Security commitments
Restricted accessAdmin/support views expose metadata only and do not routinely expose customer source documents.
Protected reportsReport links are token-protected and My Reports is OTP-protected.
Abuse controlsRate limits, upload limits, file extension checks, signature sniffing and optional malware scanning.
AuditabilityPayment, admin, OTP, processing, source-verification and notification events are logged as metadata.
Production checklist
- Run under HTTPS only with secure headers enabled.
- Use strong admin login, 2FA, unique admin users and role-based permissions.
- Keep runtime/database/backups outside the public web root.
- Configure malware scanning and server-side file limits.
- Rotate API keys and keep secrets out of source code.
- Complete penetration testing and incident-response plan before public launch.
Security limitation
No service can promise absolute security. The LegalTrust operator should maintain vulnerability management, logs, backups, recovery testing, subprocessor review and a responsible-disclosure route.
Temporary legal-content delivery controls
- Uploaded legal documents are kept outside the public web root and deleted after processing or abandoned-session expiry.
- Generated legal-report HTML/JSON/PDF uses authenticated short-lived access and no-store cache headers.
- The PWA service worker excludes API/report/runtime responses from CacheStorage.
- Persistent invoice, payment, consent and audit records use generic document labels rather than original filenames.
- Depending on configuration, temporary extracted text or rendered page images may be sent to the configured AI/OCR provider solely for the requested processing; production provider contracts/settings must be reviewed before launch.