Security & compliance
How we protect your firm’s and your clients’ data.
Data isolation
Maggie uses multi-tenant architecture. Your firm's data is strictly isolated from other tenants. Access is controlled by role (admin, lawyer, staff, client) and by tenant identifier on every query.
Encryption
Data in transit is protected with TLS (HTTPS). Production deployments should use SSL/TLS and encrypt databases and backups at rest where supported. Field-level encryption utilities (AES-256-GCM) are available for sensitive columns when configured.
Authentication
Staff access uses JWT-based sessions with configurable expiry. Two-factor authentication (TOTP) is supported in the API; enablement in the UI is rolling out. Client portal access is separate (`portal_token`) and limited to the client's own cases and invoices.
Audit & traceability
Audit logging tracks sensitive actions (tenant creation, exports, admin changes). Firm admins can review logs at Audit log in the dashboard.
AI and your data
With self-hosted Ollama (default on maggie.law), AI processing runs on your deployment infrastructure. Document text is chunked and embedded locally; vectors are stored in Qdrant with tenant isolation. Data is not sent to public cloud LLM APIs unless you configure otherwise.
Compliance documents
Your responsibilities
Maggie is designed for legal practice. You remain responsible for bar, notary, and data protection rules applicable to your jurisdiction. Configure backups, retention, and portal access according to your obligations.