Security

PractDesk stores account, case, message, and file metadata in Supabase (Postgres). Uploaded documents go in a private Supabase Storage bucket under user-scoped paths.

Supabase provides encryption at rest for database and storage. Traffic to PractDesk and to Supabase uses TLS in transit.

Database backups follow Supabase’s managed backup practices for the project. We do not claim custom offsite disaster-recovery SLAs beyond what the platform provides.

Database tables use Row Level Security (RLS) so users only read and write the rows they are allowed to see — for example, a client sees their connected case; a lawyer sees cases they own.

Invite codes are looked up through constrained server-side RPCs rather than exposing the full invite table.

In practice, who accesses a case file: the lawyer on the matter, the invited client, and constrained server paths — not the public internet.

Optional assist features (chat help, letter explanations, interview clarity feedback, document classification) may send relevant text or file content to OpenAI via the standard API.

Under OpenAI’s standard API usage terms, customer content is not used to train their foundation models. AI output is organizational help only — not legal advice.

Formal SOC 2 certification is on our roadmap. We do not claim it today.

Firm billing (when enabled) is processed by Stripe. We do not store full card numbers. Invited clients never pay PractDesk.