown away without a human seeing it.

The Near-Miss Panel

On the results page, an amber Near-Miss panel (collapsed by default) lists these lower-confidence candidates. From here you can:

• Promote a near-miss to a real LOW-risk match if it turns out to be relevant — the promotion is recorded in the audit trail.
• Research further — open the research dialog pre-seeded with the candidate's name to investigate before deciding.

Near-misses are persisted with the check and included as an optional section in the exported PDF report, so the firm can demonstrate that every automated result was presented and considered.

Clearance Decisions

After reviewing results, you make a clearance decision for the check.

Decision Options

Suggested Clearance

COIxist presents an advisory suggested clearance above the decision form — a recommendation with a confidence level and the reasons behind it (e.g., a firm-blacklist hit or a sanctions override suggests Disapproved; a HIGH match suggests Waiver Required). It's guidance only: the recommendation can be pre-filled with one click but never auto-submits. The analyst always makes the final call.

Auto-Drafted Cure Letters

On the high-volume happy path, clearance can auto-draft the relevant letter from your firm's default template — a waiver letter draft when a waiver is granted, or an engagement letter draft when approved. Drafts land in Draft status for review; nothing is auto-signed.

Check Status Flow

Pending → Running → Completed → Pending Review → (Cleared | Conflict Found | Waiver Required | Waiver Granted)

Every decision is recorded with the user's name, timestamp, and any clearance notes — forming a complete audit trail. If an approval policy applies, the decision routes through a multi-tier chain (see Approval Workflows).

Assignment & My Queue

Conflict checks can be explicitly assigned to a reviewer, so work is routed rather than left to whoever happens to pick it up.

My Queue

The My Queue page shows every check assigned to you, filterable by Open, Completed, or All. Click any row to open the check. You'll never see another user's queue.

Assigning a Check

On a check's results page, the Assignment panel shows the current assignee and lets you assign, reassign, or unassign. The check's creator, its current assignee, or any admin can reassign it; the assignee receives a notification.

Splitting Large Checks

For very large checks (mega-checks with thousands of parties), a Segments panel on the check's results page lets an admin split the party list across reviewers — auto-split into roughly equal contiguous ranges by picking assignees, or create manual ranges. Assignees see their segments and update segment status (open → in progress → completed) from the same panel, so a team can parallelize the review while the screen itself runs once.

Approval Workflows

For matters that need sign-off beyond a single reviewer, COIxist supports configurable multi-tier approval chains.

Defining Policies (Admin)

Admins define named approval policies with ordered tiers — each tier an individual user or a role — plus trigger criteria (which check types and risk levels the policy applies to) and optional escalation timeouts. Archive signals can also drive routing: a policy can fast-track when the firm has repeatedly cleared a counterparty, or escalate when a match was previously disapproved.

Working the Queue

When a check enters clearance, any matching policy starts an approval chain (its definition is snapshotted so later policy edits don't disturb in-flight chains). Approvers see their pending items in the Approvals page (My Queue / In Progress / Completed) and can approve, reject, delegate, or return to a prior tier. Overdue tiers are escalated automatically with notifications.

An Approval Progress panel on the results page shows each tier's status while the chain is active, and the dashboard includes a "Pending Approvals by Tier" widget. If no policy matches, the standard single-tier clearance flow runs unchanged.

Entity Research

The Entity Research phase lets you investigate matched parties in depth before making a clearance decision. Research runs automatically after every check, and you can also run it manually from the results page.

What You Can Do

• Review corporate affiliates, officers, directors, and beneficial owners discovered across every enabled research provider (D&B, SEC EDGAR, LexisNexis, Capital IQ, CRM systems, and more)
• See historical co-parties from your own archive — who else was on a prior matter with this entity
• Select affiliates to add them to the check, or dismiss ones that aren't relevant — with batch select/dismiss for speed
• Manually add known affiliates that weren't auto-discovered
• Add research findings with source URLs, titles, and notes
• Finalize your research to re-run the check with the selected affiliates included

When you finalize, every selected affiliate is re-screened — including an unconditional sanctions / PEP / adverse-media pass — so a sanctioned officer or beneficial owner surfaces as HIGH even if the parent entity looked clean. Research results are organized by party, with a progress tracker, and the check's creator and assignee are notified when research completes.

Clone & Model

You can create a new conflict check based on an existing one, saving time when running similar checks.

Clone

Cloning copies all data from an existing check — client name, matter details, parties, custom fields, and any uploaded documents — into a new check. Useful when you need to re-run a check with the same parties or create a closely related one.

