Security
How LawHand protects your firm's matters, and where each commitment stops. A control that is planned is listed as planned, never as done.
Support and incident communication
Published Central business hours, S1-S4 impact definitions, acknowledgement objectives, and escalation routes drive audited support cases. Shared-service incidents use sanitized append-only public updates. Objectives are not an SLA unless signed customer terms say otherwise.
Customer lifecycle evidence
Authorized onboarding, BK28 migration, and tenant export receipts bind scope, counts, artifact hashes, signer, and outcome. Missing or mismatched categories are blocked rather than treated as complete.
Offboarding without a deletion shortcut
Legal holds block progress. Two distinct operators must approve offboarding before a final proof records category reconciliation, provider disposition, and backup expiry. The evidence workflow never deletes tenant data.
Providers and privacy terms
The versioned named-provider record states purpose, data category, region and configuration boundary, terms state, and DPA or BAA evidence state. Optional providers are not represented as active for every customer.
Assurance roadmap
External penetration testing has a target cadence and owner but remains planned and not attained. SOC 2, ISO 27001, HIPAA readiness, and BAA availability are not claimed as achieved.
Downloadable review packet
The content-addressed security-review packet exports the current first-party contract and evidence catalogue without secrets, customer data, internal hostnames, or an independent audit opinion.