Security one-pager

Who we are and what we hold

Snot Nose Legal reads a Texas criminal trial record (reporter's record, clerk's record, exhibits) and returns a cited review. For an office or clinic we hold: the record you upload, the pages we extract from it, the findings and the report we render, and your organisation's members and matters. A matter is identified by county, conviction year, a short reference and client initials — never a client name.

Hosting

• Application, database and queues run on Render (US). Documents and the OCR pass live in AWS (S3, Textract), region us-east-2.
• The database is Postgres 16 with point-in-time recovery; backups expire after 35 days, so a deletion propagates fully within 35 days.
• Each environment (staging, production) has its own buckets, keys, database and email allow-list; staging never holds production data.

Encryption

• In transit: TLS everywhere — browser to site, site to API, API to AWS, Stripe, Resend and the model provider. Session cookies are Secure and HttpOnly.
• At rest: Postgres volumes and S3 objects are encrypted by the providers' server-side encryption.
• Passwords are bcrypt (cost 12). Invitation, share-link and reset tokens are stored only as SHA-256 hashes; the raw token exists in the email or URL alone.

Isolation between organisations

• Every tenant table carries a PostgreSQL row-level-security policy on the tenant; application queries run as a database role that cannot see another tenant's rows, and a forged cross-tenant write is refused by the database itself.
• An office or clinic is one tenant. Members hold a seat with a role (owner, attorney, investigator, viewer); the read-only viewer cannot open a matter. A removed seat is refused on the very next request, not the next sign-in.
• A packet a family consents to share with a clinic is delivered as a reference into the clinic's own inbox — nothing is copied or re-uploaded — and every open re-checks that the consent is still live. Revoked consent closes the packet.
• Staff access is role-gated and every staff write is audit-logged with who, what and before/after.

Malware and input handling

• Every upload is scanned by ClamAV before it reaches OCR; an infected file is quarantined and never processed.
• Records are processed per page; nothing in a record is executed.

Retention and deletion

Deletion is scoped, not monolithic: case content is hard-deleted (database rows and S3 objects), a deletion certificate is written into the surviving event stream, and the retention rows above are all that remain. Storage moves to a cooler tier after 90 days and is deleted at 12 months.

Sub-processors

A change to this list is announced to organisation owners by email before it takes effect.

Account security

• Password rules: 12+ characters with an uppercase letter and a number or symbol; sign-in is rate-limited; resets and invitations expire.
• Organisation owners invite colleagues by email; invitations expire in 7 days and are single-use. SSO and MFA are not offered in January.

Incident response

Security issues go to the organisation's named security contact at Snot Nose Legal. We notify affected organisations without undue delay after confirming an incident that touches their data, and we keep the audit trail that lets us say exactly what was touched.