Model

Modeling lets you selectively choose which fields to carry over from an existing check. You pick the fields you want to reuse, and the rest start blank. Useful when a new check shares some — but not all — details with a previous one.

How to Use

1. Open an existing conflict check from the Records page (only the check's creator or an admin can clone a check's data).
2. Click Clone or Use as Model.
3. If modeling, select which fields to carry over.
4. Review the pre-filled form, make any changes, and run the new check.

Quick Search

Quick Search is a lightweight, informational search that returns raw hits without the full clearance workflow. Use it when you need a fast lookup — for example, checking whether a name appears anywhere in your connected systems before starting a formal conflict check.

How It Works

1. Select Quick Search as the form type when creating a new check.
2. Enter the name or entity you want to search for.
3. COIxist searches your enabled sources and returns raw results.

From any match you can also trigger a per-match research or quick lookup against providers like Archive, SEC EDGAR, D&B, OFAC, and your uploaded documents — carrying the matched entity's identifiers along so direct-lookup paths (CIK, DUNS, matter number) are reachable straight from the results.

Predictive Suggestions

As you type in conflict check forms, COIxist offers autocomplete suggestions drawn from your firm's historical data — previous client names, matter names, requesting attorneys, practice areas, party names, opposing counsel, judges, requestors, and even prior identifier values (DUNS, CIK, EIN, patent numbers).

How It Works

Start typing in a supported field and a dropdown of matching suggestions appears after a couple of characters. Use the arrow keys and Enter to select, or click a suggestion to auto-fill. Suggestions come entirely from your local archive — no external calls — so the more checks your firm runs, the smarter they get.

Records & Archive

The Records page provides a complete history of all conflict checks your firm has run, split into a Conflict Checks tab and a Submitted Records (archive) tab.

Active Records

View all in-progress and recently completed checks. Filter by status, date range, risk level, or search by client/matter name.

Archive

Cleared and resolved checks are moved to the firm's archive. The archive is an always-on, can't-be-disabled data source that every future conflict check searches automatically — it is the firm's institutional memory of who it has represented and how each engagement was resolved.

Drilling into an Entity

From a match you can jump to a per-entity clearance-history view that shows every prior matter involving that entity across all name spellings, along with the identifiers the firm has on file. You can also run a full-text search across the custom fields of every archived matter.

Integrations Overview

COIxist connects to your firm's existing systems to search for conflicts across all of your data sources. It supports 19 external integrations across six categories — plus the firm's own always-on Local Archive and multi-list sanctions, PEP, and adverse-media screening.

How Integrations Are Configured

Integrations are configured by an admin in the Admin section of the COIxist Desktop app (visible only to admin-role users):

1. Open the desktop app's Admin area and go to Integrations.
2. Select an integration and enter the required credentials (API keys, URLs, etc.).
3. Click Test Connection to verify.
4. Toggle Enabled to activate it for conflict checks.

Once enabled, the integration is available to all attorneys running conflict checks — attorneys don't configure anything themselves. Each integration card shows its current connection-test status: Never tested, Passed, or Failed.

Integration Categories

• Data & Research — corporate family trees, officers, affiliates, and public-company data
• ERP & Financial — clients, parties, billing, and matters in firm systems
• Document Management — DMS metadata, titles, and full-text contents
• CRM — accounts, contacts, deals, and leads
• Sanctions & Compliance — sanctions lists, PEPs, and adverse media
• Directory & Firm Knowledge — Microsoft 365 directory and SharePoint
• HR & Onboarding — HR/workforce records for personnel checks (Oracle HCM connector planned)
• Firm Data — the firm's own always-on conflict archive

Data & Research

Dun & Bradstreet

Look up companies, corporate hierarchies, officers, and ultimate beneficial owners. D&B data powers the Corporate Affiliate matching strategy, enabling COIxist to detect parent/subsidiary relationships automatically. A Sandbox/Production toggle lets you test before going live.

Required: API Key, Secret Key (OAuth2)

SEC EDGAR

Search public company filings and drill into officers, proxy filers, insider (Form 4) filings, 13D/G beneficial owners, subsidiaries, related-party transactions, and more. Once a contact User-Agent is configured, SEC EDGAR is always-on for every check and cannot be silently disabled — names surfaced from filings are re-screened against sanctions lists, so a sanctioned officer of a public company surfaces as HIGH.

Required: No API key — only a contact User-Agent per SEC fair-access policy.

LexisNexis

Search business and person records, corporate data, and officers via the Accurint for Legal Professionals API.

