Evidence in a family matter is some of the most sensitive personal data there is. This page lists only what is actually in place today, verified against our own systems. Where something is on the roadmap rather than live, it says planned: we would rather tell you that than dress it up.
Every connection to legallyheard.co.uk uses HTTPS with TLS 1.2 or 1.3 (certificates from Let's Encrypt). Plain HTTP requests are redirected to HTTPS. Session cookies are marked Secure and HttpOnly, and every form is protected against cross-site request forgery.
Your data lives on our own dedicated server, hosted by Hetzner in Falkenstein, Germany (EU), not on a shared multi-tenant analytics platform. We operate under UK GDPR (our users are UK-based) and EU GDPR (where the data is hosted).
Every file added to a case's evidence vault gets a SHA-256 cryptographic hash computed at upload and recorded in the report's exhibit index. Any party, yours, theirs, or the court, can independently verify that a supplied copy is bit-for-bit identical to the file we recorded. Metadata such as captions can be edited; the file and its hash never change.
Cases, uploads, evidence and reports are tied to your account. Requests for another user's case return "not found", the platform does not even confirm the case exists. Login attempts are rate-limited, and passwords are stored only as salted one-way hashes (scrypt), never in a readable form.
Uploads and reports are stored outside the web root with owner-only file permissions, in per-user, per-case directories, and are reachable only through authenticated, owner-checked routes. The database file itself is readable only by the application's account.
You can delete individual uploads, evidence files, key moments and reports at any time. You can also delete your entire account, every file and every database record, self-serve from Account settings, in line with your UK GDPR right to erasure. Deletion takes effect immediately on our server.
Hetzner (Germany, EU) provides the physical server. Let's Encrypt issues our TLS certificates. Stripe processes card payments when live payments are enabled, card numbers never touch our server. The local chat overview is rule-based and runs on our server. The optional Deep Fact-Finding Review and optional draft transcription may use an external AI provider; before either, we disclose the provider, content sent, purpose, safeguards and estimated provider cost and require explicit opt-in. No chat is sent to an AI provider without that consent.
We comply with lawful UK court orders, and where we are permitted to do so we will tell you about the request. We will always seek the narrowest disclosure the order allows.
Honestly: administrators have technical access to the server. The white-glove Court Bundle and Deep Fact-Finding Review may also require authorised staff to handle scoped material for delivery and quality checks. Access is limited to operating the service and completing the agreed work; we explain the scope before engagement and do not use case content for unrelated purposes.
The service is not self-serve or fully automated. We agree scope, disclose the proposed provider and estimated provider cost, and obtain explicit opt-in before sending chat. AI returns structured findings across overlapping context windows; deterministic code deduplicates and synthesises them, direction/directedness is classified, and quotations are checked exactly against the supplied source. Reporting applies the same rules to both sides.
Accounts are fully separated. Neither account can see the other's cases or files, requests for someone else's case return "not found", and the platform never discloses whether any particular person holds an account.
In transit, yes: everything is TLS-encrypted. At rest, files are protected by strict server access controls and owner-only file permissions, but the disks themselves are not currently encrypted. Full disk-level encryption at rest is planned; we say so here rather than claim it early.
No, and we won't pretend to be. We are a young product run on infrastructure we control. Independent security review and formal certifications are on the roadmap as the product grows; anything on this page describes what is genuinely in place today.
The items below are roadmap commitments, not current facts. They will move to the list above only when they are actually in place.
Ask us directly, we'll answer plainly, including about the things we haven't built yet.