Security and data handling
A law firm's case file is privileged. This page says plainly where data lives, how it is protected, who can reach it and which providers touch it, on each of the hosting profiles OrdoMetric runs on. It is written to be aligned with the Individual Privacy Act, 2075 and the Individual Privacy Regulation, 2077 [verify with a Nepali practitioner]; we describe controls and their evidence and do not claim certification.
How we hold ourselves to account
The controls on this page are aligned with OWASP Application Security Verification Standard (ASVS) Level 2 and with the controls of ISO 27001:2022 Annex A, and each is mapped to the file, workflow or platform setting that implements it. OrdoMetric is not certified against either standard and does not claim to be. Every build runs secret, dependency, static-analysis and container-image scanning; a cross-tenant test suite runs on every change; an external penetration test of the web application, the connector and sign-in takes place before the first paying firm, and its summary is available to firms under the data processing agreement once it has been performed.
Where data lives
On the pilot (the railway profile), the database, documents and backups run on Railway in Singapore (asia-southeast1) [verify Railway region list], with Cloudflare terminating TLS at its edge and caching only static assets, so request content is visible to Cloudflare in transit and nothing dynamic is stored there. The off-site copy of the encrypted nightly database backup is stored in Cloudflare R2 object storage, whose location Cloudflare assigns automatically [verify R2 region auto placement]. Firms that require India residency can be placed, once that profile is activated for them, on the Google Cloud profile (gcp) in Mumbai (asia-south1), with backups and a second copy of documents in Delhi (asia-south2). A firm may also run OrdoMetric on its own servers (the self-hosted profile) from the same code. No provider offers a region in Nepal. Whatever the profile, the contract is governed by the law of Nepal and references the Electronic Transactions Act, 2063 [verify with a Nepali practitioner].
Encryption, per profile
Every firm has its own data-encryption key. Documents and their extracted text are encrypted under it before they reach storage, and so are the sensitive database fields (citizenship numbers, storage tokens, AI credentials); the rest of the database relies on the hosting platform's encryption at rest [verify Railway volume encryption] and on the access controls below, and TLS protects everything in transit. On the pilot and on self-hosted installations the firm's key is wrapped by a versioned key-encryption key held only in the platform's sealed secret store (the envelope model): the application encrypts each object before the object store sees it, and deleting a firm nulls its wrapped key so every live copy becomes unreadable at once. The honest caveat is that the wrapped key survives inside database backups until they age out; the deletion certificate states that date. On the Google Cloud profile each firm has its own Cloud KMS key applied to every object, and destroying it shreds everything, backups included.
Tenant isolation
One PostgreSQL database with row-level security enabled and forced on every tenant table; no application role can bypass it, and every request runs inside a transaction that sets the firm's identity first. A cross-tenant leak suite, including fuzzing of every API route, background job and AI tool, runs on every change.
Who can see what
Organization roles (Owner, Admin, Member) and per-case role templates decide access down to each section of a case. Multi-factor authentication is mandatory for Owners and Admins and can be enforced for everyone; changing security settings asks for a fresh factor. Every read of a document and every change is written to an audit log with actor, action, target, address and time, which the firm can export.
AI is opt-in
The AI assistant is off by default. Enabling it requires an Owner to accept a sub-processor notice naming the provider and region: Anthropic in the United States for the platform default, with zero data retention requested and the standard retention disclosed until it is granted [verify zero-data-retention availability for the selected models]; Google Cloud (Vertex AI) in Mumbai for document embeddings by default. For the assistant, summaries and drafts, only text the asking user may read is sent (document passages and notes returned by permission-checked tools, and the case facts the user can see); for OCR of scanned documents the document file itself is uploaded to Anthropic's Files API and deleted when the document is excluded or purged [verify Files API retention], or rendered page images go to the provider a firm has selected instead. There is no automated removal of personal information before text is sent; the controls are the Owner-only switch, exclusion of any case, note or client, tool results limited to what the user may read (citizenship numbers stay encrypted and are returned only to users with write access to that section), a usage record that keeps only a short excerpt of each prompt, redacted after 90 days by default, and an audit entry for every call. Anything client-facing the assistant proposes is a draft a person approves. A firm may instead select OpenAI, Azure OpenAI, AWS Bedrock or Google Vertex AI, optionally with its own key, in which case that firm's own notice names the provider.
The Claude connector
A firm may let its users reach their cases from Claude (claude.ai or Claude Code) through OrdoMetric's connector. Data then flows through the user's own Anthropic account, outside our processor chain and the data processing agreement, which the privacy notice and the DPA both disclose. The connector is off by default, an Owner enables it, excluded cases stay invisible, every response is watermarked with the case reference and every tool call is logged.
Backups and recovery
On the pilot, a nightly encrypted database dump is kept for 35 days [verify BACKUP_RETENTION_DAYS on the pilot], with an off-site copy in Cloudflare R2 under separate credentials, alongside Railway's scheduled volume backups [verify Railway backup schedules and retention]. The recovery point objective is 24 hours and there is no point-in-time recovery; documents are stored in a single region. The recovery time objective is about 4 hours, and a restore into a fresh database is drilled quarterly with the tenant-isolation suite run against the result. The Google Cloud profile adds point-in-time recovery (5 minutes), 35-day snapshots in Delhi and dual-region documents; the pilot's weaker posture is disclosed in the data processing agreement and is a trigger for moving a firm there once the profile is activated.
No standing staff access
Nobody at OrdoMetric has standing access to a firm's content. On the pilot, break-glass is procedural: two named people hold platform access with multi-factor authentication as a condition, credentials live only in sealed variables, and any access runs through a tool that writes a break-glass entry with the justification into the firm's audit log, emails the firm's Owners, creates a database role that expires after at most four hours with every statement logged, and on closing drops the role, rotates the credential and writes a closing entry. There is no independent approver on the pilot, which the data processing agreement discloses; on the Google Cloud profile, Privileged Access Manager adds an approver-gated grant.