Required: LexisNexis account credentials

S&P Capital IQ

Access financial data, corporate profiles, officers, subsidiaries, and ownership structures.

Required: S&P Capital IQ API credentials

ERP & Financial

Thomson Reuters 3E

Connect to your firm's 3E instance to search clients, matters, parties, and billing. Typically the primary source for internal firm data. Optional server-side support for pushing approved matters back into 3E and pulling docketing deadlines.

Required: Base URL, Tenant ID, Client ID, Client Secret (OAuth2 + OData). Optional custom field mappings for firm-specific configurations.

Aderant Expert

Search clients, matters, parties, and timekeepers via OData, with support for firm-specific custom fields (e.g., patent/trademark numbers) and server-side docketing deadline pulls.

Required: Base URL and OAuth2 (IdentityServer) or Basic credentials

Oracle NetSuite

Search customers, vendors, and contacts via SuiteTalk REST.

Required: Account ID and OAuth 1.0a token-based authentication credentials

Document Management

iManage Work

Search workspaces, documents, and client/matter metadata in iManage. Optionally enforce ethical walls directly in iManage; server-side support for provisioning matter workspaces.

Required: Base URL, Client ID, Client Secret, Customer ID, Library ID

NetDocuments

Search cloud DMS content, documents, and custom attributes. Optionally enforce ethical walls; server-side support for provisioning matter folders.

Required: Client ID, Client Secret, Region (US/EU), Cabinet ID, plus completing the OAuth authorization (grant → refresh token). NetDocuments is identity-scoped — connect a firm-wide service account (see the service-account note in the Overview).

CRM

Salesforce

Search accounts, contacts, cases, leads, and opportunities, plus Files content. Surfaces CRM context (open opportunities, pipeline value, recent activity) on matched accounts, and can push approved matters as Opportunities.

Required: Instance URL, Client ID, Client Secret

HubSpot

Search companies, contacts, tasks, and files, with CRM-context enrichment (open deals, pipeline value, recent engagements) on matched companies and matter push-back as Deals.

Required: Private App access token

Zoho CRM

Search accounts, contacts, deals, leads, and vendors, with CRM-context enrichment and matter push-back as Deals.

Required: Client ID, Client Secret, Refresh Token, Data Center domain (com/eu/in/com.au)

Microsoft Dynamics 365

Search Dataverse accounts, contacts, leads, opportunities, and cases, with matter push-back as Opportunities.

Required: Entra ID (Azure AD) OAuth2 client-credentials and Dataverse environment URL

Clio Manage

Search practice-management contacts (clients) and matters.

Required: API token (OAuth2 access token), Region (US/EU/CA/AU)

Clio Grow

Search intake contacts (Clio Grow's lead/prospect records).

Required: API token (OAuth2 access token), Region

MyCase

Search contacts, cases, companies, and leads in this legal practice-management platform, with case-context enrichment and matter push-back as Cases.

Required: OAuth2 credentials (Client ID, Client Secret, Refresh Token)

Sanctions & Compliance

Sanctions, PEP, and adverse-media screening are always on — they are injected into every conflict check regardless of integration toggles, because a missed sanctioned party is a regulatory event. This screening cannot be silently disabled.

Multi-List Sanctions Screening

COIxist ingests and unifies multiple government sanctions lists — OFAC (U.S. Treasury SDN + Consolidated), the UN, EU, and UK OFSI lists — and screens every party against all of them. Additional lists (Canada SEMA, Australia DFAT, and the U.S. Trade.gov Consolidated Screening List) are pre-registered for future enablement. No API key is needed; the lists are downloaded and cached, refreshed on a configurable schedule, with a staleness warning if the cache falls behind.

Screening features include:

• Blocking sanctions are always HIGH — the immutable regulatory floor. Sectoral / FSE / menu-based designations get per-firm-configurable risk levels with directive text.
• Typo-tolerant & cross-script matching — trigram similarity and normalized aliases catch misspellings and non-Latin scripts.
• Identifier & address screening — passport, national ID, and address matches against sanctions records.
• OFAC 50% rule cascade — an entity owned ≥ 50% (directly or through a chain) by a sanctioned party is flagged by extension.
• Continuous re-screening — after every list refresh, recently-cleared archived parties are re-screened; newly designated matches raise an admin alert.
• Per-check version snapshot — every check records exactly which list versions it screened against, for a defensible regulatory record.

