Security Policy

Last updated: 7 April 2026

1. Data Security

MatterFile employs strong encryption to protect your data at every stage:

  • Encryption at rest: All sensitive data is encrypted using AES-256-GCM authenticated encryption.
  • Encryption in transit: All connections are secured with HTTPS using TLS 1.2 or higher.
  • HSTS: HTTP Strict Transport Security is enforced across all endpoints to prevent protocol downgrade attacks.

2. Data Minimisation

MatterFile follows a strict data minimisation principle. We collect only the minimum information necessary to match emails to matters and generate time entries:

  • Email subject line
  • Sender and recipient email addresses
  • Date and time sent

We never access, read, store, or process the body content of any email. We do not access attachments, drafts, or conversation threads.

3. Data Retention

Email metadata (subject lines and addresses) is automatically purged within 7 days of processing. Users may also trigger an instant purge at any time from their account settings, which removes all stored email metadata immediately.

Message ID hashes (one-way SHA-256) are retained for deduplication only and cannot be reversed to recover the original message ID. OAuth tokens and cached practice management data are deleted immediately upon disconnection or account cancellation.

4. Infrastructure

MatterFile is hosted on infrastructure with industry-leading security certifications:

  • Application hosting: Vercel, which maintains SOC 2 Type II certification.
  • Database: AWS RDS in the ap-southeast-2 (Sydney) region, ensuring all data at rest remains within Australian data centres.
  • Database connections are encrypted and access-controlled.
  • Access to production systems is restricted and logged.

5. AI Processing

Email matching is performed using Google Gemini via Vertex AI, configured with the following safeguards:

  • Zero data retention: Vertex AI on the paid tier does not retain prompts or responses beyond the duration of the API call.
  • Australian data residency: AI inference is processed entirely within the australia-southeast1 (Sydney) region.
  • No training on user data: Google contractually guarantees that your data will not be used to train or fine-tune any AI models, as part of the Google Cloud Platform Terms of Service.
  • The AI receives only email metadata (subject, addresses) and PMS reference data (contact names, matter descriptions). It never receives email body content, attachments, OAuth tokens, or billing information.

6. Authentication

MatterFile uses OAuth 2.0 for all authentication, supporting Microsoft and Google identity providers. We do not store passwords. Users authenticate directly with their identity provider, and MatterFile receives only a scoped access token.

7. Token Security

All third-party OAuth tokens (for email providers and practice management systems) are encrypted at the application level using AES-256-GCM authenticated encryption, on top of AWS disk-level AES-256 encryption. Tokens are deleted immediately when a user disconnects a service or cancels their account.

8. Access Controls

All data within MatterFile is scoped to the individual user. There is no cross-user data access. When a user account is deleted, all associated data is removed via cascading deletion, including email metadata, cached PMS data, OAuth tokens, and tracked email records.

9. Vulnerability Management

We are committed to maintaining the security of the MatterFile platform through timely patching and remediation:

  • Critical / High-severity: Patched within 3 days of identification.
  • Medium-severity: Patched within 7 days of identification.
  • Low-severity: Patched within 30 days of identification.

Dependencies are monitored for known vulnerabilities and updated as part of our regular maintenance cycle.

10. Incident Response

In the event of a confirmed security breach, we are committed to notifying all affected users within 72 hours. Notifications will include a description of the incident, the data affected, and the steps we are taking to remediate and prevent recurrence.

We will also notify the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Australian Privacy Act 1988.

11. Compliance

  • Australian data sovereignty: All data at rest is stored within Australian data centres (AWS ap-southeast-2, Sydney). No user data is stored outside Australia.
  • GDPR-aware practices: While MatterFile is an Australian product, we adopt GDPR-aligned practices including data minimisation, purpose limitation, right to deletion, and transparent data processing.
  • Australian Privacy Act 1988: We comply with the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme.

12. Contact

If you have security concerns or wish to report a vulnerability, contact us at:

Vantage Thinking (trading as MatterFile)
Email: hello@matterfile.xyz