Data Security & Privacy

Your clients' data is
attorney-client privileged.
We treat it that way.

Everything you need to know about how Steadfast Practice stores, protects, and handles your firm's data — in plain English.

AES-256 encryption at rest
TLS 1.2+ in transit
Daily automated backups
US-based infrastructure
You own your data — always

Encryption at Rest

All data stored in our database is encrypted at rest using AES-256 encryption — the same standard used by financial institutions and government agencies. This is enforced at the infrastructure level by Neon (our database provider), meaning encryption is always on with no configuration required.

This covers all client records, case files, contact details, financial information, intake forms, documents, and any other data your firm stores in Steadfast Practice.

Algorithm
AES-256
Industry standard — enforced at storage layer
Database Provider
Neon (PostgreSQL)
US East region — encryption always on

Encryption in Transit

Every connection to and from Steadfast Practice is encrypted in transit using TLS 1.2 or higher. This means data cannot be intercepted between your browser, your clients' browsers, and our servers.

Browser → App
HTTPS / TLS 1.2+
Enforced by Render + Cloudflare CDN
App → Database
SSL Required
sslmode=require on all DB connections
App → Stripe
HTTPS / TLS 1.2+
Stripe SDK enforces HTTPS on all calls
App → File Storage
HTTPS / TLS 1.2+
Cloudflare R2 via authenticated HTTPS proxy

Database Backups

Your data is automatically backed up by Neon on a continuous basis. Backups are managed by our database provider and stored redundantly in US-based infrastructure.

Backup Type
Continuous / Point-in-Time
Neon maintains continuous WAL archiving
Retention
7–30 days
Restore to any point within the retention window
Recovery Process
Point-in-time restore
Contact support for restore requests
Storage Location
US East (AWS)
Data never leaves US-based infrastructure

Tenant Data Isolation

Steadfast Practice is a multi-tenant platform — multiple law firms share the same infrastructure. Your firm's data is completely isolated from every other firm on the platform.

Every database table includes a tenant_id column. Every API query is scoped to your firm's tenant_id — pulled from your authenticated session, never from user-supplied input. It is architecturally impossible for one firm's users to retrieve, modify, or delete another firm's data.

Isolation Mechanism
tenant_id scoping
Every query enforces firm-level isolation
Cross-Tenant Risk
None by design
tenant_id sourced from server-side session only

Authentication & Access Controls

We use a three-tier access model: platform admins, firm users (attorneys, staff, admins), and clients. Each tier is strictly isolated — a client cannot access attorney-only data, and firm users cannot access other firms.

Password Hashing
bcrypt (12 rounds)
Passwords are never stored in plaintext
Sessions
Server-side (PostgreSQL-backed)
httpOnly cookies, 30-day expiry, secure in production
Brute Force Protection
Rate limiting on login
Max 10 attempts per IP per 15 minutes
Role Enforcement
Server-side only
Admin / Attorney / Staff roles enforced on every request

API Security

All database queries use parameterized statements (prepared queries) — SQL injection is architecturally prevented. User-supplied data is never interpolated directly into SQL strings.

Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and others) are applied to every HTTP response via Helmet.js. Public-facing endpoints (chat widget, intake forms, calculators) are rate-limited to prevent abuse.

Data Ownership & Deletion

You own your data. Full stop. Steadfast Practice is a tool you use — we have no claim to your client records, case files, or firm information.

On cancellation: You can export all your data at any time via the built-in export feature (Dashboard → Settings → Export). When your firm is deleted from the platform, all associated data is permanently deleted via cascading database deletion — contacts, cases, billing records, documents, messages, and all related records are removed. This is irreversible.

Data Ownership
100% yours
We never use your client data for any purpose other than running your firm's instance
Export
Self-service, any time
Full data export available from your dashboard
On Cancellation
Complete deletion
All firm data permanently deleted from production DB
Backup Purge
Within retention window
Backup data ages out automatically within 7–30 days

Third-Party Services & Data Flows

We use a small number of carefully selected service providers. Here is exactly what data flows to each, and why:

Service Purpose Data Shared Location
Neon (PostgreSQL) Primary database All firm & client data (encrypted at rest) US East (AWS)
Render Application hosting Application code; request logs (no persistent client data) US (Oregon)
Stripe Payment processing Invoice amounts, firm name — no card data ever touches our servers US-based
Cloudflare R2 File & document storage Uploaded documents and images (encrypted in transit and at rest) US-based
Polsia AI Proxy AI chat widget responses Chat message content — used only to generate responses, not retained for training US-based

We do not use Google Analytics, Facebook Pixel, or any other third-party behavioral tracking or advertising technology on any authenticated firm pages. No client data is ever sent to analytics services.

Infrastructure & Data Residency

All data is stored and processed in the United States. We do not transfer client data to other countries or regions. Our infrastructure stack:

Database
Neon PostgreSQL
US East 2 (AWS Ohio)
Application Server
Render
US West (Oregon)
File Storage
Cloudflare R2
US-based region
Payment Processing
Stripe
PCI DSS Level 1 certified

Questions about security?

We're happy to provide additional documentation, answer specific compliance questions, or discuss your firm's particular requirements before you sign up.

Contact Us About Security

Last updated: March 10, 2026