Security, In Writing

Most security pages say the same three things: encrypted, compliant, trusted. None of that tells a firm what actually happens to a claimant's medical record between upload and review. So instead of the adjectives, here is the mechanism.

Redaction is a dial, not a promise

PII and PHI exposure is not one setting. It is four, set per matter: Tier 0 for internal matters with no PHI exposure, up to Tier 3 where records are fully de-identified before they ever reach a model. A firm chooses the tier a given matter needs — it is not a fixed policy applied blind to every file regardless of sensitivity.

• Tier 0 — none: internal matters, no PHI exposure.
• Tier 1 — claimant: claimant identifiers redacted.
• Tier 2 — parties: all party identifiers redacted.
• Tier 3 — full: complete de-identification before inference.

PHI under signed BAAs, encrypted the way you would expect

PHI is handled under signed Business Associate Agreements across the stack — not just at the top layer. In transit, everything moves over TLS 1.2 or higher; at rest, AES-256. Matter data is deletable on written request, confirmed in writing, with backups expiring on a documented schedule.

Row-level access, enforced where it cannot be bypassed

A user sees their matters and nothing else — enforced at the query layer, not the UI, which means it holds even if a screen is built wrong. Access is firm-managed through SSO/SAML, role-based down to the individual matter.

An audit trail nobody can quietly edit

Every view, every export, every machine action, every attorney correction is written to an append-only log the firm can export at any time. That last category matters most: a correction is not a silent overwrite. It is versioned, attributable, and reversible — your judgment, on the record, the same way a redline would be.

None of this replaces an attorney's judgment about what to trust with a given file. It is the floor underneath that judgment — so the question a firm asks is never 'do we trust the vendor,' it is 'can we verify what happened,' and the answer is always yes.