Security

Law firms trust us with privileged, confidential information. This page explains how we protect it.

How your data is protected

Each firm is sealed off.

Every table in the database has row-level security, so each request can see only its own firm's records, and within the firm only what the user's role allows.
An automated suite of more than 160 security checks tests this, and it runs before every release.
Signed-out visitors cannot query the database at all.

Encryption.

All traffic uses HTTPS, with HSTS.
Data is encrypted at rest by our database and storage providers.
Payment keys that firms save are additionally encrypted by us.

Files.

Documents are kept in private storage.
The browser never receives storage keys, only a short-lived link to one file, after the server has checked that the user may see it.

Sign-in.

Passwords are stored only as hashes.
Two-step sign-in with an authenticator app is available. Firms can require it for each role, and it is required by default for roles that handle money.
Sign-in attempts are rate-limited.
Every sign-in is recorded in the firm's audit log, with the device type.

Audit trail. Changes to clients, cases, documents, invoices, trust entries and roles are logged.

Trust money controls.

Trust entries cannot be edited or deleted, only reversed with a reason.
Payments to clients can require approval by a second person.
Bank-detail changes wait 24 hours, and the firm is notified.

The web app.

Strict content security policy, protection against clickjacking, and no open redirects.
Webhooks are verified by signature.
Secrets are compared in constant time.
Client portal and signing links are long and random, are stored only as hashes, can expire or be revoked, and are rate-limited.

Infrastructure. Managed providers with strong security programmes: Supabase (database and file storage, London region) and Hostinger (hosting and email). See our Privacy Policy for the full list.

Staff access.

Production access is limited to people who need it, using two-step sign-in.
We do not look at Firm Data except to provide support you ask for, to keep the service secure, or as the law requires.

Your part

Turn on two-step sign-in, and require it for everyone at the firm.
Give each person only the role they need, and remove leavers promptly.
Use a password manager and a unique password.
Be wary of emails asking you to sign in. We will never ask for your password.

If something goes wrong

If we become aware of unauthorised access to a firm's data, we will notify the firm's owner without undue delay (within 72 hours at the latest), and help the firm meet its duties under section 22 of POPIA.

Reporting a vulnerability

If you believe you have found a security issue, please email support@bambootechlaw.com with the details and steps to reproduce it.

Please do not access, change or delete other people's data.
Please do not run tests that could degrade the service.
Please give us reasonable time to fix the issue before you disclose it.

We will acknowledge your report, keep you updated, and will not take legal action against good-faith research that follows these rules.