Built for the state bar audit.
Client confidentiality, trust fund integrity, and infrastructure hardening aren't features — they're requirements. Here's how we meet them.
Client confidentiality
Local AI by default. Cloud AI strictly opt-in. No training on your data, ever.
Trust accounting integrity
Append-only audit log enforced by server-side security rules. Per-matter overdraft prevention. Saved reconciliation records for state bar audits.
Infrastructure
Google Cloud Firestore with TLS in transit and encryption at rest. Sandboxed, notarized native apps with signed updates.
Access controls
Firebase Authentication with biometric unlock on native apps. Role-based permissions enforced server-side. Firm-level data isolation.
Data protection
Everything you enter into B.Legal is encrypted in transit using TLS and encrypted at rest by Google Cloud's default encryption. On macOS, the app additionally keeps AES-GCM encrypted local backups of your database, with the encryption key held in your Mac's Keychain — not by us. A copied backup file is useless without your Keychain.
AI and privilege
By default, B.Legal runs a local Ollama model on your Mac. Client confidences — notes, drafts, billing shorthand — never leave your machine. If you opt into Anthropic Claude, requests go out under Anthropic's commercial API terms, which do not allow your data to be used for model training, and AI drafting and research output is saved to the matter it was run for.
Trust fund integrity
Every trust transaction is written through a single validated path that enforces per-matter client balances and blocks overdrafts, and each write is recorded in an append-only audit log enforced by server-side security rules: audit entries can be created but never modified or deleted. Ledger corrections happen as new offsetting entries, and three-way reconciliations and conflict checks are saved as append-only records — so the history always tells the truth.
Authentication and access
Accounts authenticate through Firebase Authentication with email and password; the native apps add biometric unlock (Touch ID on macOS, Face ID on iOS). Deactivated accounts fail closed — a removed team member is rejected at sign-in. Role-based permissions are enforced by Firestore security rules on the server, and every document is scoped to your firm: there is no path to another firm's data.
Controls checklist
- TLS in transit; encryption at rest by Google Cloud defaults
- AES-GCM encrypted local backups on macOS, key held in your Keychain
- Manual backup to any folder you choose
- Append-only audit log enforced by server-side security rules
- Append-only conflict-check and reconciliation records
- Multi-tenant firm isolation enforced by Firestore rules
- Role-based permissions checked server-side
- Biometric unlock (Touch ID / Face ID) on native apps
- Fail-closed account deactivation
- API origin validation and per-IP rate limiting
- PII-sanitized server logs
- macOS App Sandbox
- EdDSA-signed, notarized app updates
- Local AI by default; cloud AI strictly opt-in
- Credentials stored in the system Keychain
- Full data export — CSV, JSON, and PDF for trust records
Incident response
We commit to notifying affected customers within 24 hours of discovering any security incident that affects their data. Our incident response playbook is available for review under NDA on Firm-tier engagements.
Responsible disclosure
Security researchers are welcome. Please email security@b.legal with any findings. We commit to acknowledging every report within 48 hours and do not pursue legal action against good-faith research.
Need our security review materials?
Vendor security questionnaires and our incident response plan are available under NDA to Firm-tier prospects.