Security and Data Protection
DueCounsel Security and Data Protection
Legal technology must protect confidential information while giving authorized teams reliable access to the tools and records they need.
Security governance
DueCounsel applies structured security governance to protect firm data and maintain operational accountability.
- Designated Data Protection Officer
- Security policies and procedures
- Regular security reviews
- Incident response process
Application security
The DueCounsel platform is designed with security controls at the application level.
- JWT-based authentication
- Role-based authorization
- Input validation and output encoding
- Regular dependency updates
Infrastructure security
DueCounsel is hosted on Amazon Web Services with multi-tenant isolation and secure infrastructure configuration.
- AWS hosting with server-side encryption
- Multi-tenant isolation
- Network security controls
- Regular infrastructure monitoring
Encryption
All data is encrypted in transit and at rest.
- TLS 1.3 for data in transit
- AES-256 for data at rest
- Encrypted document storage
- Secure key management
Identity and access management
Access to firm data is controlled through role-based permissions and authentication safeguards.
- Role-based access control
- Matter-level permissions
- Workspace separation between firms
- User lifecycle management
Tenant and workspace separation
Each firm operates within an isolated workspace. Data is never shared between firms.
- Firm-level data isolation
- Matter-level access controls
- No cross-firm data visibility
- Private document storage
Logging and auditability
Every significant action is logged to provide a complete audit trail.
- User activity logging
- Document access and modification logs
- Matter change history
- Administrative action logs
Backups and recovery
DueCounsel maintains backup processes to support business continuity.
- Regular database backups
- Document storage redundancy
- Recovery procedures
- Business continuity planning
Incident-response process
DueCounsel maintains a structured incident response process for security events.
- Incident detection and reporting
- Assessment and classification
- Containment and remediation
- Post-incident review
Vendor and subprocessors
DueCounsel uses trusted infrastructure providers to deliver the platform.
- Amazon Web Services (hosting)
- AI processing providers (Mistral, Anthropic)
- No document content retained by AI providers for training
Responsible use of AI
DueCounsel uses AI to help organize and surface information, not to replace legal judgment.
- Documents never used to train AI models
- AI processing does not retain document content
- All AI-suggested actions require user confirmation
- No legal advice provided by the platform