Security

Lawyers have a duty to make reasonable efforts to protect client information, and that includes knowing how the software they use handles it. This page sets out, in plain terms, what Fylely actually does. It describes controls that exist in the product today. It does not claim a certification or third-party audit.

1. Your firm's data is walled off

Every table that holds matter, client, billing or document information is protected by row-level security in the database itself, not only by application code. A signed-in user can read and change only rows belonging to the firm they work for, and team members see what their firm grants them.

2. Documents stay private

Uploaded documents live in a private storage bucket. Files are filed under the firm that owns them, and storage rules allow only that firm's team to read, add or remove them. Downloads use signed links that expire after one minute, so a copied link stops working almost immediately. Clients send documents through single-purpose upload links that accept files for one request and cannot browse anything else.

3. Encryption

All traffic is encrypted in transit with TLS. Stored data, including the database and documents, is encrypted at rest by our infrastructure provider. See the sub-processors page for who hosts what.

4. Signing in

• Two-factor sign-in. Firms can require an emailed six-digit code whenever a password is used from a browser we have not seen. No session is created until the code is entered. Codes expire after ten minutes and lock after five wrong attempts.
• Automatic sign-out. The firm owner can set everyone to be signed out after 15 minutes to 4 hours of inactivity, with a one-minute warning, so an unattended office computer does not leave client files open.
• Remembered browsers. We store only a one-way hash of the browser identifier and of sign-in codes, never the values themselves. Every remembered browser can be forgotten from Settings in one click.
• Limits on guessing. Repeated wrong passwords lock sign-in for that account for 15 minutes, and wrong sign-in codes are capped across every code sent in an hour, not just per code. These limits are kept in the database, so they hold across all of our servers.
• Security alerts. We email you when your password is changed or two-factor sign-in is turned off, so a change you did not make does not go unnoticed.
• Signing out one device does not end your sessions elsewhere. A password can only be changed from an emailed reset link used within 15 minutes, never from a signed-in session alone.

5. Knowing who did what

Changes to estate and guardianship records are written to an activity log by the database itself, so your firm can see who added or changed a deadline, hearing, asset, transaction, document or time entry, and when.

6. Sharing on your terms

Read-only share links are scoped to a single matter and can be revoked at any time. Client invoice and upload links carry long random tokens and reveal only the one invoice or request they were made for.

7. Artificial intelligence

We do not send client names, matter names, notes or documents to any AI service. The one optional AI feature receives aggregate counts and totals only, and runs only when you press its button. Details are on the sub-processors page.

8. Your data leaves with you

You can export everything from Settings at any time. Closing your account permanently deletes the firm and everything in it, as described in our Privacy Policy.

9. Reporting a concern

If you think your account has been compromised, or you have found a security issue, email luminoussocialhelp@gmail.com. We will respond promptly. No system is perfectly secure, and we cannot promise absolute security, but we will tell you plainly what happened.