How Your Data Is Protected

Cloud Counsel holds sensitive material — employment records, medical information, privileged communications — so security is enforced in layers rather than relying on any single control.

Infrastructure and encryption

Google Cloud infrastructure — the platform runs on Firebase and Google Cloud, with data encrypted in transit (TLS) and at rest by default.
No shared hosting — your case file is not stored on generic web servers; it lives in access-controlled databases and storage buckets.

Access control

Database-level rules — every read and write is checked against security rules that limit access to the matter's own participants: you, the people you invite, and the attorneys on your case.
Server-side re-authorization — sensitive operations (document access, agreement signing, billing, AI drafting) are independently re-checked on our servers before they execute, so a compromised browser cannot bypass the rules.
Role separation — clients, contributors, agents, co-counsel, and firm staff each see only what their role permits. Contributors, for example, see only what has been shared with them.

Signatures and audit trails

When you sign an agreement on the platform, the signature is recorded with a cryptographic fingerprint of the document content, a timestamp, and the signer's IP address, stored in audit records that cannot be edited from the app. Matter activity is logged as an operations trail visible to the firm.

Payments

Card payments are processed by LawPay (AffiniPay), the legal industry's standard payment processor. Your card number is tokenized by the processor and never stored on Cloud Counsel's servers. Settlement funds are handled through an attorney trust account as required by Rule 1.15 of the Rules of Professional Conduct.

Professional duty

Cloud Counsel is operated by J. Madison PLC, a law firm. Beyond the technical controls, your information is protected by the professional duty of confidentiality attorneys owe under the Rules of Professional Conduct, and the platform undergoes recurring adversarial security review as part of its development process.