Security practices, stated plainly
This page lists controls that are implemented and verifiable in the product. Where we have not yet attained a certification, we say so rather than advertise it.
Tenant isolation
Matters, BriefCases, documents, and knowledge bases are private to your organization. Isolation is enforced server-side on every request, not by convention in the UI.
Authentication and access control
Accounts run on a battle-tested session-based authentication service with optional OAuth. Role-based access governs what each member of an organization can do.
Server-side authorization
Every API request is authorized on the server. Administrative functions re-verify the caller's role against the database on each use.
Rate limiting and abuse controls
Public endpoints are rate-limited; public forms include honeypot spam traps and schema validation. Payment and communication webhooks verify cryptographic signatures.
Audit logging
AI operations and consequential administrative actions are logged — who, what, when, and against which resource.
Least privilege for automation
Marketing and growth automation is isolated from client matter data by design: CRM prospect records are separate databases from legal workspaces, and marketing agents operate with narrow, auditable permissions.
Secrets management
Credentials are server-side environment variables, never shipped to browsers. External service keys are referenced by name and masked in administrative interfaces.
Data minimization
Marketing analytics records page-level events without cookies or personal profiling; client case content never leaves the workspace to analytics providers.
What we have — and haven't — attained
JuriSeek does not currently hold SOC 2, ISO 27001, HIPAA, or similar certifications, and we won't display those badges until the audits exist and pass. Security reviews, questionnaires, and DPA discussions are welcome through the contact form — you'll get answers grounded in how the system is actually built.
Found something? Tell us.
If you believe you've found a security issue, contact us before public disclosure and we'll act on it promptly.
Contact securityEvaluate us like a vendor, not a demo.
Request a security walkthrough alongside your product demo.