Security

Last updated: July 2026

LegalMindhandles legal work — so we treat your documents, research, and annotations as privileged by default. Here's how your data is actually stored and protected.

Where Your Data Lives

  • Reading cache — documents you open are cached on your device for fast, offline-friendly reading
  • Highlights, notes, bookmarks, and diary — stored in your account (per-user isolated) so they sync across your devices; nothing is shared with anyone else
  • Workspace files — files you choose to upload are stored in a private, per-user storage prefix; access requires your signed-in session and every download link is short-lived

What We Store for Your Account

  • Account identity — name, email (via Clerk)
  • Subscription state — plan tier, billing status (via Supabase)
  • Payment records — transaction IDs, not card details (via Razorpay)

Authentication

  • Authentication is handled by Clerk, an industry-standard auth provider
  • Passwords are never stored by LegalMind — Clerk handles hashing and storage
  • Session tokens are short-lived and rotated automatically
  • OAuth sign-in (Google) is supported for passwordless access
  • Every API request is verified against your identity. Requests the app makes directly to the database are additionally constrained by database row-level security; requests that go through our own backend services enforce the same per-user scoping in application code

Encryption

  • All network traffic uses TLS (HTTPS)
  • Files in our S3 bucket are encrypted at rest with S3-managed keys (AES-256); our database is encrypted at rest by Supabase under their platform terms
  • API keys and secrets are stored server-side, never in client code
  • Payment data is encrypted end-to-end by Razorpay (PCI DSS Level 1 compliant)

AI Queries

AI features run on our backend against our indexed legal corpus, using Amazon Bedrock. Your questions and the context needed to answer them are processed to serve your request. We do not use your content to train any model, and AWS states in its Bedrock service terms that it does not use inputs or outputs to train its models — that second commitment is AWS's, not ours, and is governed by their terms. Answers are grounded in the corpus and every citation is resolved against a real source before it is shown — where we cannot verify one, we say so rather than presenting it as settled. AI output is still generated text: it can be incomplete or wrong, it is not legal advice, and it should be checked against the cited source before you rely on it.

Infrastructure

  • Website hosted on Vercel with automatic DDoS protection
  • Database on Supabase with row-level security policies on every user table
  • File storage on AWS S3 with per-user private prefixes and short-lived signed URLs
  • We do not sell your data. Product-analytics events carry identifiers and counts, not the contents of your documents, notes, or questions — with one exception we are removing, described in the Privacy Policy

Data Deletion

You can delete your account from within the app (see our data deletion policy). A copy of your data can be requested from our Grievance Officer — self-service export from inside the app is not available yet. Deletion removes your personal data from active systems as described in the Privacy Policy.

Responsible Disclosure

If you discover a security vulnerability, please report it responsibly by emailing admin@cosmixgroup.com with details. We take all reports seriously and will respond within 48 hours.