Security

A petition file is a near-complete dossier on a person: identity documents, employment history, family details, and their immigration status. We treat a breach here as a serious harm to a user, not an embarrassment to us. This page describes the controls that exist, so you can judge them.

Access control

One invariant governs the system: an attorney can read a petitioner’s case only if a live engagement links them and the petitioner has unlocked it. There is no other path, no override flag, no trusted-partner tier, and no role that implies case access as a side effect.

• Every operation touching case data passes through a single authorization layer that fails closed. A missing check produces a 403, not a leak.
• Support and moderation roles reach case metadata to help users but are refused document contents by the same layer.
• An attorney whose bar credentials are unverified or suspended cannot load even a redacted listing.
• Requests for a case that does not exist and a case you cannot see are deliberately indistinguishable, so identifiers cannot be enumerated.
• These rules are covered by an automated test suite that runs against a real database on every change.

Encryption

• TLS 1.3 in transit.
• AES-256 at rest for all stored documents, in a private bucket.
• Column-level AES-256-GCM encryption for passport numbers, A-numbers, and tax and social security numbers, using a key held outside the database.
• Document access is granted only through signed URLs valid for about sixty seconds, minted after authorization rather than in advance.

Chain of custody

Every view, download, upload and deletion of every document is recorded to an append-only log with the actor, their role, a timestamp and the request origin. So is every moment a petitioner unlocks their case to an attorney. The log is scrubbed of contents and identifiers by design, so it is safe to produce in full if you ever need to demonstrate who handled your evidence.

Uploads

Uploaded files are hashed on arrival, scanned before they are readable, and held in a quarantined state until they pass. A file that fails is never served to anyone, including you, and the reason is shown so you can re-upload a clean copy.

AI features

Drafting and assessment send the relevant portion of your case text to our AI provider to produce the output, and nothing more. Your documents are not used for model training. Every generated document records the model and prompt version that produced it, so any output can be explained and reproduced later rather than being unaccountable.

What we have not done yet

Stating this plainly is more useful than a page of reassurance. We have not completed a third-party penetration test or a SOC 2 audit. We are a young product, and you should weigh that. The controls above are real and testable today; the independent attestation of them is not yet in place.

Reporting a vulnerability

If you find a security issue, tell us before disclosing it publicly and we will work with you. We will not pursue legal action against anyone acting in good faith who avoids accessing other people’s data, avoids degrading the service, and gives us reasonable time to fix the issue. Use a test account rather than a real petitioner’s case to demonstrate a finding.