Your firm's data is private. Your actions are auditable.
Enterprise security architecture built for the responsibility of legal work. Firm isolation, granular access controls, immutable audit trails, and AI governance — designed into every layer.
Roles
Permissions — Managing Partner
How security flows through FernLex
Every request passes through multiple security layers before reaching your firm's data. Here's the path from user to audit trail.
User
Secure login with encrypted passwords
Identity
Two-factor authentication and login monitoring
Permissions
Granular role-based access control
Firm Boundary
Your firm's data is isolated from everyone else's
Application
Built with modern, secure web technologies
Data
Industry-standard database with firm-level isolation
Audit Trail
Tamper-evident audit logs retained for 7 years
User
Secure login with encrypted passwords
Identity
Two-factor authentication and login monitoring
Permissions
Granular role-based access control
Firm Boundary
Your firm's data is isolated from everyone else's
Application
Built with modern, secure web technologies
Data
Industry-standard database with firm-level isolation
Audit Trail
Tamper-evident audit logs retained for 7 years
Controlled access from login to action
Every user logs in with a secure password, manages their session, and can enable two-factor authentication for extra protection.
Authentication
- Secure password storage with industry-standard encryption
- Sessions verified on every action you take in the app
- Two-factor authentication with backup codes for account recovery
- Password reset using secure, one-time links
Session Management
- Sessions automatically validated to prevent unauthorized access
- Inactive sessions cleared when a user is removed from the firm
- Client portal sessions timeout after inactivity for added security
- Session context includes your role, firm, office, and security settings
Login Security
- Complete login history: where, when, and from what device
- Both successful and failed login attempts are recorded
- Location tracking on login events for suspicious activity detection
Nine defined roles. Sixteen resource types. Six permission levels.
Granular role-based access control ensures every user — and every AI agent — operates within defined boundaries.
Managing Partner
93 of 96 permissions
| Resource | View | Create | Edit | Delete | Export | Manage |
|---|---|---|---|---|---|---|
| Cases | ||||||
| Clients | ||||||
| Documents | ||||||
| Drafts | ||||||
| Billing | ||||||
| Calendar | ||||||
| Tasks | ||||||
| Staff | ||||||
| Settings | ||||||
| AI Agents | ||||||
| Intake | ||||||
| Reports | ||||||
| Filings | ||||||
| Approvals | ||||||
| Offices | ||||||
| Dashboard |
16 resources. Each with View, Create, Edit, Delete, Export, and Manage permissions. Granular control ensures every user — and every AI agent — operates within defined boundaries.
How your data is protected
Your passwords are securely stored. Every action is logged in a tamper-evident record. All data is encrypted in transit.
Password storage
Passwords are encrypted using industry-standard methods. Even we cannot see your password.
Audit trail integrity
Every action is logged in a tamper-evident record — sequential numbering and checksums make any change detectable.
Secure sessions
Login sessions are cryptographically signed and validated on every action.
Transport encryption
All data between your browser and FernLex is encrypted. Your connection is always secure. See the NIST Cybersecurity Framework for our control baseline.
Sensitive data protection
SSNs, passport numbers, and government IDs are encrypted at the field level.
Database encryption
All stored data is encrypted at rest. Your firm's data is protected even at the storage layer.
AI operates within controlled boundaries
Each AI employee has a defined role, scoped permissions, and operates only within the firm's configured governance rules.
Client-level AI governance
Each client record has a governance profile that restricts which AI agents can access that client's data. AI cannot operate outside the configured boundaries.
Case-level AI governance
Individual cases can have custom AI restrictions. When a case has restricted governance, AI agents respect those boundaries.
Agent role specialization
Each AI employee has a defined role and scope. Marcus routes tasks. Atlas analyzes documents. Harper qualifies leads. No agent operates outside its defined function.
Usage budgets and cost controls
Daily and monthly usage limits per agent. Real-time cost tracking with configurable caps. Firm-wide budget controls.
Master AI switch
Firm-wide pause and disable controls for all AI operations. Instant effect across all agents.
Every action is recorded. Every record is verifiable.
FernLex maintains a tamper-evident audit trail with cryptographic integrity. Records are sequentially numbered, checksum-verified, and retained for 7 years.
Immutable audit log
Every significant action is recorded with a timestamp, who did it, and what firm they belong to. These records cannot be changed.
Sequential numbering
Actions are numbered in order. Any gap or reordering is immediately detectable.
Tamper detection
The system verifies that no records have been altered after they were created.
Login tracking
Every login attempt — successful or failed — is recorded with location and device information.
Policy decision logging
Access control decisions, approvals, and overrides are logged with full context.
Long-term retention
Audit records are retained for up to 7 years, with recent records stored for fast access.
Enterprise security built for AI-powered legal operations.
Firm isolation, granular access controls, immutable audit trails, and AI governance — so your data stays protected while your team works with AI.