Security & Trust
How we protect your confidential legal information — stated plainly, with nothing overclaimed.
Hosted in Canada
Your database and the documents you upload are stored in Canada (Montréal), with our hosting provider Supabase. Your data lives on Canadian soil.
Encryption everywhere
Data is encrypted in transit (TLS) and at rest (AES-256). Nothing moves or sits in the clear.
Strict access isolation
Access is enforced at the database level: each client can reach only their own data, and the private lawyer working notes are never exposed. Sign-in is passwordless — we store no passwords.
Private documents
Files are kept in private storage and opened through short-lived, single-use links. They are never publicly accessible.
A lawyer reviews everything
We use AI to help gather facts and prepare drafts — but a licensed Québec lawyer reviews and approves every answer before it reaches you. No legal advice is ever delivered by AI alone, and the AI provider does not use your data to train its models.
A short, vetted list of providers
We rely on a small set of sub-processors under data-processing agreements: Supabase (hosting, Canada), Vercel (application, US), Anthropic (AI, US), Resend (email, US), and Stripe (payments, US). None use your data for their own purposes, and we never sell personal data.
Where processing happens
We believe in being precise: your data is stored in Canada, but some processing occurs in the United States (application hosting, AI drafting, email), and our lawyer accesses it securely from outside Québec under strict controls. We assess these transfers under Québec’s Law 25.
Retention & professional duty
As a member of the Barreau du Québec, we keep closed files for at least 7 years, then securely destroy them. Your confidential and privileged information is protected by professional secrecy at all times.
Governance
We maintain a privacy impact assessment for the portal and a breach response plan, and we can share our approach with your procurement or security team on request.
Questions from your security team?
We’re happy to walk through our controls, sign a DPA, or complete a security questionnaire. See our Privacy Policy and DPA, or reach out.