Straight answers about
how your data is protected.

Your firm's data is walled off — by the database itself

Every firm on Lawmighty is isolated using row-level security enforced by the database engine itself, not just by application code. In practice, that means the database refuses to return another firm's records even if a piece of application code were to ask incorrectly: the isolation fails closed. No request without your firm's verified context sees your data, period. We re-test this isolation every time the database structure changes.

Encrypted in transit and at rest

Every connection to Lawmighty is encrypted in transit with TLS — browser, mobile apps, everything. And the data itself is encrypted at rest with AES-256 where it's stored, including backups. Stolen hardware yields ciphertext, not client files.

Inside your firm, access is role-based

• Clients see only their own matter. A client logging into the portal sees the forms, dates, and documents shared with them — never anything about another client.
• Staff access is permission-based. You decide what your staff can do; sensitive abilities are separate permissions you grant deliberately.
• Actions are logged. Significant actions in your firm's account are recorded — who did what, and when — so there's always an answer to that question.

Accounts and logins

• Passwords are stored only as one-way cryptographic hashes — we never see, store, or transmit your actual password.
• Sessions expire automatically, and repeated failed login attempts are rate-limited to shut down password-guessing.
• Clients must set their own password on first login — temporary credentials never stay live.
• On the mobile apps, fingerprint and face unlock are processed entirely on your device. Biometric data is never transmitted to us.

The AI features and client confidentiality

This is the question attorneys ask most, so here it is directly:

• Your firm owns its data. That's written into our Terms of Service, not just this page.
• We never sell your data, and we never use it to train AI models.
• AI features run only when someone at your firm initiates them — nothing is analyzed in the background.
• When you do run one, the content you submit is processed by our AI provider, Anthropic, under commercial API terms that restrict use of the data to providing the service and prohibit using it to train their models.

Payments

All payments run through Stripe's own hosted checkout — your card number never touches Lawmighty's servers. Card storage, receipts, and payment security are handled by Stripe.

The honest part

No system on earth is perfectly secure, and any vendor telling you otherwise is selling something. What we can tell you: the safeguards above protect our founder's own clients' files every day, and if a confirmed security incident ever affected your firm's data, you would be notified as applicable law requires. The complete commitments live in our Terms of Service and Privacy Policy.

Have a security question this page didn't answer, or your own requirements to check against? Email mail@lawmighty.com and you'll get an answer from the founder personally.