PEP & Adverse Media

Every check screens for Politically Exposed Persons (heads of state, ministers, judiciary, central bankers, SOE executives, family members, and close associates — with FATF cooling-off detection for former PEPs) and adverse media (public reports of fraud, corruption, money laundering, sanctions evasion, and related conduct, severity-tagged with a configurable lookback window). PEP status is elevated per your firm's policy; adverse-media risk is severity-driven. Your compliance team tunes all of this from the Admin section's Sanctions tab.

World-Check (LSEG / Refinitiv)

Optionally connect World-Check for additional PEP, sanctions, and adverse-media coverage.

Required: World-Check API credentials

Sanctions Observability

Admins get list-diff reports after each refresh, named-entity watchlist subscriptions for long-running matters, an ad-hoc unified sanctions search bar, and a periodic compliance report ready for regulatory submission.

Continuous re-screening hits land in an admin alert queue: each alert snapshots the original clearance context (who cleared the matter, when, and with what notes) and must be acknowledged, optionally with disposition notes — the compliance officer's documented review of the newly designated match.

Directory & Firm Knowledge

Microsoft Graph

Search your Microsoft 365 tenant — Entra ID users, organization contacts, Microsoft 365 groups, SharePoint sites, and OneDrive/SharePoint files — with optional Outlook calendar and mailbox surfaces. Useful for personnel checks (new hires, laterals) and firm-knowledge matter research.

Required: Entra ID (Azure AD) OAuth2 client-credentials, with per-surface consent for the scopes you enable

HR & Onboarding

An Oracle HCM Cloud connector for employee and workforce directory data is planned for personnel-related conflict checks.

Firm Data (Local Archive)

The firm's own conflict-check archive is modeled as a first-class, always-on integration. Unlike every other source it has no remote API, no credentials, and no off switch — a firm's duty to check against its own history is non-delegable.

What It Provides

• Exact, fuzzy, phonetic, and identifier matching against every previously cleared, waived, or disapproved matter
• Previously waived / disapproved and former-client annotations on matches
• Attorney and practice-area prior-clearance heat maps (how many times this attorney or practice group has touched this counterparty)
• Transitive co-appearance — who else was on a historical matter with this party
• The feedstock for continuous sanctions re-screening

It is the highest-weighted source (1.0) by default; the weight is tunable via the matching-settings API. New firms with an empty archive see a friendly "no records yet" note; the archive grows automatically as checks clear, and historical data can be loaded via Bulk Import or Data Migration.

Ethical Walls

Ethical walls (information barriers) restrict specific users from accessing certain matters or client data. COIxist enforces these barriers, tracks compliance, and — optionally — pushes the restrictions into your DMS.

Creating an Ethical Wall

1. Open Ethical Walls and click Create New Wall.
2. Select a wall type:
   • Full Screen — complete barrier; restricted users cannot access any data related to the screened matter.
   • Partial Screen — limited barrier; restricted users see some data but not sensitive details.
3. Choose a duration: Indefinite, Date-based, or until Matter Close.
4. Specify the restricted users and the screened matters/clients.
5. Submit for admin approval.

Wall Lifecycle

Pending Approval → Active (or Rejected) → Removed

Administrators approve or reject walls with a reason. Active walls can be removed at any time (reason required), and a time-based sweep auto-expires walls past their end date. Pending or rejected walls are never enforced in conflict matching.

Acknowledgments & Compliance

Once a wall is active, restricted users must acknowledge it — an acknowledgment banner appears until they confirm. Admins can require periodic reconfirmation; overdue acknowledgments (beyond 48 hours by default) are flagged on the compliance dashboard. Reminder and expiry cadences are tunable in the Admin section's Correspondence & Compliance tab.

Violation Reporting

Any user can report a potential violation with a severity level (Low / Medium / High / Critical) and description. Admins review and resolve violations with resolution notes; all activity is logged.

DMS Enforcement

When enabled, an approved wall pushes deny rules into iManage (Security Policy Manager / ACL) or NetDocuments (cabinet/document deny rules), tagged so they can be reliably revoked when the wall is removed. Failed pushes are retried automatically.

Compliance Dashboard & Conflict Integration

The Ethical Walls page has tabs for Active, Pending Approval, and Removed walls. The admin compliance dashboard shows total active walls, unacknowledged users, overdue acknowledgments, and unresolved violations. During a conflict check, any match against a walled matter is annotated with the wall's details so reviewers are aware before clearing.

Firm Blacklist

The firm blacklist (or "black book") is your firm's list of restricted entities. Where the whitelist suppresses known false positives, the blacklist elevates — any match against a blacklisted entity is forced to HIGH risk regardless of score, source, or relationship, and that override is immutable.

