Confidential by obligation, not as a feature.
A law firm’s software holds privileged files, filing deadlines, and client trust money. Legal Hub was engineered to a production security bar from the first commit — here is exactly how, in plain terms.
Tenant isolation
Every firm is a separate tenant. Records are scoped per organization with row-level isolation, and sign-in requires explicit tenant selection — so one firm’s data never crosses into another’s.
Authentication
Hosted sign-in with OIDC and PKCE. Session tokens are issued as HttpOnly, Secure, SameSite cookies — never left in browser storage — and verified against the provider’s keys on every request.
Data & storage
Postgres reached over Cloudflare Hyperdrive, documents in Cloudflare R2 with checksum-verified uploads, an offsite R2 audit-log mirror, and soft deletes so nothing vanishes silently.
Integration safety
Inbound webhooks from Stripe, Twilio, and providers are signature-verified with constant-time checks, replay windows, and idempotency records. Counters and receipts use atomic operations, not read-modify-write races.
AI boundaries
The assistant retrieves only within a tenant’s own documents, wraps untrusted context to resist prompt injection, cites its sources, and enforces per-firm usage caps. Your files are never used to train AI models, and the responsible attorney reviews before anything goes out.
Trust-money integrity
IOLTA trust transactions post to a ledger that reconciles, with every movement recorded. Withdrawals and reconciliations are first-class, because getting trust accounting wrong is a bar problem, not a bug.
Observability
Request IDs on every call, Sentry error monitoring, product analytics, and rate limits across the API. CI gates run install, typecheck, lint, tests, dependency audit, and build before anything ships.
Hardened by default
Security headers, fail-closed CORS, per-endpoint rate limiting, and audit logging are on by default — not switches an admin has to remember to flip.
No badges we haven’t earned.
We won’t put a compliance seal on this page that we don’t hold. What we will do is tell you precisely which controls are in place and back it up. As Pcnaid pursues formal attestations, we’ll say so here — dated, and only when they’re real.
In the meantime, two things you can hold us to: your data is portable — export your matters, documents, and ledgers whenever you like, so you’re never locked in — and the platform runs on infrastructure from Cloudflare and Stripe rather than a homegrown stack.
Building on a regulated workflow and need specifics — a data-flow diagram, subprocessor list, or a security questionnaire? Ask us directly.
Where your data lives
edge runtime · isolated Postgres · R2
Responsible disclosure
Found something that looks off? We want to hear from you before anyone else does. Email support@pcnaid.com with the details and steps to reproduce, and we’ll acknowledge and work it with you.
Put confidential work on solid ground.
Start your firm’s workspace, or talk to us about the specifics your compliance team needs to see.