Data classification
The six classes of data LegalBook handles and how each is treated.
For: Owner
LegalBook classifies the data it holds so each class is handled consistently: who may see it, how it is stored, and what happens when it is exported.
| Class | Examples | Handling |
|---|---|---|
| Public approved content | Published general education and public firm information | Only approved versions are published, with no client-specific context |
| Internal operational | Queue data, staffing, configuration, capacity and aggregate reports | Signed-in role access and firm filters; real-time updates do not identify clients |
| Confidential client data | Names, contact details, intake answers, case status, invoices, messages | Firm and record-level authorization, client-safe views, private storage, audited exports and downloads |
| Restricted legal and personal data | Identity documents, protected facts, privileged notes, safety flags, recordings | Narrow role and matter authorization, recent sign-in where specified, approved redactions, no broad support access |
| Secrets | Sign-in and provider tokens, webhook secrets, encryption keys | Encrypted or held outside the database; never in responses, logs or saved replies |
| Security and audit records | Session data, role changes, access logs, incident evidence | Restricted access and an unchangeable history; reviewed before export |
Rules that follow from it
- A firm id is an access boundary, not just a label.
- Event notifications that only describe a change never carry document contents, intake answers, message bodies, codes or credentials.
- Unscanned or failed files are never released through a share, the portal, an export or a signature.
- A redacted copy does not change the original's class.
- AI input is checked against the source's sensitivity and the matter's controls before anything is sent, and AI suggestions stay non-authoritative until a person accepts them.
Field-level rules
Behind the classes is a detailed matrix: for each field, how it is masked in exports and who may see it. LegalBook's security administrators maintain the matrix. A firm can see it under Data classification and adjust some rules; weakening a rule needs a second administrator's confirmation.