Security

Last updated September 20, 2026

A summary of how VakilFirm protects Firm and client data. This describes what the application actually does today, not a certification or compliance claim.

Access control

Every user has one of a fixed set of roles (Master Admin, Admin, Super User, Advocate, or Client), and every case, document, and record action is authorized against that role and the user's actual relationship to the case on the server, not just hidden in the interface. A client only ever sees the cases and documents a Firm has explicitly shared with them.

Passwords and sign-in

Passwords are stored only as a salted hash; VakilFirm never stores or logs a password in plain text. Sign-in and password recovery are protected by rate limiting, and password recovery uses a one-time code sent to a verified email or mobile number rather than a reusable link.

Documents

Case documents are stored in private cloud object storage that is never given a public URL. Every download is authorized on the server before the file is served, and the upload process is designed so a document only becomes part of a case record after it passes that authorization check.

Audit logging

Security-sensitive actions — sign-ins, role changes, document access and deletion, and administrative changes — are recorded in an audit log a Firm's administrators can review.

In transit

All traffic to VakilFirm is encrypted (HTTPS). Session cookies and cross-site request forgery protections follow the underlying framework's standard, actively maintained defaults.

Reporting a concern

If you believe you've found a security issue in VakilFirm, please email support@vakilfirm.com with details so we can investigate.