Security · trust · isolation
Built for confidential legal work.
Protect your corporate records with firm-scoped access, encrypted storage, and AI that requires zero data retention. Your team stays in control of who can see, change, and act on client information.
Read the privacy and AI processing noticeFirm-scoped access
Your corporate records belong to your firm. Access is checked in both the application and database, so users can work only with the records their firm permits.
Encrypted at rest, TLS in transit
Supabase provides encrypted database and document storage. Hosted connections use TLS. Scheduled backups produce encrypted database and document archives.
AI with zero data retention
Built-in AI requires zero data retention (ZDR) model endpoints, with provider data collection disabled. Requests stop if a compliant endpoint is unavailable. Your legal work is not used to train those models.
Expiring client intake
Client intake links expire and are bound to the intended request. Staff review the submitted particulars and documents before accepting them into the corporate record.
Recorded activity
Record changes and supported access events are logged for review. The firm archive includes activity and access records alongside the corporate data.
Least-privilege access
Firm membership, roles, and entity access determine which records and actions a user can access. Sensitive actions check current access, including membership and session status.
The architecture
How the product is built, in plain terms.
Use this overview to start your firm's security review. Contact us for supporting details.
- Application
- Hosted on Vercel. Server-side actions and API routes validate requests and access before reading or changing firm records.
- Data
- Supabase stores corporate records, identity data, and documents with encryption at rest. Scheduled encrypted archives support recovery of database records and document files.
- Secrets
- Stored integration credentials are encrypted on the server. Encryption keys are supplied through server environment configuration and kept out of browser bundles.
- Transport
- Hosted traffic uses TLS. Microsoft mailbox access uses OAuth. Provider callbacks are checked using the verification mechanism required by each integration.
- Auth
- Supabase Auth provides sign-in and account recovery. Route protection is backed by firm membership and permission checks on protected operations.
- AI processing
- Built-in AI uses zero data retention (ZDR) model endpoints. Relevant records, document text or images, prompts and conversation context are sent through OpenRouter, with ZDR required and provider data collection disabled on every request. If no compliant endpoint is available, the request stops.
Commitments
What we owe you, in writing.
Your firm's trust rests on clear commitments: ownership of your records, transparent data processing, and direct support when you need it.
- We will never sell your data or your clients' data.
- We explain the AI and service providers involved in processing firm data in our privacy notice.
- Your firm keeps ownership of its records and documents, with archive exports and support for larger transfers.
- We are committed to the transparent and prompt reporting of any material security incidents.
Questions from your IT team?
We answer security questionnaires without outsourcing them.
When your firm performs its security due diligence, your questions won't be bounced between support tiers. Send us your questionnaire, and the founders who engineered the platform will reply directly.