ClientSignal™ was architected from day one for law firm and legal department information security standards, not retrofitted from general enterprise software.
Our architecture documentation, Data Processing Agreement, and Information Security Policy are available on request.
Firm Data is stored and processed in the United States. The database, authentication, file storage, backups, and server-side functions run in one AWS region, US West (Northern California), operated by Supabase. Firm Data is not transferred outside the United States without the firm’s prior written consent. Our Data Processing Agreement commits to US storage and processing.
Single US RegionPostgreSQL Row-Level Security ensures complete isolation. No firm's data is ever accessible by another firm's users, enforced at the database level, not just the application layer.
Zero Cross-ContaminationEvery data access event is written to an immutable PostgreSQL trigger table. Full audit trail available on request, who accessed what, when, and from where.
Tamper-Proof LogsInfrastructure SOC 2 Type II compliance inherited through Supabase, AWS, and Netlify. ClientSignal's own application-level SOC 2 Type II audit is in progress.
SOC 2 CompliantClientSignal™ uses AI analysis on a per-request basis. No client data is retained by the AI model or accessible outside your tenant. Contractually guaranteed.
Zero AI RetentionPKCE OAuth, JWT claims, and four-tier role-based access control. MFA enforcement and SSO/SAML integration are on the H2 2026 roadmap. Breach notification SLAs negotiable by firm.
Enterprise Auth