Security
Your rate card is the most commercially sensitive thing you own.
We treat it that way. This page describes what we actually do, in enough detail to be checkable.
- Hosting and data residency
- All infrastructure runs in AWS ap-southeast-2 (Sydney). All data — including document processing and any AI-assisted drafting — stays in Australia. There is no cross-region replication and no processing outside the region.
- Tenant isolation
- Every record is partitioned by firm at the database level, not filtered by a query condition. The firm identifier is derived from the authenticated session and can never be supplied by a request. A request for another firm’s resource returns 404 rather than 403, because confirming that something exists is itself a disclosure. An automated test suite attempts cross-firm access against every endpoint on every build.
- Access control
- Single sign-on via Microsoft Entra ID or Google Workspace, or an email magic link. No passwords, which removes credential stuffing, weak passwords and reset-flow abuse. Cost rates and margin are visible only to owners and admins, and are removed server-side so they never reach another user’s browser.
- Encryption
- At rest with AWS KMS customer-managed keys, separate per environment. In transit with TLS 1.2 minimum, TLS 1.3 preferred, HSTS enforced with preload.
- Audit logging
- Sign-ins, permission changes, rate card publishing, proposal generation, outcome recording, document downloads, settings changes and all administrative actions are recorded to an append-only log. There is no update or delete path in the code. Owners and admins can view and export their firm’s own log. Retained for seven years.
- Administrative access
- Our staff cannot browse your fee data casually. Support access requires an explicit impersonation session with a typed reason, expires after 60 minutes, is read-only unless separately escalated, shows a persistent banner for its duration, and emails the firm owner that it occurred.
- Backup and recovery
- Point-in-time recovery on the database with a 35-day window. Object versioning on generated documents. Restores are rehearsed before launch, not assumed.
- File handling
- Uploads go directly to isolated storage and are held in quarantine until validated — content type verified by magic bytes rather than by extension, scanned for malware, and structurally checked. Document processing runs in an isolated function with minimal permissions and a hard timeout.
Subprocessors
Third parties that may process data on our behalf.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, database, email delivery | Australia (ap-southeast-2) |
| Anthropic (via AWS Bedrock) | Scope library extraction during onboarding | Australia (ap-southeast-2) |
| Sentry | Client-side error reporting (scrubbed of fee and client data) | European Union |
Reporting a vulnerability
Email security@feeletter.com. We acknowledge within two business days and will keep you updated until it is resolved. We will not pursue legal action against good-faith research that avoids privacy violations, service degradation and data destruction.
Notifiable data breaches
We operate under the Privacy Act 1988 and the Notifiable Data Breaches scheme. If a breach is likely to result in serious harm, we notify affected firms and the OAIC as required, and we maintain a documented response runbook rather than improvising.