Security and compliance, built in the open.
Personal injury files hold medical records, financial details and privileged work. Here is how we protect them today, and the roadmap we are following, published with honest status.
Protections in place today
Encryption
TLS in transit and AES 256 at rest.
MFA and least privilege
Multi factor sign in, six roles, field level sharing for portals.
Audit logs
Every view, change, share, API call and AI action recorded per case.
Scoped vendor access
OAuth 2.0 grants limited to what an order needs, revocable any time.
Responsible AI
AI drafts are labeled and approved by a person. No training on client data.
Medical data care
Medical records shared only with the parties a firm chooses.
Compliance roadmap
What we are pursuing, and why
Every framework below is pending, and the work is underway. We publish this because most case management companies do not, and firms trusting us with medical and privileged data deserve to see the plan.
SOC 2 Type IIEssentialPending, in progress
What we are doing
Our most important independent security assurance for law firms and enterprise customers.
Why it matters to your firm
Firms trust a third party audit over a vendor's promises. Type II proves controls work over time, not just on one day.
HIPAAEssentialPending, in progress
What we are doing
Safeguards for medical information, plus a clear assessment of where our services create business associate obligations.
Why it matters to your firm
PI files are full of medical records. Firms and providers need to know exactly how that information is protected.
ISO 27001HighPending, in progress
What we are doing
A valuable additional certification as we scale into enterprise and international markets.
Why it matters to your firm
An internationally recognized standard for running security as a managed program, audited yearly.
NIST CSF 2.0HighPending, in progress
What we are doing
The foundation of our cybersecurity program.
Why it matters to your firm
A common language for identifying, protecting, detecting, responding and recovering, used by government and industry.
CIS ControlsHighPending, in progress
What we are doing
A practical baseline for endpoints, infrastructure, access controls and monitoring.
Why it matters to your firm
Prioritized, proven safeguards that stop the most common attacks.
PCI DSSConditionalPending, in progress
What we are doing
Required controls depend on how the platform handles cardholder data.
Why it matters to your firm
If we ever process card data directly, these controls keep payment data safe. Today a processor handles cards.
GDPRConditionalPending, in progress
What we are doing
Applies when we serve customers or process data within its territorial scope.
Why it matters to your firm
Ready privacy rights handling for any firm or client covered by European data protection law.
ISO 27701OptionalPending, in progress
What we are doing
Privacy information management, useful as our data processing footprint grows.
Why it matters to your firm
Extends ISO 27001 to cover how personal data is governed end to end.
The certification roadmap
Three phases. Timing is illustrative and will be updated here as each milestone is reached.
Foundation
Months 0 to 3, illustrative- SOC 2 controls
- NIST and CIS safeguards
- HIPAA applicability assessment
- Vendor management
- Encryption and MFA
- Incident response
- Penetration testing
- Audit logging
- SOC 2 Type I readiness, if useful
Independent assurance
Months 3 to 12, illustrative- SOC 2 Type II examination after the observation period
- Validate HIPAA safeguards where applicable
- Continuous security monitoring
Enterprise expansion
Months 9 to 18, illustrative- ISO 27001 certification
- Formal enterprise customer security reviews
- Expanded privacy controls as the platform grows
Why this is a difference maker
Most case management platforms never publish their security posture. Firms are left to take it on faith. We show the plan, the priority and the status, and update it as we go.
PI firms carry medical records, financial details and privileged strategy. Independent assurance like SOC 2 Type II and real HIPAA safeguards protect clients, firms and the medical providers sharing records with them.
Transparency between the firm, medical providers and clients starts with trust. The same openness we build into the portals applies to how we protect the data inside them.
Data and subprocessors
| Area | Detail |
|---|---|
| Hosting | US data centers, multi zone, daily encrypted backups |
| Access | SSO and MFA for staff, scoped OAuth for vendors |
| Retention | Firm controlled, with legal hold |
| AI | Case Lab AI runs on enterprise model providers under zero retention terms |
| Incident response | Documented plan with prompt customer notification |