Security
What we can
actually claim.
Eight things the software does, each one you can hold us to.
Files are never public
A document link is useless to anyone outside your firm. Every time a file is opened we check who is asking, and which firm they belong to, before sending any of it.
One firm cannot reach another
Another firm’s files are not hidden from you — they are never fetched at all. Every request is narrowed to your own firm before it reaches the database.
Access is decided per matterengagement, in one place
Whether you may see something is settled by a single check that every part of the product calls — eight services, one gate. There is no second path that forgot to ask.
Walls that fail closed
Turn ethical walls on and an attorneya CPA reaches only the mattersengagements they are staffed on. The request is refused at the database, not greyed out on screen — and where it cannot establish that you are staffed, the answer is no.
A code as well as a password
Turn it on and signing in takes a code from your phone as well as your password. Lose the phone and single-use backup codes get you back in.
Signed in, but not forever
The key your browser signs in with expires within the hour and is renewed quietly in the background. A copy taken off a machine stops working on its own.
What each person can do is fixed
Owner, admin, attorneyCPA and client are separate roles, recorded per firm. What each one may do is decided on our side — not by what the screen happens to show them, and an attorneya CPA behind an ethical wall is refused the query, not just the button.
Invitations that die quickly
A client invitation works once and expires within a day. Unused ones are cleared on a schedule, and an expired link is refused even if someone finds it later.
What we do not claim
None of these has been done. When one is, it will appear on this line with its date and its auditor.
Three things the product does not do, for the same reason: its activity log is nobody’s evidence but your own, no segregated client accounts and no three-way reconciliation, and nothing that calculates a deadline from any court’s rules.
| Certification | Date | Auditor |
|---|---|---|
| SOC 2 or ISO 27001 certification | None | None |
| A GDPR or CCPA attestation | None | None |
| Independent penetration testing | None | None |
What we do not claim
Four things
said just as plainly.
Set in the same type as the claims above, because they are worth the same weight. A firm cannot plan around a gap it has to find out about in a vendor questionnaire.
No SOC 2, and no other audit
Nobody independent has examined this product against SOC 2, ISO 27001, HIPAA or anything else. If a vendor questionnaire asks for a report, the honest answer is that there is not one. We would rather lose the deal than have you rely on a badge we printed ourselves.
No "GDPR compliant" badge
The product is built to keep one firm’s data away from another and lets you export and delete, which is the groundwork. Compliance is a property of how your firm uses it, not a sticker we can hand you.
An activity log, but not evidence
Since October 2026 you can read who opened, downloaded or deleted a document, on the matter and across the firm. Nothing signs those rows or seals them, nobody independent has examined them, and nothing alerts you — so it answers your questions about your own firm, and you should not offer it to a regulator as an attested access log.
Two-factor is on when you turn it on
It is available to every account on every plan, and it is opt-in rather than enforced. A firm that needs it mandatory does not have a setting for that today.
The mechanism
Written down,
before you ask.
Six articles, each about how one of these actually works rather than what it is called.
Who can see a document
The decision made on a single file, and the order it is made in.
Access control and permissions
The firm-wide settings behind that decision.
Ethical walls
Staff reach only the matters they are on, refused at the database rather than hidden on screen.
Data encryption and storage
Where files sit and how they are served.
Two-factor authentication
Turning it on, and what happens if somebody loses their phone.
Data protection and your clients
Export, deletion, and what we hold.
Including the awkward ones. If the answer is no, you will get a no.
Get started
Set it up before the
next return lands.
Thirty days, every feature, no card. Or tell us about your firm and we’ll walk you through the whole loop — upload to signed PDF — on your own files first.