Security at Lawzana Flow
How we look after your clients' information, in plain terms.
Data Protection
How your client data is protected in Flow.
Encryption in Transit
Everything between your browser and Flow travels over encrypted HTTPS connections.
Encryption at Rest
Uploaded files are encrypted at rest by Google Cloud, and the database by DigitalOcean, our hosting providers.
Access Controls
Role-based permissions (Owner, Admin, Member, Viewer) give each person only what they need. Sign-ins and key changes are recorded in an audit log.
Critical for Legal
AI Security & Privacy
We understand the unique confidentiality requirements of legal work.
AI Data Handling
We use Google Vertex AI. Google does not use your content to train its models, and request logging is off on our project. Google may keep requests in memory for up to 24 hours for caching, and may log them to detect abuse.
No Model Training
Client data is never used to train AI models. Your confidential information stays confidential. Google's terms say it will not use your data to train its models without your permission.
Lawyer-in-the-Loop
AI drafts, you decide. Automatic AI replies to prospects and the client-portal AI assistant are off by default; you turn them on in your settings or per lead, and per client link.
Bottom line: Your client communications, case strategies, and confidential documents are sent to Google Vertex AI only to process your requests, and are never used to train AI models.
Infrastructure
Where Lawzana Flow runs and how it is protected.
Google Cloud for files and AI
Uploaded files are stored in Google Cloud Storage in the US, the EU or Singapore, and AI runs on Google Vertex AI.
DigitalOcean for the application
The application, database, search and background jobs run on DigitalOcean servers in the United States.
Automated Backups
The database is backed up every day, and we can restore it to any point in the last 7 days.
File Storage Region
Firms that join from the Lawzana Directory choose the region during setup; direct sign-ups are stored in the European Union. The rest of the service runs in the US.
United States
Iowa
European Union
Belgium
Asia Pacific
Singapore
Important: The region cannot be changed later. It applies to uploaded files only. Our database, search, background jobs and application servers run on DigitalOcean in the United States, and AI requests are processed by Google Vertex AI on its global endpoint.
Subprocessors
Third-party services that process data on our behalf.
| Provider | Purpose | Data Location |
|---|---|---|
| Google Cloud Platform | File storage, AI processing (Vertex AI) | Files: US, EU or Singapore. AI: global endpoint |
| DigitalOcean | Hosting: application, database, search, background jobs | United States |
| Stripe | Payment processing | United States |
| SendGrid (Twilio) | Sending email and receiving email forwarded to Flow, with open and click tracking | United States |
| Sentry | Error monitoring and session replays (on-screen text masked); may include personal data | United States |
| Crisp | In-app support chat | European Union |
| Canny | Product feedback board | United States |
| Google Analytics | Usage analytics | United States |
| Cloudflare | Network delivery and protection | Global network |
Who can see your data
Access inside your firm is controlled by you. In plain terms:
Role-based access
Every member of your firm has a role (owner, admin, member, or viewer) and each role unlocks only what it needs. Viewers can read but never change or send anything.
Ethical walls
When a matter must be isolated, an ethical wall restricts it to the specific people you choose. For everyone else it disappears: from lists, from search, and from AI assistant answers.
Conflict checking
New leads are checked against your clients and the other parties in your matters, and possible conflicts are flagged before a lead becomes a matter.
Lawzana staff work from account-level information to operate the service; we only look inside your workspace with your permission, when you ask us for help.
Your data when you leave
No lock-in. If you close your account, here is exactly what happens.
Cancel and keep your data
Cancelling a paid plan moves you to the Free plan at the end of the billing period. Your matters, contacts and documents are kept.
Full export, on request
Ask us and we send you your documents and records as CSV/JSON files within 30 days.
Deletion, on request
When you ask us to close your account, we delete your organization's data, including uploaded files. Database backups roll off after 7 days.
Honest comparison: Flow vs. keeping files on your own machine
Some firms prefer that client files never leave a computer they physically control. We respect that. Here is who Flow is for, and who it isn't.
Flow is a good fit if you…
- Work with colleagues and need everyone on the same, current file
- Want your matters reachable from court, home, or another office
- Want search, client intake, and AI assistance working across your documents
- Prefer managed encryption and backups over doing it yourself
Flow may not be right if you…
- Are bound by bar rules or client contracts requiring files to stay on machines you physically control
- Need a fully offline workflow with no cloud storage of any kind
If that is your situation, a local-only setup is the honest answer, and we would rather tell you that than oversell. Unsure? Email us and we will tell you straight whether Flow fits your confidentiality requirements.