Security and privacy
Your matters, protected the way professional secrecy demands
This is what we do to protect the data of law firms and their clients. The privacy policy has the details.
Where your data lives
- The app, the database and the documents run on our own servers in the European Union.
- Lawyer recommendations are computed on those same servers: the text of your case isn't sent to third-party AI services.
- Email notices about messages and proposals don't include their content, only a link that asks you to sign in.
- Encrypted backups, kept off the main server and checked with restore drills.
Encryption
- Every connection is encrypted with HTTPS.
- Documents are stored encrypted on the server (encryption at rest).
- Passwords are stored as an irreversible hash: nobody can read them, us included.
- Documents are downloaded through signed links that expire after 5 minutes.
Access to your account
- Two-factor sign-in: authenticator app, emailed code and backup codes.
- Passkeys: sign in with your device's fingerprint, face or PIN, no password needed.
- Creating an account requires a verified email, and sessions expire after 7 days of inactivity.
- Attempt limits on sign-in and on sensitive actions slow down automated attacks.
Confidential matters
- Each matter has its team (lead, collaborators, paralegals) and its client. Only they can see it.
- The firm's internal notes and documents never reach the client: the firm decides what to share.
- Before you hire, lawyers see your identity anonymised.
- A negotiation is visible only to its two parties, not even to Slawly's administrators.
- Every document opening is logged.
Verified lawyers
- We check every lawyer's bar registration number by hand before listing or recommending them.
- If a lawyer stops being verified, they disappear from the directory and from recommendations.
Your rights (GDPR)
- Download all your data from Settings › Account.
- Delete your account whenever you like: it's erased 30 days after you confirm, and you can cancel until then.
- We keep a record of which version of the legal texts you accepted and when.
- Cookieless analytics on public pages only: nothing you do inside your account is measured.