Security Assurance
Law-firm security controls for client and invoice data
DueForce is built for attorneys and law firms. This page summarizes the technical and operational measures we implemented to protect sensitive client and invoice information.
1) Data isolation (RLS) at the database layer
- • Supabase Row Level Security (RLS) is enabled for `invoices` and `clients`.
- • Supabase RLS is enabled for `user_firm_settings` (firm name, billing reply-to, branding, and related profile fields).
- • Supabase RLS is enabled for `reminder_logs` and `client_contact_preferences` (firm-controlled per-client contact settings, such as suppressing reminders when you enable "Do not contact" on the Clients page).
- • Supabase RLS is enabled for `email_tracking` (per-user read of delivery status rows associated with your account). Inserts and webhook-driven updates run only through secured server-side routes using elevated credentials, not from the browser.
- • DueForce uses a strict isolation model: each subscriber account maps to an authenticated user, and RLS policies scope data access to that user's rows.
- • Demand letter sends are logged to `demand_letter_logs`, also protected by RLS.
- • Supabase RLS is enabled for `clio_connections` and `clio_invoices` (optional Clio integration data). Policies scope every read and write to the connected firm's account; integration sync and webhook processing run only through secured server-side routes.
- • Cross-account isolation for Clio-synced data is verified by an automated acceptance test that confirms one firm's account cannot read another firm's synced invoice rows.
- • Pro and admin access checks exist both in the app UI and in protected backend routes.
2) Confidential client communications
- • On invoices and demand letters, you can enable a "Confidential client data" labeling toggle.
- • When enabled, reminder emails and demand letters include a clear "CONFIDENTIAL CLIENT COMMUNICATION" label/header so your team can treat communications appropriately.
- • Confidential labeling is a communications safeguard and workflow signal. It is not a substitute for your professional or contractual confidentiality obligations.
3) Clio integration security (optional)
- • Connecting Clio is optional and uses OAuth sign-in with Clio; DueForce never sees or stores your Clio password.
- • Minimum-scope access: DueForce requests only the Clio permissions needed to read billing records and manage webhooks. It does not request access to matters, documents, notes, calendars, or time-entry content.
- • Minimal data synced: invoice/bill identifiers and numbers, client business contact name and email, issue and due dates, invoice state, amounts, outstanding balance, and currency. Matter narratives, time-entry descriptions, notes, and documents are never retrieved or stored — privileged content stays in Clio.
- • Token protection: Clio OAuth access and refresh tokens are encrypted at the application layer (AES-256-GCM) before storage and are decrypted only server-side at time of use. All Clio API calls are made from our servers, never from the browser.
- • Webhook integrity: inbound Clio webhooks are accepted only after signature verification; unsigned or invalid deliveries are rejected.
- • Payment-aware suppression: before a reminder or demand letter tied to a synced invoice sends, DueForce re-checks that invoice in Clio and holds the send if the invoice is paid, reduced to a zero balance, or deleted.
- • Logging discipline: integration logs record identifiers and counts, not invoice payloads or client contact details, enforced by an automated check in our build pipeline.
- • Deletion: disconnecting Clio (from Settings or by deauthorizing DueForce within Clio) revokes and deletes stored tokens and deletes your firm's synced Clio records. Synced invoices that reach a paid or closed state in Clio are automatically deleted 90 days after reaching that state.
- • These controls are exercised by automated acceptance tests run against our production configuration. DueForce is not affiliated with or endorsed by Clio.
4) Auditability for professional recordkeeping
- • Reminder automation writes `reminder_logs` (scheduled time, status, and metadata).
- • Demand letter sends write `demand_letter_logs` (status, recipient email, and letter hash).
- • Email delivery records in `email_tracking` store message type, recipient, provider message identifier, and status timestamps (for example sent, delivered, opened, or bounced) when reported by the email infrastructure.
- • You can export reminder logs and view the activity history for your own cases.
- • Automated retention: a scheduled server job deletes `email_tracking` rows older than 24 months and `reminder_logs` / `demand_letter_logs` rows older than 7 years, consistent with our Privacy Policy.
- • Account closure: users may permanently delete their account from the Account page, which removes DueForce application data for that user (see Privacy Policy for processor-specific nuances).
5) Transport security and encryption
- • All traffic uses HTTPS/TLS.
- • Data is stored in Postgres via Supabase (encryption at rest).
- • Payment card details are handled by Stripe; DueForce does not store full card numbers.
- • Optional firm logos are stored in Supabase Storage (dedicated bucket); access is tied to your account for upload and retrieval consistent with app permissions.
- • Clio integration tokens receive an additional layer of application-level encryption (AES-256-GCM) on top of database encryption at rest.
6) Email delivery, webhooks, and firm copies
- • Outbound invoice reminders and demand letters are sent through transactional email infrastructure (e.g., Resend). Message content and headers are transmitted to that provider only as needed to deliver mail.
- • Inbound delivery webhooks are accepted only after signature verification (industry-standard signing, e.g. Svix-style headers and a secret configured on our servers), reducing the risk of forged status updates.
- • The same signature-verification posture applies to inbound Clio webhooks: only cryptographically verified events update invoice status.
- • The Service applies a BCC to your configured billing reply-to address on automated reminders and demand letters when that address differs from the primary recipient, so your firm receives a copy for records.
This page is provided for informational purposes and does not constitute legal advice. No system can guarantee absolute security. If you have specific confidentiality or compliance requirements for your firm, email us at admin@dueforce.ai.