Security and confidentiality for family law client data
Financial disclosure means tax returns, bank statements and account numbers. This page explains, plainly, how Disclosio protects them.
Where a client's upload goes
From the client's phone to your staff, a document takes one path and stays inside it.
The client's phone or computer
The client signs in to their own portal and uploads. The file travels encrypted (TLS 1.2 or higher).
Virus scan
Every file is scanned for viruses before anyone on your staff opens it.
Encrypted storage
Stored encrypted at rest (AES-256) in DigitalOcean Spaces in San Francisco (SFO3), in the United States.
Your firm's staff
Your firm's staff open it to review. Other firms on Disclosio cannot see it, and the client sees only their own matter.
How Disclosio protects client data
- Firm data isolation
- Disclosio serves many firms, and each firm's data is kept separate from every other firm. One firm's staff cannot see another firm's matters, clients or documents.
- Microsoft sign-in (SSO) for staff
- Staff sign in with their Microsoft 365 work accounts through single sign-on. Your firm's existing Microsoft account policies apply, and there is no separate staff password to manage.
- Encrypted document storage
- Documents are encrypted at rest (AES-256) and in transit (TLS 1.2 or higher).
- Virus scanning on every upload
- Each file a client uploads is scanned for viruses before staff open it, so your team is not downloading unknown attachments from email.
- Access control
- Clients only see their own matter in the portal. Staff access is role-based and can be limited to the matters each person is assigned to.
- AI that can be switched off
- AI assistance is optional and off until a firm administrator turns it on. AI can also be turned off for a single matter on request, for example where a client has asked that AI not be used.
Why a portal is safer than email for disclosure
When disclosure runs over email, client financial records end up as attachments in many inboxes, forwarded, downloaded and saved in several places. Disclosio keeps documents in one controlled place: uploaded through a secure portal, scanned, stored encrypted, and visible only to the people who should see them.
Questions your IT provider may ask
- Where is data hosted?
- In the United States. The application runs on a Hostinger server in the US, and documents are stored in DigitalOcean Spaces in San Francisco (SFO3).
- How long is data kept after a matter closes?
- Data is kept for as long as your firm subscribes to Disclosio, plus any period required by law or your firm's retention policy. When a firm leaves, its data is deleted or returned under the firm's agreement.
- How is data backed up?
- Nightly encrypted database backups, kept for 14 days, with an encrypted copy stored off-site.
- Which AI provider is used when AI is on?
- Disclosio's AI assistance uses only Anthropic's Claude models through Amazon Bedrock, in a US region of Amazon Web Services, under Disclosio's own AWS account. Nothing is sent unless Disclosio has confirmed, within the past hour, that the account is set to keep no prompts or documents, and Amazon Bedrock does not use them to train models. AI is off until a firm administrator turns it on, and AI can also be turned off for a single matter on request. Your staff review what it finds, and each finding is checked against the page of the document it came from.
Have security questions before a demo?
We are happy to walk your IT provider through how Disclosio handles client data.