Built for the state bar audit.
Client confidentiality, trust fund integrity, and infrastructure hardening aren't features — they're requirements. Here's how we meet them.
Client confidentiality
Run AI locally on your Mac if you choose. No training on your data, ever.
Trust accounting integrity
Append-only audit log enforced by server-side security rules. Per-matter overdraft prevention. Saved reconciliation records for state bar audits.
Infrastructure
Google Cloud Firestore with TLS in transit and encryption at rest. Sandboxed, notarized native apps with signed updates.
Access controls
Firebase Authentication with biometric unlock on native apps. Role-based permissions enforced server-side. Firm-level data isolation.
Data protection
Everything you enter into B.Legal is encrypted in transit using TLS and encrypted at rest by Google Cloud's default encryption. On macOS, the app additionally keeps AES-GCM encrypted local backups of your database, with the encryption key held in your Mac's Keychain — not by us. A copied backup file is useless without your Keychain.
AI and privilege
B.Legal's AI is cloud-based out of the box. On macOS you can point it at a local Ollama model instead, in Settings — and with that backend selected, client confidences (notes, drafts, billing shorthand) never leave your machine. Ollama is macOS-only; the web app and the iPhone and iPad apps always use cloud AI. Cloud requests go to Anthropic under Anthropic's commercial API terms, which do not allow your data to be used for model training, and AI drafting and research output is saved to the matter it was run for.
Trust fund integrity
Every trust transaction is written through a single validated path that enforces per-matter client balances and blocks overdrafts, and each write is recorded in an append-only audit log enforced by server-side security rules: audit entries can be created but never modified or deleted. Ledger corrections happen as new offsetting entries, and three-way reconciliations and conflict checks are saved as append-only records — so the history always tells the truth.
Authentication and access
Accounts authenticate through Firebase Authentication with email and password, or Google sign-in on the webapp; the native apps add biometric unlock (Touch ID on macOS, Face ID on iOS). No SAML or enterprise SSO today. Deactivated accounts fail closed — a removed team member is rejected at sign-in. Role-based permissions are enforced by Firestore security rules on the server, and every document is scoped to your firm: there is no path to another firm's data.
Controls checklist
- TLS in transit; encryption at rest by Google Cloud defaults
- AES-GCM encrypted local backups on macOS, key held in your Keychain
- Manual backup to any folder you choose
- Append-only audit log enforced by server-side security rules
- Append-only conflict-check and reconciliation records
- Multi-tenant firm isolation enforced by Firestore rules
- Role-based permissions checked server-side
- Biometric unlock (Touch ID / Face ID) on native apps
- Fail-closed account deactivation
- API origin validation and per-IP rate limiting
- PII-sanitized server logs
- macOS App Sandbox
- EdDSA-signed, notarized app updates
- Optional local AI on macOS (Ollama)
- Credentials stored in the system Keychain
- Full data export — CSV, JSON, and PDF for trust records
Incident response
We commit to notifying affected customers within 24 hours of discovering any security incident that affects their data. Our incident response playbook is available for review under NDA on Firm-tier engagements.
Responsible disclosure
Security researchers are welcome. Please email security@b.legal with any findings. We commit to acknowledging every report within 48 hours and do not pursue legal action against good-faith research.
Need our security review materials?
Vendor security questionnaires and our incident response plan are available under NDA to Firm-tier prospects.