Incident response
Detection signals (bursts of not-found responses, unusual document downloads, exports, failed second factors, edge blocks and application errors) alert the on-call. An incident lead is named within an hour; containment means revoking sessions, rotating secrets or disabling a service or a firm; evidence is preserved in write-once storage where the provider offers it; affected firms are notified within 72 hours with scope and actions, supporting their own client notices; a review follows within ten days.
Sub-processor register
Providers that process firm data. Regions and retention are stated as configured for the pilot, and each row flags what still awaits confirmation; the same register is published as a legal document with its version history.
Processors engaged by OrdoMetric
Engaged for every firm, only once a firm enables AI (the AI rows), or only for firms placed on the Google Cloud profile (the gcp hosting row).
| Provider | Purpose | Region | Data |
|---|---|---|---|
| RailwayInfrastructure | Compute, PostgreSQL, object storage (Railway Buckets), service logs and scheduled volume backups for the pilot (railway profile) | Singapore (asia-southeast1); documents are single-region on the pilot[verify Railway's own infrastructure sub-processors and the Railway region list] | Database, documents encrypted under the per-firm key, encrypted backups |
| CloudflareEdge | Edge proxy for the pilot: DNS, TLS termination, web application firewall, rate limits, static-asset caching; R2 object storage holds the off-site copy of the encrypted nightly database backup (35 days) | Global edge; TLS terminates at Cloudflare, so request content is visible to it in transit; no request bodies or dynamic responses are stored. R2 location assigned automatically by Cloudflare[verify R2 region auto placement] | Connection metadata and request content in transit; age-encrypted database dumps (off-site backup copy) |
| Google Cloud (Vertex AI embeddings)AI, opt-in | Document embeddings for search (platform default), called over the API from every profile; only when the firm enables AI | Mumbai (asia-south1) | Text chunks of documents of firms that enabled AI |
| Google Cloud (gcp profile hosting)Infrastructure | Cloud SQL, Cloud Storage, Cloud KMS and Cloud Logging for firms placed on the gcp profile once it is activated (India residency, per-firm hardware-backed keys, approver-gated staff access) | Mumbai (asia-south1); backups and the documents dual-region pair in Delhi (asia-south2) | Database, documents under per-firm Cloud KMS keys and backups, only for firms on that profile |
| AnthropicAI, opt-in | Platform default AI provider: assistant, summaries, drafts, key-date extraction and OCR; only when the firm enables AI | United States, in transit; zero data retention requested, the standard API retention disclosed until it is granted[verify zero-data-retention availability for the selected models and Files API retention] | For the assistant, the text the asking user may read (document passages, notes, case facts); for OCR of scanned documents, the document file itself, uploaded to the Files API and deleted on exclusion or purge; no automated redaction before sending |
| ResendEmail | Transactional email: verification codes, invitations, digests, client updates | EU[verify Resend retention period] | Recipient address, subject and delivery status; the message body is kept for the shortest available period |
| SentryMonitoring | Error monitoring on every profile, including the public website; traces (10% sampling) on the pilot and self-hosted profiles | EU[verify Sentry EU data residency] | Error messages and identifiers only; request bodies and document, note and comment fields are stripped before sending |
Processors a firm selects
Engaged by the firm's own decision in Settings and listed here for transparency. The firm names them in its own notice to its clients; with a firm-held key or account, the firm's own vendor agreement governs.
| Provider | Purpose | Region | Data |
|---|---|---|---|
| OpenAISelected by the firm | AI provider selected by a firm instead of the platform default, for the assistant, OCR and, where offered, embeddings; with a bring-your-own key the firm holds the vendor contract | As configured by the firm | Text of that firm’s cases and documents that the asking user may read; rendered page images for OCR of scanned documents; no automated redaction before sending |
| Azure OpenAI (Microsoft)Selected by the firm | AI provider selected by a firm instead of the platform default, for the assistant, OCR and, where offered, embeddings; with a bring-your-own key the firm holds the vendor contract | As configured by the firm | Text of that firm’s cases and documents that the asking user may read; rendered page images for OCR of scanned documents; no automated redaction before sending |
| AWS Bedrock (Amazon Web Services)Selected by the firm | AI provider selected by a firm instead of the platform default, for the assistant, OCR and, where offered, embeddings; with a bring-your-own key the firm holds the vendor contract | As configured by the firm | Text of that firm’s cases and documents that the asking user may read; rendered page images for OCR of scanned documents; no automated redaction before sending |
| Google Vertex AI (firm-selected AI provider)Selected by the firm | AI provider selected by a firm instead of the platform default, for the assistant, OCR and, where offered, embeddings; with a bring-your-own key the firm holds the vendor contract | As configured by the firm | Text of that firm’s cases and documents that the asking user may read; rendered page images for OCR of scanned documents; no automated redaction before sending |
| DropboxSelected by the firm | Bring-your-own storage: the firm's own account holds the original documents uploaded after the firm connects it | The firm's own account | Original documents; OrdoMetric holds an OAuth token encrypted under the firm key and keeps derived text and vectors on the platform |
| Google DriveSelected by the firm | Bring-your-own storage: the firm's own account holds the original documents uploaded after the firm connects it | The firm's own account | Original documents; OrdoMetric holds an OAuth token encrypted under the firm key and keeps derived text and vectors on the platform |
Legal documents
The privacy notice, the data processing agreement and the sub-processor register are published with their version, effective date and review status.
Report a concern
Security reports and privacy requests: hello@ordometric.hamropanchanga.com. We acknowledge within two working days [verify service level].