Security isn’t a feature.
It’s the foundation.
Tenant-scoped security at the database layer.
Firm-owned records use tenant-scoped row-level security policies enforced in Postgres, alongside authenticated server routes and role-based permissions. Provider-managed encryption, security audit events, and server-side secret handling add defense in depth.
Role-based access control assigns granular permissions per user, role, and matter. Partners, associates, paralegals, and clients each see only what they need — nothing more, nothing less. Permissions cascade hierarchically and can be overridden per matter.
Walls enforced where the data lives.
Matter access controls compartmentalise work across the firm. When an ethical wall is applied to a matter, walled attorneys and staff cannot view, access, or even confirm that the matter exists — enforcement happens at the database layer.
Conflict screening raises a review event; it does not silently change access. An authorized administrator applies and reviews the appropriate matter barrier, which is then enforced by the platform's access controls.
Provider-specific controls, reviewed by your firm.
AI requests are sent server-side to the provider configured for the feature or firm. LawAOS supports multiple providers, including firm-provided keys, and each provider has its own retention, training, region, and contractual terms.
LawAOS does not use firm content to train its own models. Before sending client-confidential material, the firm must review the selected provider, account tier, data-processing terms, and professional obligations. Using an AI feature does not by itself establish or preserve legal privilege.
Logged, timestamped, attributable.
Security-relevant actions inside LawAOS are logged, timestamped, and attributable — including permission changes, administrative actions, and security events — supporting compliance review.
Your client data is yours. Full stop.
- Provider-managed encryption and encrypted transport
- Firm data is not used to train LawAOS models
- Service providers receive only the data needed to deliver configured services
- Supported record exports are available to authorized firm administrators
- Postgres row-level security scopes tenant-owned records
Where we stand on each framework, honestly.
Legal firms operate under strict regulatory obligations. LawAOS is engineered with these frameworks in mind — and this page states plainly what is live today and what is still on the roadmap.
We do not currently hold a SOC 2 attestation. It is on our roadmap, and we say so rather than implying otherwise.
The current shared deployment uses one configured database region. Residency, data-processing terms, retention, and data-subject workflows must be reviewed and documented for each regulated Enterprise deployment.
Firms handling protected health information must complete a security, provider, and contractual review before storing that data in LawAOS. The public application does not claim HIPAA compliance by default.
California residents' access and deletion requests under the California Consumer Privacy Act are supported through our support channel; broader CCPA workflows must be reviewed and documented for each regulated deployment.
Our security practices draw on ISO/IEC 27001, the international standard for systematic management of sensitive information through risk controls and continuous improvement. We do not currently hold an ISO 27001 certification.
On our roadmap: MFA across all accounts, with TOTP authenticator apps, hardware security keys (FIDO2/WebAuthn), and SMS fallback under configurable security policies.
On our roadmap: restrict platform access to specific IP ranges — office networks, VPN exit nodes, or approved remote locations — with login attempts from unrecognised IPs blocked and flagged for administrator review.
Security questions? We welcome the scrutiny.
Request our security documentation or an internal security audit summary, or schedule a security review call. We aim to respond to security enquiries within one business day — NDA available on request.