Your firm is not buying a feature list. It is buying the judgement of whoever wrote this.

One module in the entire codebase can transmit a case document to a remote model

Every path that could send case-file content to a hosted model funnels through a single egress gate. It refuses unless five independent conditions hold simultaneously: the build was compiled with AI egress enabled, an API key is present, an attorney has attested by name that a signed Business Associate Agreement is in place, the firm has switched the feature on, and that individual client is not on hold. Failing any one of them returns a named refusal reason - build_disabled, no_api_key, no_baa, firm_disabled - not a silent no-op.

What it means for your firm. A misconfiguration cannot quietly become a disclosure. The gate fails closed and says which lock stopped it, so the failure is diagnosable rather than mysterious.

What it does not cover. This gate is specifically the remote-model path for case-file content. Ordinary integrations - Stripe checkout, Twilio SMS, Google Drive import, Clio pilot sync, Slack alerts - have their own scopes and signature checks. The build-level egress flag is the only one your firm cannot change from inside the app. The other four are firm-controlled, which means they are also firm-revocable.

What an egress gate is, in plain English →

Any single client can be held back on their own

The per-client hold is evaluated inside the same gate as the firm-wide switch, not layered on top of it. A held client's documents cannot be transmitted even while the firm's switch is on.

What it means for your firm. One unusually sensitive matter does not force you to switch the feature off for everyone, and switching it on for the firm does not silently opt in the client you were most careful about.

The record of a transmission is written before the transmission

The audit entry is committed first, then the send is attempted. A crash midway leaves the entry behind rather than losing it.

What it means for your firm. There is no ordering of events in which a document leaves without a trace. A send that failed to record is a send that does not happen.

Refusals are recorded, not just successes

A blocked transmission writes its own audit entry with the reason it was blocked, alongside the entries for transmissions that went through.

What it means for your firm. The log answers "did anything try to leave?" and not only "what left?" - which is the question that actually matters after an incident.

Passwords are stored with scrypt and a per-user salt

scrypt is deliberately memory-hard, which makes large-scale offline guessing expensive in a way that plain hashing is not. Each password gets its own salt, so two users with the same password have nothing in common on disk.

What it means for your firm. A stolen copy of the database does not hand an attacker your firm's passwords, and nobody - including us - can read one out of our own records.

Secrets are compared in constant time

Comparisons run through timingSafeEqual over fixed-length SHA-256 digests of both sides. An ordinary === on a secret leaks, through how long it runs, how many leading bytes matched - enough to recover the secret byte by byte over many requests.

What it means for your firm. The comparison itself gives nothing away, including the length of what it compared.

Integration secrets and sensitive profile fields use AES-256-GCM

OAuth tokens, integration secrets, and sensitive firm-profile fields go through one encryption module before they are stored. GCM is an authenticated mode: a modified ciphertext fails its authentication tag on decrypt rather than returning plausible garbage. Integrations never touch the cipher directly - all encryption and decryption goes through a single module, so a new provider inherits at-rest encryption automatically and nobody has to remember to wrap it.

What it means for your firm. A row edited by hand in the database stops working outright instead of quietly doing the wrong thing, and a future integration cannot accidentally ship unencrypted.

What it does not cover. This is field-level encryption for named secrets and sensitive fields. It is not a claim that every ordinary database column or every stored case-file byte is encrypted by this module; those rely on the deployment's volume or object-storage controls.

What AES-256-GCM is →

TOTP second factor, to RFC 6238

Time-based one-time codes implemented against the published standard, so any standard authenticator app works.

What it means for your firm. For a user who has enrolled MFA, a leaked password on its own is not enough to sign in as that attorney.

What it does not cover. MFA enrollment is per-user until firm-wide enforcement is enabled. The firm-wide requirement exists, but it is deliberately behind a deployment switch so a firm can test the audit trail before the block takes effect. TOTP secrets are not yet encrypted through the same secret box as OAuth tokens.

Firm-wide 2FA enforcement has two locks

The firm's require_2fa flag records the firm's choice. The deploy-wide ENFORCE_FIRM_2FA switch decides whether that choice actually blocks requests from users who have not enrolled. Both have to be on for enforcement.

What it means for your firm. A firm can turn the policy on in staging, watch the audit records, and then enforce it without changing the meaning of the firm flag. If enforcement misbehaves, the deployment switch can be turned back off without erasing the firm's policy decision.

What it does not cover. With the deploy switch off, the firm flag is evidence and preparation, not an access block. Ross should not describe firm-wide MFA as enforced on a deployment where that switch is off.

