Your firm is not buying a feature list. It is buying the judgement of whoever wrote this.

One module in the entire codebase can transmit a document

Every path that could send case content off the machine funnels through a single egress gate. It refuses unless five independent conditions hold simultaneously: the build was compiled with AI egress enabled, an API key is present, an attorney has attested by name that a signed Business Associate Agreement is in place, the firm has switched the feature on, and that individual client is not on hold. Failing any one of them returns a named refusal reason - build_disabled, no_api_key, no_baa, firm_disabled - not a silent no-op.

What it means for your firm. A misconfiguration cannot quietly become a disclosure. The gate fails closed and says which lock stopped it, so the failure is diagnosable rather than mysterious.

What it does not cover. The build-level flag is the only one your firm cannot change from inside the app. The other four are firm-controlled, which means they are also firm-revocable.

What an egress gate is, in plain English →

Any single client can be held back on their own

The per-client hold is evaluated inside the same gate as the firm-wide switch, not layered on top of it. A held client's documents cannot be transmitted even while the firm's switch is on.

What it means for your firm. One unusually sensitive matter does not force you to switch the feature off for everyone, and switching it on for the firm does not silently opt in the client you were most careful about.

The record of a transmission is written before the transmission

The audit entry is committed first, then the send is attempted. A crash midway leaves the entry behind rather than losing it.

What it means for your firm. There is no ordering of events in which a document leaves without a trace. A send that failed to record is a send that does not happen.

Refusals are recorded, not just successes

A blocked transmission writes its own audit entry with the reason it was blocked, alongside the entries for transmissions that went through.

What it means for your firm. The log answers "did anything try to leave?" and not only "what left?" - which is the question that actually matters after an incident.

Passwords are stored with scrypt and a per-user salt

scrypt is deliberately memory-hard, which makes large-scale offline guessing expensive in a way that plain hashing is not. Each password gets its own salt, so two users with the same password have nothing in common on disk.

What it means for your firm. A stolen copy of the database does not hand an attacker your firm's passwords, and nobody - including us - can read one out of our own records.

Secrets are compared in constant time

Comparisons run through timingSafeEqual over fixed-length SHA-256 digests of both sides. An ordinary === on a secret leaks, through how long it runs, how many leading bytes matched - enough to recover the secret byte by byte over many requests.

What it means for your firm. The comparison itself gives nothing away, including the length of what it compared.

AES-256-GCM at rest, through exactly one chokepoint

Every access token Ross holds for an outside service is encrypted at rest. GCM is an authenticated mode: a modified ciphertext fails its authentication tag on decrypt rather than returning plausible garbage. Integrations never touch the cipher directly - all encryption and decryption goes through a single module, so a new provider inherits at-rest encryption automatically and nobody has to remember to wrap it.

What it means for your firm. A row edited by hand in the database stops working outright instead of quietly doing the wrong thing, and a future integration cannot accidentally ship unencrypted.

What AES-256-GCM is →

TOTP second factor, to RFC 6238

Time-based one-time codes implemented against the published standard, so any standard authenticator app works.

What it means for your firm. A leaked password on its own is not enough to sign in as one of your attorneys.

Rate limiting and lockout on sign-in

Repeated failed attempts throttle and then lock the account.

What it means for your firm. Guessing at a password one attempt at a time stops being viable.

Sessions die on the next request, not on their own schedule

Change a password or deactivate an account and every session that person held stops working on their very next request - not whenever the cookie happens to expire.

What it means for your firm. Removing someone's access actually removes it. This is the part most software gets wrong, and it is the part that matters on the day someone leaves the firm.

Which firm you are comes from your signed session, never from the browser

Tenant identity is read from the server-side session. It is never taken from a URL parameter, a form field, or a header, so it cannot be changed by editing a web address.

What it means for your firm. There is no request a browser can construct that claims to be a different firm.

