Security at Matterly
Law firms hold some of the most sensitive data that exists — privileged, confidential, and irreplaceable. Security isn't a feature we bolted on; it's the foundation Matterly is built on.
Your firm's data is kept logically separate from every other customer's, with safeguards enforced at multiple layers.
Data is encrypted in transit and at rest using industry-standard encryption.
Role-based permissions so each person sees only what they need, with optional two-factor authentication.
Changes to key records are logged, giving your firm a clear history of who did what and when.
Regular encrypted backups, kept separate from live systems and tested for recovery.
Built around UK GDPR, SRA expectations, and AML tooling from day one.
Our approach
We design Matterly on the assumption that it will hold privileged client data for firms that cannot afford a breach. That means defence in depth — multiple independent layers of protection, encryption by default, and least-privilege access — so that no single control failure exposes client data.
Tenant isolation
Matterly is a multi-tenant platform, and keeping each firm's data separate is our highest priority. Isolation between customers is enforced at more than one layer of the system rather than relying on application code alone, and it is verified by automated tests before every release so that one firm can never see or change another firm's matters, clients, documents, or financial records.
Encryption
All traffic to and from Matterly is encrypted in transit, and your data — including documents and backups — is encrypted at rest using industry-standard encryption. Credentials for connected services, such as your email integration, are stored encrypted and limited to the minimum access each integration needs.
Access control & RBAC
Access within Matterly is governed by role-based permissions, so each member of your team can only see and do what their role requires. Passwords are never stored in readable form, and firms can require two-factor authentication for every user. Internally, access to production systems is restricted to a small number of authorised personnel and is logged.
Audit logging
Changes to matters, contacts, documents, invoices, and accounting records are recorded in an audit log showing who made each change and when. Audit records can't be edited or deleted from within Matterly, giving your firm a defensible trail for compliance reviews, SRA inspections, or internal investigations.
Infrastructure & backups
Matterly runs on secured, regularly patched infrastructure, with separate environments for testing and live use. Your data is backed up automatically, encrypted, and stored separately from live systems, and we test that backups can be restored.
Compliance
We build with the following regulatory landscape in mind:
- UK GDPR and the Data Protection Act 2018 — see our Privacy Policy for how we process personal data.
- SRA Standards and Regulations — Matterly supports firm-level compliance but does not replace it; see our Terms of Service.
- Anti-money laundering — built-in AML tooling to support your firm's client due diligence.
Responsible disclosure
If you believe you've found a security vulnerability in Matterly, we want to hear about it. Please email details, including steps to reproduce, to [email protected]. We investigate every report, will acknowledge receipt promptly, and ask that you give us a reasonable opportunity to address an issue before any public disclosure. We do not take legal action against researchers who report vulnerabilities in good faith and in accordance with this policy.