Encryption
- Documents and files are encrypted with AES-256-GCM under a separate key per matter, before they reach storage. Each matter key is itself encrypted with a master secret held in AWS Systems Manager Parameter Store — never in code, builds, or logs.
- Storage-layer encryption sits underneath as a second layer: the database, the file storage bucket, and the server’s own disk are all encrypted at rest with AWS KMS keys.
- All traffic is TLS-encrypted in transit — browser to edge, edge to origin, and application to database. The database connection is certificate-verified against the Amazon RDS root bundle, and the database independently refuses any connection that is not encrypted, so neither side will fall back to plaintext.
- Master key rotation is scripted, documented, and has been exercised on production (most recently August 2026), with the prior key retained for rollback.
Who can reach your content
We should be precise about this rather than claim more than we can deliver. Pasqio holds the master secret that wraps your matter keys, so a small number of authorized Pasqio personnel can technically decrypt content — that is what makes support, backup restoration, and disaster recovery possible at all. What we commit to is that they do so only where there is a strict business reason, as required by Section 20.3 of the Terms of Service, and that nothing about our routine operations requires it: support, monitoring, and billing all run on metadata. We do not read, mine, analyze, sell, or train on your content.
Access control
- Role-based access with per-matter permissions: even within your firm, staff see only what is explicitly shared with them. Firm isolation is enforced inside every access check, not merely at the edge.
- Two-factor authentication (TOTP) with single-use backup codes, passkeys (WebAuthn), and single sign-on against your own identity provider — Google Workspace and Microsoft 365 via OpenID Connect, or any SAML provider such as Okta or Microsoft Entra ID.
- Brute-force lockouts on passwords and 2FA codes alike; session and trusted-device management with immediate revocation.
- Administrative roles are infrastructure-only by design — firm admins manage users, invitations, and billing but have no access to matter content.
Accountability
- An audit log records every meaningful action — access, changes, permission grants, financial events — and is exportable for bar audits and investigations. It is written and never edited: the application exposes no path to alter or selectively remove an entry. It is destroyed only if a firm’s entire account is deleted.
- E-signature evidence — signer identity, IP, user agent, timestamps, and document hashes — is recorded separately from the matter, so the record of an executed document survives deletion of the underlying file.
- Infrastructure activity is logged independently in AWS CloudTrail, multi-region, with log file integrity validation enabled.
- Optional blockchain certification anchors document hashes to Bitcoin via OpenTimestamps for independently verifiable proof of existence.
Infrastructure
- The database is not publicly reachable — it accepts connections only from the application’s own security group inside the VPC.
- Encrypted file storage blocks all public access and keeps object versions. A bucket policy denies every request that does not arrive through the application’s private VPC endpoint, with a narrow break-glass exception for named administrator identities used in incident recovery — an exception whose every use is recorded in CloudTrail.
- AWS WAF and CloudFront sit in front of the application, and the origin only accepts traffic that arrives through them.
Availability & recovery
- Live public status: stats.uptimerobot.com/BjtqiB6UgN (99.5% monthly uptime target).
- Zero-downtime deployments, 24/7 infrastructure monitoring, and alerting on error rates, resource pressure, and endpoint health.
- Daily encrypted database snapshots with 30-day retention. A documented disaster-recovery plan targets an 8-hour recovery time objective and a 24-hour recovery point objective; recovery is a documented rebuild rather than an automatic failover, and the plan is written around that.
- Restore tests run on a quarterly cadence and include decryption verification — restoring a real snapshot to a throwaway instance and unwrapping a matter key to confirm the data is not merely present but readable. Most recent: August 2026.
Data lifecycle
Deleted clients and matters are recoverable for 30 days, then permanently destroyed — database records and encrypted file storage both — by an automated nightly retention job. Deleted data may persist in encrypted database snapshots for up to 30 further days before those age out. Our retention principles are set out in Section 6 of the Privacy Policy.
Subprocessors
Document content reaches third parties only in encrypted form, or not at all. We rely on Amazon Web Services for hosting, Resend for transactional email, Confido Legal for payments and trust accounting, and Sentry for error monitoring — plus Google, Microsoft, and Anthropic only where your firm turns on the features that use them. What each one processes, and where, is on our Authorized Subprocessors page.
Compliance
A SOC 2 readiness program covering the Security, Confidentiality, and Availability criteria is underway: policies adopted, controls implemented, and evidence collected on a quarterly cadence. No SOC 2 examination has been completed yet — an independent Type 1 audit is planned, ahead of a Type 2. We would rather tell you that plainly than imply a report we cannot hand you. Prospective customers can request our current security documentation at support@pasqio.com.
Responsible disclosure
Found a vulnerability? Email support@pasqio.com with details. We commit to acknowledging reports within 2 business days, will not pursue good-faith researchers, and ask that you avoid accessing customer data and give us reasonable time to fix before disclosure.