Security Policy

Lawgbook implements multiple layers of authentication to protect user accounts and platform access:

• Password hashing — user passwords are hashed using bcrypt with a work factor of 12. Plaintext passwords are never stored or logged.
• Session management — access is controlled via short-lived JSON Web Tokens (JWT). Refresh tokens are single-use, hashed before storage, and rotated on each use. Token revocation is enforced server-side via a token version mechanism.
• OAuth 2.0 — third-party integrations (Clio, Gmail, Outlook, Zoom, Microsoft Teams) use the OAuth 2.0 Authorization Code flow. We request only the minimum scopes required for each integration.
• Role-based access control — users may only access data belonging to their firm. Cross-firm data access is not possible by design.

Lawgbook is hosted on enterprise-grade cloud infrastructure with the following protections:

• Network segmentation and firewall rules restricting access to internal services
• Isolated database environments per deployment region
• Secrets and credentials managed via environment variables and secrets management services — never committed to source control
• Container-based deployments with minimal attack surface
• Automated database backups with point-in-time recovery

By default, Lawgbook stores and processes data in the United States. Enterprise customers may request data residency in alternative regions, including the European Economic Area. Available regions and any applicable restrictions are confirmed during onboarding.

Where data is transferred across borders, we rely on appropriate legal mechanisms including Standard Contractual Clauses for EEA and UK data transfers.

Lawgbook uses the following subprocessors to deliver the platform. Each subprocessor is bound by a data processing agreement and is required to maintain appropriate security standards:

AI model providers are contractually prohibited from retaining or training on any data submitted through the Lawgbook platform.

We maintain a structured vulnerability management process to identify, assess, and remediate security issues:

• Automated dependency scanning and static analysis run on every code change
• OWASP Top 10 mitigations applied throughout the application layer
• Regular review of third-party dependency advisories

Patch timelines by severity:

• High / Critical — remediated as soon as possible, typically within 24 hours of confirmed identification
• Medium — within 3 business days
• Low — within 3 weeks

In the event of a confirmed security incident affecting customer data, Lawgbook will:

• Contain and investigate the incident immediately upon detection
• Notify affected customers within 72 hours of confirming a breach, as required by GDPR and applicable law
• Provide a written summary of the incident, data affected, and remediation steps taken
• Cooperate with any regulatory notifications required by the customer's jurisdiction

We maintain documented incident response and business continuity procedures reviewed on a regular basis.

Security is integrated throughout our development lifecycle:

• Code is reviewed before merging; security considerations are part of review criteria
• Secrets and credentials are managed via environment variables — never committed to version control
• Input validation is applied at all system boundaries
• SQL injection is prevented through parameterized queries and ORM usage throughout

If you discover a security vulnerability in the Lawgbook platform or website, please report it to us privately before public disclosure. We will acknowledge your report within 2 business days and work to resolve confirmed issues according to the patch timelines above.

Please send vulnerability reports to [email protected]. Include a description of the vulnerability, steps to reproduce, and your assessment of potential impact. We ask that you refrain from accessing or modifying data beyond what is necessary to demonstrate the issue.

We may update this Security Policy as our practices evolve. Material changes will be communicated to customers via email or through the platform. We encourage you to review this page periodically.

For security-related inquiries or vulnerability reports:

Antematter Inc.
Security: [email protected]
General: [email protected]
Website: www.lawgbook.com