Skip to content
IntuitiveLegal

Security

Your firm’s records include privileged client information. This page describes how the platform protects it today.

Each firm’s data is its own

  • Every client, matter, document and invoice belongs to one firm.
  • Each request that reads or changes a record checks that the record belongs to your firm first.
  • IDs sent in a request, such as an assignee or a matter, are checked against your firm too.

People see what their role allows

  • Roles from owner to staff come with sensible defaults, and your firm can widen or narrow them.
  • Permissions are enforced on the server for billing, users, invitations, settings, exports and confidential documents, not just hidden in the interface.
  • Deactivated users are refused straight away.

Clients see only their own matters

  • Client portal accounts are separate from firm accounts and can’t open firm pages.
  • A portal sign-in is linked to one client record and sees only that client’s matters.
  • Clients never see draft invoices, internal notes, budgets or other people’s tasks.

Sign-in

  • Sign-up is by invitation: people join a firm only when invited.
  • Two-factor authentication with an authenticator app, plus backup codes.
  • Email addresses must be verified before they can be linked to a firm or client record.

Documents

  • Files are kept in private storage and served only through access-checked routes.
  • Confidential documents are limited to the people allowed to see them.
  • Word editing runs on our own server, so documents aren’t sent to third-party services to be converted.
  • Only PDFs, images and plain text open in the browser; everything else downloads, so an uploaded file can’t run code.

Payments

  • Card details are entered in LawPay’s hosted fields and never reach our servers.
  • Invoice totals are calculated on the server, and an invoice can only be marked paid once.
  • Clients and matters with billing history can’t be deleted, only closed or marked inactive.

Infrastructure

  • Hosted in the western United States.
  • All traffic is encrypted in transit; the database and file storage are encrypted at rest.
  • Connections to Google, DocuSign and LawPay are stored encrypted and are never sent to the browser.
  • A strict content security policy and standard security headers on every page.

Certifications and questionnaires

We don’t have a SOC 2 report yet. If your firm needs a security questionnaire completed or has questions about data handling, email hello@intuitive-legal.com.