Security

How we protect your client data

Ready file path

What happens to a file depends on where you use Ready

Public checker

A redacted PDF is read on your device. It is not uploaded, and its name, contents, and extracted text are not included in analytics.

Public voicemail

The recording is held in backend memory and sent inline to Google's paid Gemini API for the requested transcription and intake extraction. DocketBuddy does not save the recording or transcript. Google may retain the input and output for up to 55 days for abuse monitoring.

Signed-in case

The file goes to private storage, then to Google's paid Gemini API only for the document work you requested. Important results link back to the source page for review.

PHI

Before Ready issues a signed upload URL, the uploader must confirm that the files do not contain protected health information. DocketBuddy does not currently offer a BAA or claim a HIPAA-compliant environment.

Account deletion

Permanent account deletion removes stored files and account-linked data within eight days, except for a minimal record DocketBuddy must retain by law. Read the retention policy.

Preflight file path

What happens during a private file check

Upload

The authenticated workspace creates an expiring signed URL in the firm's private Supabase storage path. The backend verifies the object size, file signature, and SHA-256 digest before processing.

Processing

DocketBuddy sends the authorized file to Anthropic’s commercial Messages API for classification, structured extraction, and observable file-quality review. Anthropic states that standard API inputs and outputs are deleted within 30 days, subject to its published exceptions, and are not used for model training by default.

Retention

DocketBuddy keeps the original file, extracted review fields, findings, and attorney decisions in the firm workspace until the Preflight is deleted. Deletion removes stored objects before removing their database records.

PHI

Every run requires an affirmative no-PHI attestation. DocketBuddy does not currently offer a BAA or claim a HIPAA-compliant environment.

Anthropic retention terms Anthropic training terms

Retention record

What DocketBuddy keeps and what a provider may keep

Deleting a DocketBuddy record does not shorten a separate provider window. The table keeps those two responsibilities distinct.

Browser workpapers and the public Ready file checker

DocketBuddy: Entered facts and checked files stay in page memory. They are not uploaded or included in analytics.
Provider: No content processor receives the entered facts or checked file.
Deletion: Resetting or closing the page clears that page state. A Preflight destination and completeness score, not the entered facts, may remain in same-tab session storage until used or the tab session ends.

Public Ready voicemail

DocketBuddy: The backend holds the recording in memory for the request and does not save the recording or transcript.
Provider: Google may retain the prompt, context, and output for up to 55 days for abuse monitoring under its paid Gemini API terms.
Deletion: DocketBuddy has no stored copy after the request. Google controls its published abuse-monitoring window.

Signed-in Ready, Preflight, and matter files

DocketBuddy: Original files and saved workspace results remain while the account is open unless the user deletes the file, Preflight, or matter sooner.
Provider: A selected AI feature can create a separate provider-controlled copy for the limited windows described below.
Deletion: Item deletion removes the governed stored object and its linked record. Account deletion removes account-linked files and records within eight days of the request, subject to the limited exceptions below.

Anthropic API inputs and outputs

DocketBuddy: A saved result remains with the workspace record until that record or the account is deleted.
Provider: Anthropic documents deletion within 30 days for standard API inputs and outputs, with published exceptions for safety enforcement, legal obligations, feedback, and separately controlled services.
Deletion: Deleting the DocketBuddy record removes DocketBuddy's copy. Anthropic controls its published provider-retention window.

Google Gemini API prompts, context, files, and outputs

DocketBuddy: Signed-in feature results can remain with the workspace record. DocketBuddy deletes its temporary Gemini Files API upload after processing.
Provider: Google documents up to 55 days for prompt, context, and output abuse-monitoring logs for the paid Gemini API. Other selected Gemini features can have separate published storage behavior.
Deletion: Deleting the DocketBuddy record removes DocketBuddy's saved copy. Google controls its published provider-retention window.

Firm knowledge-base text and Voyage embeddings

DocketBuddy: Knowledge-base records and embeddings are stored in the firm workspace. Search questions, generated answers and citation previews are also saved separately as search history.
Provider: We have not confirmed the production Voyage organization’s training-data opt-out setting. We cannot currently promise zero retention or training exclusion for knowledge-base documents and search text. Do not add confidential material to this feature until that setting is confirmed.
Deletion: Item deletion requests removal of the stored file and embeddings. Saved search history is separate and is not removed by deleting an item. Contact support for help with failed removal or search-history deletion.

Operational, analytics, and error logs

DocketBuddy: Operational records may include account identifiers, request metadata, filenames and diagnostic details used for security, reliability and support.
Provider: Hosting, monitoring and analytics providers retain operational records separately from workspace files. We have not confirmed a retention period for every production provider.
Deletion: We cannot currently promise one deletion deadline for these records. Contact support for the status of a specific deletion request.

