Security controls, stated without exaggeration.
Exit Protocol separates application-encrypted Evidence Vault files, deployment-specific storage controls for other artifacts, case-scoped permissions, selected audit events, optional-provider boundaries, and exact-byte integrity references. A self-hosted or private-cloud environment requires a separate operating scope and validation. This page does not claim that the platform is unbreakable or formally certified.
Last updated: 17 July 2026
Defense in depth, explained plainly.
No web platform can credibly claim to be unhackable. The practical goal is layered protection, least privilege, reviewable events, and clear escalation paths.
Evidence Vault Encryption
New Evidence Vault document bytes are encrypted by the application with a dedicated evidence key before storage. Generated report files, evidence versions, database fields, backups, and object-store copies have separate controls that must be validated for the deployment.
Evidence Integrity Metadata
SHA-256 is calculated over received evidence plaintext bytes and exact final report bytes. A matching reference shows byte equality with an eligible authoritative row; it does not authenticate origin, ownership, completeness, custody, or admissibility.
Bounded AI Processing
AI-assisted drafting and review are kept separate from deterministic tracing calculations that decide forensic balances.
Case-Party Permissions
Financial, evidence, communication, upload, and export actions are checked against active case membership and explicit permission flags. Role labels do not create firm-wide roles or an organization tenant.
Audit Logging
Important actions such as upload, report generation, export, and access events can be logged for later review.
Controlled Integrations
Third-party integrations use scoped permissions, revocable access, and clear data-handling policies.
Trust zones and verification lifecycle.
These schematics show where integrity checks live: bounded public surfaces, protected processing zones, and byte-exact verification on /verify/.
Verification lifecycle
Generated workpapers store a final file hash. Public verification recomputes SHA-256 on uploaded bytes and matches the authoritative ledger row.
Swipe horizontally to view the full diagram on narrow screens.
flowchart TD
G[PDF generated] --> H[SHA-256 of exact PDF bytes]
H --> S[file_hash_sha256 on ForensicReport]
H --> P[Snapshot digest stored separately]
S --> EV[Optional encrypted vault mirror of the same plaintext PDF bytes]
S --> DL[User downloads PDF]
DL --> U[User uploads to /verify/]
U --> C{Size and type checks}
C -->|fail| E[Reject upload]
C -->|pass| B[Hash uploaded bytes]
B --> M{Exact hash lookup}
M -->|ForensicReport match| R[Match: Generated Review Workpaper]
M -->|eligible attorney-review packet match| V[Match: Eligible evidence record]
M -->|no row| N[No match]
P -.->|snapshot text alone| X[Does not verify]
What a match establishesThe uploaded bytes have the same SHA-256 digest as an eligible authoritative report or attorney-review packet row. The snapshot digest printed inside a workpaper is a separate calculation-state fingerprint. Neither reference authenticates origin, custody, completeness, ownership, or admissibility.
What can breakRe-saving or print-to-PDF changes bytes and breaks the match. Filename-only or partial-hash matching would create false confidence. A missing or stale authoritative row prevents a valid lookup. Synthetic demo PDFs correctly return no match unless separately registered.
Trust boundary map
Security posture depends on keeping public, authenticated, integration, generation, and vault zones clearly separated.
Swipe horizontally to view the full diagram on narrow screens.
flowchart TB
subgraph Public["Public zone"]
PP[Marketing and /verify/]
end
subgraph Auth["Authenticated app"]
UI[Matter-scoped UI]
ING[Ingestion and claims]
end
subgraph ClioZone["Clio boundary"]
OAuth[Encrypted OAuth tokens]
SEL[Selected matter and document only]
end
subgraph Gen["Report generation"]
LIBR[Deterministic LIBR]
RPT[PDF export and hashes]
end
subgraph Vault["Evidence Vault"]
ED[Stored artifacts and provenance]
end
PP -.->|bounded copy only| PP
UI --> ING --> LIBR --> RPT --> ED
OAuth --> SEL -->|read-only| ING
PP -.->|eligible exact-hash lookup only| RPT
PP -.->|eligible packet hash lookup only| ED
What it provesLeast-privilege boundaries: public pages do not imply legal conclusions; Clio access is user-triggered and selected-document only; verification stays conservative.
What can breakOAuth token exposure. Workspace-wide ingestion implied in copy or code. Weakened /verify/ matching rules. PII leaking into public templates. Generation zone errors propagating as false integrity signals.
Scoped, user-triggered, and auditable access to Clio.
OAuth 2.0 Scoped Permissions
Connection and staging use configured OAuth access to list matters and read one user-selected document. Those steps do not write to Clio.
Token Protection & Revocation
Clio OAuth access and refresh tokens are encrypted at rest. Users can disconnect at any time; local tokens are cleared and best-effort remote deauthorization is performed via Clio.
Selected-Document-Only Processing
Exit Protocol processes only explicitly user-selected matters and documents. There is no workspace-wide or silent sweep of Clio data.
Source Document Integrity
Extraction candidates stay local until explicit approval. Finalization saves the local workpaper and attempts to upload a new PDF to the selected matter. It does not modify, overwrite, or delete the source document; a failed upload leaves the verified local report available for a scoped retry.
Auditability
Eligible evidence plaintext and generated report bytes receive SHA-256 references, and selected actions are logged. Reviewers can compare bytes and inspect reconciliation records; hashes do not verify source identity or legal provenance.
Security Contact
For Clio integration security or incident reports, contact security@exitprotocols.com.
Built for sensitive and sometimes unsafe situations.
High-conflict matters can involve coercion, surveillance, or pressure around credentials. Safety features are designed to reduce exposure during risky moments.
Duress Mode
A secondary login path can show a neutral interface instead of sensitive matter data when a user may be under pressure.
Quick Exit
The current shortcut redirects the browser away from the platform. It does not end the server session, clear browser history or caches, close other tabs, or delete local or server records; users should sign out separately when safe.
Reviewable evidence beats black-box confidence.
Exit Protocol is designed to support professional review with source references, hashes, calculation logs, and deterministic methodology.
Review MethodologyDeterministic Calculations
Core LIBR tracing uses explicit repeatable logic, not generative AI judgment.
Professional Review
Reports are intended for counsel, CPA, expert, or firm review so they can evaluate before litigation use.
Buyer-Controlled Deployment
Containerized deployment can be scoped separately. Offline operation, egress denial, key custody, backups, and support boundaries are not implied and require validation.
Exact-Byte Export Reference
Generated PDF bytes receive a recorded SHA-256 reference for later comparison. This does not establish origin, custody, or admissibility.
Need firm-level diligence?
Review the current architecture and contact the deployment desk for data residency, access control, logging, backup, and deployment questions.