Skip to content

Enterprise

What your security review will ask about

Rather than make you extract this in a questionnaire, here is how access, isolation, and assurance actually work.

Identity and access

  • SAML and OIDC single sign-on against your existing directory
  • Enforced multi-factor authentication, set at the tenant level
  • Five roles, enforced in the database rather than only in the interface
  • JWT claims carry tenant and role, checked on every request
  • Automatic deprovisioning when a user is removed from your directory

Data protection

  • Row-level security keyed by tenant on every table
  • Object storage partitioned by tenant and case identifier
  • Encryption in transit and at rest, with short-lived signed URLs for file access
  • Configurable retention and deletion schedules per tenant
  • New Zealand Privacy Act 2020 alignment, including breach notification obligations

Assurance

  • Append-only audit log, per case and per actor, exportable on demand
  • Citation validation results retained alongside each generated document
  • Golden-test suite run against document templates before any release
  • Named support contact and an agreed response target

Integration

  • REST API for case creation, document upload, and draft retrieval
  • Webhooks for document completion and deadline events
  • Bulk tenant provisioning
  • Sandbox tenant for integration testing

Certification status

We build against the controls that ISO 27001 and SOC 2 describe, but we hold neither certification today. We would rather tell you that up front than let it surface halfway through your procurement process. If a certification is a hard requirement for you, say so when you get in touch and we will tell you honestly where we are.

Talk to us

Technical detail is in the API documentation and tenant setup guide.