Security and data control
Clear controls for sensitive family information.
Family law records can contain financial, personal, and safety-sensitive information. This page describes the protections currently implemented in DivFolio and the limits users should understand.
Production MFA
Secure, HttpOnly cookies
Deny-by-default case access
Append-only audit events
Accounts and sessions
Protection begins at sign-in.
A browser never proves identity by asserting a user ID. Protected requests depend on a live server-side session.
Multi-factor authentication
Production sign-in requires a password and an email-delivered verification code.
Opaque server sessions
Random session tokens are stored as hashes and checked on the server for every protected request.
Time-limited sessions
Sessions have a 30-minute inactivity timeout and a 12-hour absolute lifetime.
Revocable access
Sessions can be revoked individually or across an account after a password reset or suspected compromise.
Matter access
A title at a firm is not access to every matter.
DivFolio evaluates access at the case, record class, category, and action level. Missing permission means denial.
Case-specific grants
Firm access requires an active engagement, active membership, and a live grant for that matter.
Separate record classes
Client records, firm records, attorney work product, and shared deliverables carry separate permissions.
Access ends with representation
Ending an engagement revokes the firm's live grants while preserving records required for professional retention.
Ethical screens
An active ethical screen denies the screened account before broader firm grants are considered.
Sensitive data and record integrity
Protect the value and preserve the history.
DivFolio distinguishes ordinary case facts from fields requiring additional protection and avoids placing case content in audit metadata.
Sensitive fields
Highly sensitive values, including full Social Security numbers, are encrypted before being written to the case record.
Limited display
Encrypted values are withheld from ordinary packets and review queues and are decrypted only by explicit document-generation paths.
Version history
Corrections create new fact versions rather than silently replacing the earlier answer.
Production safeguards
Production refuses to start when required encryption or scheduled-endpoint protections are missing.
Audit history without case narrative
Material events record who acted, what type of object was affected, and when it happened. Audit metadata rejects obvious sensitive fields and truncates long strings so the security history does not become another copy of the case file.
Shared-device safety
Quick Exit moves the browser away from DivFolio and in-progress answers save as work proceeds. It cannot erase browser history, phone records, or monitoring software on a shared device.
Read shared-device safety guidanceWhat these controls do not promise
No online service can guarantee absolute security. DivFolio does not claim that using the software creates attorney-client privilege, and certification or independent-audit claims will be published only after the applicable review is complete. Security concerns can be reported to security@divfolio.com.