What you put in Litigo stays yours, and stays private.
A legal memory only works if it's trustworthy. Here's how case data, documents, and payments are actually protected.
Row-level isolation
Every table — cases, memories, arguments, research, documents — is scoped to its owner with Postgres Row-Level Security. No advocate can ever read another's data, enforced at the database itself, not just in application code.
Authentication
Sign-in runs through Supabase Auth (email/password or Google), with sessions handled by signed, HTTP-only cookies.
Private documents
Uploaded documents and profile pictures live in access-controlled storage, scoped to your own account folder. Case documents are never public — every download goes through a short-lived signed URL generated on demand.
Payments
Billing runs through Razorpay. Litigo's servers never see or store your card details, and every billing webhook is verified with a signed HMAC check — using a timing-safe comparison — before anything is trusted.
Infrastructure
Hosted on Vercel with Supabase as the database and storage layer, and error monitoring configured to scrub sensitive fields before anything is logged.
Found a security issue? We'd genuinely like to know — get in touch.
Back to home