Security overview

Law firms trust us with confidential client files. This is how we protect them.

Data

• HTTPS for every connection, with HSTS.
• Case facts, client identity numbers, file notes, enquiry and advice notes, client messages and two-step secrets are encrypted in the database. eSewa merchant credentials are encrypted and never shown again.
• Documents and uploads are kept in private storage and served only to authorised users through short-lived signed links.
• Each firm's records are isolated: another firm gets "not found", never a glimpse. We test this with automated cross-firm checks.
• Encrypted backups every night, with an automatic restore test, kept for 14 days.

Accounts

• Passwords stored only as bcrypt hashes; at least 10 characters; known-breached passwords refused.
• Two-step verification with an authenticator app for everyone, required for our staff.
• Sign-in rate limits, session lists with "sign out other devices", and other sessions ended when a password changes.
• Firm roles (owner, partner, associate, staff) checked on the server for every request.

Operations

• An audit log of sign-ins, role changes, settings, payments, exports and administrative actions.
• Uploads checked by type and size, with a virus-scanning hook.
• Payments confirmed with the provider before they are recorded; amounts always calculated on the server.
• Regular dependency audits and security reviews.

Reporting a vulnerability

If you find a security problem, please tell us through the contact page or [security email] and give us a chance to fix it before disclosing it. We will not take action against good-faith research that respects other users' data.