Security and compliance
Built for medical records. Protected from day one.
Your firm keeps medical records, settlement numbers and privileged notes in PlaintiffStack. Here is how they're protected, where we stand on each framework, and who else handles them.
Compliance
Where we stand, framework by framework.
SOC 2 Type II
Type II means an independent auditor tests our security controls over months, not on one day. We build to them now, and until the report is out we'll walk your IT lead through how PlaintiffStack is built.
In progressISO/IEC 27001
The international standard for running information security as a program: risks assessed, controls in place, and the whole of it reviewed every year.
In progressCCPA and CPRA
California's privacy laws. We don't sell or share personal information, and anyone can ask to see, correct or delete what we hold about them.
In placePrivacy noticeHIPAA
HIPAA doesn't certify software, so be wary of anyone who says it does. We build to its Security Rule, and sign a business associate agreement with your firm before any client data arrives.
- A BAA signed before any client data arrives
- Case data, documents and AI models in one US AWS account
- Every request scoped to your firm by the database itself
BAA with every firmSRBusiness Associate AgreementSato & Rivera LLP and PlaintiffStackFor the firmFor PlaintiffStackSigned · Sep 23, 2026
Practices
How it's built, said plainly.
No AI training
The models run on Amazon Bedrock, inside our own AWS account. Nothing your firm keeps in PlaintiffStack is used to train them, or any other model.
Encrypted
Case data and documents are encrypted at rest and in transit, and the keys that protect your documents rotate.
Hosted in the US
Your case database, your documents and the AI models all run inside one AWS account in the United States. Nothing that holds client data runs anywhere else.
Audit log
Every change is on the record, whether a person made it or an agent did. So is every change to how your workspace works, from a new field to a new phase.
Walled off
Your firm's data stays in its own walled-off space. The database itself scopes every request your team makes to your firm, so no request reaches another firm's cases.
Yours to take
Your firm owns its data. If you leave, we export your cases, contacts and documents for you, then delete our copy.
Sub-processors
Who else handles your data. All of it in the US.
The only providers that handle your firm's data, where they run and what for.
Integrations your firm turns on, like Dropbox or RingCentral, are your firm's own providers, not ours. On the demo we'll answer your security questionnaire in writing.
- Amazon Web ServicesUnited StatesHosting, the case database and documents
- Amazon BedrockUnited StatesAI models, run in our own AWS account
- Amazon SESUnited StatesEmail delivery
Questions
What IT leads ask before they sign.
HIPAA doesn't certify software, so be wary of anyone who says it does. We build to its Security Rule: your case database, documents and AI models run inside one AWS account in the US, documents are encrypted with keys that rotate, and the database itself scopes every request your team makes to your firm. We sign a business associate agreement with your firm before any client data arrives.
Not yet. On the demo we'll walk your IT lead through how PlaintiffStack is built and hosted, and answer your security questionnaire in writing.
Only the case summary. Agents propose facts, deadlines and tasks, and none of them lands in a case until a person accepts it. The summary at the top of each case is written by an agent, and earlier versions can be restored from Notes. Drafts wait for review, flows can hold for an admin's approval, and nothing goes to a client, a carrier or a court until a person sends it.
Your firm does. It stays in your firm's walled-off space in our database and is never used to train AI models. If you leave, we export your cases, contacts and documents for you, then delete our copy.
Bring your security questionnaire. We'll answer it in writing.