Managing the Blacklist (Admin)

Admins maintain the list from the Firm Blacklist tab in the Admin section. Each entry has an entity name, a reason, and a category — former problem client, banned counterparty, regulatory target, litigation adversary, fraud or misconduct, or other — plus an optional expiry date and internal notes. The category surfaces on every match so reviewers see why the entity is flagged. Expired entries are skipped at match time but remain visible for reference.

Jurisdiction Rules

COIxist applies a firm-wide jurisdiction setting that tailors conflict logic to your bar's ethics rules. The default is US ABA, and seven jurisdictions ship out of the box: US ABA, UK SRA, EU CCBE, Canada FLSC, Australia ASCR, Hong Kong HKBA, and Singapore LPA.

What Jurisdictions Control

Each jurisdiction can override the relationship matrix (which role pairings are HIGH vs. LOW) and toggle rule flags such as strict former-client handling, imputation strictness, and whether screening alone is sufficient for a waiver. Matches whose risk was changed by a jurisdiction rule are annotated so reviewers can see it. Admins can also add custom jurisdictions. Set your firm's jurisdiction from the Admin section's Jurisdiction Settings.

Waiver Letters

When a conflict is identified but the engagement should proceed, a waiver letter documents the acknowledged conflict and the firm's decision. Waivers, engagement letters, and closure requests are all reachable from the Correspondence area of the app.

Managing Templates

Admins create and manage letter templates. Templates support placeholder variables that auto-fill from conflict check data:

Generating & Signing

1. From a conflict check's results page (or the Correspondence area), click Generate Waiver and select a waiver template — fields auto-populate from the check data.
2. Review and edit the letter content if needed.
3. Click Sign to capture an electronic signature (name, title, and date).
4. Download the signed letter as PDF, DOCX, or plain text.

Letter Statuses & Versioning

• Draft — created but not yet signed.
• Signed — electronically signed and finalized.
• Revoked — cancelled after signing (reason required).

Every edit to a template snapshots the prior version, so you can always reconstruct which template text a given letter was cleared under. Template CRUD is admin-gated; a letter can only be edited, signed, or revoked by an admin or the owner of the underlying check.

Engagement Letters

Engagement letters follow the same workflow as waiver letters — templates with placeholder variables, auto-population from check data, electronic signatures, and PDF/DOCX/text export. They are managed under Engagement Letters in the Correspondence area and use their own dedicated notifications.

The same template placeholders, versioning, signing flow, and status lifecycle (Draft → Signed → Revoked) apply. A waiver template can only build a waiver letter, and an engagement template only an engagement letter.

Closure Requests

Closure requests help your firm identify and close stale matters — matters that are no longer active but haven't been formally closed.

How It Works

1. COIxist identifies stale matters based on a true activity signal (an inactivity threshold — default 24 months — keyed off real matter activity rather than incidental record edits; tunable in the Admin section's Correspondence & Compliance tab).
2. You draft a closure request from a template and deliver it to the responsible attorney by email.
3. The attorney responds: Approved (the matter is auto-closed), Denied (kept open), or the request Expires after a configurable window without a response.

Statuses

• Draft — created but not yet sent.
• Sent — delivered to the responsible attorney for review.
• Approved — attorney confirmed the matter should be closed (the matter is closed automatically).
• Denied — attorney indicated the matter is still active.
• Expired — no response received within the allowed timeframe.

Audit Trail

Every significant action in COIxist is logged with full context: who did it, what they did, when, and the details.

What's Logged

• Conflict checks created, completed, cloned, and deleted
• Clearance decisions (with notes) and approval-chain actions
• Each individual sanctions / PEP / adverse-media match, for per-match regulatory replay
• Users added, modified, or deactivated
• Integrations configured, tested, or attested
• Ethical walls created, approved, rejected, acknowledged, or removed
• Letters generated, signed, or revoked
• Settings, matching thresholds, and sanctions policy changes
• Bulk imports, data migrations, and GDPR redactions

Viewing the Audit Log

Open the Audit Log tab in the Admin section of the desktop app and filter by date range or action. For richer slicing — by user, entity type, or arbitrary criteria — and for exporting audit data (CSV, XLSX, PDF, or JSON), use the Report Builder's audit-log data source.

Quality Control Re-Review

The Quality Control tab in the Admin section runs a random-sampling pass over completed conflict checks within a date window. Each sampled check is snapshotted (its clearance status and risk at sampling time) and queued for a senior reviewer to mark pass or fail — findings text is required on a fail. Batch summaries report the pass/fail rate, giving the firm a documented answer to "how often do we QC our conflict-check process."

