Security at BetterDocket

• Encryption. BetterDocket is served over HTTPS/TLS in production. Our hosted infrastructure providers state that they encrypt data stored on their platforms.
• Authenticated product access.Firm and client application access requires an authenticated account. API access tokens are verified before BetterDocket builds the user's firm or client context.
• Database-level authorization. Row-level security policies scope product reads and writes to the relevant firm, client, and Case relationships. Restricted Cases limit firm-side access to assigned Firm Members plus firm owners and admins. A separate invoicing capability exposes only the narrow financial records needed for Billing; it does not grant general Case access.
• Document storage. Case documents are stored in a private bucket and storage policies apply the same Case access checks used for application data. Invoice PDFs are stored in a separate private bucket and require authenticated Firm invoicing authority or immutable invoice-recipient membership to download. Firm logos are intentionally public so they can appear in client emails; they must be fetched using their exact object address.
• Server-side credentials. Privileged service credentials are kept on the API server rather than shipped to browsers or native applications. Automated services use them for limited operational functions such as invitations, subscriptions, webhooks, and scheduled jobs.
• Activity records. BetterDocket records activity events for many material product changes. These records support product history and accountability, but they are not a comprehensive log of every application or infrastructure action.
• Error monitoring. When the application fails, BetterDocket sends an error report to Sentry, a third-party monitoring service, so the failure can be diagnosed. A report carries the error message, the stack trace, and the page address with record identifiers replaced by a placeholder. Session replay is not enabled in Sentry, and request bodies, cookies, request headers, query strings, and the text of anything clicked or typed are removed before a report is sent. An error message produced by our own code may in principle quote a value it was processing, so this is a description of what BetterDocket does not intentionally send rather than a guarantee.
• AI provider processing.AI-assisted features send limited case information to OpenAI’s API. BetterDocket has executed OpenAI’s Data Processing Addendum and its OpenAI organization is enrolled in Zero Data Retention, under which OpenAI does not retain request or response content, including for abuse monitoring. BetterDocket also sets the no-retention flag on every individual call, so the protection does not rest on one organization-level setting. OpenAI states that it does not train on API data.

At present, one BetterDocket operator has direct privileged access to the production database. That access uses an individual account protected by multi-factor authentication and is available for operating, supporting, and securing the service.

This operator count does not include automated application services that use server-side credentials, or infrastructure-provider personnel who may access systems under their providers' controls. BetterDocket data is therefore not end-to-end encrypted from BetterDocket and its infrastructure providers.

BetterDocket uses Supabase for hosted database, authentication, and storage services, and Vercel for application hosting and delivery. Each provider publishes information about its own security controls and attestations:

• Supabase security information
• Vercel security and compliance measures

Provider certifications and attestations apply to those providers within their stated scope. They do not make BetterDocket itself certified or independently audited.

We want firms and clients to understand the limits of our current early-stage security posture:

• BetterDocket has not completed its own SOC 2 or ISO certification and does not yet maintain a formal, independently audited security program.
• BetterDocket has not completed an independent application penetration test.
• BetterDocket does not maintain a HIPAA compliance program or offer Business Associate Agreements, and should not be treated as a HIPAA-compliant service.
• Multi-factor authentication is not currently available for firm or client product accounts.
• BetterDocket data is not end-to-end encrypted. Authorized application services, the operator described above, and infrastructure providers can process data when necessary to provide the service.
• BetterDocket’s AI-assisted features send limited case information to OpenAI’s API to produce a suggestion. That content is processed by a third party, even though it is not retained — see “AI provider processing” above.
• Error reports are sent to and retained by a third-party monitoring service. BetterDocket removes request bodies, cookies, headers, query strings, and typed or clicked text from those reports, but an error message written by our own code could quote a value it was processing — see “Error monitoring” above.
• BetterDocket does not provide a contractual uptime commitment or guarantee uninterrupted availability or recovery.
• BetterDocket does not publish a fixed retention schedule covering every category of product data. Our general retention approach and request process are described in the privacy notice.

No internet transmission, storage system, or access control can guarantee complete security. These practices reduce risk; they do not eliminate it.

Firms are responsible for managing their Firm Members, removing access when it is no longer needed, assigning people to Cases, choosing when to mark a Case as restricted, protecting account credentials, and deciding whether BetterDocket's current posture is appropriate for the information they upload. Clients are responsible for protecting their own credentials and signed-in devices.

Contact us before using BetterDocket for information subject to special contractual, regulatory, residency, or security requirements.

Send security questions or reports of a suspected vulnerability to hello@betterdocket.com. Please do not include passwords or sensitive Case content in the initial email.

We may update this page as our product, providers, and practices change. The date above identifies the latest published version.