← Field notes

Security, In Writing

2026-08-27 · Workplex · 6 min read · Security, Compliance, Trust

Most security pages say the same three things: encrypted, compliant, trusted. None of that tells a firm what actually happens to a claimant's medical record between upload and review. So instead of the adjectives, here is the mechanism.

Redaction is a dial, not a promise

PII and PHI exposure is not one setting. It is four, set per matter: Tier 0 for internal matters with no PHI exposure, up to Tier 3 where records are fully de-identified before they ever reach a model. A firm chooses the tier a given matter needs — it is not a fixed policy applied blind to every file regardless of sensitivity.

PHI under signed BAAs, encrypted the way you would expect

PHI is handled under signed Business Associate Agreements across the stack — not just at the top layer. In transit, everything moves over TLS 1.2 or higher; at rest, AES-256. Matter data is deletable on written request, confirmed in writing, with backups expiring on a documented schedule.

Row-level access, enforced where it cannot be bypassed

A user sees their matters and nothing else — enforced at the query layer, not the UI, which means it holds even if a screen is built wrong. Access is firm-managed through SSO/SAML, role-based down to the individual matter.

Who saw what, when — and what the machine did.

An audit trail nobody can quietly edit

Every view, every export, every machine action, every attorney correction is written to an append-only log the firm can export at any time. That last category matters most: a correction is not a silent overwrite. It is versioned, attributable, and reversible — your judgment, on the record, the same way a redline would be.

None of this replaces an attorney's judgment about what to trust with a given file. It is the floor underneath that judgment — so the question a firm asks is never 'do we trust the vendor,' it is 'can we verify what happened,' and the answer is always yes.

Book the 15-minute demo →