Confidential by construction.
Law firms hold other people's secrets. Source Doc is designed so that isolation between firms is physical, access inside a firm is decided by the firm, and nothing Source Doc does can alter a source file.
read-only grants
audit log, encrypted secrets
index, OCR, search
People sign in to Source Doc. Only Source Doc's server talks to the retrieval appliance, using that firm's own key. The browser never receives a storage key or a connector token, and the appliance never sees an end user.
Isolation between firms
Every firm is provisioned with its own index bucket and its own key on the retrieval appliance. Documents from two firms are never stored together, and a request made with one firm's key physically cannot read another firm's data. We deliberately did not build a single shared index with a “tenant” column: a filter can have bugs, a separate bucket cannot leak by accident.
Per-firm keys are held only by the Source Doc server, envelope-encrypted at rest with AES-256-GCM. They are never sent to the browser, never written to logs, and can be rotated without re-indexing.
Read-only, source-first
Connectors request read scopes only from Microsoft 365 and Google Workspace, and SFTP accounts are provisioned read-only. When a crawl runs it downloads a file to temporary storage, indexes it, and deletes the copy. Source Doc never edits, moves, renames, or deletes a source file, and the index it builds is a derivative your firm can purge at any time from the admin screen.
Access inside a firm
- Roles. Owner, admin, and member roles control who can manage connectors, people, billing, and access scopes.
- Matter-level scopes (ethical walls). An owner can restrict any person to specific matters or folders. Scopes are applied on the server to every search and every document open, and they can only narrow access, never widen it.
- The same rules for AI. Personal access tokens used by Claude, ChatGPT, or other MCP clients inherit the scope of the person who created them. Tokens are shown once, stored hashed, and revocable at any time.
- Sign-in. Microsoft or Google single sign-on, or a one-time email link. Sessions are server-side, HttpOnly, secure cookies; no tokens or document text are kept in browser storage.
Audit and accountability
Source Doc keeps a search audit log: who searched for what, when, which results they opened, and administrative actions such as connector changes, invitations, and scope edits. Retention is 90 days on Starter, one year on Practice, and unlimited on Vault and Enterprise. Firm admins can review and export it.
Where your data is processed
Indexing, OCR, and search run on a dedicated retrieval appliance operated by Source Doc — not on a public, multi-tenant AI service. Your documents are used for your firm's retrieval only. They are never used to train models, ours or anyone else's. Optional AI analysis through MCP happens in the AI tool your firm chooses and is governed by that tool's terms.
Enterprise agreements can place the appliance on your premises or a private network reachable only over VPN.
Operations
- Encryption in transit everywhere: TLS to the browser, to each cloud provider, and between Source Doc and the appliance.
- Backups. Application data is backed up nightly with off-site copies. The index can be rebuilt from your source files at any time; nothing in Source Doc is the only copy of a document.
- Rate limiting and quotas per firm keep one customer's bulk indexing from affecting another's search.
- Least privilege. One master credential provisions firms and is used only by the server for that purpose; day-to-day operations use per-firm keys.
Questionnaires, DPAs, and BAAs
Vault and Enterprise plans include a signed Data Processing Agreement, and a Business Associate Agreement where required. We are happy to complete your security questionnaire before a pilot. Write to security@getsourcedoc.com.