Encryption everywhere
- ✦In transit: all traffic is encrypted with TLS 1.2+ (HTTPS). We enforce HSTS so browsers never connect insecurely.
- ✦At rest: your data and documents are encrypted with AES-256 by our infrastructure providers (Supabase / managed Postgres and object storage).
- ✦Documents are stored in a private bucket and served only through signed, time-limited links that expire automatically.
Strict access controls
- ✦Row-Level Security (RLS) is enabled on every database table. The database itself enforces that you can only ever read or write your own records.
- ✦Attorneys see only the specific case metadata required to perform a review you requested — never your full intake.
- ✦Administrative access is limited, role-gated, and logged.
- ✦Secrets and API keys are stored in environment variables, never in code or version control.
Application hardening
- ✦Security headers on every response: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
- ✦All sensitive API routes verify your authenticated session before returning data.
- ✦Input is validated and sanitized; documents are generated server-side.
- ✦Payments are handled by Stripe — we never see or store full card numbers.
Data minimization & retention
We collect only what we need to generate your documents and run your plan, and we never sell your data. You can delete documents at any time, and request full account deletion at privacy@preandpost.io.
Incident response
We maintain an incident-response plan. In the event of a security incident affecting your data, we will investigate promptly, contain the issue, and notify affected users and regulators as required by applicable law.
Responsible disclosure
Found a vulnerability? We appreciate responsible disclosure. Email security@preandpost.io with details and we'll respond promptly. Please give us reasonable time to remediate before public disclosure. See our security.txt.
On the roadmap
As we grow, we are pursuing formal third-party assessments (including SOC 2) and ongoing penetration testing to continually raise the bar on the protection of your information.