Rate limiting and lockout on sign-in

Repeated failed attempts throttle and then lock the account.

What it means for your firm. Guessing at a password one attempt at a time stops being viable.

Sessions die on the next request, not on their own schedule

Change a password or deactivate an account and every session that person held stops working on their very next request - not whenever the cookie happens to expire.

What it means for your firm. Removing someone's access actually removes it. This is the part most software gets wrong, and it is the part that matters on the day someone leaves the firm.

Public webhooks are authenticated at the door

Stripe webhooks are verified against Stripe's signature over the raw request body. Twilio inbound and delivery-status webhooks are accepted only when the Twilio signature or a configured shared webhook secret checks out. Replays are refused.

What it means for your firm. A public URL is not the same thing as public authority. A forged "client replied STOP" or "payment succeeded" request does not become a real product event because it reached the route.

What it does not cover. Webhook authentication depends on the provider secrets being configured correctly. A missing or wrong webhook URL at the provider can still mean the event never arrives; that is an operations failure, not an authorization bypass.

Security headers are on, with CSP enforced in production

Every response gets browser hardening headers such as frame denial, no-sniff, referrer policy, permissions policy, opener isolation, and HSTS on HTTPS. The production Fly deployment sets SECURITY_CSP=enforce, so the Content-Security-Policy is a blocking policy there rather than an aspiration.

What it means for your firm. A browser gets a second line of defence if a future page accidentally exposes a risky resource or can be framed by another site.

What it does not cover. The CSP still permits the inline script and style blocks this server-rendered app uses. It is a backstop, not a proof that XSS is impossible, and development deployments may run with CSP off unless their environment opts in.

Production boot refuses known-unsafe settings

Production configuration checks fail or warn on the settings that have caused real security drift: default session secrets, default admin credentials, development auth bypass, insecure cookies, missing provider secrets, unenforced CSP, and expired demo waivers.

What it means for your firm. A dangerous deployment posture is caught at boot instead of being discovered by a prospective firm or by a client reply that never processed.

What it does not cover. A config gate catches known bad states. It does not replace an operator reading the deployment diff, and it cannot prove a third-party account outside Ross is configured correctly.

Which firm you are comes from your signed session, never from the browser

Tenant identity is read from the server-side session. It is never taken from a URL parameter, a form field, or a header, so it cannot be changed by editing a web address.

What it means for your firm. There is no request a browser can construct that claims to be a different firm.

Another firm's record answers 404, not 403

Asking for a record belonging to someone else returns "does not exist" rather than "access denied".

What it means for your firm. Ross will not even confirm that a record exists. A 403 is itself a disclosure - it tells a probing party they found something real.

Why 404 and not 403 →

Enforced at the edge and again at the data layer

The tenant boundary is checked when the request arrives and again when data is read, and a dedicated isolation suite proves it on every change.

What it means for your firm. A single forgotten check in one route handler is not sufficient to cross the boundary.

What it does not cover. The rule currently lives in application code and tests. The production deployment is still a single SQLite-backed instance on one Fly volume; pushing tenant isolation down into Postgres row-level security is the scaling step, not something this page claims is already done.

Every audit entry commits to the one before it

Each row stores a SHA-256 digest computed over a fixed, explicit field ordering that includes the previous row's hash. Any insert, deletion, or edit anywhere in the history breaks the chain from that point forward and is detectable by re-walking it. You can run that verification yourself, whenever you want.

What it means for your firm. The log does not merely record - it can demonstrate that it has not been rewritten after the fact, and the demonstration is yours to run rather than ours to assert.

What it does not cover. This makes the log tamper-EVIDENT, not tamper-proof. The digest is an unkeyed SHA-256 and the head hash lives in the same database, so an actor with write access who edited a row and recomputed every later hash would pass verification. It reliably catches accidental corruption, partial deletion, and naive edits - not a determined adversary who already holds database credentials. Court-grade integrity means keying the digest with an HMAC secret held outside the database, or anchoring the head hash to an external append-only store. Both are on the roadmap; neither is done.

The hash chain, explained →

The log records what happened without keeping what was said

In place of message text, the trail stores a hash and a length. That is enough to prove a specific message is the one that passed through, and not enough to reconstruct it.

What it means for your firm. Your audit trail does not quietly become a second copy of every privileged communication your firm has ever sent.

Redaction that does not break the chain

Redacting an entry's content is a recorded operation that preserves chain verifiability, with its own dedicated test.

