Security

What is in place

Each firm has its own database, with its own credentials. Not a shared table with a tenant column and a WHERE clause standing between one practice’s ledger and another’s, and not a shared schema. A firm is provisioned onto its own database, on infrastructure in Australia. That is how every instance is built, not a feature tier, and if it ever stops being true this page changes before anything else does.

Every connection is over HTTPS. There is no unencrypted route to the application.

Passwords are enforced by the server. A minimum length with mixed character classes, checked by the API rather than by the browser, and an account created for you must set its own password before it can do anything.

Roles are enforced from the database. What a user may do is read from the record at the time of the request, not from a claim carried in the browser.

Every entry that moves money is audited. Receipts, payments, inter-matter transfers and reconciliations each record who made the change, when, from what address, and the state of the record before and after it. So do user and role changes, settings changes and client report links. That log is what an examiner or an insurer would want, and it is what you would want if you ever had to prove what happened.

Report links given to clients can be revoked, can be given an expiry, and log every access. A link issued to a client for their own matter records when it was last opened and how often, and the endpoint serving it is rate limited. Set an expiry when you issue one, or switch it off whenever you like.

The ledgers can be checked from outside the application. A read-only checker walks every trust ledger and reports any account whose stored balance does not match the ledger read in date order, any account that does not close at the balance it holds, and any matter that was overdrawn at any point in its history. It issues nothing but reads, so it is safe to run against live records.

A reconciled month is closed to ordinary entry. Once a month has a Rule 48 reconciliation against it, an entry dated into that month is refused rather than quietly accepted. An administrator can still record one, because a genuine late item has to be able to go in, but only by giving a written reason, which is recorded against the entry. There is no path that puts something into a reconciled month silently.

The application has been through a structured security review, and the findings from it are tracked and remediated as ordinary work. No number and no grade is quoted here, because a finding count means nothing without the methodology behind it.

What is not claimed

Stated as plainly as the section above, and for the same reason.

• No regulator has approved, certified or endorsed TrustLedger. Not the Law Society of New South Wales, not the Victorian Legal Services Board and Commissioner, not the Legal Practice Board of Western Australia, not anyone. An examination of a practice’s records is not an approval of software. See about.
• There is no SOC 2, ISO 27001 or equivalent certification.
• No third-party penetration test has been carried out.
• TrustLedger is not described as “bank-grade” or “military-grade” anywhere, because neither phrase means anything.
• Encrypted off-site backups, production access restricted to named people over a private network, and nightly integrity checks across every firm are requirements for the hosted service, not features of it yet. Each will move into the section above, with the date it started, once it is running and can be demonstrated.

If you need something on that second list before you could use this, say so. It is useful to know which one, and in what order.

Reporting something

If you find a security problem, please report it before you publish it.

You will get a reply from a person. Testing done in good faith against your own firm’s instance, or against nothing at all if you have only read the site, will not be met with a legal threat. Please do not test against another firm’s data, and please do not run anything that degrades service for a practice trying to do its month end.

Who else touches your data

Every third party involved in running this service is listed on the subprocessors page, which is kept current because it is a continuing obligation and not a marketing page.