EU data residency
Client evidence stays in EU-hosted infrastructure. No transfer outside the EEA for storage or processing.
Least-privilege access
Contacts are scoped to their own engagements. Team roles separate admin, manager and member capability.
Versioned, non-destructive files
A revision never overwrites the original. Each upload is a new immutable version with its own hash and uploader.
Access transparency
Views, downloads and exports are logged alongside state changes, so you can answer 'who saw this' precisely.
Magic-link and SSO
No shared passwords for client contacts. Firm users can be federated through your existing identity provider.
Encrypted in transit and at rest
TLS in transit, AES-256 at rest, with key rotation handled by the platform rather than by your IT lead.
The audit log is insert-only
Nothing in the timeline can be edited or deleted — not by a client, not by a partner, not by us. When a reviewer asks how a figure was evidenced, the answer is a timestamped chain rather than a memory of an email.
Need our security pack for procurement?
We'll send the data-processing addendum, sub-processor list and architecture summary.
Request the pack