How we protect your firm's records.

Each firm's data is walled off in the database

Every record belongs to one firm, and PostgreSQL row-level security is switched on and forced for every firm table. The application connects as a database role that cannot bypass those rules, so a bug in our code still cannot return another firm's rows.

• Code that queries firm data without naming the firm fails before it reaches the database
• Automated tests try every API route with another firm's record IDs and expect "not found"

Sensitive fields are encrypted

The most sensitive values are encrypted inside the database with a key derived per firm, so a copy of the database alone does not reveal them:

• Trust account bank account numbers (exports show only the last four digits)
• Your outgoing mail server password
• Access tokens for connected email accounts
• Storage locations of call recordings

Connections to LawMOR use TLS 1.2 or 1.3, with HTTP Strict Transport Security.

A second factor for actions that move money or data

Sign-in supports authenticator-app codes. For the riskiest actions LawMOR asks you to confirm your second factor again if you have not done so in the last 10 minutes:

• Posting trust deposits, disbursements, transfers and reversals
• Signing a monthly trust reconciliation and producing the CTAPP packet
• Recording payments and issuing refunds
• Exporting or importing firm data

An audit log that cannot be edited

Changes to money, time, matters, conflict checks and communications are recorded with who, when, what changed and the request it came from. Database triggers refuse any update or deletion of audit entries, including from our own application.

Backups that are restored on a schedule

The database is backed up daily, encrypted and checksummed, and backups are kept for 30 days. Every week an automated drill restores the latest backup into a scratch database and checks that every table came back. A backup we have never restored is not counted as a backup.

Your data leaves with you

A firm owner can export everything at any time: every table as CSV and JSON, your documents, and the audit log, with a manifest of file hashes. Export keeps working when a subscription lapses and the workspace is read-only. There is no export fee.

Captured calls and texts stay private

• Drafts created from calls and texts are visible only to the timekeeper until they release them
• A call is recorded only when the consent announcement played; otherwise the audio is discarded
• Card numbers, Social Security numbers and bank account numbers are removed from transcripts and texts before they are stored
• Recordings are deleted after their retention period unless a legal hold applies
• No screenshots, keystroke logging or desktop monitoring, ever

The rest of the basics

• Rate limits on sign-in, sign-up and every API route
• Signatures checked on every incoming webhook from payment, phone and messaging providers
• Uploaded files are accepted only when their contents match an allowed type
• Strict security headers, including a content security policy that blocks framing
• Sessions end after 12 hours