Security at Lawzana Flow
Built for the legal profession's highest standards of confidentiality and data protection.
Data Protection
Your client data is protected at every layer of our platform.
Encryption in Transit
All data transmitted between your browser and our servers is protected with TLS 1.3 encryption, the latest and most secure transport protocol available.
Encryption at Rest
Your documents and data are encrypted at rest using AES-256 encryption, the same standard used by financial institutions and government agencies.
Access Controls
Role-based permissions (Owner, Admin, Member, Viewer) ensure team members only access what they need. All access is logged for audit purposes.
Critical for Legal
AI Security & Privacy
We understand the unique confidentiality requirements of legal work.
Zero Data Retention
Your data is never stored by our AI providers. Google Vertex AI processes requests in real-time and immediately discards all input and output. No caching, no logging.
No Model Training
Client data is never used to train AI models. Your confidential information stays confidential. This is contractually guaranteed by our AI infrastructure provider.
Lawyer-in-the-Loop
AI assists, never acts alone. Every AI-generated output requires human review before use. You maintain complete control over all work product.
Bottom line: Your client communications, case strategies, and confidential documents are never seen, stored, or used by any AI system beyond the immediate processing of your request.
Enterprise Infrastructure
Built on world-class infrastructure with enterprise-grade reliability.
Google Cloud Platform
Built on GCP infrastructure with ISO 27001, SOC 1/2/3 certifications. Enterprise-grade security you can trust.
Regular Security Updates
Continuous security patching and updates. We monitor for vulnerabilities and deploy fixes promptly.
Automated Backups
Daily automated backups with point-in-time recovery. Your data is protected against accidental loss.
99.9% Uptime SLA
Enterprise-grade reliability with redundant systems and automatic failover capabilities.
Google Cloud Platform maintains ISO 27001, SOC 1, SOC 2, and SOC 3 certifications for their infrastructure services.
Data Residency Options
Choose where your data is stored to meet your compliance requirements.
United States
Iowa
European Union
Belgium
Asia Pacific
Singapore
Important: Data residency selection is immutable once chosen for your organization. This ensures consistent compliance and prevents accidental data migration.
Subprocessors
Third-party services that process data on our behalf.
| Provider | Purpose | Data Location |
|---|---|---|
| Google Cloud Platform | Infrastructure, storage, AI processing | Per data residency selection |
| Stripe | Payment processing | United States |
| Resend | Transactional emails | United States |
| Sentry | Error monitoring (anonymized) | United States |
Who can see your data
Access inside your firm is controlled by you. In plain terms:
Role-based access
Every member of your firm has a role (owner, admin, member, or viewer) and each role unlocks only what it needs. Viewers can read but never change or send anything.
Ethical walls
When a matter must be isolated, an ethical wall restricts it to the specific people you choose. For everyone else it disappears: from lists, from search, and from AI assistant answers.
Conflict checking
New clients and matters are checked against everyone your firm has represented or faced, and potential conflicts are flagged before you proceed, with a full audit trail.
Lawzana staff work from account-level information to operate the service; we only look inside your workspace with your permission, when you ask us for help.
Your data when you leave
No lock-in. If you close your account, here is exactly what happens.
Full export, on request
Ask us and we provide a complete export of your documents and structured data (CSV/JSON) within 14 days, usually within 2 business days.
30-day grace period
After closure, your data stays intact and exportable for 30 days, in case you need one last copy or closed the account by mistake.
Deletion, on schedule
After the grace period, your data is deleted from our live systems. Encrypted backups expire within 90 days of closure.
Honest comparison: Flow vs. keeping files on your own machine
Some firms prefer that client files never leave a computer they physically control. We respect that. Here is who Flow is for, and who it isn't.
Flow is a good fit if you…
- Work with colleagues and need everyone on the same, current file
- Want your matters reachable from court, home, or another office
- Want search, client intake, and AI assistance working across your documents
- Prefer managed encryption and backups over doing it yourself
Flow may not be right if you…
- Are bound by bar rules or client contracts requiring files to stay on machines you physically control
- Need a fully offline workflow with no cloud storage of any kind
If that is your situation, a local-only setup is the honest answer, and we would rather tell you that than oversell. Unsure? Email us and we will tell you straight whether Flow fits your confidentiality requirements.
Legal & Compliance
Designed with legal industry requirements in mind.
GDPR compliant with data processing agreements available upon request
California Consumer Privacy Act (CCPA) compliant
Designed with ABA Formal Opinion 512 guidance in mind
State bar AI ethics requirements considered in product design