Security, In Writing
2026-08-27 · Workplex · 6 min read · Security, Compliance, Trust
Most security pages say the same three things: encrypted, compliant, trusted. None of that tells a firm what actually happens to a claimant's medical record between upload and review. So instead of the adjectives, here is the mechanism.
Redaction is a dial, not a promise
PII and PHI exposure is not one setting. It is four, set per matter: Tier 0 for internal matters with no PHI exposure, up to Tier 3 where records are fully de-identified before they ever reach a model. A firm chooses the tier a given matter needs — it is not a fixed policy applied blind to every file regardless of sensitivity.
- Tier 0 — none: internal matters, no PHI exposure.
- Tier 1 — claimant: claimant identifiers redacted.
- Tier 2 — parties: all party identifiers redacted.
- Tier 3 — full: complete de-identification before inference.
PHI under signed BAAs, encrypted the way you would expect
PHI is handled under signed Business Associate Agreements across the stack — not just at the top layer. In transit, everything moves over TLS 1.2 or higher; at rest, AES-256. Matter data is deletable on written request, confirmed in writing, with backups expiring on a documented schedule.
Row-level access, enforced where it cannot be bypassed
A user sees their matters and nothing else — enforced at the query layer, not the UI, which means it holds even if a screen is built wrong. Access is firm-managed through SSO/SAML, role-based down to the individual matter.
Who saw what, when — and what the machine did.
An audit trail nobody can quietly edit
Every view, every export, every machine action, every attorney correction is written to an append-only log the firm can export at any time. That last category matters most: a correction is not a silent overwrite. It is versioned, attributable, and reversible — your judgment, on the record, the same way a redline would be.
None of this replaces an attorney's judgment about what to trust with a given file. It is the floor underneath that judgment — so the question a firm asks is never 'do we trust the vendor,' it is 'can we verify what happened,' and the answer is always yes.