Admin Overview

Ongoing administration lives in the Admin section of the COIxist Desktop app, available to any admin-role user. (The server's web interface is used for the one-time setup wizard and a lightweight dashboard; day-to-day admin work happens in the desktop app.)

What's in the Admin Section

The Admin area is the central management hub for your COIxist deployment. Its tabs include:

• User Management — create, edit, and deactivate accounts and assign roles
• Form Types — build and customize conflict-check forms and fields
• Integrations — configure and test connections to external systems
• Matching & Advanced Matching — thresholds and tuning parameters
• Sanctions and SEC EDGAR — screening & EDD policy; the SEC EDGAR tab adds per-surface toggles, runtime-tunable rate/size caps (no restart needed), and a request-telemetry dashboard (daily volume, latency, error rate)
• Correspondence & Compliance — closure, ethical-wall, auto-cure, and predictive tunables
• Jurisdictions, Approval Policies, Ethical Walls, Billing Gates, Reports
• Firm Blacklist, Matter Reservations, Canonical Entities, Archive Suggestions, Bulk Export, GDPR Redaction
• Quality Control (random-sample re-review of completed checks) and Report Schedules
• Data Retention, Support Requests, Maintenance, and the Audit Log — plus the separate Data Migration view

System Health

When an admin is logged in, COIxist surfaces a health banner if a silent-failure condition is detected — for example, an empty sanctions cache, a missing database extension, or migration drift. Regulatory-grade conditions can't be permanently dismissed; a fresh check re-asserts them until they're resolved.

User Management

Administrators manage user accounts from the Users tab in the Admin section.

Roles

Managing Users

The Users tab lists every account with its role and lets admins change a user's role in place. Account creation, deactivation, and password resets are performed through the server's admin API today (an in-app surface is planned); the number of active users is limited by your license seat count. Deactivating a user immediately revokes their live sessions, but their history and audit trail are preserved.

Form Configuration

Administrators customize conflict-check forms from the Form Types tab in the Admin section.

Custom Form Types

Create new form types with a name, description, and category, and toggle them active/inactive. You can also clone an existing form type, or export/import a form type as versioned JSON to move it between environments.

Field Types

Field Behavior

Each field can be marked required, given a default value and help text, and constrained with validation rules (pattern, min/max, length) that are enforced both in the form and on the server. Fields support conditional visibility — show or hide a field based on the value of another field — enabling branching intake forms. Deleting a form type or field that historical checks reference is guarded with an impact count so you don't break the record of past intakes.

Matching Configuration

The Matching and Advanced Matching tabs let admins tune how conflicts are scored and classified.

Thresholds

Set the HIGH, MEDIUM, and floor score bands (defaults 0.90 / 0.75 / 0.60), plus the near-miss floor (default 0.45) that defines the band of below-floor candidates collected for near-miss review. The system validates the ordering (0 < near-miss floor < floor < MEDIUM < HIGH ≤ 1) and audits every change. Remember that the relationship matrix and sanctions/blacklist overrides can take precedence over raw scores.

Advanced Tuning

Adjust temporal-decay years, practice-area boost, entity-type penalty, suffix-strip penalty, transitive-detection depth, and the near-miss floor. Per-source reliability weights (including the Local Archive weight) are tunable via the matching-settings API today. You can also maintain the alias and whitelist tables. The Archive Suggestions tab surfaces COIxist's own archive-derived candidates — pairs your analysts have repeatedly cleared as false positives, and name variants that co-occur often enough to be aliases — each acceptable with one click (a whitelist entry with an audit-traceable reason, or a canonical-entity merge).

Canonical Entities

The same counterparty often appears under several spellings — "ACME Corp," "Acme Corporation," "ACME Inc." Canonical entities let admins group those name variants into one entity so clearance history and drill-downs unify across all spellings.

Managing Canonical Entities

From the Canonical Entities tab in the Admin section you can create a canonical entity, add individual aliases, or bulk-merge a pasted list of variants. A regulatory uniqueness guarantee is enforced: an alias can map to at most one canonical entity, and a bulk merge is all-or-nothing — a conflict rolls the whole merge back. Every mutation is audit-logged.

Where It Surfaces

• Matches whose name resolves to a canonical entity show a badge on the match card, and the "view all matters" link routes to the canonical grouping.
• The per-entity clearance-history page offers a unified view across all aliases of the canonical entity.
• COIxist's archive-derived alias suggestions (see Matching Configuration) feed directly into canonical-entity merges with one click.

Lateral Hire Screening

Lateral screening projects handle multi-candidate hiring waves as a single workflow, on top of the standard single-candidate Lateral Hire check type.