What it means for your firm. Complying with a deletion obligation does not destroy your ability to prove the rest of the log is intact.

Anything that can send automatically is template-only

The automation dials can choose only from approved templates. A model-written case update is permanently ineligible for automation and must be reviewed by an attorney before a client can see it.

What it means for your firm. Ross separates two risks that are often blurred together: choosing when to send a routine approved template, and letting a model write new client-facing prose. The first can be earned and automated. The second cannot.

What it does not cover. A case-update draft can be model-written. The safety claim is not "the model never writes"; it is "model-written free text never auto-sends."

Two-layer anti-fabrication check on every summary

A summary is decomposed into atomic claims. A second model pass must quote the passage in the source that supports each one. Then an ordinary non-AI string check confirms that quote genuinely appears in the document. A claim backed by a quote that is not really there is marked unsupported.

What it means for your firm. A fabricated citation is caught by a mechanism that cannot itself hallucinate, because the second layer is not a model at all.

How grounding verification works →

If the check cannot run, the answer is 'not checked'

A verification failure returns an explicit unchecked state rather than defaulting to pass.

What it means for your firm. Ross never tells you something passed when it was never looked at. A tool that is right most of the time and silent about the rest is worse than no tool.

What fail-closed means →

The part that learns cannot reach the part that writes

Ross has an adaptive communication policy that chooses which approved template to send and whether a quiet period needs a message at all. It is hierarchical Thompson sampling over the attorney-curated template library, with each segment cell taking its prior from its parent's posterior, so a cell with single-digit observations behaves like the pooled estimate rather than a random picker. Every decision logs its sampling probability, which is what makes a logged decision re-usable to evaluate a different policy offline instead of once, online. The reward is a policy document rather than a set of hyperparameters: one opt-out is weighted to cancel roughly twenty-five replies, solved for rather than tuned.

What it means for your firm. Four things it is structurally unable to do, each a rule that runs before the sampler. It never authors wording - no reward signal reaches template authoring or the grounding check, because a system rewarded for engagement would eventually discover that alarming a client gets a reply. It cannot suppress a communication a confirmed deadline requires. It cannot go quiet on a client who has heard nothing in twenty-one days, which is otherwise the cheapest way to avoid an opt-out penalty. And when an arm is thin and its posterior wide it falls back to the rules engine, because "I don't know" must not mean "experiment on this person." It also never widens what the safety shield already permits: for a decision the shield refused, the policy is not consulted at all - the call is never made.

What it does not cover. The honest claim is learning and instrumented, not has learned. It ships dark: the live flag is off by default, the rules engine executes, and the policy only records what it would have chosen. A kill switch overrides the live flag, and a circuit breaker sets it automatically if the policy's opt-out rate exceeds the rules engine's by more than one percentage point over the trailing two hundred decisions - automatic, because a safety control that depends on someone watching a chart is a control that works only during the week someone is looking. Convergence figures quoted anywhere are from simulation, not from production. Cadence learning is designed and not built.

Quiet hours are enforced by the system, not by discipline

TCPA quiet-hours restrictions are applied at send time in the client's own time zone.

What it means for your firm. A late-night approval does not become a late-night text to your client, and nobody has to remember the rule on a busy week.

Model calls are routed, labelled, bounded, and costed

Model usage passes through purpose-aware routing, concurrency limits, retry budgets, and per-firm spend accounting. Each call is labelled by purpose so document reading, findings, drafting, and summary work can be measured separately rather than treated as one anonymous AI bill.

What it means for your firm. A model outage or rate limit becomes a controlled refusal or escalation, not a silent partial answer, and the firm can see what AI work is costing before it becomes a surprise.

What it does not cover. Spend controls and rate limits reduce blast radius; they do not make a hosted model free, instant, or appropriate for every document. A firm over a configured spend cap gets a refusal that routes to a human.

More than 200 package test scripts, run as gates

Tenant isolation, webhook authentication, session revocation, egress gating, and provisioning each have dedicated suites. Time-dependent logic runs against injected clocks rather than the wall clock, and provider mocks are deterministic, so a passing run means the same thing twice.

What it means for your firm. The behaviours your firm is relying on are the ones under test, and a change that breaks one of them does not reach production.

What it does not cover. Tests prove the cases someone thought to write. They are evidence of diligence, not proof of absence of defects, and we would not claim otherwise.

Strict TypeScript, enforced in CI

The codebase is strict-mode TypeScript with ESM throughout, and a typecheck gate runs before any change lands.

What it means for your firm. A whole category of runtime failure is eliminated before the code is ever run.