Is Law Hired safe for client data?
Yes, with one gap you should know about. Law Hired keeps each firm’s records apart in the database itself (row-level security on every table, so one firm’s query cannot return another firm’s rows), encrypts data in transit and at rest, supports multi-factor sign-in and SAML single sign-on, and sends client text only to AI providers whose commercial API terms forbid training on it. The gap: Law Hired is not SOC 2 or ISO 27001 certified. Instead of a badge it publishes every control, marked in place, in progress or not started, so you can check each one before you rely on it.
11 of 19 security-programme controls are in place; 5 are in progress and 3 not started. Each is listed below with its evidence or what is missing.
Firm separation is enforced by Oracle Virtual Private Database: the database attaches the signed-in firm to every query, and a test fails if any table lacks a policy.
AI features read only what the firm allows: a matter or a single document can be closed to Claude, and firm knowledge is read only after the lawyer confirms which matters.
No independent attestation yet. Law Hired does not claim SOC 2, ISO 27001 or any certification of its own.
Every control, with its status
The security programme grouped by the SOC 2 Trust Services Criteria. “In place” lists the evidence a buyer can ask to see; anything else lists what is missing. This is a self-assessment, not an audit.
| Criterion | Control | Status | Evidence, or what is missing |
|---|---|---|---|
| Security | Tenant isolation in the database | In place | Row-level security on every table; a test fails if a table lacks a policy. |
| Security | Multi-factor sign-in and firm-wide MFA policy | In place | TOTP enrolment, step-up on trust payments, firm "require MFA" setting. |
| Security | Single sign-on for firms | In place | SAML sign-in with a pilot runbook. |
| Security | Independent penetration test | Not started | Missing: Engage a third party; publish the summary. |
| Security | Documented security policies approved by management | In progress | Missing: Access, change, incident and vendor policies written and signed. |
| Availability | Health probes with automatic restart | In place | Public status page and container health checks. |
| Availability | Incident record | In place | Every outage listed with cause and change on the status page. |
| Availability | Tested backup restore | Not started | Missing: Restore a backup end to end, time it, and publish the recovery time. |
| Availability | Separate development and production databases | In progress | The development server uses its own database. Missing: Point every script and tool at it by default, separate file storage, and stop copying client records into development. |
| Availability | Redundant production hosting | Not started | Missing: Move from a single free-tier host to paid, redundant hosting. |
| Confidentiality | Encryption in transit and at rest | In place | TLS everywhere; storage encryption provided by the database and object store. |
| Confidentiality | Controls over what AI may read | In place | Per-matter and per-document switches, firm default, firm-only knowledge with confirmation. |
| Confidentiality | Record of who and what read each matter | In place | Each time a person opens a matter or a document it is recorded (who, when, which record) on the firm Audit Logs page, with CSV and PDF export; repeat opens inside ten minutes are one entry. |
| Processing integrity | Verified-by and date on legal rules and figures | In progress | Reference data and deadline rules carry the verifying attorney and date. Missing: Show it on every rule, figure and template; publish the coverage matrix. |
| Processing integrity | Change control | In place | Every change passes lint and tests before commit; migrations are additive, idempotent and recorded. |
| Processing integrity | Figures calculated and recorded | In place | Each calculation stores the inputs and the reference version it used. |
| Privacy | Data processing agreement | In place | Published at /dpa. |
| Privacy | Subprocessor list | In progress | Hosting, sign-in, payments and AI providers are named on the security page. Missing: Name every provider with what it receives and where it processes it. |
| Privacy | Export and deletion on request | In progress | Missing: Self-service full export of matters, documents and ledgers. |
Where client text goes when you use the AI features
Only these providers receive client text, and only what the lawyer chose or the matter allows. A firm can use its own key instead, so the provider contract is the firm’s own.
| Provider | Used for | What is sent | Training on your data | Retention by the provider |
|---|---|---|---|---|
| Anthropic (Claude) | Drafting, summaries, research help, document review and the Claude assistant. | The question, plus the matter text and documents the lawyer chose or that the matter allows Claude to read. | Not used to train models: commercial API terms. | We are confirming the exact retention term in our agreement with this provider. Ask legal@lawhired.com for it in writing before you rely on it. |
| OpenAI | Optional model choice, document embeddings for search, and audio transcription. | The question and the text the lawyer chose; document passages for search embeddings; audio for dictation. | Not used to train models: commercial API terms. | We are confirming the exact retention term in our agreement with this provider. Ask legal@lawhired.com for it in writing before you rely on it. |
| Groq | The included default model tier and fast transcription. | The question and the text the lawyer chose; audio for dictation. | Not used to train models: commercial API terms. | We are confirming the exact retention term in our agreement with this provider. Ask legal@lawhired.com for it in writing before you rely on it. |
What the firm controls
Settings a firm uses to decide what the AI features may read.
| Control | What it does |
|---|---|
| Keep Claude away from a matter | The responsible lawyer can switch a matter off. Nothing in that matter is read by the Claude features, even for people who can open it. |
| Keep Claude away from one document | Each document has its own switch, for the one document in a permitted matter that must not be read. |
| A firm default | An administrator sets whether matters nobody has decided about are open to Claude or closed. |
| Never another firm's data | Every search and every read is limited to the signed-in person's own firm and to matters they could open themselves, ethical walls included. |
| Firm knowledge asks first | To draw on the firm's other matters, the lawyer is shown exactly which matters and documents would be read, can untick any, and only what stays ticked is read. A matter for a different client is labelled. |
| Use your own key | A firm can supply its own provider key, so the provider contract is the firm's own. |
Law Hired and Clio on data safety
Clio’s column is what Clio states on its pricing page, read on 2026-10-25. “Not stated” means that page does not say, not that Clio lacks it.