How It Works

1. Create a screening project (name, hiring manager, expected candidate count).
2. Bulk-import candidates and their portable clients / parties from CSV or XLSX.
3. Each candidate runs its own conflict check (with a cap on concurrent checks in flight).
4. Cross-candidate deduplication surfaces parties that appear across multiple candidates.
5. An Archive Overlap view surfaces every candidate party that overlaps with the firm's archive, flagging prior disapprovals so imputation-conflict clusters are obvious.

A side-by-side comparison view and a per-project summary (total candidates, flagged count, shared parties) round out the workflow. The server also provides a secure, one-time-use invitation API so a candidate's portable-client list can be collected without a firm login (invitation minting is API-driven today; an in-app surface is planned).

Billing Gates

Billing gates prevent time from being entered against a matter until conflicts are cleared, by integrating with your ERP (Thomson 3E or Aderant Expert).

How It Works

When a matter has an uncleared check or an active ethical wall, COIxist maintains a "gated" state and pushes it to the ERP so the ERP can block time entry. Gate state is re-evaluated on check completion, clearance decisions, and ethical-wall approval/removal. From the Billing Gates admin view you can list active gates, override a gate (allow time entry despite it), close it, or retry a failed ERP sync. Every sync attempt is recorded, and failures are retried on a schedule.

Report Builder

The custom report builder (admin only) lets you run ad-hoc queries across your COIxist data without writing SQL.

Building a Report

1. Pick a whitelisted data source (conflict checks, ethical walls, waiver letters, audit log, users, approval requests, lateral candidates, matters, clients, or archived records).
2. Choose columns, add filters (equals, ranges, in-list, is-null, between, and more), group, aggregate (count/sum/avg/min/max), sort, and limit.
3. Preview results inline, then export as CSV, XLSX, PDF, or JSON.
4. Save the report as private or shared for reuse.

Saved reports can also run on a schedule — daily, weekly, or monthly — with the output written to a directory for your IT tooling to pick up. Manage schedules from the Report Schedules tab in the Admin section (create, delete, and trigger the due-schedule sweep on demand).

Matter Reservations

To help two attorneys avoid unknowingly working the same prospective client, COIxist automatically places a short-lived advisory hold on every intake name when a check is submitted.

How It Works

Reservations are advisory — they never block a check from running. They surface the overlap so a partner can consolidate effort. Admins can view all active reservations (entity, owning user, expiry, originating check) from the Reservations tab, cancel a reservation, or purge expired ones. Holds expire automatically after a default 14-day window.

Bulk Import

Import clients, matters, parties, and archived records in bulk from spreadsheet files.

Import Workflow

1. Upload — drag and drop a CSV or XLSX file (re-save legacy .xls files as .xlsx first).
2. Map Columns — map file columns to COIxist fields (auto-mapping by header name is available). Choose the entity type: Clients, Matters, Parties, or Archived Records.
3. Choose Duplicate Handling — Skip, Update existing, or Create New.
4. Validate — review a preview and fix row-level errors (missing required fields, invalid dates, bad enum values).
5. Import — execute in batches with a live progress indicator; a failed row is skipped and logged, not fatal.
6. Summary — view imported / skipped / error counts (updates count as imported) and download an error report.

Every import is audit-logged with the file name, entity type, counts, and duration.

Data Migration

The migration tooling onboards historical conflict data from incumbent products so you don't start with an empty archive.

Supported Sources

• Intapp Conflicts (XML/JSON)
• Thomson Reuters 3E (CSV/JSON)
• Aderant Expert (CSV/JSON)
• Elite (CSV, legacy 3E)
• Litera Foundation (CSV/JSON)
• COIxist JSON export (for moving between COIxist deployments)
• Generic CSV with admin-mapped columns

Each importer maps external clients, matters, parties, conflict checks, archived records, and ethical walls into COIxist, recording external↔internal id mappings so re-imports merge rather than duplicate. You can run a dry run to preview counts and errors before committing, cancel mid-run, and download an error report. Access it from the Admin section's Data Migration view.

Bulk Export & Legal Holds

When a subpoena, legal hold, or regulator data request names specific entities, the Bulk Export tab in the Admin section produces a defensible export without hand-written database queries.

Running an Export

1. Paste the entity names (one per line) and optionally filter by clearance date range or clearance status.
2. Enter the legal-hold reference (subpoena number or audit case ID) — required, and captured verbatim in the audit trail so the export's authority can be replayed later.
3. Run the export and download the result as JSON. Exports are capped at 5,000 rows per call; a truncation flag is surfaced prominently if the cap is hit.

