Security & Compliance

Built for the data lawyers can't afford to lose.

Personal-injury firms hold two of the most regulated data types there are, privileged client files and protected health information. Highbar is architected around that from day one. We list our controls honestly below, and we don't display certifications we don't hold.

Controls

Live

Encryption in transit & at rest

TLS everywhere; production runs on an encrypted, BAA-covered AWS RDS (Postgres) host. Passwords are bcrypt-hashed.

Live

Authentication & sessions

Server-side sessions with httpOnly cookies; every route and mutation is validated against a live session, not just cookie presence.

Live

Role-based access control

Attorney / Paralegal / Intake / Admin roles, enforced server-side on every sensitive action (settlement figures, deletions, playbooks).

Live

Append-only audit log

Who did what, when, written on every change, never edited or deleted. The evidentiary-integrity record firms expect.

Live

Zero data retention for AI

AI runs on Claude through a BAA-covered, zero-retention endpoint (Amazon Bedrock, under our AWS BAA). Case data is processed in transit, not stored by the model or used for training.

In progress

Continuous monitoring

Error tracking and uptime monitoring on deploy; formal security monitoring (Vanta/Drata) onboarding ahead of first production firm.

Certifications & frameworks

Architected
HIPAA (BAAs + Security Rule)
One AWS BAA now covers every system that touches PHI: the database (RDS), AI processing (Bedrock), and file storage (S3). "Compliant," not a certificate, there is no HIPAA certification.
In progress
SOC 2 Type II
Monitoring onboarding underway; Type I then Type II with an auditor.
In progress
GDPR / CCPA
Privacy policy + DPA + data-subject rights as EU/California users come online.
Not applicable
PCI DSS
We never touch card data, payments run through Stripe, so PCI scope is out of our hands by design.

Roles & permissions

Enforced server-side on every action.

CapabilityAttorneyAdminParalegalIntake
Create / intake cases
Edit case details
Change case status
Delete records (claims, providers)
Edit settlement figures
Manage AI playbooks
Review & approve AI drafts
Assign tasks to other team members
View audit log
View team performance (owner/admin only)

Questions or a security review request? This page reflects the current build, a demo environment running on sample data only.