Law firms entrusting client data to a SaaS platform have an obligation to understand where that data lives and how it is protected. This post is the plain-language version of the security architecture — not the marketing version.
Where data is stored
All client data is stored in the United States on AWS infrastructure. We do not use international data centers or cross-border data transfers for client case data. Database storage uses AES-256 encryption at rest. All data in transit uses TLS 1.2 or higher.
Access controls
Client data is accessible only to the firm that owns the case, the client who submitted it, and bankruptcy.ai infrastructure staff under strict need-to-access policies. Row-level security at the database layer ensures that queries from one firm's session cannot return data from another firm's cases. We do not cross-pollinate firm data for any purpose, including AI model training.
Bank and payroll integrations are read-only
The bank data and payroll integrations are read-only by design. The platform cannot initiate transactions, modify account data, or access any information beyond the specific document types the client has authorized. The integrations use standard OAuth flows with scope limitations explicitly defined in the client consent.
Data portability and deletion
Firms can request a full data export at any time. The one-click client file ZIP provides a complete record for any case. If a firm offboards, we provide a complete data export and honor deletion requests for all client data within 30 days of the request. We do not retain data for purposes that were not disclosed at the time of collection.