Billing and connected-service records

DocketBuddy: DocketBuddy keeps account-linked billing status, integration tokens, and transaction references while needed to operate the account.
Provider: Payment and integration providers retain their records under their own terms and legal obligations.
Deletion: Account deletion removes DocketBuddy connection tokens and reusable payment methods. Providers may retain transaction or compliance records they are legally required to keep.

Account deletion receipt and documented exceptions

DocketBuddy: The account is disabled when deletion is requested. Permanent deletion runs after the seven-day cancellation period and completes within eight days. A de-identified deletion receipt and a minimal documented legal, fraud, security, or dispute record may remain only while needed.
Provider: A provider may retain a corresponding minimal record when its terms or legal obligations require it.
Deletion: Retained exceptions are isolated from product use, minimized, and removed when the documented need ends.

What this means in plain English

Encrypted in transit and at rest

Your data is protected while it moves and while it is stored. Browser and external service traffic use TLS; the database storage layer uses AES-256.

Firm data isolated

Your clients are yours. No attorney can access another firm's records, enforced at the application and database layer.

Never sold or licensed

DocketBuddy does not sell or license your data for advertising. Review the provider-specific terms and the unresolved knowledge-base limitation below.

Administrative automation stays within firm controls

Ready may send client-fixable requests and reminders using the channels, templates, schedules, and touch limits your firm approves. Legal advice, work product, filings, and judgment calls wait for attorney review.

Anthropic and Google training terms

Client data sent through DocketBuddy's commercial Anthropic API and paid Google Gemini API is not used to train either provider's general AI models.

Technical details

Encrypted in transit

Public and signed-in browser traffic, backend service calls, and database connections use TLS.

Browser → FrontendVercel enforces HTTPS (TLS 1.2+) on all requests to docketbuddy.org. HTTP is automatically redirected to HTTPS.

Browser → Backend APIRailway provides TLS termination for the API server. All external API calls use HTTPS. Unencrypted traffic is handled at the Railway infrastructure layer before reaching the application.

Backend → DatabaseSupabase connections use TLS by default. The PostgREST API layer and direct PostgreSQL connections both require SSL. No plaintext database connections are permitted.

Backend → AI providersCalls to the Anthropic API and Google Gemini API use HTTPS through their official server SDKs.

Document routingUploads go from the browser directly to private Supabase Storage through a signed upload URL. Ready then retrieves a file through the backend for the requested classification, information extraction, and observable quality checks. Ready files of 14 MB or less are sent inline to the paid Gemini API. Larger supported files are uploaded temporarily through the Gemini Files API, reused for the checks, and deleted after processing. A public voicemail is handled separately: the backend holds the recording in memory, sends it inline for transcription and intake extraction, and does not save the recording or transcript. Downloads are served as time-limited signed URLs. A second exception is the PAF bundle for H-1B clients: the backend retrieves the component files, assembles the ZIP in memory, and streams it to the browser without writing the assembled ZIP to disk.

Encrypted at rest

Client data in the database is encrypted at the storage layer. Sensitive credentials stored in the database get an additional application-level encryption pass.

DatabaseSupabase (PostgreSQL hosted on AWS, us-west-1. Northern California) encrypts all data at rest with AES-256. This is a platform-level guarantee enforced by the storage layer, not configurable or bypassable by the application.

SMTP credentialsAttorneys who configure white-label email have their SMTP passwords encrypted with authenticated AES-256-GCM before storage. The encryption key is a 32-byte server-side secret (SMTP_ENCRYPTION_KEY) that is not stored in the database. New ciphertext uses the versioned gcm:iv:ciphertext:tag format in hex. Raw SMTP passwords are never stored. Legacy AES-256-CBC records remain readable only so they can be migrated safely.

OAuth tokensGoogle Calendar refresh tokens and EOIR login credentials use the same authenticated AES-256-GCM encryption for new writes. Legacy AES-256-CBC values remain read-compatible during migration.

AI data handling depends on the provider

Anthropic commercial API and paid Google Gemini terms exclude general model training. Voyage’s production setting remains unconfirmed; the knowledge-base limitation is described below.

How AI is usedDocketBuddy uses Anthropic's Claude API for selected analysis and drafting features. Ready uses Google's paid Gemini API for document classification, information extraction, observable file-quality checks, and the public voicemail-to-intake transcription. Data is sent only when the requested feature needs it.

Anthropic's policyAnthropic's current commercial privacy guidance states that inputs and outputs from the Anthropic API are not used to train its models by default. Explicit feedback or another affirmative opt-in can be handled differently. Anthropic commercial privacy guidance

What this relies onThis no-training claim is backed by Anthropic's commercial API terms, not by code enforcement within DocketBuddy. DocketBuddy uses the standard Anthropic commercial API, for which Anthropic currently documents up to 30 days of API input and output retention. DocketBuddy does not describe that arrangement as zero retention.

