Security
You are holding your clients' medical records. So are we.
A personal injury caseload is protected health information from the first day of treatment. That shaped how the platform is built rather than being added to it afterwards.
How case data is protected
Isolation enforced by the database
Every query runs under PostgreSQL row-level security tied to the firm. A missing filter in application code cannot return another firm's data, because the database will not return it.
Permission checked per action
Every endpoint checks the specific action against the specific record before answering. Access is never inferred from which screen someone managed to reach.
PHI kept out of logs
Protected health information is masked in application logs and excluded from error messages. Logs and error reports are where PHI usually escapes a system that otherwise handles it correctly.
Encrypted at rest and in transit
The database is encrypted with a customer-managed KMS key, documents in object storage are encrypted server-side, and everything is served over TLS.
Multi-factor on by default
Every user enrols an authenticator app before they can finish setting up their account. It is enforced per firm and enabled unless an administrator deliberately turns it off - nobody has to remember to switch it on.
An audit trail on the case
Who saw what and who changed what is recorded as events against the case, readable by the firm rather than reconstructed from server logs by us.
Where your data lives
One region, one tenant boundary, your data is yours
Case data is held in AWS in the United States. It is not used to train models, it is not shared between firms, and it is not sold or given to anyone. Each firm's data sits behind its own tenant boundary, enforced in the database rather than by application code remembering to filter.
Certifications
We hold no security certification today - not SOC 2, not ISO 27001. A SOC 2 Type II needs an observation window a company our age has not yet had, and we would rather say so than describe an audit as though it were finished.
If your procurement requires a certificate in hand, we will not be a fit today, and you should know that here rather than three meetings in. What we can send now is a security questionnaire response, a BAA and our subprocessor list.
The full posture - where data lives, who can reach it, and what we do not have - is on the trust centre.
Visit the trust centreQuestions we get asked
- Do you train AI models on our case data?
- No. Your case data is not used to train any model, ours or a vendor's. The AI in the platform reads documents on your cases to extract structure for your team to confirm; that is the extent of it.
- Can one firm see another firm's cases?
- No, and the reason is worth stating precisely: the isolation is enforced by PostgreSQL row-level security rather than by application code filtering correctly. A bug in our code cannot return data from another firm because the database will not return it.
- Who at OneCounsel can see our data?
- Access is limited to the people who need it to run and support the platform, and support access is logged. We are a small team and we would rather be direct about that than describe a process we do not yet have.
- What happens to our data if we leave?
- It is yours. Export is part of the platform rather than a favour, and we delete on request.
- Are you HIPAA compliant?
- HIPAA compliance is a property of how a firm operates, not something software can hold on its own - but a vendor handling PHI has to support it, and the controls above are what that support consists of. We sign a business associate agreement. We hold no certification today, and the security page sets out exactly what we do and do not have rather than making you ask.
- Do you run penetration tests?
- Not yet. We have not had an independent penetration test, and we would rather say so than describe a cadence we have not started. It is on the path alongside SOC 2; ask us and we will tell you where it stands.
Bring your security questionnaire
We will answer it honestly, including the parts where the answer is not yet. That is a faster conversation than discovering it later.
Request a Demo