Security

Documents

• Identity documents are held in private storage that is not publicly reachable, and are never served from a public web path.
• A document can only be retrieved by a signed-in member of the firm that created the matter. A request from anyone else returns “not found” rather than confirming the record exists.
• Uploads are validated by inspecting the file contents, not the filename or the browser-declared type.

Accounts

• Passwords are stored as a one-way salted hash and are never readable by us.
• Session cookies are HttpOnly, SameSite and Secure.
• Repeated failed sign-in attempts are rate limited by both address and account.
• Firms are created by invitation only; there is no public self-registration.

The audit trail

Every material action on a matter is written to an append-only trail. The database refuses updates and deletions of audit records from the application, and refuses any change to an MLRO decision once recorded. Each entry also carries a hash of the entry before it, so altering or removing history is detectable.

Stated precisely, because the distinction matters: this is immutability enforced against the application. Someone holding direct database credentials could still alter records — but not without breaking the hash chain, which is exactly what makes it evidence.

In the browser

A Content Security Policy with a per-request nonce, strict transport security, framing and MIME-sniffing protection, a no-referrer policy so verification links cannot leak, and origin checking on every state-changing request.

Reporting a vulnerability

If you believe you have found a security problem, please tell us through the contact page. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable opportunity to fix it.