Security practices
LitigTrack is engineered for evidentiary integrity. The controls below describe how client workspaces are protected. This page is not a compliance certification and does not replace counsel’s own professional obligations.
Passkey authentication
Client sign-in uses industry-standard passkeys (device-bound or credential-manager authenticators). There is no shared password login on the public internet. Sign-in attempts are logged. Recovery codes are issued at enrollment for break-glass access.
Sealed files
Files attached when composing correspondence, and case materials sealed into the workspace evidence store, are kept as immutable objects with SHA-256 digests. Share and recipient links are tracked rather than relying on mutable MIME attachments. View and download events are recorded against the sealed object.
Hash-chained audit trail
Operational events append to an audit chain in which each entry references the hash of the prior entry. The chain is verified in the client dashboard; a break surfaces as an integrity failure rather than a silent edit.
Delivery & engagement records
Outbound mail-provider events (accepted, delivered, failed) are captured alongside LitigTrack’s own open-pixel and file-access signals. Prefetch-like activity is classified separately from human engagement where the signals permit.
Transport & session hardening
Production traffic is served over HTTPS. Session cookies are httpOnly and bound to the application origin. Public contact forms use automated abuse controls and rate limits; they are not a channel for privileged case documents.
Litigation hold
Client correspondence, sealed files, and audit rows are retained for the engagement. Routine permanent-deletion workflows are not part of the product surface.
Responsible disclosure
Security researchers may report issues via the contact form. See also security.txt. Do not include client case content or exploit payloads in reports.