How MtaaLex Protects Your Data

This page details the technical and operational safeguards actually built into the MtaaLex platform to protect your law firm's confidential files, client records, and legal correspondence.

---

1. Authentication & Session Security

To access your MtaaLex workspace, every user must be authenticated through our secure identity service, powered by Clerk.

• Passwords Never Touch MtaaLex Application Servers: Your password is never sent to or stored in the MtaaLex core database. Authentication credentials are handled exclusively by Clerk, a dedicated identity platform that uses modern, salted cryptographic hashing algorithms.
• Cryptographic Session Verification: When you sign in, your browser receives a secure, time-limited digital session token (a JSON Web Token). Every time your browser asks for a case file, fee note, or client record, our backend server cryptographically verifies this token before returning any data.
• Automated Expiry & Invalidation: If an authentication token expires, is tampered with, or if you sign out, the session is invalidated immediately.
• Email Verification: Every user must confirm ownership of their official email address via a one-time verification code (OTP) before they can join a law firm workspace.

WHAT IS A SESSION TOKEN?

A session token is like a temporary, digitally signed electronic keycard issued to your browser after you log in. It proves your identity for each page you visit without requiring you to re-type your password on every click.

---

2. Firm & Workspace Data Isolation (Multi-Tenancy)

One of the most critical questions lawyers ask is: Can another law firm using MtaaLex accidentally see our files?

No. MtaaLex uses strict workspace data segregation:

• Workspace Partitioning: Every firm has a unique, cryptographically generated Organization ID in the database.
• Mandatory Organization Verification: Our backend middleware (RequireOrganization) intercepts every single incoming request. If a request lacks a valid firm ID, it is blocked immediately.
• Database Query Scoping: Every database lookup—whether for clients, court matters, pleadings, or invoices—is strictly constrained by your firm's ID (e.g., WHERE organization_id = $1). Even if an advocate from another firm tries to guess a case reference number, the system will return a 404 Not Found or 403 Forbidden error because the record does not belong to their workspace.

---

3. Role-Based Access Control (Within Your Firm)

Within your own law firm, not all practitioners need access to every matter or financial report. MtaaLex provides a comprehensive Role-Based Access Control (RBAC) model:

• Standard Firm Roles: Predefined roles—including Managing Partner / Owner, Senior Associate, Junior Associate, Pupil, Paralegal, and Finance—define baseline privileges.
• Granular Task Permissions: Administrative partners can configure specific permissions for viewing, creating, editing, and deleting cases, clients, and fee notes.
• Case Collaborator Restrictions:
  • The advocate who creates a case and the designated Lead Counsel have administrative authority over that matter.
  • Invited colleagues can be given Edit or View Only access.
  • Invited collaborators cannot invite other lawyers or delete the case file without the permission of the Lead Counsel or a Managing Partner.

---

4. Document Vault & File Protection

Your client documents, title deeds, contracts, and court pleadings are managed through the MtaaLex Document Vault:

• Private Object Storage: Files are stored in dedicated cloud object storage and are completely private. There is no public internet link to any document stored in MtaaLex.
• Temporary Presigned Access Links: When an authorized advocate clicks to view or download a pleading, MtaaLex generates a temporary, short-lived presigned URL that expires after a few minutes. The file can only be fetched by someone who has passed full authentication and permission checks.
• Document Versioning: Every time an updated version of a draft or agreement is uploaded, MtaaLex stores a new version record alongside the original. Prior versions remain accessible, preventing accidental overwrites.
• File Integrity Checksums: The system records cryptographic checksums (digital fingerprints) of uploaded files to ensure that documents cannot be modified or corrupted in transit.

---

5. Protected Data Transmission (HTTPS/TLS)

All communication between your computer and the MtaaLex platform is encrypted using modern Transport Layer Security (TLS/HTTPS):

• In-Transit Encryption: Whether you are typing a confidential case note or uploading an affidavit, the information is scrambled as it travels across the internet, protecting it from interception on office Wi-Fi networks or mobile connections.
• Automated HTTP-to-HTTPS Redirection: Any unencrypted web request is automatically redirected to the secure https:// protocol.
• Modern Cipher Suites: We use TLS certificates issued by Let's Encrypt with strict forward secrecy and secure cipher suites.

WHAT IS ENCRYPTION?

Encryption is a mathematical method of scrambling your information so that only the intended recipient (your browser and our secure server) can unscramble and read it. If anyone tries to eavesdrop on the internet connection, they only see meaningless scrambled text.

---

6. Defensive Security Headers & Rate Limiting

To guard against malicious attacks, MtaaLex deploys active protective measures on every web response:

• Anti-Clickjacking Protection (X-Frame-Options: DENY): Prevents external websites from invisibly framing MtaaLex to trick users into clicking buttons.
• MIME-Type Sniffing Prevention (X-Content-Type-Options: nosniff): Blocks browsers from executing files masquerading as harmless images or documents.
• Cross-Site Scripting Guard (X-XSS-Protection): Instructs modern browsers to block pages if an injection attack is detected.
• Intelligent Rate Limiting: Our servers monitor request velocity and automatically throttle suspicious IP addresses that attempt rapid password-guessing or brute-force attempts.

---

7. Security Audit Trails

For managing partners, transparency is crucial for firm governance:

• System Audit Logging: The application records significant actions performed in your workspace, including user logins, matter creation, collaborator additions, and billing adjustments.
• Attribution: Each audit event notes who performed the action (User ID and Email), what entity was affected, and the exact timestamp.
• Partner Review Portal: Authorized administrators can inspect these logs at /audit-logs to maintain oversight and detect any anomalous behavior.

---

8. Server Infrastructure & Database Resilience

• Dedicated Database Instance: All relational structured data is housed in an enterprise PostgreSQL engine with strict connection pooling and prepared statements that prevent SQL injection attacks.
• Server Health Monitoring: Systemd service supervisors automatically restart background processes if any unexpected failure occurs, maintaining high availability for court deadlines.