Personal-injury firms hold two of the most regulated data types there are, privileged client files and protected health information. Highbar is architected around that from day one. We list our controls honestly below, and we don't display certifications we don't hold.
TLS everywhere; production runs on an encrypted, BAA-covered AWS RDS (Postgres) host. Passwords are bcrypt-hashed.
Server-side sessions with httpOnly cookies; every route and mutation is validated against a live session, not just cookie presence.
Attorney / Paralegal / Intake / Admin roles, enforced server-side on every sensitive action (settlement figures, deletions, playbooks).
Who did what, when, written on every change, never edited or deleted. The evidentiary-integrity record firms expect.
AI runs on Claude through a BAA-covered, zero-retention endpoint (Amazon Bedrock, under our AWS BAA). Case data is processed in transit, not stored by the model or used for training.
Error tracking and uptime monitoring on deploy; formal security monitoring (Vanta/Drata) onboarding ahead of first production firm.
Enforced server-side on every action.
| Capability | Attorney | Admin | Paralegal | Intake |
|---|---|---|---|---|
| Create / intake cases | ||||
| Edit case details | ||||
| Change case status | ||||
| Delete records (claims, providers) | ||||
| Edit settlement figures | ||||
| Manage AI playbooks | ||||
| Review & approve AI drafts | ||||
| Assign tasks to other team members | ||||
| View audit log | ||||
| View team performance (owner/admin only) |
Questions or a security review request? This page reflects the current build, a demo environment running on sample data only.