Confidential by construction.
Law firms hold other people's secrets. Source Doc is designed so that each firm has a separate index and key, access inside a firm is decided by the firm, and nothing Source Doc does can alter a source file.
read-only grants
audit log, encrypted secrets
index, OCR, search
People sign in to Source Doc. Only Source Doc's server talks to the retrieval appliance, using that firm's own key. The browser never receives a storage key or a connector token, and the appliance never sees an end user.
Isolation between firms
Every private customer workspace is provisioned with its own index bucket and its own key on the retrieval appliance. Each firm's key is scoped to its own index. Separate buckets, server-side membership checks, and matter-level access scopes provide multiple layers of protection. The indexes may share the same retrieval appliance; dedicated hardware is an Enterprise option.
Public tours and free demo workspaces share only our approved demonstration archive. Public visitors cannot change profiles, connectors, billing, or documents. Demo PDF previews are labeled reconstructions of indexed text; they never proxy a secured source file. Your original storage permissions remain in place.
Per-firm keys are held only by the Source Doc server, envelope-encrypted at rest with AES-256-GCM. They are never sent to the browser, never written to logs, and can be rotated without re-indexing.
Read-only, source-first
Connectors request read scopes only from Microsoft 365, and SFTP accounts are provisioned read-only. When a crawl runs it downloads a file to temporary storage, indexes it, and deletes the copy. Source Doc never edits, moves, renames, or deletes a source file, and the index it builds is a derivative your firm can purge at any time from the admin screen.
Access inside a firm
- Roles. Owner, admin, and member roles control who can manage connectors, people, billing, and access scopes.
- Matter-level scopes (ethical walls). An owner or admin can restrict a person to selected matter scopes. For example, a receptionist can work with assigned intake matters without access to the entire archive. Scopes are applied on the server to every search and every document open, and they can only narrow access, never widen it.
- The same rules for AI. Personal access tokens used by Claude, ChatGPT, or other MCP clients inherit the scope of the person who created them. Tokens are shown once, stored hashed, and revocable at any time.
- Sign-in. One-time email links or account passwords. Sessions are server-side, HttpOnly, secure cookies; no tokens or document text are kept in browser storage.
Audit and accountability
Source Doc records successful logins and workspace activity: who signed in and when, the sign-in method, searches, document views, and administrative actions such as connector changes, invitations, and scope edits. Login records include the actor, timestamp, a hashed IP fingerprint, and browser information. Retention is 90 days on Starter, one year on Practice, and unlimited on Vault and Enterprise. Firm admins can review the trail to support internal oversight, compliance reviews, and regulatory recordkeeping. These controls support your firm’s compliance process; they are not a certification or a guarantee that a particular regulation is satisfied.
Where your data is processed
Indexing, OCR, search, and selected-document summaries run on a dedicated appliance operated by Source Doc. Your documents are used for your firm's retrieval and review. They are never used to train models, ours or anyone else's. Optional analysis through MCP happens in the AI tool your firm chooses and is governed by that tool's terms.
Document details remain available while a summary is prepared. Each summary request checks current document permissions, including cached results. Summaries are cached encrypted for up to 24 hours; partial reviews identify their coverage. Source links and supporting excerpts help readers verify AI-generated findings against the record.
Enterprise agreements can place the appliance on your premises or a private network reachable only over VPN.
Operations
- Encryption in transit: TLS protects browser sessions and cloud-provider API connections.
- Backups. Application data is backed up daily with a copy in object storage. The index can be rebuilt from your source files at any time; nothing in Source Doc is the only copy of a document.
- Rate limiting and quotas help manage indexing and search workloads.
- Least privilege. One master credential provisions firms and is used only by the server for that purpose; day-to-day operations use per-firm keys.
Questionnaires, DPAs, and BAAs
Security questionnaires, data-processing terms, and any BAA requirements are reviewed and agreed before engagement. Availability depends on the proposed deployment and requirements; these are not automatic plan inclusions. Write to security@getsourcedoc.com.