LawDepLawDep

Security

Security we can
actually defend.

Legal data is the crown jewels. Here is exactly what we do today, what we’re building toward, and what we won’t claim until it’s true.

Shipping today

The controls that protect you now

Multi-tenant isolation

Every table in the database carries an organization_id, and every query filters by it at the service layer. A tenant's data is scoped by the request context end-to-end: it isn't a convention we hope people follow.

Encryption in transit and at rest

All traffic between the browser and the API is TLS. The database and object storage are managed services with encryption at rest enabled by the infrastructure provider.

Authentication & sessions

Passwords are hashed with bcrypt. Login is rate-limited and locked out after repeated failures. Sessions are signed JWTs with an expiry; the secret rotates on deploy.

LLM data handling

Your prompts and documents are sent to LawDep's LLM provider only for the specific request you make. Document embeddings run locally on our infrastructure, so your documents are never sent to a third party for indexing. LawDep never trains a model on your data.

Storage boundaries

Uploaded files go to object storage; only paths and extracted text live in the database. We never embed binary files in database columns.

Audit & accountability

LLM calls are logged with cost and prompt metadata. Matter stages are append-only. AI-generated content carries a visible disclaimer: we don't remove it, because it's a liability guardrail for you.

On the roadmap

What’s coming, and our honest status

  • Single sign-on (SAML / OIDC) for enterprise teams
  • SCIM provisioning for user lifecycle management
  • SOC 2 Type I → Type II certification (in progress: we won't claim it until the audit is real)
  • Region-pinned data residency options (EU / India)
  • Full audit export for e-discovery evidence

Straight answers

The questions a security review will ask

Are you SOC 2 certified?+
Not yet. We're running the SOC 2 Type I readiness process and we won't market ourselves as certified until the audit report is real. In the meantime we run the underlying controls you'd audit us for: tenant isolation, TLS, encrypted-at-rest storage, bcrypt auth with lockout, and audit logging.
Where is my data stored?+
By default on Railway's managed cloud infrastructure (Postgres, Redis) and their S3-compatible object storage, currently hosted in a single region (Southeast Asia). Region-pinned EU and India residency are on the roadmap. A fully self-managed deployment is on the roadmap but not available today: we'll be honest about that in your security review rather than overstate it.
Is my data used to train an AI model?+
No. Your data is used only for the specific prompts you send to LawDep's LLM provider, and document embeddings run locally on our infrastructure. LawDep itself never trains a model. Refer to our LLM provider's data-use policy for confirmation of their handling of prompts.
Can I export or delete my data?+
Yes. Any workspace can download a full JSON export of every table plus every uploaded document, at any time. On offboarding, data is retained for a defined period then removed from primary storage.
What happens if the LLM makes a mistake?+
It will. That's why every AI-generated draft carries a visible disclaimer, citations are verified against live legal databases, and nothing AI produces is ever presented as final legal advice without review by qualified counsel.

We don’t overstate security

The legal AI space is full of tools that print “SOC 2 certified” before the audit is done. We won’t do that. If you need formal certifications today, we’ll tell you where we are honestly: if your data simply cannot leave your own infrastructure, a self-managed deployment is on the roadmap, and we'll tell you plainly whether we can support it before you commit.