Security at Matter Vault.

Matter Vault is built for law firms handling sensitive client data. Security is a core requirement, not an afterthought.

All data transmitted between your browser and Matter Vault is encrypted in transit using TLS 1.2 or higher, and browsers are told to refuse unencrypted connections to Matter Vault. Data at rest is encrypted by our infrastructure providers.

Matter Vault uses Supabase for authentication. Firm staff log in via email and password or with their Google account. Clients are invited to the client portal by email and sign in with a password they set.

Filed matter documents are stored in your firm's Google Drive account, and your firm controls access to those files directly through Google. Matter Vault also holds document content itself:

• An uploaded file is held in our file storage (Supabase) until it is copied to Drive, then deleted from our storage.
• Some files stay in our storage: intake uploads when a firm has not connected Drive, raw copies of emails captured from connected mailboxes (with attachments), original files from data imports, and forms, templates and logos a firm uploads.
• The full text read from documents, scans and emails is stored in our database with a search index built from it. That text includes whatever the document contains, such as a Social Security number on an intake form.
• Each document's record: file name, size, upload date, SHA-256 hash, and custody events.

Every document action in Matter Vault — upload, review, production, deletion — is recorded in an append-only custody log with SHA-256 hash verification. The database rejects any change to or deletion of a custody entry, whichever application account attempts it.

Matter Vault uses the following providers. Each entry says what the provider receives:

• Supabase — database, file storage and authentication (SOC 2 Type II). Holds everything Matter Vault stores, including document text and the files described above.
• Anthropic — AI processing. Receives the content an AI feature reads: document text and page images, email messages and attachments, meeting transcripts, and the case details used for drafting.
• Voyage AI — search indexing. Receives passages of document text, and the questions typed into document search, to build and query the search index.
• Vercel — application hosting (SOC 2 Type II)
• Google — Drive storage, plus Gmail, Calendar and Meet where a firm connects them (ISO 27001, SOC 2 Type II); Google Cloud runs our background workers that transfer, scan, stamp and file documents and email.
• DocuSign— e-signature. Receives documents sent for signature and the signers' names and email addresses.
• Google Maps — address autocomplete. Receives the address text typed into address fields.
• Resend — transactional email. Receives the emails Matter Vault sends, including their content and recipients.
• Sentry — error monitoring. Receives reports of application errors.

If you discover a security vulnerability in Matter Vault, please report it responsibly to legal@matter-vault.com. Do not disclose vulnerabilities publicly before we have had a chance to address them.

legal@matter-vault.com