We hold evidence.So we hold it carefully.
Names, addresses and delivery records are the whole product. Everything below is how they are stored, sealed and eventually deleted.
Encryption
TLS 1.3 in transit, AES-256 at rest. Passcodes are stored only as salted hashes — we cannot read a live code back.
Access
Role-based permissions, SSO and SCIM on Enterprise. Every internal read of a case is written to an immutable audit log.
Residency
EU cases are processed and stored in Frankfurt, North American cases in Virginia. No cross-region replication.
Evidence Integrity
A pack that changes
stops matching its seal.
The SHA-256 hash is computed over the finished PDF at seal time and published alongside it. Anyone holding the file can recompute it and see whether a single byte moved.
verify a pack locally
shasum -a 256 case_9fK2m.pdf 6ff53459a1b2c3d4e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f708192a3b4
Compliance
Frameworks
we work inside.
UK GDPR & EU GDPRProcessor, DPA available
ISO 27001Certification in progress
SOC 2 Type IIObservation window open
MLR 2017 / FCA guidanceEvidence format aligned
Retention7 years, then hard delete