Security
Firms hand us the most sensitive documents in a matter. This page sets out how we protect them, and how we handle the questions procurement asks.
Encrypted in transit and at rest
- TLS 1.2 or better on every connection, including to the database
- Documents, database, cache, and logs encrypted at rest under keys we manage in AWS KMS
- Documents reached only through short-lived signed links, never public URLs
Firm-level isolation
- Every case, document, and generated output is scoped to one firm
- Isolation is enforced at the database layer on each request, not by UI filtering
- No shared workspace, no cross-firm search
Audit trail
- Uploads, views, edits, exports, and account changes are recorded
- Each entry carries the user, timestamp, IP address, and browser
- Personal and health information is scrubbed from application logs
Malware scanning
- Uploaded files are scanned before they enter the processing pipeline
- Anything flagged is quarantined and never reaches your case
- Accepted formats are limited to the document types the product reads
Infrastructure
- Hosted on AWS in the United States
- Databases and caches sit in private subnets with no route from the internet
- A web application firewall fronts the API
- Infrastructure changes are made through version-controlled Terraform
- Control-plane activity, network flows, and threat detection are logged continuously
Backups and durability
- Automated encrypted database backups on a rolling schedule
- Document storage is versioned, so an overwrite is recoverable
- Deletion protection on production data stores
How AI processing works
Reading a record means sending its text to a model. We use third-party providers for text recognition, for the embeddings that make documents searchable, and for the drafting itself. Every provider that receives case data is named on the sub-processor list, along with what it receives and where it processes it.
Your content is not used to train generalized AI models. Nothing from one firm's cases is visible to another firm, or used to improve output for anyone else.
Generated work product is a draft for an attorney to review, not a filing. Every factual claim cites the page it came from, so you can check it rather than take it on trust.
Compliance and assurances
The questions that come up most often in a security review, and how we answer them.
- HIPAA
- We operate HIPAA-compliant security. The safeguards above are built to the HIPAA Security Rule: personal and health information scrubbed from system logs, firm-level isolation enforced at the database layer, encryption in transit and at rest, and a complete audit trail. HIPAA has no certifying body, so there is no certificate for any vendor to produce. What we can do is take you through each control and show you how it works.
- Business associate agreements
- For plaintiff-side firms there is nothing for a BAA to attach to. Your firm receives medical records under your own client's HIPAA authorization, which means the firm is neither a covered entity nor a business associate, and we are not a subcontractor to one. A BAA between us would import obligations that neither party actually has. Our confidentiality commitments run through the Terms of Service instead, aligned to your duties under ABA Model Rule 1.6, and a data processing agreement is available on request.
- SOC 2
- A Type I assessment is planned. The technical controls on this page are already in place ahead of it, which is the substance an assessment examines. If a report is on your firm's checklist, tell us and we'll talk through timing.
- Breach notification
- If we confirm unauthorized access to or disclosure of your case files, we notify you without undue delay and with enough detail for you to meet your own obligations to your clients. That commitment is in the Terms of Service, not just on this page.
- Data deletion
- Delete individual documents and cases from the application at any time. For an account and everything in it, email us; verified requests are completed within 30 days, apart from copies in encrypted backups that expire on their own schedule. The Privacy Policy has the detail.
Reporting a vulnerability
If you have found a security issue, email support@settlhq.com with the subject “Security report”. We will confirm receipt and keep you updated while we work on it. Please give us a reasonable window to fix the issue before disclosing it publicly, and don't access data that isn't yours while testing.