SECURITY AND TRUST

Your case files, handled with care.

What protects the documents you keep here, the controls you hold yourself, and the limits we would rather tell you about than let you assume.

YOUR FILES

How your case files are protected.

A custody declaration or a protective-order petition is among the most sensitive documents a person will ever write. This is what stands between it and anyone who should not see it.

Encrypted in transit and at rest

Every connection to the app uses TLS, and your documents and database records are encrypted where they are stored.

Your records are yours alone

The database enforces row-level security: every query runs as you, and it can only return the records your account owns. Files in storage are scoped to your account the same way.

Never sold, never used to train AI

We do not sell, rent, or trade your personal information, we do not share your case files with data brokers or advertisers, and your workspace content is not used to train any artificial-intelligence model.

Payments stay with Stripe

Card numbers are entered on Stripe and never reach our servers. We receive your name, your email address, and an account identifier.

Delete everything, any time

Deleting your account from your profile cancels your plan and removes your cases, motions, pleadings, evidence, forms, and files. It runs as one server-side operation and it cannot be undone.

Breach notification

If we discover a breach affecting your personal information, we notify you without unreasonable delay and within the time your state law requires.

YOUR ACCOUNT

Controls you hold.

The Security section of your profile is where these live, on every platform.

Two-factor authentication

Add an authenticator app such as Google Authenticator, 1Password, or Authy. Someone who learns your password still cannot sign in without your phone.

Sign out of other devices

Lost a phone or used a shared computer? One control ends every session except the one you are holding.

Password rules and reset

Passwords need at least eight characters with mixed case and a number, changes require the current password, and a reset link is emailed on request and works once.

Sign in with Google

Google accounts use Google’s own sign-in, including any passkey you keep there, and can add two-factor authentication here on top of it.

YOUR AI ASSISTANT

Connectors act only with your permission.

When you connect Claude, ChatGPT, or another assistant, it works through an authorization you grant and can revoke.

You authorize it, you can disconnect it

A connector is granted on the Connections page and removed there. Removing it ends its access immediately.

Nothing happens unless you ask

The assistant reads and writes your workspace only in response to what you tell it. Deleting a record through an assistant requires your explicit confirmation.

The assistant is a third party

You choose the assistant and you pay for it separately. Your use of it is governed by that provider’s terms, not ours, and what you paste into a chat is subject to their privacy policy.

WHAT WE DO NOT DO

Being precise about the limits.

Overstating security is itself a harm. These are the controls we do not have today, stated plainly so you can decide what to upload.

No end-to-end encryption

Your documents are encrypted in storage and in transit, but they are readable by our systems. That is what lets the platform render, format, and search them. It also means a member of our team with production access could, in principle, read them. We do not, and we would rather say so here than let you assume otherwise.

No recurring third-party audit yet

We do not run a formal recurring third-party security audit program and we do not hold a SOC 2 report. Our engineering practice includes dependency updates, error monitoring, and reviewed changes, and we will say so here when a formal program is in place.

Please limit what you upload

Upload what your case needs. Redact Social Security numbers, account numbers, and children’s identifying details where the court allows, the same way you would on a filing.

QUESTIONS

Asked before, answered here.

Who at ProPera Legal can see my case files?

Files are readable by our systems so the platform can render and search them, and by a small number of staff with production access, only for support you have asked for. We do not browse case files, and our advocates see only what you choose to show them.

Is two-factor authentication required?

It is optional and we encourage it. Turn it on from the Security section of your profile with any authenticator app. If you lose the app, email help@properalegal.org and we will verify your identity before removing it.

Where is my data stored?

In managed cloud infrastructure in the United States, encrypted at rest, with backups. The Privacy Policy lists every service provider we use and what each one receives.

Can I get my data out?

Every pleading and packet downloads as a PDF, and every evidence file downloads as the file you uploaded. A one-step export of a whole case is on our list; until then, contact us and we will help.

How do I report a security problem?

Email help@properalegal.org with the details. A person reads every message, and we will acknowledge a security report promptly and tell you what we did about it.