Trust
Your firm’s files are your firm’s. Here is how.
Where your data lives, who can see it, which providers touch it and when — written to match what the system does today, including what is not done yet.
01
Your firm runs on its own instance
- Its own database and deployment
- Each firm gets a separate database project and a separate deployment. No other firm’s records sit in the same database as yours.
- A region chosen with you
- Your instance is created in the hosting region we agree on — the nearest to Manila is Singapore. (The public demo runs in Seoul.)
- Encrypted in transit and at rest
- Every connection is over HTTPS, and the database and file storage are encrypted at rest by the hosting provider.
- Yours to take
- Because your data is a project of its own, it can be handed over to you whole if an engagement ends.
02
People see what their role allows
- Checked by the database, not the screen
- Row-level security in the database decides what each signed-in person can read and write, so a hidden button is never the only lock.
- Matters by assignment
- Lawyers see the matters they are on; partners, finance and the office see what their roles need. A firm’s records are never readable from another firm’s account.
- Clients see their own, and only the finished
- The client portal shows a client their own matters, filed work, sent invoices and files — never drafts, internal briefs or another client’s anything.
- Tested on every change
- Automated probes sign in as every kind of user, at two separate test firms, and try to read and write across the line. A change ships only when every attempt is refused.
03
Files stay private
- No public folders
- Documents, receipts and templates sit in private storage, filed under your firm. A file is opened through a short-lived link the server issues to someone allowed to see it.
- Your integrations’ keys are sealed
- Credentials you give us for your own SharePoint or other services are encrypted (AES-256-GCM) before they are stored, and are never shown back — they can be replaced, not read.
04
A record of what happened
- Who changed what, and when
- Record edits, status changes and hand-offs are written to an audit trail your firm’s administrators can read.
- Including us
- When we open your firm’s configuration to support you, that is written to your firm’s own audit trail too, under our name — not a staff member’s.
05
AI is off until you switch it on
- Four separate switches
- Reading your documents, indexing them for search, the staff assistant, and answering your clients are separate consents. Turning on one turns on none of the others.
- Refused in code
- Every model call passes through one gate that checks your firm’s switches first. If a feature is off, nothing is sent — it is not a setting the screen merely hides.
- Capped if you want it capped
- We can set a ceiling on your firm’s model calls per hour and per day, and the gate refuses calls past it.
- Ask us for the terms
- We have not yet signed zero-retention terms with the model providers. Ask us for their current data-handling terms before you switch anything on.
Who processes data
Every provider, and when it is used.
| Provider | What for | When |
|---|---|---|
| Supabase | Database, sign-in and file storage | Always — this is where your instance lives |
| Vercel | Hosting and delivery of the application | Always |
| Resend | Sending email: notifications, and statements to your clients | When mail is sent |
| Anthropic (Claude) | Reading and drafting: document analysis, briefs, the assistant, client chat | Only for the AI features your firm switches on |
| Voyage AI | Indexing documents for search by meaning | Only if your firm switches on AI search |
| Firecrawl | Collecting public circulars and issuances from government sites | Only for the issuances feature; it handles public material, never your files |
| Microsoft | Your own SharePoint or OneDrive, through your own Microsoft account | Only if your firm connects it |
The public demo
The demo firm, its people and its clients are invented. It shares one database with our own test firms — never with a client’s — and is put back every night at 3:00 AM, Manila time. It sends no email.
When you ask to try it, we keep the name, email and position you give us so we can follow up about Lumilex, and for nothing else.
Questions about any of this: hello@lumilex.co.