Security & trust
Estateur holds privileged client information on behalf of law firms. This page says what we actually do about that, and — further down — what we have not done yet.
Encryption
- Client contact details are encrypted at rest
- Client email addresses, phone numbers and mailing addresses are sealed with AES-256-GCM before they are written to the database, each with its own initialisation vector and authentication tag. They are decrypted only when the firm that owns the matter reads them.
- Uploaded documents are encrypted the same way
- Files stored in the vault are sealed as binary with the same AES-256-GCM scheme, under a distinct prefix so a sealed file is never mistaken for a sealed text field.
- Everything travels over TLS
- The application, its API and the client portal are served over HTTPS. Session cookies are set httpOnly and, in production, secure — so they are never readable by page scripts and never sent over a plain connection.
- Passwords are hashed, never stored
- Account passwords are stored as bcrypt hashes. Nobody at Estateur can read a password, and a database copy does not yield one.
Access control
- Every query is scoped to one firm
- Matters, documents, messages and invoices are read and written through queries bound to the firm's own account id. A second firm asking for your matter by its id gets the same answer as a stranger: not found.
- Roles and permissions inside a firm
- Firm plans carry seats with roles, so a paralegal can run intake and assemble a matter while sign-off stays with an attorney.
- Sign-in is rate limited and locks out
- Repeated failed sign-ins are throttled per address and per account, with an escalating backoff and a durable lockout — so a stolen password list cannot be tried at speed.
- Firm-private surfaces never reach the client
- Internal case notes are readable only inside the firm. They are excluded from every client-facing portal response, including the attorney's own 'view as client' preview, and that exclusion is covered by end-to-end tests.
Auditability
- An append-only audit trail per firm
- Client changes, status moves, document generation and intake edits are recorded to a per-firm audit log that is appended to and never rewritten.
- The audit trail is hash-chained
- Each audit entry is chained to the one before it, so an entry cannot be altered or removed without breaking the chain — and the chain can be verified.
- Documents carry their own provenance
- Each generated document records the facts it was built from and the rule set and versions in force at the time, so what a document says can be traced to what was known when it was drafted.
How we handle your data
- Your matters stay yours
- Estateur does not sell client data, does not market to your clients, and does not use your matters to solicit anyone. You can export your documents.
- Estateur is software, not a law firm
- Estateur does not practise law and does not provide legal advice. The subscribing attorney is the professional of record and is responsible for reviewing every document.
What we have not done yet
Estateur holds no security certification today. Rather than leave that to be inferred, here is the list.
- SOC 2 Type IINot yet
- Not yet obtained. Estateur has not completed a SOC 2 audit and does not claim SOC 2 compliance. This section will name the report and its date once the audit is complete.
- Third-party penetration testNot yet
- Not yet commissioned. This will state who performed the test and when.
- Backup and disaster recoveryNot yet
- Backups are handled by our managed database provider. We have not yet published a recovery-point or recovery-time commitment, so none is claimed here.
- Hosting and data residencyNot yet
- To be published: hosting provider, regions, and where data is stored at rest.
- Sub-processor listNot yet
- To be published: the third parties that process data on our behalf.
- Two-factor authenticationNot yet
- Not yet available. Sign-in is protected by rate limiting and account lockout; a second factor is not offered today.
- InsuranceNot yet
- To be published: the professional liability and cyber cover carried, and by whom.
Reporting a vulnerability
If you believe you have found a security issue, email contact@estateur.com with “security” in the subject and enough detail to reproduce it. Please give us a reasonable chance to fix it before disclosing it publicly.
For contractual terms, see the Subscriber Agreement and Privacy Policy.