Trust Center
Security and compliance at Invilex
Controls implemented
Subprocessors listed
Documents published
01 — Compliance
Frameworks
SOC 2
PlannedAlastronix, LLC is building the Invilex platform against the AICPA Trust Services Criteria for Security, Availability, Confidentiality, and Processing Integrity. A SOC 2 audit has not started.
Verified: October 2026
02 — Security Controls
Controls
Data Protection
6/6
Dedicated Tenancy per Firm
Each firm runs in its own Oracle Cloud Infrastructure tenancy with its own network, key vault, database, storage, and identity domains. No data store is shared between firms.
Verified: October 2026
Encryption at Rest
Cached case data and sensitive fields (names, case numbers, staff notes, appointment details) are encrypted in the application with AES-256-GCM. Their keys are wrapped by an HSM-protected AES-256 master key in OCI Vault that never leaves the HSM. Journal entries and chat transcripts are stored in OCI Object Storage, encrypted at rest by Oracle with Oracle-managed keys.
Verified: October 2026
Encryption in Transit
All traffic reaches Invilex over TLS through Cloudflare. Cloudflare connects to the load balancer over TLS 1.2 with forward-secret AES-GCM cipher suites. The load balancer and application communicate inside a private subnet. Calls to Oracle services and third parties use HTTPS.
Verified: October 2026
Short-Lived Case Cache
The firm's case management system stays the system of record. Case data Invilex caches is encrypted under keys that are destroyed every night, and a firm can revoke a case's cached data on demand. Every key destruction is audited.
Verified: October 2026
Tamper-Evident Pain Journal
Journal entries are signed on the client's phone with a non-exportable hardware key, linked in hash chains, and anchored hourly by a signature from an HSM key in OCI Vault. They are stored in write-once buckets locked for five years.
Verified: October 2026
Retention by Data Class
Case caches are kept about one day. Staff notes are destroyed 12 months after a case closes. Chat transcripts are kept six years after closure by default (configurable by the firm). Journal entries are locked for five years. Audit evidence is locked for two years.
Verified: October 2026
AI & Privacy
2/5
AI Inside the Firm Tenancy
The assistant's model will run on OCI Generative AI in the firm's own tenancy and region. Invilex does not train models on customer data. Zero-data-retention terms are being confirmed with Oracle.
Verified: October 2026
Answers Limited to the Client’s Case
The assistant answers only from the client's own published case information and firm-approved knowledge entries. It never sees staff-only records, and questions that call for legal advice go to the firm's staff.
Verified: October 2026
Legal-Advice Safety Check
A fixed phrase check reviews assistant answers and flags possible legal advice to the responsible attorney. An independent second-model review is planned.
Verified: October 2026
Masking Before Escalation to Invilex
When an attorney sends an assistant answer to Invilex for review, a masking service on the same host removes the client, case parties, staff, case numbers, contact details, dates, addresses, medical terms, and long numbers before Invilex can read it.
Verified: October 2026
On-Device Voice
Speech recognition and text-to-speech run on the client's phone. Audio never leaves the device.
Verified: October 2026
Access Control
2/5
Granular Staff Permissions
Sixteen permissions, each scoped to assigned cases, specific locations, or all cases. Grants and revocations are audited. Cases a person cannot access return "not found", so their existence is not revealed.
Verified: October 2026
Staff Sign-In and MFA
Staff will sign in through a dedicated OCI Identity domain in the firm's tenancy, with multi-factor authentication required (authenticator app or email code; FIDO2 security keys for attorneys).
Verified: October 2026
Client Sign-In
Password plus a required second factor (authenticator app or email code; SMS is never a factor). Lockout after repeated failures, rate-limited sign-in, 30-minute access tokens, and one approved phone per client. Integration with the production identity domain is in progress.
Verified: October 2026
No Standing Invilex Access
Invilex's access into a firm tenancy is limited by policy to reading operational logs and masked incident reports. Hardware-key-only administrator sign-in, network restrictions, and an audited break-glass procedure are planned.
Verified: October 2026
Least-Privilege Workloads
The application authenticates to Oracle services with resource principals, so there are no long-lived API keys. It cannot drop database tables, delete locked buckets, or delete secrets.
Verified: October 2026
Infrastructure Security
4/5
Network Isolation
Application instances run in a private subnet with no public IP addresses. The load balancer accepts HTTPS only from Cloudflare, and the application accepts traffic only from the load balancer.
Verified: October 2026
Edge Protection
Every firm domain is served through Cloudflare for TLS and DDoS protection. Web application firewall rules are being finalized.
Verified: October 2026
Container Hardening
Containers run as non-root users from pinned base images and are deployed by image digest. Images are pulled with workload identity, so no registry credentials exist.
Verified: October 2026
Infrastructure as Code
Each firm tenancy is defined in Terraform with automated tests. Vaults, keys, identity domains, and locked buckets are protected from accidental destruction.
Verified: October 2026
Secret Management
Third-party credentials (case management, calendar, messaging) are stored in OCI Vault and never in images, configuration, or logs.
Verified: October 2026
Application Security
2/5
Automated Testing
Unit and integration tests cover encryption, key destruction, permissions, record visibility, transcript retention, and the client API. Infrastructure modules have their own test suites.
Verified: October 2026
CI/CD and Code Scanning
A deployment pipeline with required peer review and passing tests, dependency and container scanning, signed images, and an SBOM for each release.
Verified: October 2026
Upload and Webhook Validation
Uploads are limited to JPEG, PNG, HEIC, and PDF up to 25 MB, with the type checked from file contents. Case management webhooks must carry a valid HMAC-SHA256 signature. Malware scanning of uploads is planned.
