Security

Every organisation's data in Law OS is isolated from every other organisation's — no firm can see another firm's clients, cases, hearings, or documents.

• Passwords are hashed and never stored or logged in plain text.
• Login sessions use signed, HTTP-only cookies.
• Repeated failed logins are temporarily locked out.
• Password resets are delivered by a one-time code, never returned in an API response.

Law OS is in early access and has not yet completed a full, independent security review. See SECURITY.md in the project repository for the complete model and the pre-production checklist.