Separate firm databases
Each firm has its own application database. This is database separation, not a promise of a dedicated physical server.
SECURITY & DATA PROTECTION
Confidential work.
Considered protection.
Understand the controls behind your workspace and the responsibilities that go with them.
LAYERS OF CONTROL
Built around firm boundaries.
Role and matter permissions
Staff access is checked against firm membership, assigned roles and relevant matter permissions.
Controlled client access
Portal access is limited by the client’s grant and the information made available to them. Sharing supports expiry and withdrawal.
Document screening
The production document workflow uses ClamAV screening. Screening reduces risk but cannot guarantee that every threat will be detected.
Audit records
Recorded actions and changes support accountability and review within your firm.
Protected connections
The production web applications require HTTPS. Deployment configuration also requires encrypted SQL connections.
AI & INFORMATION HANDLING
Know where your content goes.
When external AI is enabled, content needed to fulfil the request is sent to the configured provider. This can include instructions, extracted document text and follow-up context.
Document access permissions also apply to AI workflows. Your firm should decide what content is appropriate to process and review provider terms before use.
Ask us about hosting location, provider arrangements, backup schedules, recovery procedures and retention before onboarding. Do not infer a certification, uptime guarantee or encryption-at-rest commitment from the controls described here.
Your team’s part
Use individual accounts, review permissions, keep recipient addresses accurate and remove access when people leave. Never send passwords, access codes or full confidential files in an initial support enquiry.
Report a security concern
Email info@plexlegal.com with a brief description. We will arrange a suitable way to receive sensitive details.