Security & confidentiality

Built for the duties a law firm can't get wrong

Client confidences are protected under Rule 1.6, and the two mistakes that get solo attorneys disbarred — missed deadlines and trust-account errors — are exactly what our approval gates are built around. Here is how the platform handles security today.

Access & authentication

Passwords are stored only as scrypt hashes — never in plain text.
Sessions ride HMAC-signed cookies; tampering invalidates them.
Optional two-factor (TOTP, RFC-6238): the shared secret is AES-GCM-encrypted at rest and backup codes are scrypt-hashed.
New firms join by single-use invitation — no open self-serve firm creation.
Login, signup, and unlock endpoints are rate-limited; password reset is single-use and does not reveal whether an email exists.

Attorney approval, by design

Conflict determinations and engagement terms, substantive drafting relied on in filings, filing deadlines, trust accounting and disbursements, and anything that reaches a client or a court are permanently attorney-approved.
AI staff draft and recommend; nothing leaves the building — no text, email, letter, or filing — until the Managing Partner approves it.
A dedicated review layer challenges unsupported citations before work product goes out.

Data & infrastructure

Hosted on Vercel with a Neon Postgres database, in the United States.
Encrypted in transit (TLS) and at rest.
Every firm's data is isolated by tenant — one firm can never read another's records.
Credentials and API keys live in the platform's secret store, never in source control.
Bank connections use Plaid; e-signatures use Anvil — the firm connects each and can disconnect at any time.

AI & confidentiality (Rule 1.6)

Conversations are processed by Anthropic's Claude models through the Vercel AI Gateway. Under Anthropic's commercial terms, your firm's data is not used to train models.
Staff are instructed never to disclose case details to anyone but the client of record, and to keep text/SMS off case substance — an unsecured channel.
The platform provides administrative software, not legal advice; the attorney remains responsible for every professional judgment.

Governance

Written InfoSec, data-retention, and access-control/IAM policies, plus a vulnerability, patch, and end-of-life policy.
Access is reviewed on a recurring quarterly cadence.
Dependencies are monitored for security advisories and patched.

Diligence requests

Evaluating Lawstaff for your firm and need our SOC 2 status, a Business Associate Agreement, a Data Processing Addendum, our subprocessor list, or answers to a security questionnaire? We're glad to walk through it.