Personal-injury firms hold two of the most sensitive kinds of data there are, privileged client files and medical records. Highbar is built around that from day one. We list our actual controls below, in plain terms, and we don't claim certifications we don't hold.
TLS everywhere; production runs on an encrypted, BAA-covered AWS RDS (Postgres) host. Passwords are bcrypt-hashed.
Server-side sessions with httpOnly cookies; every route and mutation is validated against a live session, not just cookie presence.
Attorney / Paralegal / Intake / Admin roles, enforced server-side on every sensitive action (settlement figures, deletions, playbooks).
Every firm's data is walled off. Access is scoped to your firm on every query, so one firm can never see another's cases, clients, or files.
Who did what, when, written on every change, never edited or deleted. The evidentiary-integrity record firms expect.
AI runs on Claude through a BAA-covered, zero-retention endpoint (Amazon Bedrock, under our AWS BAA). Case data is processed in transit, not stored by the model or used for training.
Account and infrastructure activity is logged continuously with AWS CloudTrail (multi-region, encrypted) and streamed to AWS CloudWatch. Administrative access to production infrastructure requires multi-factor authentication.
Enforced server-side on every action.
| Capability | Attorney | Admin | Paralegal | Intake |
|---|---|---|---|---|
| Create / intake cases | ||||
| Edit case details | ||||
| Change case status | ||||
| Delete records (claims, providers) | ||||
| Edit settlement figures | ||||
| Manage AI playbooks | ||||
| Review & approve AI drafts | ||||
| Assign tasks to other team members | ||||
| View audit log | ||||
| View team performance (owner/admin only) |
Questions or want a security review? We're glad to walk through any control in detail. This page reflects our current production controls, and we don't claim certifications we don't hold.