Verified: October 2026
Threat Model
Documented threat model covering cross-firm exposure, unpublished content, journal tampering, log leakage, stolen phones, compromised staff accounts, CMS token theft, and prompt injection.
Verified: October 2026
Penetration Testing
Annual third-party penetration test with tracked remediation.
Verified: October 2026
Logging & Incident Response
2/4
Audit Trail
About 70 kinds of security events (sign-ins, permission changes, publishing, transcript views, key destruction, device approvals, consent) are recorded without case content. Each event is written to the database and to a write-once, hash-chained stream anchored hourly.
Verified: October 2026
Infrastructure Audit and Alerting
Oracle's tenancy audit log is archived to a bucket locked for two years. On-call is paged for destructive actions (deleting buckets, keys, policies, logs, or identity domains) and for unhealthy application instances.
Verified: October 2026
Application Log Monitoring
Shipping application logs to OCI Logging and alerting on application events (failed key destruction, failed anchoring, delivery failures).
Verified: October 2026
Incident Response Plan
A written incident response plan with an on-call rotation, customer notification procedure, and annual tabletop exercise.
Verified: October 2026
Business Continuity
1/3
High Availability
Two application instances run across availability domains with health checks and automatic restart. Either can carry the full load.
Verified: October 2026
Second Region
Each firm tenancy has a second OCI region with a locked bucket for transcript copies and a second master key. Replicating journal, evidence, database, and identity data to it is in progress.
Verified: October 2026
Backups and Recovery Testing
Database backups to a locked bucket in the second region, with annual restore tests and failover drills.
Verified: October 2026
Governance
0/4
Security Policies
A written policy suite (information security, access, change management, vendor management, incident response) with annual review and risk assessment.
Verified: October 2026
Personnel Security
Background checks and security training at hire and annually, with policy acknowledgments, for Invilex personnel.
Verified: October 2026
Vendor Management
A subprocessor inventory, security terms in vendor contracts, and annual review of vendor security reports.
Verified: October 2026
Data Processing Agreement
A customer data processing agreement for firms.
Verified: October 2026
03 — Architecture
Data Flow
How data moves through Invilex — from the user to storage and the AI model, with security boundaries at every layer.
Who connects
Client app
iOS · Android · voice stays on the phone
Journal entries signed on device
Firm staff
Staff Console in the browser
Firm's case management
Clio · signed webhooks
Edge — TLS
Cloudflare
TLS · DDoS protection · one zone per firm
The firm's dedicated OCI tenancy — nothing shared
Load balancer
Public subnet · HTTPS only
Application ×2
Private subnet · no public IPs
PII masking service on the same host
OCI Generative AI
In the firm's region
Planned
OCI Vault
HSM master key never leaves
Wraps every data key
NoSQL database
Sensitive fields AES-256-GCM
Case caches shredded nightly
Object storage
Journal locked 5 years
Audit evidence locked 2 years
Second OCI region
Locked copies · second master key · replication in progress
Outbound services
Invilex access
Read-only, by policy
Operational logs
Masked incident reports
No standing access to firm data
04 — Subprocessors
Vendors
| Vendor | Purpose | Location | DPA |
|---|---|---|---|
| Apple and Google | Planned: push notifications (generic text only) and app store distribution | To be confirmed | — |
| Clio | Firm-directed integration: syncs with the firm's own Clio account, its system of record | To be confirmed | — |
| Cloudflare | DNS, TLS, and DDoS protection in front of every firm domain | Global (edge network) | → |
| Mailgun | Planned: invitation and staff notification email (no case content) | To be confirmed | — |
| Microsoft and Google calendars | Firm-directed integration: reads busy times from calendars staff choose to link (start and end times only) | To be confirmed | — |
| Oracle Cloud Infrastructure | Hosting for each firm's dedicated tenancy: compute, database, object storage, key vault, identity, and logging. Planned: AI models through OCI Generative AI. | United States | → |
| Twilio | Planned: crisis alert texts and calls to firm contacts (a case reference only, no client details) | To be confirmed | → |
Apple and Google
Planned: push notifications (generic text only) and app store distribution
To be confirmed
Clio
Firm-directed integration: syncs with the firm's own Clio account, its system of record
To be confirmed
Mailgun
Planned: invitation and staff notification email (no case content)
To be confirmed
Microsoft and Google calendars
Firm-directed integration: reads busy times from calendars staff choose to link (start and end times only)
To be confirmed
Oracle Cloud Infrastructure
DPA →Hosting for each firm's dedicated tenancy: compute, database, object storage, key vault, identity, and logging. Planned: AI models through OCI Generative AI.
United States
Twilio
DPA →Planned: crisis alert texts and calls to firm contacts (a case reference only, no client details)
To be confirmed
Last updated: October 2026
Questions about subprocessors? privacy@alastronix.com
06 — Changelog
Recent Updates
2026-10-18
PII masking for escalations
Identifiers removed before Invilex can read an escalated answer
2026-10-18
Per-firm tenancy baseline
Terraform for network, key vault, locked storage, identity domains, logging, and alerts
2026-10-17
Legal-advice safety check
Assistant answers screened for possible legal advice and flagged to attorneys
2026-10-11
Biometric app lock
Face ID lock for the client app on iOS
2026-10-07
Nightly key destruction
Cached case data crypto-shredded every night
Have security questions?
We're happy to answer security questionnaires, share more detail on our architecture, or schedule a call with the team.