Security Information

Passwords are stored using Argon2 and are never recoverable, only resettable. Sessions use short-lived access tokens with rotating refresh tokens held in httpOnly cookies, so no token is readable by JavaScript in your browser. Every request is authorised on the server. Access to a matter is decided by whether you are a participant of it, checked on each call rather than inferred from a link, and suspending an account takes effect within seconds rather than at token expiry. Documents are stored in object storage and served through short-lived, single-use links generated per download. Visibility can be restricted to named participants or revoked entirely by the person who uploaded the document or a lawyer on the matter. Consequential actions are written to an append-only audit trail recording who acted, on what, and when. Administrator duties are separated: the people who review credentials are not the people who can disable accounts. If you believe you have found a security issue, please contact support so we can look into it.