Every table — cases, hearings, tasks, notes, research, documents — enforces row-level security at the database level, not just in the app. An advocate can only ever read or write their own records; there is no code path that bypasses this.
Sign in with email and password, or Google. Passwords are never stored by Litigo directly — authentication is handled by Supabase Auth.
Uploaded case documents live in a private storage bucket, not a public one. Every file is only ever accessed through a short-lived signed link generated at the moment you open it — there is no permanent public URL for any document you upload.
Every connection to Litigo, in the browser and to the database, is encrypted over HTTPS.
If you find a security issue, please email hello@mylitigo.com.