Built for privileged material.

• Documents and files are encrypted with AES-256 under a separate key per matter, before they reach storage. Each matter key is itself encrypted with a master secret held in a dedicated secrets store, outside the application — never in code, builds, or logs.
• Storage-layer encryption sits underneath as a second layer: the database, file storage, and the servers’ own disks are all encrypted at rest.
• All traffic is encrypted in transit, at every hop between your browser and our database. The database connection is certificate-verified, and the database independently refuses any connection that is not encrypted, so neither side will fall back to plaintext.
• The master secret can be rotated under a documented procedure that has been carried out on production, not just on paper.

• Role-based access with per-matter permissions: even within your firm, staff see only what is explicitly shared with them. Firm isolation is enforced inside every access check, not merely at the edge.
• Two-factor authentication (TOTP) with single-use backup codes, passkeys (WebAuthn), and single sign-on against your own identity provider — Google Workspace and Microsoft 365 via OpenID Connect, or any SAML provider such as Okta or Microsoft Entra ID.
• Brute-force lockouts on passwords and 2FA codes alike; session and trusted-device management with immediate revocation.
• Administrative roles are infrastructure-only by design — firm admins manage users, invitations, and billing but have no access to matter content.

• An audit log records every meaningful action — access, changes, permission grants, financial events — and is exportable for bar audits and investigations. It is written and never edited: the application exposes no path to alter or selectively remove an entry. It is destroyed only if a firm’s entire account is deleted.
• E-signature evidence — signer identity, IP, user agent, timestamps, and document hashes — is recorded separately from the matter, so the record of an executed document survives deletion of the underlying file.
• Infrastructure activity is logged independently of the application, in tamper-evident logs.
• Optional blockchain certification anchors document hashes to Bitcoin via OpenTimestamps for independently verifiable proof of existence.

• The database and file storage sit on a private network and cannot be reached from the internet.
• File storage keeps prior versions of every object. Direct administrative access is limited to a small number of named people for incident recovery, and every use is logged.
• A web application firewall filters all traffic before it reaches the application, and the servers accept nothing that has not passed through it.

• Live public status: stats.uptimerobot.com/BjtqiB6UgN (99.5% monthly uptime target).
• Zero-downtime deployments, 24/7 infrastructure monitoring, and alerting on error rates, resource pressure, and endpoint health.
• Daily encrypted database snapshots with 30-day retention. A documented disaster-recovery plan targets an 8-hour recovery time objective and a 24-hour recovery point objective; recovery is a documented rebuild rather than an automatic failover, and the plan is written around that.
• Restore tests run on a quarterly cadence and include decryption verification — restoring a real snapshot to a throwaway instance and unwrapping a matter key to confirm the data is not merely present but readable. Most recent: August 2026.

Deleted clients and matters are recoverable for 30 days, then permanently destroyed — database records and encrypted file storage both — by an automated nightly retention job. Deleted data may persist in encrypted database snapshots for up to 30 further days before those age out. Our retention principles are set out in Section 6 of the Privacy Policy.

Document content reaches third parties only in encrypted form, or not at all. We rely on Amazon Web Services for hosting, Resend for transactional email, Confido Legal for payments and trust accounting, and Sentry for error monitoring — plus Google and Microsoft only where your firm turns on the features that use them. What each one processes, and where, is on our Authorized Subprocessors page.

Found a vulnerability? Email support@pasqio.com with details. We commit to acknowledging reports within 2 business days, will not pursue good-faith researchers, and ask that you avoid accessing customer data and give us reasonable time to fix before disclosure.