How LegalBook protects firm data
Tenant walls, an authorization check on every route, least access by role, two-step and recent sign-in, signed links, encrypted secrets and the audit log.
For: OwnerAttorney
On this page
This page describes what the product does to protect a firm's data. It is a description of behavior, not a certification. No third-party security certification or audit has been completed for LegalBook.
Tenant walls
LegalBook serves many firms, and a shared workforce may work for several of them. Keeping firms apart is the first rule of every part of the product.
- Every record belongs to one firm. Every firm-owned table carries the firm, and every query in a firm's request is filtered to that firm automatically. With no firm bound, the filter matches nothing.
- Another firm's record answers "not found". LegalBook never confirms that another firm's record exists, even to say access is denied.
- Live updates are walled too. Real-time channels are prefixed with the firm and checked with the same authorization as the screens.
- Files are stored under the firm. Every stored object's path starts with the firm.
- Search never spans two firms, and identifiers are matched through a per-firm key.
An authorization check on every route
Every action the server exposes must check who is asking, for which firm and with which permission, or verify a provider's signature for a webhook. An automated gate scans every registered route and fails the test run if one has no check. At the last checkpoint it covered 1,919 routes: 1,916 guarded and three declared exemptions, with none unprotected.
Isolation tests check that a person at one firm cannot read, list, search, export or receive events about another firm's records.
Least access by role
LegalBook has 29 roles and 173 permissions, narrowed further by each record's context:
- Reception sees what a live call needs, not whole records.
- Production workers see the matter context for the work item they hold, while they hold it.
- Attorney-only matters, notes and facts need an attorney role, an assignment or an explicit, time-limited grant.
- External co-counsel sees only the matters they are assigned to.
- Clients see a client-safe view built for them. See What clients can and cannot see.
Sign-in
- One LegalBook account, with no passwords held by the app.
- Two-step verification is required for everyone who works in a firm: authenticator app or passkey, with single-use recovery codes.
- Recent sign-in is required for sensitive actions such as changing a matter to attorney-only, sharing a document outside the firm, connecting an integration, releasing a legal hold and approving or downloading an export.
- Per-device sessions: each device can be signed out on its own, and signing out at the account service ends the app's sessions within seconds.
See Signing in and two-step verification.
Documents
- Every upload is fingerprinted, scanned for malware and checked before use; failures are quarantined.
- Files are served only through signed, time-bound, single-purpose links, minted after a permission check. Every mint and download is audited.
- Print uses one-time tokens.
See Scanning, quarantine and validation and Viewing, sharing and printing.
Encrypted secrets
Provider credentials, OAuth tokens and webhook secrets are sealed with an encryption key before they are stored, and are never returned by any screen or response. Identifiers such as A-numbers are stored encrypted, with only the last four digits shown to most people.
Nothing hard-deleted by accident
Firm data is soft-deleted, and retention and legal holds decide what happens to it. Audit events, document versions, filings, QA findings and usage entries are never changed or deleted by the application; corrections supersede them.
The audit log
Every change, download, share, approval and refusal on a sensitive record is written to an append-only, hash-chained audit log, verified daily. See The audit log.
What is not yet verified
The product's controls are tested in development. Some things can only be proven in production and are still pending: certification with live vendors, production-scale load tests, backup restoration and disaster-recovery drills, real-device checks and independent penetration testing.