Security and privacy
Your firm's data, on your firm's server.
We built MatterOwl so that the safest arrangement is also the default one. Here is exactly how it works, including what we don't have yet.
The architecture
The decisions that do most of the work
1. A dedicated server for each firm
Every firm runs on its own cloud server, with its own database and file storage. There is no shared, multi-customer database, so one customer's data can't leak into another's through a software mistake.
2. Signed releases
Updates are signed with a key kept offline, never on our management systems. Your server verifies the signature before it installs anything and refuses a release that doesn't match. A compromise of our management console can't push code to your server.
3. Encrypted backups that can't be erased
Every night your server makes a full backup of its database, files and settings and encrypts it before anything leaves the server. It's stored with a backup provider separate from the hosting provider, in a bucket locked so that no one, including us, can change or delete a backup for 30 days. Neither the backup store nor our management console can read your backups; the key that decrypts them is kept offline by Matter Owl, for restores. We check every night that the expected backup arrived intact.
4. WireGuard-only administrative access
Your server accepts administrative (SSH) logins only from our management server, using keys rather than passwords. The management server itself has no public login at all: it's reachable only over a private, encrypted WireGuard network. The public can reach only the web application.
5. Zero-data-retention AI, under your controls
Barnaby is off until you turn it on. When it's on, every request is routed only to model providers with a zero-data-retention commitment that don't collect your data, and requests that can't meet that are refused rather than sent elsewhere. You choose the roles that may use it, mark clients as "No AI", and keep protective-order files out.
Patched and watched
Servers install security updates automatically, block repeated failed logins, and deny all incoming traffic except the web application and our management server. Each server reports its health and last backup to our console every minute, and the report contains no client data.
Inside the application
Controls your administrator can see and use
- Two-factor sign-in with an authenticator app
- Roles enforced on the server, not just hidden in the screens
- Ethical walls that bind everyone, administrators included
- Append-only audit log of uploads, downloads, deletions and other changes; the database rejects edits to it
- Session controls: idle time-out, throttling and account lockout
- Encrypted connections (TLS 1.2 or later) for all traffic
- Retention settings with nightly clean-up, and legal holds that pause it
- Client portal sign-in with an emailed one-time code
Ownership
Your data stays yours
Your matters, documents and records live in your firm's own database on your firm's own server. We don't mine it, sell it or use it to train AI models. Our management console sees health and backup status, never your client data.
When you leave, your data goes with you: the database and files are yours.
Plain answers
What we don't have yet
- No SOC 2 report, ISO 27001 certificate or other independent security certification.
- No published uptime SLA or public status page.
- Single sign-on is limited to Microsoft Entra ID (OpenID Connect); no SAML yet.
- Encryption of the live server's disk relies on the hosting provider's storage; we don't offer customer-managed keys.
If any of these is a requirement for your firm, tell us. It helps us decide what comes next.
Have a security questionnaire?
Send it over. We'll answer it plainly, and we'll tell you when the answer is no.
