Built to protect confidential legal information

• HTTPS encryption for all traffic between you and the platform.
• Secure authentication with hashed passwords and signed, HttpOnly, same-site session cookies.
• Password hashing using industry-standard algorithms — credentials are never stored in plain text.
• Role-based access control (RBAC) enforced on pages, actions and APIs.
• Secure sessions with expiry, session management and the ability to log out of all devices.
• Secure file uploads — MIME and extension allowlists, size limits and random storage names.
• Malware-scan hook for uploaded documents before they are made available.
• Secure APIs with request validation, input sanitisation and same-origin (CSRF) protection.
• Rate limiting across sensitive endpoints to prevent abuse.
• Login & brute-force protection with progressive delays and temporary lockout.
• Audit logs & activity monitoring for sensitive administrative and security events.
• Secure infrastructure, regular security updates and dependency checks.
• OWASP practices guiding our defences against the most common web risks.

Confidentiality is enforced by design, not just by policy:

• Every user's data is isolated to their own account.
• Lawyers cannot access another lawyer's data.
• Clients cannot access another client's data.
• Administrators cannot view confidential Matter Management conversations, uploaded documents, AI conversations or legal files.

AI sessions are isolated per account — no AI conversation is visible to another user, lawyer or administrator. Matter Management workspaces, including documents, milestones, invoices and communications, are accessible only to the assigned client and lawyer.

Security starts at the door. Every account is protected by CNIC uniqueness checks and a minimum age requirement of 18+. Lawyers and law firms may use plan features and appear in public directories after signup. The optional Verified badge is granted when admin reviews declared identity fields (CNIC number, bar council number, contact) — document photo uploads are not required. Paid subscriptions activate through a separate payment-verification flow.

• CNIC uniqueness checks across the platform.
• Minimum age requirement (18+) enforced at registration.
• Optional Verified badge — admin reviews identity fields only (no document photos).
• Identity fields used for badge review are confidential — visible to the applicant and authorized administrators.

Each account may stay signed in on one desktop and one mobile device at a time (maximum two concurrent sessions). Every login generates a trusted device fingerprint from the device type, browser, operating system, approximate location, IP address and login time.

• Device login limits — 1 desktop + 1 mobile; a new device of the same type replaces the old one, which is signed out immediately.
• Session replacement confirmation — you are warned before a login replaces an existing trusted device.
• Suspicious-login detection — new country, distant region, unknown or modified device, or poor IP reputation triggers OTP verification.
• Active Devices & login history — review trusted devices and your recent login events (with status), and sign out any device.
• Secure sessions with inactivity expiry, log-out-of-all-devices, trusted-device removal and forced re-authentication after a password change.
• Security notifications — email and in-app alerts when a device is added or replaced, your password changes, a suspicious login is detected, or all sessions are terminated.
• Account-sharing protection — repeated suspicious activity escalates from warning to temporary login restriction to admin review.

A structured complaint workflow lets users report lawyers or clients. Our team reviews complaints, verifies facts, and may issue warnings or apply temporary or permanent suspension for confirmed or repeated violations. A permanently banned CNIC cannot be used to register again.

Subscription plans define AI-credit quotas, lifetime storage limits and fair-usage boundaries. Storage included with a plan (and any purchased add-ons) does not reset on renewal; when the limit is reached, uploads pause with options to free space or buy more lifetime storage.

Uploaded documents are validated, stored with randomised names outside public directories, and served only to authorised participants through access-checked, signed downloads. Proposals and invoices are generated within the platform and shared only with the client and assigned lawyer or firm.

If you believe you have found a security issue, please email [email protected] with details. We appreciate responsible disclosure and will investigate promptly.