Security & Privacy

This guide explains where your data is stored, how it is protected and who in your firm can see it.

Data Encryption#

• In transit: Everything between your browser and Lawzana Flow travels over HTTPS
• At rest: Our cloud providers encrypt stored data: Google Cloud for uploaded files, DigitalOcean for the database
• Documents: Uploaded files are stored in Google Cloud Storage with server-side encryption

Data Residency#

Your uploaded files are stored in one region. Firms that sign up on flow.lawzana.com get the Europe region; firms that start from the Lawzana Directory choose theirs when the workspace is created.

Only uploaded files are stored in that region. The database, search, background jobs and application servers run on DigitalOcean in the United States. AI requests are processed by Google Vertex AI on its global endpoint, so they are not limited to your file storage region.

You can see your region in Settings → General under File Storage Region.

AI Data Privacy#

What Google does with your requests#

We use Google Vertex AI. Google does not use your content to train its models, and request logging is off on our project. Google may keep requests in memory for up to 24 hours for caching, and may log them to detect abuse.

• Your documents and data are never used to train AI models
• Request logging is off on our Google Cloud project
• Google may keep requests in memory for up to 24 hours for caching, isolated to our project
• Google may log requests to detect abuse
• Lawzana Flow itself stores your AI chat history, summaries and extracted facts as part of your matter

How AI Processing Works#

1. You request an AI operation (e.g., summarize a document)
2. The document is sent to Google Vertex AI for processing
3. The AI generates a response
4. The response is returned to Lawzana Flow and saved in your account
5. Google handles the request as described above

Authentication & Access#

• Email and password sign-in, with email verification before your first sign-in
• Google and Microsoft sign-in
• Magic links for the client portal: clients need no password or account
• Roles: four permission levels (Owner, Admin, Member, Viewer). See Team & Roles
• Record visibility: choose whether members and viewers see every lead and matter or only the ones assigned or shared with them
• Ethical walls: keep team members out of conflicted matters. See Ethical Walls
• Portal links expire, and you can revoke them at any time

Session Security#

• Sessions use signed, encrypted, HTTP-only cookies (not readable by JavaScript)
• Access is re-checked every few minutes, so a removed member loses access quickly

Audit Logging#

The audit log records:

• Sign-ins
• Changes to leads, matters, contacts, clients and automations
• Document uploads, views, downloads and deletions
• Matter stage changes and lead conversions
• Conflict checks
• Team member role changes and removals
• Changes to record visibility and sharing

Audit logs are:

• Searchable by action, record type, user or date
• Exportable as a CSV file
• Available to the firm Owner only, in Settings → Audit Logs

Infrastructure Security#

• Application servers, database, search and background jobs are hosted on DigitalOcean in the United States; uploaded files are stored in Google Cloud Storage
• Traffic goes through Cloudflare
• Content Security Policy (CSP) headers to help prevent cross-site scripting
• Error monitoring with Sentry

Data Backup#

• Daily automated database backups, kept for 7 days
• Point-in-time restore of the database within those 7 days

Your Data#

• Data processing agreements available on request
• Download any of your files at any time
• Ask us for a full export of your data, or to delete your personal data

Responsible Disclosure#

If you discover a security vulnerability, please report it to [email protected].

Contact#

For security-related questions:

• Email: [email protected]
• General support: [email protected]