Engineered for the Standards of Modern Legal Practice
ChronLaw Standard provides authenticated, firm-scoped analysis for legal documents that do not contain protected health information (PHI). It uses selected field encryption, access controls, transient document processing, and in-memory authentication tokens.
Do not upload identifiable PHI to the Standard service. PHI Enterprise is a separate Google-hosted workspace that is planned but not currently available. It will remain disabled until infrastructure, vendor agreements, retention controls, and counsel review are complete.
AES-256-GCM Encryption
All firm data encrypted at rest. Keys derived from secure environment variables — no hardcoded vectors.
Transient Processing
Standard documents and results are held in runtime memory and removed on configured cleanup schedules.
Explicit PHI Boundary
Standard accounts do not include a BAA and may not be used to process PHI.
Cross-Firm Isolation
Firm-scoped database and application segmentation. Unauthorized requests rejected with HTTP 403.
Standard Document Processing Boundary
ChronLaw Standard uses API-based AI processing for non-PHI legal documents. It is not the planned PHI Enterprise environment.
API Processing
Standard legal documents are sent through commercial API endpoints rather than consumer chat products. Standard users must still follow the no-PHI restriction.
Transient Runtime Processing
Uploaded files are assembled and processed in the running service. Upload chunks and completed jobs have limited in-memory collection windows rather than a claim of immediate or zero retention.
Legal Ethics Alignment
Attorneys remain responsible for evaluating technology use under applicable confidentiality duties, engagement terms, protective orders, and local professional-conduct rules.
Data Encryption & Cryptographic Integrity
ChronLaw protects sensitive legal data and protected health information (PHI) using advanced cryptographic protocols at every storage boundary.
AES-256-GCM Encryption
All firm, clinical, and member documents undergo rigorous roundtrip encryption utilizing AES-256-GCM, ensuring raw plaintext is entirely unrecoverable within database ciphertext.
Secure Key Derivation
Cryptographic keys are dynamically derived strictly from secure environment variables, completely eliminating the risk of hardcoded access vectors within the codebase. Keys are never committed to source control and are rotatable without application downtime.
Non-Reversible Metadata Tokens
Internal system tracking relies on deterministic, non-reversible HMAC tokens to safeguard transactional metadata without exposing underlying plaintext strings — allowing safe querying of encrypted fields.
Multi-Tenant Isolation & Access Control
To ensure absolute confidentiality between separate legal clinics, university departments, and external law firms, ChronLaw enforces strict programmatic segmentation at both the database and application layers.
Firm-Scoped Data Architecture
All computational jobs are strictly scoped using a validated firm_id token claim architecture. The system automatically blocks and rejects unauthorized requests (HTTP 403) where the requested data does not perfectly match the authenticated user's firm profile. Cross-firm data access is structurally prevented at the schema level.
Endpoint Authentication Enforcement
Every protected GET and POST endpoint automatically rejects unauthenticated traffic, returning an explicit HTTP 422 error. There are no endpoints that silently degrade to lower privilege — authentication failure is always explicit.
API Schema Concealment
Standard FastAPI documentation interfaces (/docs, /redoc, /openapi.json) are completely disabled in production, serving a unified React SPA to ensure underlying API schemas are never exposed to public probing or automated enumeration.
Volatile Session Security & Threat Protection
ChronLaw actively protects active user sessions from both physical and digital exposure.
In-Memory Authentication Tokens
Authentication tokens reside strictly in volatile frontend runtime memory (tokenRef). The platform completely avoids the use of localStorage or sessionStorage, rendering browser-based token-sniffing attacks impossible even if the user's device is shared.
15-Minute Inactivity Termination
To safeguard unattended active workstations, the application enforces a strict 15-minute idle timeout with a 60-second warning sequence, executing a forced logout upon expiration. This is especially critical for clinical environments where workstations are shared.
Brute-Force Protection
Login endpoints restrict rapid entry attempts to a baseline threshold of 5 attempts. A 6th consecutive unauthorized attempt triggers an immediate, sticky HTTP 429 block that persists across server restarts — preventing brute-force attacks from surviving infrastructure cycles.
Transport Security & Webhook Integrity
Hardened Infrastructure Headers
Every server response is reinforced with enterprise security headers: X-Frame-Options: DENY (anti-clickjacking), X-Content-Type-Options: nosniff, and customized Cross-Origin Resource Sharing (CORS) blocks that systematically reject requests from unrecognized origins.
Replay-Attack Protection
External billing operations — such as subscription sync webhooks — are protected against replay attacks via a strict 300-second (5-minute) validation window and processed via hmac.compare_digest timing-safe comparison functions to prevent side-channel timing analysis.
PHI Processing Is Not Yet Available
ChronLaw is building a separate Google-hosted PHI Enterprise workspace for law school clinics, healthcare litigation firms, and LNC practices. The public Standard service must not be used for PHI.
Vendor Agreements Required
Google Cloud covered services, an OpenAI API BAA with Modified Retention, approved subprocessors, and customer terms must be confirmed before PHI processing is activated.
Separate Activation and Agreement
A BAA will apply only to an explicitly activated PHI Enterprise organization after versioned acceptance. Standard and trial registration do not include a BAA.
Questions About Compliance?
Our team is available to discuss specific HIPAA, ABA ethics, or institutional compliance requirements for your firm or law school clinic.
Contact PHI Enterprise