Google's paid API termsReady is configured to refuse Gemini document processing unless the Google project has active paid-service terms. Google states that paid Gemini API prompts, files, and responses are not used to improve its products. Google may retain prompts, context, and outputs for up to 55 days for abuse monitoring; DocketBuddy does not claim zero data retention. Large temporary Files API uploads are deleted by DocketBuddy after processing. Google Gemini API terms and abuse-monitoring details

Voyage AI (embeddings)Voyage AI receives only documents a firm explicitly adds to the firm knowledge base, plus query strings entered into that feature. DocketBuddy does not automatically send structured client records, intake answers, or ordinary client-file uploads to Voyage. Documents added to the knowledge base are chunked and sent to voyage-law-2 to generate embeddings for similarity search. We have not confirmed the production organization’s training-data opt-out setting. We cannot currently promise zero retention or training exclusion for this feature. Do not add confidential knowledge-base documents or search text until that setting is confirmed. Saved questions, answers and citation previews are separate from the uploaded item and remain in search history when an item is deleted.

DocketBuddy does not sell client data for advertising

Each attorney's clients are isolated. DocketBuddy does not sell or license client data for advertising. Named providers process content to deliver features; the knowledge-base limitation above remains unresolved.

Application-layer isolationTenant-aware client and matter routes authenticate the request with a Supabase JWT and pass the verified attorney ID into enforced-scope wrapper functions. clientSbGet, clientSbPatch, and clientSbDelete inject attorney_id = [your ID] into governed client-data queries and throw when the attorney ID is absent. A pre-commit guard identifies raw client-data queries that lack the wrapper or an explicit system-context annotation. Cross-tenant regression tests cover reads and mutations for clients, invoices, documents, notes, and messages.

Database-layer isolationThe governed client-data tables covered by DocketBuddy's RLS audit use Supabase Row Level Security policies tied to the signed-in user or firm boundary. The backend uses a service-role credential, which bypasses RLS, so RLS does not filter the application's own queries. The application-layer predicate above is the primary isolation control for those backend routes. RLS provides a separate boundary for direct requests made with a standard user JWT.

Providers and user-directed sources

Required providers operate the service. Feature providers receive data only when the user runs or connects that feature. Public analytics are limited to public surfaces. Government and court systems receive identifiers only for a lookup or connection the user requests; they are sources, not DocketBuddy subprocessors.

Supabase

Required service provider

Authentication, database, and private file storage

Account, firm, client, matter, and stored-file data needed to operate the workspace

Railway

Required service provider

Backend application hosting and delivery

Requests sent to the backend, response metadata, and operational logs

Vercel

Required service provider

Website hosting and delivery

Web requests, delivery metadata, and operational logs

Anthropic

Selected feature or integration

Selected AI-assisted analysis, drafting, and Preflight extraction

The prompts, client or matter context, and authorized document text needed for the feature the user runs

Google Gemini API

Selected feature or integration

Ready document and public voicemail processing

Authorized Ready files or public voicemail audio and the instructions needed for the requested classification, extraction, transcription, or file-quality work

Resend

Required service provider

Transactional email and account notices

Recipient addresses, names, delivery metadata, and email content

Stripe

Required service provider

Subscription and invoice processing

Account billing details, payment status, and transaction records; DocketBuddy does not store full payment-card numbers

Sentry

Required service provider

Error detection, security diagnostics, and reliability monitoring

Error and performance reports. The main application removes request bodies, cookies and authorization headers; worker diagnostics may still contain filenames, storage paths and account identifiers.

Voyage AI

Selected feature or integration

Search within material a firm deliberately adds to its knowledge base

Knowledge-base text and the search terms entered in that feature; structured client records and ordinary client-file uploads are not added automatically

Twilio and Telnyx

Selected feature or integration

Text messaging when a firm enables that channel

Sender and recipient phone numbers, message content, and delivery metadata

LawPay/AffiniPay

Selected feature or integration

Firm-enabled client payment processing

Payer, invoice, payment, and transaction details needed for the payment the user authorizes

DocuSign

Selected feature or integration

Electronic signatures when a firm connects the integration

Documents sent for signing, signer name and email address, and envelope status

Google Calendar, Clio, and QuickBooks

Selected feature or integration

Calendar, practice-management, and accounting functions a user chooses to connect

Connection tokens and the specific calendar, matter, contact, invoice, or accounting data needed for the authorized action

Microsoft Clarity and Vercel Analytics

Public-site analytics

Limited usage and performance analytics on public marketing pages and the no-signup demo

