ChambersDirect is built on a security-first architecture designed for the confidentiality requirements of barristers' practices.
Every chambers and solo practice is a completely isolated tenant. Row Level Security is enforced at the database layer — not the application layer. A query from one tenant cannot return data from another, even if the application has a defect.
All mutations execute through SECURITY DEFINER functions. The application runtime role has no direct write access to data tables. Authorization checks — session validity, tenant membership, matter participation, resource permissions and restricted-matter barriers — are enforced in the database transaction.
Session tokens are HMAC-SHA256 hashed before storage. Sessions have a maximum 12-hour absolute lifetime. MFA is required for all users. Session versions are monotonically incremented on security events, invalidating all prior sessions.
Every significant action — authentication, authorization decisions, data access, agent invocations, AI transfers — is recorded in an immutable audit log with correlation identifiers. Audit events are tenant-scoped and accessible to authorized administrators.
AI agents operate under a governed runtime with tool-level permissions, approval requirements, consequence classification and kill switches at global, tenant, agent and tool levels. No agent can independently accept instructions, send external communications or transfer data without required authorization.
Integration with CirclAI uses a controlled broker architecture. No shared database. No direct access. Only metadata is transferred — never raw document content. Synthetic-only enforcement is applied at the type level. Remote revocation is supported. Currently operating in sandbox mode only.
Application data is hosted in DigitalOcean-managed PostgreSQL. Document storage uses secure cloud storage with access-controlled delivery. No data is automatically shared with third parties.
ChambersDirect is designed to support the confidentiality and professional conduct requirements of barristers in England and Wales. We do not currently hold ISO 27001, SOC 2 or Cyber Essentials certification. We do not make unsupported compliance claims.
For security questions or to report a vulnerability, please contact our team.