Security
A client's papers, held the way they should be.
What follows is what LawPal does to protect a firm's data. A control that doesn't exist isn't listed: a security page that promises more than the product does is worse than none.
Eight controls.
Each is part of LawPal for every firm.
Workspace isolation
Every record carries the workspace it belongs to, and the database itself refuses another workspace's rows, not only the application. Automated tests check that one firm can never read or change another's.
Access control
Each member has a role, and an admin decides what each person can reach. A suspended member can reach nothing.
Closed matters
A matter can be restricted to the people named on it. For everyone else it disappears: from lists, the diary, search, AI features and exports.
Expiring file links
Files are kept in private storage and opened through a link that expires after five minutes, issued only after an access check.
Two-factor authentication
Anyone can add a code from an authenticator app to their password, and a firm can require it of every member.
Audit log
Who did what, and when, in a log that can't be edited or deleted. Each entry is chained to the one before, so a change would show.
Processor list
Every company that processes data for LawPal, what it handles and where, is listed below and in the privacy policy.
Data export
A firm admin can export every record and file the firm holds at any time, and for 30 days after closing the account.
Who else processes data.
Every provider, what it handles and where. The privacy policy says the same, from the same list.
- Oleon (Olee AI)Hosting: runs the application, the API and background work
- Everything the service handles while it is being processed
- Region: Region to be confirmed
- Microsoft Azure (Database for PostgreSQL)Database
- Accounts, firm records and the search index
- Region: India (Central India)
- Microsoft Azure (Blob Storage)File storage
- Uploaded files, exports and backups
- Region: India (Central India)
- Google (Vertex AI)AI: generation, embeddings, ranking and speech
- Masked text and public library text
- Region: Region to be confirmed
- OpenAI (OpenAI API or Azure OpenAI)AI: generation, embeddings and speech
- Masked text and public library text
- Region: Region to be confirmed
- ZeptoMailEmail
- Recipient address and the message
- Region: Region to be confirmed
- Cloudflare (Email Worker)Incoming mail to LawPal mailboxes
- Messages sent to LawPal addresses
- Region: Cloudflare's global network
- Cloudflare (Turnstile)Bot check on sign-up and public forms
- Browser signals read by the check
- Region: Cloudflare's global network
- Dialog Axiata (e-SMS)Text messages
- Telephone number and the message
- Region: Sri Lanka
- TwilioText messages, as a fallback or with a firm's own account
- Telephone number and the message
- Region: Region to be confirmed
- Meta (WhatsApp Cloud API)WhatsApp messages
- None at launchNot used at launch
- Region: Region to be confirmed
- PayHereCard payments
- Order, amount and the payer's name, email and telephone. Card details never reach LawPal
- Region: Sri Lanka
- Google DriveFiles a firm links from its own Drive
- The files and folders the firm choosesOnly when a firm connects its own Drive
- Region: Region to be confirmed
Found a problem?
If you believe you can reach data that isn't yours, tell us with enough detail to reproduce it. We confirm we received it and tell you what we did.
Write to info@lawpal.lk.
If a personal data breach happens, we notify the affected firms and the Data Protection Authority of Sri Lanka within 72 hours of becoming aware of it.