Every export writes an audit row with the filters, legal-hold reference, and result count. For preventing deletion of specific checks during litigation, see retention holds in Data Retention; for data-subject erasure, see the GDPR Redaction tool.

Data Retention

COIxist includes configurable data-retention policies to help your firm meet regulatory requirements.

Retention Settings

Set retention periods (3, 5, 7, 10, or 15 years, or indefinite) independently for conflict checks, audit logs, and archived records.

Retention Options

• Archive before deleting — exports full check data to JSON before purging, so you keep a backup.
• Warning period — records inside the warning window (default 30 days) are flagged on the retention dashboard before deletion.
• Retention schedule — run retention manually, daily, or weekly.
• Export directory — configure where retention exports are saved.

Notifications

COIxist includes an in-app notification system that keeps users informed of important events.

Notification Types

• Conflict check completed and research results ready
• Clearance decisions and approval-chain events (assigned, overdue, escalated, completed)
• Check assigned or reassigned to you
• Waiver / engagement letter signed or revoked
• Ethical wall created, approved, rejected, or violated
• Auto-drafted cure letter ready for review
• Sanctions watchlist hits and DMS enforcement failures
• License expiration warnings and new-user creation

Preferences

Each user can toggle individual notification types on or off from the Notification Preferences section of the Settings page. From the notification bell in the navigation bar you can read, dismiss, and forward notifications via email with one click.

Support & Maintenance

COIxist gives firm IT self-service diagnostics without touching the database directly.

Report a Bug

Any user can file a bug report from the app. COIxist auto-collects safe diagnostics (app version, OS, PostgreSQL status, enabled integration names, recent error log lines, current page) — never credentials or secrets — for the user to review before sending. Reports are both persisted to a server-side Support Requests queue (visible to admins) and offered as an email fallback.

Maintenance View

The Maintenance tab surfaces a read-only observability report: app and platform versions, database size, recent applied migrations, per-table sizes, sanctions-cache freshness per list, recent audit-log activity, and the overall system-health check. Download it as JSON to forward to support without running database queries by hand.

Settings

Appearance

Choose between Light, Dark, or System theme.

Report Customization

Upload your firm's logo, set custom title/header/footer text, pick an accent color, choose the page size, and toggle which of the report's sections appear in exported PDFs.

Notification Preferences

Toggle individual notification types on or off for your account (see Notifications).

Updates

See the currently installed version and any available update for the desktop app.

Database & Data Import

View the database location and take a backup (the connection itself is managed on the COIxist Server — use the Connection page to point the desktop app at a different server). A Data Import shortcut jumps to the Bulk Import wizard.

Support

Use the Report a Bug button (see Support & Maintenance) to submit a report. The support email address shown in the app is configurable by your admin; general inquiries can also go to contact@coixist.com.

Dashboard Overview

The dashboard is your command center for conflict-checking activity.

Stat Cards

Three clickable stat cards show Total Checks, Pending Review, and Submitted (Archived) counts. Click any card to jump to the filtered Records view.

Widgets

• Check Completion Trends — check volume over time with configurable granularity (daily/weekly/monthly) and date range.
• Risk Distribution — the HIGH / MEDIUM / LOW / NONE breakdown across all checks.
• Turnaround Metrics — average time from check creation to completion, with trend indicators.
• Pending Reviews — checks awaiting decisions, grouped by age.
• Pending Approvals by Tier — outstanding items in multi-tier approval chains.
• Archive Analytics — total records, 30-day growth, clearance velocity, top counterparties, per-practice-area disapproval rates, and per-officer clearance accountability.
• Recent Activity — a live feed of the most recent actions across the system.
• Recent Checks — the latest conflict checks with one-click access.

PDF & Export Reports

Export any conflict check from the results page. Reports are available as PDF, DOCX, and CSV, and every export is archived server-side with a hash and timestamp so there is an immutable record of exactly what was produced. An Export History list on the results page shows every prior export of the check, re-downloadable at any time.

Report Contents

• Check details: client, matter, parties, form type, requesting attorney
• Intake form data, including custom fields, risk-screening answers, and source documents
• All matches with scores, risk levels, match types, source information, and compliance annotations (sanctions, PEP, adverse media, ethical walls, archive context)
• Near-miss candidates (optional section)
• Clearance decision, notes, and research findings
• Audit trail for the check
• Your firm's logo and branding (if configured)

Customization

Customize the report from Settings → Report Customization: upload a logo, set accent colors and page size, configure header/footer text, and toggle which sections appear.