How Your Clients' Data Is Protected
Every document a paralegal uploads to Affidavit Mapp is stored in Amazon Web Services in the United States, in an account Affidavit Mapp owns. It is encrypted in transit, is not publicly accessible, and is processed only by providers that hold independent security certifications. The AI providers do not train their models on it.
How the platform handles data
- Location: stored data (uploaded statements, case records) sits in AWS us-east-1 (Northern Virginia), in Affidavit Mapp's own AWS account.
- In transit: the app and its API accept only HTTPS; plain HTTP requests are redirected to HTTPS.
- Files: uploaded statements are not publicly accessible. Users reach them only through signed links that expire within hours.
- Credentials: passwords are stored as one-way (bcrypt) hashes; system keys are held in AWS Secrets Manager.
- Payments: card entry happens on Stripe's hosted checkout page, so card numbers never reach Affidavit Mapp.
- Separation: the test environment runs on its own network, database and keys, apart from live client data.
Verified against the platform's live configuration and code on October 28, 2026 by Nexrizen, Affidavit Mapp's engineering partner.
Providers that host or process client data
| Provider | Role | Independent certifications | Data terms |
|---|---|---|---|
| Amazon Web Services | Servers, database, file storage | SOC 1, 2, 31; ISO 270012 | Every AWS service used is HIPAA-eligible3 |
| OpenAI (paid API) | Primary AI: reads and categorizes statements | SOC 2 Type 2; ISO 27001, 27017, 27018, 277014 | Not used for training; abuse logs kept up to 30 days5 |
| Anthropic (paid API) | Secondary AI provider | SOC 2 Type I and II; ISO 27001; ISO 420016 | Not used for training7; deleted within 30 days by default8 |
| Vercel | Delivers the web app | SOC 2 Type 2; ISO 27001:20229 | Encrypted at rest (AES-256) and in transit9 |
| Sentry | Error monitoring | SOC 2 Type 2; ISO 2700110 | |
| Resend | Account emails (sign-up, password reset) | SOC 2 Type II11 | |
| Stripe | Subscription payments | PCI DSS Service Provider Level 1; SOC 1, SOC 2 Type II12 |
These certifications belong to each provider, not to Affidavit Mapp. Affidavit Mapp's own SOC 2 Type 1 preparation is under way.
Strengthening already planned
- Remove the retired Google Gemini reading pipeline, which is still in place only as a fallback.
- Review options to shorten how long AI providers hold data (currently 30 days at most).
- Two-step login for firm users, a written retention and deletion policy, and the published privacy policy.
- Security review of the inherited code, as groundwork for SOC 2 Type 1.
References (all checked October 28, 2026)
- [1] aws.amazon.com/compliance/soc-faqs (reports downloadable in Affidavit Mapp's AWS account via AWS Artifact)
- [2] aws.amazon.com/compliance/iso-certified
- [3] aws.amazon.com/compliance/hipaa-eligible-services-reference
- [4] trust.openai.com
- [5] developers.openai.com/api/docs/guides/your-data
- [6] support.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained
- [7] anthropic.com/legal/commercial-terms
- [8] privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
- [9] vercel.com/docs/security/compliance
- [10] sentry.io/trust
- [11] resend.com/security/soc-2
- [12] docs.stripe.com/security