Security and privacy at Legal Stylus
Plain answers about where your record lives, who can see it, what we log, and what we do not do. Each answer carries its limit. If a statement here stops being true, the page changes before the statement does.
Where your record lives
Entries and their history are stored in a managed Postgres database on a managed hosting provider in the United States. Everything between your device and our servers travels over an encrypted connection.
The limit: your record is not encrypted with a key only you have. Whatever encryption the storage provider applies at rest uses keys they hold, not yours, and the people who run the service can reach your record if they must.
Who can see it
- You, and anyone you invite to a case, with the role you chose. Remove them and their access ends at once.
- Anyone holding a share link you created, for the fields you left visible, until it expires or you turn it off. Every successful opening is logged for you, including automated link previews made by email and chat apps.
- Our own systems, to run the service.
- Service providers we rely on, listed below, each for its stated purpose.
What we log
An activity history for every entry and case: creation, edits, uploads, removals, shares, share-link openings (with time, network address, and browser), exports, every file download, and each time someone other than an entry’s author opens it (at most once an hour per person; software using an API key counts), with who did it and when. You can see it in the app and it is included in your export. The database itself refuses to change or delete a history entry. The one exception is deleting your account, which removes the history of your records, the ones you deleted earlier included, and takes your name off the rest.
The limits: you opening your own entries is not recorded, on purpose: this history is made to be shown to other people, and when you re-read your own account is not theirs to know. The database enforces the refusal, not only our code, but the database account our application uses could switch it off, and so could anyone who stole its password. Deleting an entry or a case does not delete its history: the database keeps what was done to it and when, with the details each event recorded, such as a title, a file’s name or, for a link, each opening’s network address and browser, until you delete your account. One exception: the openings of links deleted before 28 September 2026 were recorded without the account they belonged to, so deleting the account cannot remove them.
Fingerprints and time-stamps
Our server computes a SHA-256 fingerprint of every file you upload, over the exact bytes it stores, and re-checks the stored file against it on every download and export, and about once a month otherwise. Right after the upload it sends the fingerprint, and only the fingerprint, never the file, to DigiCert, an independent time-stamp authority. DigiCert signs it together with the time it received it, under the RFC 3161 standard. That signed token goes into your packet and your export, with instructions for checking it with OpenSSL, without us.
The limits: a time-stamp shows that a file with that fingerprint existed by that time. It does not show who made the file, when it was made, or what it shows. Files uploaded before we turned time-stamping on were time-stamped when we did, so their tokens show that later date. Your written entries are not independently time-stamped yet: their dates come from our server’s clock.
Redaction and sharing
Sharing is off until you turn it on. When you share, you choose what to hide, titles and case names included; the hidden text is removed on our servers each time the link is opened and never reaches the recipient. Links expire on the schedule you choose (24 hours to 30 days) and can be turned off at any time. Files are never included in a share link.
The limit on files: a phone camera can store hidden data in a photo, such as the place it was taken. When you upload a JPEG or PNG you can ask us to remove location data: the picture itself is unchanged, but the file is not, so the record keeps two fingerprints, of the file as it arrived and of the file as stored, and says why they differ. Otherwise we keep each file exactly as received, that data included, and it travels with the file in your export and to anyone you invite to the case. We cannot yet remove it from other formats, such as HEIC; ask, and the upload is refused rather than kept with it.
The limit: a share link is a link. Anyone who has it can open it until it expires or you turn it off. Send it only to the person it is for, and watch the log. A link to a whole case shows every entry in that case at the moment it is opened, whoever wrote it. Whatever you hide, each entry’s date and type still show.
Your unfinished entry
While you write, an unfinished entry is kept on the device you are using so a closed tab does not lose it, and so are changes to an entry that you have not saved yet. Starting another entry never replaces one: each is kept until you save it or discard it. It belongs to your account: someone else signing in on the same browser is not offered it. Signing out erases it from the device, and so does the Leave button, including an entry you were partway through.
The limit: until you sign out or leave, it stays in this browser’s storage, unencrypted. Closing the tab does not remove it. On a shared device, sign out or use the Leave button before you step away.
Sign-in
You sign in with your email address and a password. In Settings, under Sign-in and security, you can turn on two-step verification: signing in then also takes a 6-digit code from an authenticator app on your phone. The same page lists the devices signed in to your account, and signs out any you choose. A session ends after 24 hours, or after 2 hours with the site closed.
The limit: two-step verification is off until you turn it on. Without it, anyone who can read your inbox can reset your password and sign in as you. Use an email account only you can read, and sign out when you finish.
Backups and durability
A separate daily backup is written to an independent bucket: the database, and a copy of each file you upload, made overnight and checked against its fingerprint before it is kept. The credentials that write it can only write, not read or delete. A monitor alerts us if that backup ever fails to run.
The limits: the independent bucket is with the same cloud provider, in the same account, as the storage it copies.
Your rights are buttons
Export everything from Settings: every entry with every version, every file with its fingerprint, your cases, links (with every opening of each), and history, as one ZIP. Deleting your account erases your records from the live database at once; the copies in our database backups are gone within 180 days. Neither export nor deletion ever depends on paying us.
The limit: a deleted file leaves the app at once, but not our systems at once: our file storage deletes its copy after 90 days, and the independent backup within 180. Until then the people who run the service could still recover it.
AI tools
When you run one, the text of the entries involved (and, for some tools, the names you recorded and the case name) is sent to OpenAI’s API to produce the result, and the result is shown to you. The names of your uploaded files are never sent. The switch is off for new accounts until you turn it on in Settings.
Your switch covers your entries wherever a tool reads them. If anyone whose entries a tool reads has AI switched off, including someone you share a case with, the tool runs on built-in heuristics and nothing is sent. Only people who can edit a case can run a tool over it, and every run goes into the history of what it read, saying whether anything was sent.
The limit: the people named in your entries have no switch of their own. A name you recorded goes with the entry whenever a tool that reads it runs with everyone’s AI on.
What we do not do
No ad trackers. No analytics sold to anyone. Fonts served from our own site. Error monitoring runs with personal data and session recording switched off.
Service providers
- Hosting and database: Render.
- File storage: Amazon Web Services S3 (United States).
- Sign-in: Clerk.
- Email: Resend.
- Error monitoring: Sentry.
- AI tools (when you run them): OpenAI.
- Independent time-stamps: DigiCert. It receives each file’s fingerprint, never the file.
- Backup monitoring: healthchecks.io.
- Network: Cloudflare.
- Support email (what you write to [email protected]): Google Workspace. Nothing from inside the app goes there.
Legal process
A fact worth knowing either way: in a case, court rules can require a party to produce relevant records, edit history included. That is part of what makes a well-kept record credible.
Reporting a security problem
Email [email protected]. We will acknowledge within two business days.
Say what you found, where, and how to see it. Use your own account and entries you made to test: do not open, change or keep anyone else’s records, and do not send us any. We do not pay bounties.