Skip to content
LitAxis

Security & trust

Medical records. Settlement money. Privileged strategy.

A plaintiff firm’s data is some of the most sensitive there is. Here is how LitAxis protects it, the agreements behind it, every company that processes it for us — and, just as plainly, what isn’t in place yet.

Security overview (PDF)Subprocessor list (CSV)

Updated . No sign-up needed.

Controls

What protects your data today.

Firm-by-firm isolation

Every query is scoped to your firm in the application, and Postgres row-level security enforces it again in production.

Encrypted, stored and moving

The database, document storage, secrets and call recordings are encrypted with AWS KMS customer-managed keys, with rotation on. Connections are HTTPS-only, with Strict Transport Security.

Integration tokens sealed

Access tokens and API keys for the ad, accounting, chat and data services you connect are encrypted (AES-256-GCM) before they are stored.

Ethical walls beyond the screens

Record-level screens apply in the app, the API, the MCP server, custom Canvas screens and Slack commands — not just the main screens.

Multi-factor sign-in

Passkeys (recommended) or authenticator apps, one-time recovery codes, and remember-this-device for 30 days. The firm owner can require a second factor for everyone, for owners and admins, or leave it optional — with a separate setting for the client portal.

Directory provisioningBeta

Connect your identity provider over SCIM 2.0 to add, update and deactivate LitAxis users from your own directory. LitAxis stores only a hash of the connection token.

Roles you define

Configure what each role can see and do, per firm.

Tamper-evident audit trail

Changes and sign-ins go into a hash-chained log. Database triggers block ordinary edits and deletes, and a one-click check in settings verifies the chain is intact.

API keys done carefully

Stored only as hashes, limited to the scopes you grant, acting as the person who created them, and rate-limited.

Outbound calls fenced

Webhooks and integrations can't be pointed at internal addresses (SSRF protection with IP pinning).

Backed up and versioned

The database keeps continuous backups with point-in-time restore, and stored documents keep their earlier versions, so an accidental change or deletion can be recovered.

Built on AWS

CloudFront, Lambda, Aurora PostgreSQL and S3. Drafting, chronology and analysis AI runs on Anthropic's Claude through Amazon Bedrock.

Agreements & data location

What's signed, where your data lives, and what isn't done yet.

In place

Business associate agreement with AWS

LitAxis has a signed business associate agreement (BAA) with Amazon Web Services, active since October 14, 2026. It covers AWS's HIPAA-eligible services, which host the LitAxis application, its database and your documents.

In preparation

A BAA for your firm

Our business associate agreement for firms is being finalized. Ask us and we'll tell you where it stands.

In place

Data stays in the United States

Firm data is stored in AWS's US West (Oregon) region. Drafting, chronology and analysis AI runs on Amazon Bedrock in US regions, and the companies that make the models don't receive your data.

Not yet

Independent security audit

LitAxis hasn't completed a third-party security audit. When it has, the report will be listed here. Until then we show no badges, and we're glad to walk your team through every control in detail.

Subprocessors

Every company that processes firm data for us.

These are the outside companies LitAxis itself uses to run the service and that receive your firm's data.

  • Amazon Web Services (AWS)(opens in a new tab)

    Hosting, database, document storage, AI models (Anthropic's Claude on Amazon Bedrock), text recognition, the phone system, email, sign-in, encryption keys and logs.

    Data it receives
    All firm data, including medical records, documents, call recordings and AI requests.
    Location
    United States

  • ElevenLabs(opens in a new tab)

    The AI voice agent that can answer a firm's intake calls, and natural voices for phone menus.

    Data it receives
    What callers say on intake calls, and the call scripts a firm writes.
    Location
    Not yet confirmed

  • Twilio(opens in a new tab)

    Phone numbers that carry intake calls to the AI voice agent.

    Data it receives
    Call audio and callers' phone numbers on intake calls.
    Location
    Not yet confirmed

Services your firm connects with its own account — such as Microsoft 365, Slack, your ad accounts or your identity provider — receive data only once you connect them, under your firm's own agreement with that company.

Download the list as a spreadsheet (CSV)

AI guardrails

AI that shows its sources and waits for a person.

  • AI chronology entries that can't quote their source word for word are dropped, not shown.
  • Case valuation says how many of your settled cases it compared against, and their range — or that there aren't enough.
  • Suggested next steps on a matter never send, file or execute anything on their own.
  • AI Jobs ship switched off. Their AI steps wait for a person to approve or run them, and drafted letters wait for review.
  • The client portal's AI answers only from client-safe case information, and is instructed to hand legal-advice questions to your team.

Access controls on the way

  • Single sign-onComing soon

    Per-person sign-in through your identity provider (SAML / OIDC).

Questions or a security report

Email hello@litaxis.app. If you think you’ve found a vulnerability, tell us before anyone else and we’ll work with you on it.

Bring your security questions to the demo.

We'll show the controls in the product itself — isolation, walls, the audit trail — not in a questionnaire.

Request a demoExplore the product