Security & data,
honestly described.
ThresholdTrack is in private beta. The controls below are in place today, and we're transparent about what isn't yet certified, and what we don't recommend storing here until we've completed ISO 27001 certification at general availability.
Defence in depth, by default.
TLS 1.3 in transit
Every byte to and from ThresholdTrack travels over TLS 1.3, enforced by HSTS with a two-year max-age (preload eligible). No fallback to plain HTTP is possible.
AES-256 at rest
Your case data is stored in Postgres on Neon (London, eu-west-2). The storage layer encrypts everything at rest with AES-256 and managed key rotation.
AES-256-GCM for sensitive credentials
When you connect a solicitor mailbox, your password is wrapped with AES-256-GCM before it touches the database. Even with full database access an attacker cannot decrypt it without the server-side key.
bcrypt for passwords
Account passwords are hashed with bcrypt (cost factor 12). They are never stored in plaintext and never logged. Forgotten passwords are reset, not recovered.
Gated document access
Uploaded documents are served only through an authenticated endpoint that checks case membership before streaming. Direct file URLs return 410 Gone. Audit log records every download.
Role-based access control
Every case query is scoped through a single helper (requireCaseAccess) that verifies session, membership and capability. A query that forgets to scope is treated as a bug.
Rate limiting + brute-force protection
Login attempts are capped at 8 per IP per 10 minutes. The public demo form is capped at 10 per IP per hour. Both return 429 with Retry-After.
AI sub-processing, disclosed
To build your timeline, the AI reads the full text of the correspondence you route to it, not just metadata; metadata alone can't extract "searches received". That text is sent to Anthropic's Claude API and, under Anthropic's commercial terms, is not used to train their models. Anthropic processes in the US, so this is an international transfer, covered by our DPA and standard contractual safeguards, which we're formalising ahead of GA.
UK storage, one disclosed exception.
All Postgres data is stored in eu-west-2 (London) via Neon, with document storage colocated. The one exception is AI processing: correspondence text routed to the assistant is processed by Anthropic's Claude API in the US (and not used to train their models), covered by our DPA and standard transfer safeguards, being formalised ahead of GA.
30 days of point-in-time recovery.
Neon snapshots Postgres continuously with 30-day retention by default. Your case data can be restored to any second within that window.
Our AI layer runs on Anthropic, where security and capability are the whole thesis.
Your matter correspondence is only as trustworthy as the model that reads it. We deliberately run on Anthropic's Claude, one of the world's leading AI labs, founded to build frontier AI safely, where security isn't bolted on afterwards. What that means for your firm:
Anthropic powers ThresholdTrack's AI layer only, the reading and summarising of correspondence. Your data is stored in the UK on Neon (eu-west-2), and the app runs on our own infrastructure, separate from the model that reads it. These accreditations are Anthropic's, as our AI sub-processor. Anthropic also offers GDPR data-processing terms (with standard contractual clauses) and a zero-data-retention option for API customers, both of which we're putting in place as we formalise our own DPA ahead of general availability.
What changes when we leave beta.
Two commitments anchor our GA release. We won't move firms off beta until both are in place.
ISO 27001 certified
ISO 27001 is the international standard for information security management, the one your firm's PI insurer and risk officer will ask about. We're working toward certification with an accredited UK body, on a timeline that matches our general-availability launch.
Sensitive-document ready
KYC documents, certified ID scans, source-of-funds evidence and other sensitive files become first-class objects in ThresholdTrack at GA, encrypted object storage, signed download URLs, per-document access scopes, and a full retention & deletion workflow. During beta these stay in your existing case-management system.
AWS eu-west-2 (London)
Production data moves onto Amazon Web Services in the London region for general availability. AWS eu-west-2 carries ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, PCI-DSS Level 1, and Cyber Essentials Plus accreditations, the baseline UK legaltech runs on, and the answer your firm's PI insurer and risk officer expect.
During private beta we run on Neon managed Postgres (also in eu-west-2, London), sufficient for the controls and data we hold today, but we're explicit about the production migration: AWS is the destination the legaltech sector evaluates against, and that's where we land before general availability.
- Two-factor authentication (TOTP) for all accounts
- SOC 2 Type 1 audit, alongside ISO 27001
- Per-user activity log surfaced in the dashboard
- Migration to encrypted object storage with signed URLs
- Web Application Firewall rules at the edge
Found a security issue?
Email oli@thresholdtrack.org with details. We aim to acknowledge within 24 hours and ship a fix within 7 days for any issue rated medium or higher. Please do not file a public GitHub issue.
Email security