Security & data isolation
Tenant isolation is enforced in the database, not just the app. Trust-account integrity and Bar Council canon compliance are first-class concerns.
Row-Level Security
Every tenant-scoped table runs Postgres RLS. Lawyer A cannot read Lawyer B's cases, time entries, trust ledgers, or any other private data — RLS enforces this in the database, not just the application layer.
Authentication
Email + password via Better Auth, with phone-OTP support for clients. Sessions are cookie-based with a 7-day rolling window.
Trust account integrity
Trust accounting uses deferred constraint triggers to enforce that every trust ledger is balanced (sum debits = sum credits) before any transaction commits. Bar Council canon compliance is a first-class concern, not an afterthought.
API keys
Public API keys are stored as SHA-256 hashes — the plain token is shown exactly once at creation. Token verification happens in-database via a SECURITY DEFINER function.
Reporting
Found something? File a security report via the in-app feedback module after signing in, or reach the maintainers through the public GitHub repository.