Built so we can't read your files.

Encryption

• Documents and files are encrypted with AES-256-GCM using a separate key per matter, before they reach storage. Storage-layer encryption (S3, RDS) sits underneath as a second layer.
• All traffic is TLS-encrypted in transit — browser to edge, edge to origin, and application to database (certificate-verified, enforced server-side).
• Key material lives in AWS Systems Manager Parameter Store, never in code, builds, or logs; key rotation is scripted and tested.

Access control

• Role-based access with per-matter permissions: even within your firm, staff see only what's explicitly shared. Firm isolation is enforced on every access check.
• Two-factor authentication (TOTP) with single-use backup codes; brute-force lockouts on passwords and 2FA codes alike; full session management with revocation.
• Administrative roles are infrastructure-only by design — firm admins manage users and settings but have no access to matter content.

Accountability

• An append-only audit log records every meaningful action — access, changes, permission grants, financial events — exportable for bar audits and investigations.
• Optional blockchain certification anchors document hashes to Bitcoin via OpenTimestamps for independently verifiable proof of existence.

Availability & recovery

• Live public status: stats.uptimerobot.com/BjtqiB6UgN (99.5% monthly uptime target).
• Zero-downtime deployments; 24/7 infrastructure monitoring and alerting; AWS WAF and CloudFront at the edge.
• Daily encrypted backups with 30-day retention, quarterly tested restores including decryption verification, and a documented disaster-recovery plan (8-hour recovery time objective).

Data lifecycle

Deleted clients and matters are recoverable for 30 days, then permanently destroyed — database records and encrypted file storage both — by an automated nightly retention job. Full details in the Privacy Policy.

Subprocessors

Document content reaches third parties only in encrypted form, or not at all.

• Amazon Web Services — all hosting (compute, database, encrypted file storage, edge/WAF), US region.
• Resend — transactional email (invoices, notifications).
• Stripe & Confido Legal — payments and IOLTA trust accounting; card data never touches our servers.
• Sentry — error monitoring, with sensitive values scrubbed before events leave the server.
• Google / Microsoft — only if your firm enables email import or calendar sync.
• Anthropic — only if your firm uses AI-assisted data migration; sees folder/file names, never file contents.

Compliance roadmap

A SOC 2 readiness program (Security, Confidentiality, and Availability criteria) is underway: policies adopted, controls implemented and evidenced, with an independent Type 1 audit planned ahead of a Type 2 examination. Prospective customers can request our security documentation at hello@pasqio.com.

Responsible disclosure

Found a vulnerability? Email hello@pasqio.com with details. We commit to acknowledging reports within 2 business days, will not pursue good-faith researchers, and ask that you avoid accessing customer data and give us reasonable time to fix before disclosure.