Personal-injury firms hold two of the most sensitive kinds of data there are, privileged client files and medical records. Highbar is built around that from day one. We list our actual controls below, in plain terms, and we don't claim certifications we don't hold.
TLS everywhere; production runs on an encrypted, BAA-covered AWS RDS (Postgres) host. Passwords are bcrypt-hashed.
Server-side sessions with httpOnly cookies; every route and mutation is validated against a live session, not just cookie presence.
Every user must set up an authenticator-app code before they can open a single case. Not optional, not a setting an admin can turn off.
Firms can sign in with their Microsoft 365 work accounts. Matched by Microsoft's permanent account ID, never by email, and Highbar's own 2-step code is still required.
Six roles (Attorney, Admin, Case Manager, Paralegal, Legal Assistant, Intake), enforced server-side on every sensitive action: settlement figures, deletions, demand approval, citation sign-off.
Every firm's data is walled off. Access is scoped to your firm on every query, so one firm can never see another's cases, clients, or files.
Who did what, when, written on every change, never edited or deleted. The evidentiary-integrity record firms expect.
AI runs on Claude through a BAA-covered, zero-retention endpoint (Amazon Bedrock, under our AWS BAA). Case data is processed in transit, not stored by the model or used for training.
If our team ever has to touch your firm's account (say, to unlock a user), it is written into your firm's own audit trail with the reason. You can see it.
Account and infrastructure activity is logged continuously with AWS CloudTrail (multi-region, encrypted) and streamed to AWS CloudWatch. Administrative access to production infrastructure requires multi-factor authentication.
Starting January 1, 2027, California attorneys who use generative AI must protect client confidences, verify what the AI produces, including every citation, and keep the legal judgment their own (Business and Professions Code §6068.1; Code of Civil Procedure §128.7). These are the attorney's duties, and no software can carry them for you. Highbar is built so you can meet each one and show that you did.
Enforced server-side on every action.
| Capability | Attorney | Admin | Case Manager | Paralegal | Legal Assistant | Intake |
|---|---|---|---|---|---|---|
| Create / intake cases | ||||||
| Edit case details | ||||||
| Change case status | ||||||
| Delete records (claims, providers) | ||||||
| Edit settlement figures | ||||||
| Manage AI playbooks | ||||||
| Review & approve AI drafts | ||||||
| Verify legal citations (licensed attorneys only) | If an attorney | |||||
| Approve demand letters & AI drafts (licensed attorneys only) | If an attorney | |||||
| Assign tasks to other team members | ||||||
| View audit log | ||||||
| View team performance (owner/admin only) |
Questions or want a security review? We're glad to walk through any control in detail. This page reflects our current production controls, and we don't claim certifications we don't hold.