Public-page interaction, referral, device, and performance data; signed-in attorney workspaces are excluded from Clarity session replay

USCIS and EOIR

User-directed source

Official immigration case-status and agency information requested by a user

The receipt number, case identifier, or credentials needed for the lookup or monitoring the user requests

CourtListener/RECAP and PACER-related services

User-directed source

Court and docket information requested through bankruptcy and litigation features

The docket number, court identifier, search terms, or connected-service credentials needed for the requested court-data action

Provider	Relationship	Purpose	Data received
Supabase	Required service provider	Authentication, database, and private file storage	Account, firm, client, matter, and stored-file data needed to operate the workspace
Railway	Required service provider	Backend application hosting and delivery	Requests sent to the backend, response metadata, and operational logs
Vercel	Required service provider	Website hosting and delivery	Web requests, delivery metadata, and operational logs
Anthropic	Selected feature or integration	Selected AI-assisted analysis, drafting, and Preflight extraction	The prompts, client or matter context, and authorized document text needed for the feature the user runs
Google Gemini API	Selected feature or integration	Ready document and public voicemail processing	Authorized Ready files or public voicemail audio and the instructions needed for the requested classification, extraction, transcription, or file-quality work
Resend	Required service provider	Transactional email and account notices	Recipient addresses, names, delivery metadata, and email content
Stripe	Required service provider	Subscription and invoice processing	Account billing details, payment status, and transaction records; DocketBuddy does not store full payment-card numbers
Sentry	Required service provider	Error detection, security diagnostics, and reliability monitoring	Error and performance reports. The main application removes request bodies, cookies and authorization headers; worker diagnostics may still contain filenames, storage paths and account identifiers.
Voyage AI	Selected feature or integration	Search within material a firm deliberately adds to its knowledge base	Knowledge-base text and the search terms entered in that feature; structured client records and ordinary client-file uploads are not added automatically
Twilio and Telnyx	Selected feature or integration	Text messaging when a firm enables that channel	Sender and recipient phone numbers, message content, and delivery metadata
LawPay/AffiniPay	Selected feature or integration	Firm-enabled client payment processing	Payer, invoice, payment, and transaction details needed for the payment the user authorizes
DocuSign	Selected feature or integration	Electronic signatures when a firm connects the integration	Documents sent for signing, signer name and email address, and envelope status
Google Calendar, Clio, and QuickBooks	Selected feature or integration	Calendar, practice-management, and accounting functions a user chooses to connect	Connection tokens and the specific calendar, matter, contact, invoice, or accounting data needed for the authorized action
Microsoft Clarity and Vercel Analytics	Public-site analytics	Limited usage and performance analytics on public marketing pages and the no-signup demo	Public-page interaction, referral, device, and performance data; signed-in attorney workspaces are excluded from Clarity session replay
USCIS and EOIR	User-directed source	Official immigration case-status and agency information requested by a user	The receipt number, case identifier, or credentials needed for the lookup or monitoring the user requests
CourtListener/RECAP and PACER-related services	User-directed source	Court and docket information requested through bankruptcy and litigation features	The docket number, court identifier, search terms, or connected-service credentials needed for the requested court-data action

Real-client actions require a recorded attorney boundary

You can explore DocketBuddy before attesting. Real-client sending and Site publication remain blocked until attorney status and current policy acceptance are recorded.

Recorded consentAcceptance is affirmative, versioned, and attached to the attorney account rather than inferred from product use.

Server enforcementThe backend rejects a real-client Ready send or DocketBuddy Site publication when the current attorney and policy record is missing. Sample mode does not send client communications.

Evaluating DocketBuddy for live client data

Ask for our current data-processing terms, subprocessor details, security questionnaire responses, and recommended pilot controls. We will state what is available today and where a firm requirement is not yet met.

DocketBuddy does not currently claim HIPAA compliance or offer a BAA. If your firm requires a BAA, do not upload protected health information until a supported agreement and environment are in place.

Request the security packet

Responsible disclosure

If you discover a security vulnerability, please report it privately before public disclosure. We will acknowledge receipt within one business day and work to resolve confirmed issues promptly.

Email: hello@docketbuddy.org

A machine-readable security.txt is available per RFC 9116.

SOC 2 note: DocketBuddy is not SOC 2 certified today. The infrastructure providers we use, including Supabase, Railway, Anthropic, and Google Cloud, maintain their own security programs and publish supporting security information. We describe our infrastructure as "security-reviewed" rather than certified. If SOC 2 or equivalent certification is a requirement for your firm, please contact us to discuss.

Questions about security practices or data handling? hello@docketbuddy.org

Last reviewed August 2026. This page describes the technical architecture at time of review.