Security

What is in place

Each firm has its own database, with its own credentials. Not a shared schema, and not a shared table with a tenant column and a WHERE clause standing between one practice's ledger and another's. Every firm is provisioned this way, on infrastructure in Australia.

Every connection is over HTTPS. There is no unencrypted route to the application.

Passwords are enforced by the server. A minimum length with mixed character classes, checked by the API rather than the browser. An account created for you sets its own password before it can do anything.

Roles are enforced from the database. What a user may do is read from the record at the time of the request, not from a claim carried in the browser.

Every entry that moves money is audited. Receipts, payments, inter-matter transfers and reconciliations each record who made the change, when, from what address, and the state of the record before and after. So do user and role changes, settings changes and client report links. It is the log an examiner or an insurer would ask for, and the one you would want if you ever had to prove what happened.

Client report links can be revoked, can be given an expiry, and log every access. A link issued to a client for their own matter records when it was last opened and how often, and the endpoint serving it is rate limited. Set an expiry when you issue one, or switch it off whenever you like.

The ledgers can be checked from outside the application. A read-only checker walks every trust ledger and reports any account whose stored balance disagrees with its ledger read in date order, any account that does not close at the balance it holds, and any matter that was overdrawn at any point in its history. It issues nothing but reads, so it is safe to run against live records.

A reconciled month is closed to ordinary entry. Once a month has a Rule 48 reconciliation against it, an entry dated into that month is refused rather than quietly accepted. An administrator can still record a genuine late item, with a written reason that stays on the entry. Nothing goes into a reconciled month silently.

The application has been through a structured security review. Findings from it are tracked and worked through as ordinary engineering work.

What is not claimed

• No regulator has approved, certified or endorsed TrustLedger. Not the Law Society of New South Wales, not the Victorian Legal Services Board and Commissioner, not the Legal Practice Board of Western Australia, not anyone. An examination of a practice's records is not an approval of software. See about.
• There is no SOC 2, ISO 27001 or equivalent certification.
• No third-party penetration test has been carried out.
• Encrypted off-site backups, production access limited to named people over a private network, and nightly integrity checks across every firm are on the build list for the hosted service and are not running yet. Each moves to the section above, with the date it started, once it is.

If something on that second list has to be in place before you could move, say which. It changes the order things get built.

Reporting something

If you find a security problem, please report it before you publish it.

You will get a reply from a person. Testing done in good faith against your own firm's instance, or against nothing at all if you have only read the site, will not be met with a legal threat. Please do not test against another firm's data, and please do not run anything that slows down a practice trying to do its month end.

Who else touches your data

Every third party involved in running this service is listed on the subprocessors page, and that page is updated before a new one is engaged, not after.