Security

Infrastructure Security

LawForge is built on Cloudflare's global network, providing enterprise-grade security infrastructure without the enterprise price tag.

Network Security

• DDoS Protection: Automatic mitigation of volumetric, protocol, and application-layer attacks via Cloudflare
• Web Application Firewall (WAF): Protection against OWASP Top 10 vulnerabilities including SQL injection and XSS
• Bot Management: Automated detection and blocking of malicious bot traffic
• Rate Limiting: Protection against abuse and brute-force attacks

Data Centers

Our infrastructure runs on Cloudflare Workers, distributed across 300+ data centers worldwide. Cloudflare maintains SOC 2 Type II, ISO 27001, and PCI DSS certifications for their infrastructure.

Data Protection

Encryption

Access Controls

• Authentication: OAuth 2.0 with PKCE flow - we never store your password
• API Tokens: Cryptographically secure, rotatable API tokens for programmatic access
• Session Management: Signed JWT tokens with configurable expiry
• Principle of Least Privilege: Internal access restricted to necessary personnel only

Application Security

Secure Development

• Security Headers: Strict Content Security Policy, HSTS, X-Frame-Options, and other protective headers
• Input Validation: All user inputs validated and sanitized
• Dependency Scanning: Automated vulnerability scanning of dependencies
• Code Review: All code changes reviewed before deployment

Security Headers

Vulnerability Disclosure

We appreciate the security research community and welcome responsible disclosure of security vulnerabilities.

Reporting a Vulnerability

Our Commitment

• We will acknowledge receipt within 48 hours
• We will provide an initial assessment within 5 business days
• We will keep you informed of our progress
• We will not take legal action against good-faith security researchers

Scope

The following are in scope for security research:

• lawforge.io and subdomains
• api.lawforge.io
• mcp.lawforge.io

Incident Response

We maintain an incident response plan to quickly address any security events.

Response Timeline

Communication

In the event of a security incident affecting your data, we will notify you via the email address associated with your account and provide:

• Description of the incident and data affected
• Steps we are taking to address the incident
• Recommended actions you should take
• Contact information for questions

Regulatory Notification

We comply with applicable breach notification requirements, including:

• GDPR Article 33: Notification to supervisory authorities within 72 hours where required
• State Laws: Notification to affected individuals and state attorneys general as required by applicable state breach notification laws (all 50 states have enacted such laws)
• CCPA (Cal. Civ. Code § 1798.150): Compliance with California's enhanced requirements for security breaches affecting California residents

Subprocessors

We use the following third-party service providers to deliver our Service. Each has been evaluated for security and compliance:

To receive notifications of changes to our subprocessors, contact privacy@lawforge.io

Questions

For security-related inquiries, please contact: