One workspace per practice

Every record in DeLaw belongs to exactly one workspace — a firm, a court, a department or a sole practitioner. Access is enforced on the server by signed identity claims minted when a person is admitted to the workspace, and by database rules that refuse any read or write across a workspace boundary. The browser never decides who may see what.

Least privilege for clients

A client-portal login receives only the records a lawyer deliberately shared: its own matters, invoices and shared documents. Internal drafts, prep notes and counsel's working papers default to unshared and stay that way unless someone chooses otherwise.

What Korevra's servers hold

• Your sign-in (email, name, password hash held by Firebase Authentication).
• Your workspace: organisation name, members and roles, plan, trial and subscription state.
• Your workspace data, stored tenant-isolated and encrypted: matters, documents, time, fee notes, the trust ledger, messages.
• Billing records: invoices, the payment provider's references, webhook receipts. Card numbers are handled by Flutterwave or Stripe and never reach us.
• Activity counts per month, as numbers only, for capacity planning and support.
• A hash-chained audit log of privileged actions.

Controls

• Transport is TLS everywhere; data at rest is encrypted on Google Cloud.
• Payment webhooks are verified by signature before anything is recorded.
• A workspace whose trial or plan has lapsed becomes read-only on the server, not merely in the interface.
• Roles: owner, administrator, partner, lawyer, paralegal, finance, judge, general counsel, client. Enterprise tenants can use SSO through their own identity provider.
• Infrastructure runs on Google Cloud (Firebase Hosting, Cloud Run, Firestore and Cloud Storage in the European multi-region) with budgets and alerts in place.

DeLaw AI

On-device answers never leave the browser. Cloud answers send the question, aggregate figures and curated playbooks to Claude — never a document, a privileged note or a client's contact details — and the workspace owner can switch them off. Live drafting through the residency-safe proxy sends only the text the user chooses; the model key is held on the server and never in the browser.

Nigeria Data Protection

Korevra Limited processes personal data under the Nigeria Data Protection Act 2023 and the NDPR, as the controller for account and billing data and as the processor for your workspace data. Our data processing summary sets out the terms; a signed DPA is included with Enterprise and Judiciary.

Reporting a concern

Write to support@korevra.com with "security" in the subject. We acknowledge within one business day.