Security
Your clients’ files, and what happens to them
A practice holds other people’s confidences for a living, and the partner who signs for the software is the one who answers if it goes wrong. This page is written for them.
- Where the data sits
- Hosted, it lives in a database dedicated to your firm alone, never shared with another practice. Hybrid, your documents stay on your own server and move directly between your staff and that server. Corporate, nothing of yours is on our infrastructure at all.
- Who can see what
- Every table carries role-based rules enforced by the database itself, so a query cannot return a file the person is not entitled to even if the application asks for it. Advocates see their own matters. Partners see the firm.
- Two-factor authentication
- Required, checked on every request rather than at sign-in only. Recovery codes are issued at enrolment, and an administrator can reset a lost authenticator. Both are recorded and the account holder is emailed.
- The audit trail
- Sign-ins, failed sign-ins, MFA changes, exports and every change to a file, recorded with the person, the address and the time. Nobody can edit or delete a row once written, including us.
- Backups, and getting it back
- Nightly and off-site, with restores actually rehearsed rather than assumed. Ask us when the last restore drill was and we will tell you the date.
- Leaving
- Your data is yours. A full export is available at any time, in a form you can read without us. Thirty days notice either way and no charge to leave.
If your clients will not allow a third party to hold the files
Some work genuinely cannot sit with anybody else, and for a large litigation practice that is a position rather than a misunderstanding. Two of the three ways to buy exist for exactly this: Hybrid keeps every document on your own server while we run the application, and Corporate puts the entire system on your infrastructure with nothing of yours on ours.
For a security review
Larger firms and their insurers ask for detail this page does not carry: the components we build on, how sessions are handled, what is logged and for how long, and our incident process. We answer all of it in writing, under a non-disclosure agreement. Ask at info@jurisflow.co.ke.