Another firm's record answers 404, not 403

Asking for a record belonging to someone else returns "does not exist" rather than "access denied".

What it means for your firm. Ross will not even confirm that a record exists. A 403 is itself a disclosure - it tells a probing party they found something real.

Why 404 and not 403 →

Enforced at the edge and again at the data layer

The tenant boundary is checked when the request arrives and again when data is read, and a dedicated isolation suite proves it on every change.

What it means for your firm. A single forgotten check in one route handler is not sufficient to cross the boundary.

What it does not cover. The rule currently lives in application code. Pushing it down into the database itself, where the code cannot forget it, is in progress and not finished.

Every audit entry commits to the one before it

Each row stores a SHA-256 digest computed over a fixed, explicit field ordering that includes the previous row's hash. Any insert, deletion, or edit anywhere in the history breaks the chain from that point forward and is detectable by re-walking it. You can run that verification yourself, whenever you want.

What it means for your firm. The log does not merely record - it can demonstrate that it has not been rewritten after the fact, and the demonstration is yours to run rather than ours to assert.

What it does not cover. This makes the log tamper-EVIDENT, not tamper-proof. The digest is an unkeyed SHA-256 and the head hash lives in the same database, so an actor with write access who edited a row and recomputed every later hash would pass verification. It reliably catches accidental corruption, partial deletion, and naive edits - not a determined adversary who already holds database credentials. Court-grade integrity means keying the digest with an HMAC secret held outside the database, or anchoring the head hash to an external append-only store. Both are on the roadmap; neither is done.

The hash chain, explained →

The log records what happened without keeping what was said

In place of message text, the trail stores a hash and a length. That is enough to prove a specific message is the one that passed through, and not enough to reconstruct it.

What it means for your firm. Your audit trail does not quietly become a second copy of every privileged communication your firm has ever sent.

Redaction that does not break the chain

Redacting an entry's content is a recorded operation that preserves chain verifiability, with its own dedicated test.

What it means for your firm. Complying with a deletion obligation does not destroy your ability to prove the rest of the log is intact.

The engine never writes prose of its own to a client

It selects from approved templates. An attorney approves the message before anything sends.

What it means for your firm. Nothing reaches your client in words a human at your firm did not write and approve. The automation dials only ever choose among things a person already signed off on.

Two-layer anti-fabrication check on every summary

A summary is decomposed into atomic claims. A second model pass must quote the passage in the source that supports each one. Then an ordinary non-AI string check confirms that quote genuinely appears in the document. A claim backed by a quote that is not really there is marked unsupported.

What it means for your firm. A fabricated citation is caught by a mechanism that cannot itself hallucinate, because the second layer is not a model at all.

How grounding verification works →

If the check cannot run, the answer is 'not checked'

A verification failure returns an explicit unchecked state rather than defaulting to pass.

What it means for your firm. Ross never tells you something passed when it was never looked at. A tool that is right most of the time and silent about the rest is worse than no tool.

What fail-closed means →

Quiet hours are enforced by the system, not by discipline

TCPA quiet-hours restrictions are applied at send time in the client's own time zone.

What it means for your firm. A late-night approval does not become a late-night text to your client, and nobody has to remember the rule on a busy week.

110 test modules, run as CI gates

Tenant isolation, webhook authentication, session revocation, egress gating, and provisioning each have dedicated suites. Time-dependent logic runs against injected clocks rather than the wall clock, and provider mocks are deterministic, so a passing run means the same thing twice.

What it means for your firm. The behaviours your firm is relying on are the ones under test, and a change that breaks one of them does not reach production.

What it does not cover. Tests prove the cases someone thought to write. They are evidence of diligence, not proof of absence of defects, and we would not claim otherwise.

Strict TypeScript, enforced in CI

The codebase is strict-mode TypeScript with ESM throughout, and a typecheck gate runs before any change lands.

What it means for your firm. A whole category of runtime failure is eliminated before the code is ever run.