| Question | Law Hired | Clio (as Clio states it) |
|---|---|---|
| Independent security attestation | None yet. Not SOC 2 or ISO 27001 certified; the path to an audit is published on the SOC 2 roadmap. | SOC 2 Type II and GDPR are stated; encrypted backups and multi-factor authentication on every plan. |
| How one firm is kept from another | In the database: Oracle Virtual Private Database attaches the signed-in firm to every query, on every table. | Not stated on the pricing page. |
| Encryption | TLS for all traffic; storage encryption provided by the database and the object store. | Encrypted backups are stated. |
| Sign-in protection | Authenticator-app MFA, a firm-wide “require MFA” setting, a fresh MFA check before trust payments, and SAML single sign-on. SSO/SAML with SCIM provisioning is listed on the Scale plan. | Multi-factor authentication on every plan is stated. |
| AI training on client data | No. Providers are used under commercial API terms that forbid training; Law Hired does not train models on client content. | Clio states that firm data is not used to train AI models. |
| Keeping AI away from a matter or a document | Yes: per-matter and per-document switches and a firm default. | Not stated on the pricing page. |
| Record of who opened a matter | Yes: every open of a matter or document is recorded on the firm’s Audit Logs page, with CSV and PDF export. | Not stated on the pricing page. |
| Uptime commitment | No uptime percentage is promised. Every incident is listed with its cause on the public status page. | A 99.9% uptime guarantee is stated. |
| Backups | An end-to-end restore test has not been done yet; it is listed as not started. | Encrypted backups are stated. |
| Hosting redundancy | Production runs on a single host today; redundant hosting is listed as not started. | Not stated on the pricing page. |
| Getting your data out | Export and deletion on request to legal@lawhired.com; self-service full export is in progress. | Data can be exported while the account is active or within 90 days of cancellation. |
| Who else processes the data | Named on the security page, AI providers included; the current full list is available from legal@lawhired.com. | Not stated on the pricing page. |
What “safe” has to mean for a law firm
ABA Model Rule 1.6(c) asks a lawyer to make reasonable efforts to prevent unauthorized access to or disclosure of client information. For software that means three questions: can anyone outside the firm reach the data, does any third party receive it and on what terms, and can the firm show what happened to it. The tables above answer each one for Law Hired.
Separation in the database, not only in the code
Most practice software keeps firms apart with checks in application code. Law Hired adds a second wall underneath: the production database itself filters every query by the signed-in person’s firm (Oracle Virtual Private Database). A bug in a screen cannot return another firm’s rows, because the database never hands them over. A test fails the build if a table is added without a policy.
AI without giving the data away
ABA Formal Opinion 512 asks lawyers using generative AI to understand where client information goes and whether the tool learns from it. On Law Hired the answer is per provider in the table above: named providers, commercial terms that forbid training, the firm’s own key as an option, and switches that keep the AI out of a matter or a single document.
What Law Hired itself keeps
An append-only AI audit log: the prompt, the answer, the matter, who asked and whether a lawyer reviewed it. Only the person who asked and the firm's administrators can read it, and rows are never deleted. The usual application records (matters, documents, billing). They live in the firm's own tenant of the database and are separated from other firms by the database itself, not only by application code.
What is not done yet
No SOC 2 or ISO 27001 report, no independent penetration test, no tested end-to-end backup restore, and a single production host. Each is listed above as in progress or not started, with what closes it. Ask legal@lawhired.com for the evidence behind any control marked in place.
Questions people also ask
Is Law Hired SOC 2 certified?
No. Law Hired has no SOC 2 or ISO 27001 report and does not claim one. Its controls and the remaining gaps are published on the SOC 2 roadmap, with the steps to a Type I and then a Type II audit.
Does Law Hired use client data to train AI?
No. The AI providers it uses (Anthropic, OpenAI and Groq) are called under commercial API terms that forbid training on the inputs, and Law Hired does not train models on confidential case content or attorney-client communications.
Can another firm on Law Hired see my matters?
No. Every table carries a database policy that limits rows to the signed-in person’s own firm, and inside the firm to matters that person may open, ethical walls included.
Can Law Hired staff read my files?
Production access is limited to authorized personnel and logged. Support or security staff may need narrowly scoped access for an authorized support request, an incident, an abuse investigation or a legal obligation; Law Hired does not claim that access is technically impossible.
Where is the data stored?
Application data and files are hosted on Oracle Cloud Infrastructure in the United States. Sign-in is provided by Supabase and card payments by Stripe.
How long do the AI providers keep what is sent?
The exact retention term for each provider is being confirmed against the agreement and is shown on the page once confirmed. Until then, ask legal@lawhired.com for it in writing.
How do I get my data out if I leave?
Request an export and a deletion scope review from legal@lawhired.com. A self-service full export of matters, documents and ledgers is in progress.
What happens if there is a breach?
Law Hired investigates suspected incidents and gives the notices required by law and by any signed agreement without unreasonable delay.
How do I report a vulnerability?
Email security@lawhired.com. Reports are acknowledged within 48 hours, and good-faith researchers are not pursued legally.
Sources
ABA Model Rule 1.6: Confidentiality of information (read 2026-10-25)
ABA Formal Opinion 512: Generative artificial intelligence tools (PDF) (read 2026-10-25)
Clio pricing page (read 2026-10-25)