Two-factor authentication — mandatory
Every staff account requires TOTP two-factor authentication (compatible with Google Authenticator, Authy, and any RFC 6238 app). There is no way to disable 2FA for production accounts. New staff are walked through setup on first login and cannot proceed until it is complete.
SHA-256 hash-chained audit log
Every action in Lex — every login, document view, file upload, invoice edit, setting change, and role assignment — is recorded in an append-only audit log. Each entry is linked to the previous entry using SHA-256 hashing, forming a chain. Any attempt to alter or delete a historical entry breaks the chain and is immediately detectable. This log cannot be manipulated, even by a system administrator.
Firm-isolated document storage
Every firm's documents and voice notes are stored in isolated, firm-specific directories: storage/firms/{firm_id}/. No firm can access another firm's files — not through the application, not through the database, not through the filesystem. Files are never served by URL. They are always routed through the application, which verifies firm membership and permission on every request before returning a single byte.
SHA-256 file integrity verification
Every document uploaded to Lex is hashed with SHA-256 on arrival. The hash is stored alongside the file. Before serving any file — download, preview, or portal view — Lex re-computes the hash from the file on disk and compares it against the stored value. If they do not match, the file is refused and an alert is raised. This catches storage corruption, unauthorised file replacement, and any tampering at the filesystem level.
Role-based access control (ten levels)
Lex has ten defined permission levels: super admin, firm admin, managing partner, partner, associate, paralegal, accounts, receptionist, auditor, and client. Each role has a precisely defined set of permissions. Associates can only see their assigned cases. The accounts role sees all billing but cannot view case documents. The auditor role has read-only access to the audit log and nothing else. Permissions are enforced at the controller level on every request — not just in the UI.
Multi-tenant data isolation
Lex is a multi-tenant platform. Every database table that holds firm data has a firm_id foreign key. Every query in the application is scoped to the requesting firm's ID — which is read from the authenticated session, not from user input. A user at one firm cannot read, write, or even confirm the existence of data from another firm. The super admin can see aggregate system statistics but has no access to any firm's legal content.
CSRF, session, and password security
Every form submission and AJAX request in Lex carries a CSRF token that is validated server-side. Sessions expire on inactivity, regenerate on every login, and are destroyed fully on logout. Passwords are hashed with bcrypt (12 rounds). New staff accounts arrive with a temporary password and are forced to set their own before accessing anything. Password reset tokens expire after 60 minutes and are single-use.
PCI-DSS compliant payments
Subscription payments are processed through PowerTranz, a PCI-DSS Level 1 certified payment gateway integrated with Bank of The Bahamas. Card details are entered on PowerTranz's hosted payment page — Lex never sees, stores, or transmits card data. Fraud scoring is provided by Kount by Equifax, which runs real-time risk assessment on every payment attempt.
TLS 1.3 in transit
All communication between the browser and the Lex server is encrypted using TLS 1.3 — the current gold standard. HTTP connections are automatically redirected to HTTPS. HSTS headers ensure browsers remember to always use HTTPS for your firm's domain. There is no fallback to unencrypted transport.