Security by Architecture,
Not Afterthought
Zero trust. Tenant isolation at every layer. 21 automated regression tests. 8 confidentiality classes. Immutable hash-chained audit trail.
Built for FedRAMP-aligned ATO evaluation.
Security regression tests
Confidentiality classes
Audit action types
Security test categories
Tenant Isolation
Every query, every document retrieval, every search operation is scoped to the authenticated tenant. There is no system-level query that can bypass tenant boundaries.
Identity & Access Control
Four-layer authorization model: gateway identity check, service-level policy enforcement, document confidentiality verification, and UI action visibility — with the server always authoritative.
Data Protection
PII is systematically excluded from logs, metrics, and Temporal search workflow attributes. The PiiScrubber class removes SSN patterns and email addresses from all observable outputs.
Document Security
Document confidentiality is enforced at storage, search, API, and UI layers. A sealed document cannot be found in search, retrieved via API, or rendered in the UI without the appropriate role grant.
Audit Trail
Every write operation across the entire platform produces an immutable audit event with the configuration snapshot that governed the decision. Tampering is detectable through hash chain verification.
Operational Security
AI-assisted operations through the Model Context Protocol are governed by the same security model as human operations — with additional approval gates for any mutation.
8 Document Confidentiality Classes
Every document in the system is assigned a confidentiality class that governs access at storage, search, API, and UI layers.
Available to all authenticated users and PACER public access. Default classification for most filings.
Entire case sealed by court order. Requires SEALED_VIEWER role. Invisible in public search and PACER.
Individual document sealed within a public case. Docket entry visible; document content restricted to SEALED_VIEWER.
Document restricted to case participants only. Excluded from public PACER access and general search results.
Visible only to the filing party and the judge. Opposing counsel has no access until the court lifts the restriction.
Judicial eyes only. Submitted for private review by the judge — not accessible to any party or clerk without explicit grant.
Classified Information Procedures Act material. Requires security clearance verification and SCIF-level access controls.
Protected under Federal Rule of Criminal Procedure 6(e). Disclosure prohibited except by court order. Separate audit chain.
10 Automated Security Test Categories
Every build executes the full security regression suite. A single failure blocks deployment.
Cross-tenant case access denial
Tenant A cannot read, update, or list cases belonging to Tenant B — verified across all API endpoints.
Cross-court case access denial
Users with court-scope claims for Court X cannot access cases filed in Court Y within the same tenant.
Sealed document access enforcement
Documents classified SEALED_CASE or SEALED_DOCUMENT are invisible in search, API, and UI without SEALED_VIEWER role.
Restricted document access enforcement
EX_PARTE and IN_CAMERA documents enforce party-specific and judge-only access rules respectively.
Missing package snapshot rejection
Operations that reference a configuration snapshot that does not exist are rejected — fail-closed, not fail-open.
Wrong package snapshot rejection
Hash mismatch, wrong tenant, or revoked snapshot all produce immediate rejection with specific error codes.
Authorization denial audit logging
Every denied access attempt produces an audit event with the requesting principal, target resource, and denial reason.
PII scrubbing verification
SSN patterns (XXX-XX-XXXX) and email addresses are verified absent from all log outputs and search attributes.
Idempotency replay attack detection
Duplicate submission with the same idempotency key returns the original result without re-executing the operation.
Break-glass access audit distinction
Break-glass access produces a distinct audit event type, separate from standard access, enabling compliance review.
Ready for a security deep-dive?
Walk through our security architecture with your CISO or ATO evaluation team. We'll cover tenant isolation, audit trails, and FedRAMP-aligned controls in detail.