Security Statement

1. Tenant Isolation

Customer Data is logically segregated within the Services such that it is accessible only to a customer's authorized users and to those third parties, including professional advisors, to whom that customer has expressly granted access through the Services. Separation is enforced at the database layer through row-level security policies and by authorization checks in the application.

2. Encryption

Customer Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest through the managed encryption of the Company's infrastructure providers.

3. Access Control

Access to production systems containing Customer Data is limited to Company personnel having an operational need for that access, is protected by multi-factor authentication, and is reviewed no less frequently than quarterly.

4. Security Incident Notification

The Company will notify affected customers without undue delay, and in any event within seventy-two (72) hours of the Company's determination that a Security Incident affecting their Customer Data has occurred, using the technical and administrative contacts maintained in the Services.

"Security Incident" means a confirmed unauthorized access to, or acquisition, disclosure, alteration, or destruction of, Customer Data. It does not include unsuccessful access attempts, port scans, pings, or similar activity that does not result in unauthorized access to Customer Data. Notification may describe the information then known to the Company and will not be delayed pending completion of root cause analysis.

5. Access Changes

Access granted or revoked by a customer through the Services, including access delegated to that customer's professional advisors, takes effect immediately upon the change being made in the Services. Revocation terminates an in-progress session rather than taking effect only at next sign-in. Customers are responsible for making such changes promptly when the underlying relationship changes.

6. Retention of Disclosure Records

Delivery records, signed receipts, engagement history, generated documents, and correspondence sent through the Services are retained as permanent evidentiary records. A user-initiated deletion removes the item from the deleting user's view and does not purge the underlying record.

This is a deliberate design characteristic. The purpose of the Services is to evidence that a franchise disclosure occurred on a particular date, and a record that can be erased cannot serve that purpose. Confidentiality obligations under the applicable customer agreement continue to apply to retained records.

7. Independent Assessment

The Company obtains an independent external security assessment of the public application surface no less frequently than annually, and remediates findings according to severity. A summary of the most recent assessment is available to customers on written request, subject to confidentiality.

8. Customer Responsibilities

Certain protections depend on action by the customer. Multi-factor authentication is available to all non-buyer users of the Services and enrollment is at the election of the user or the customer organization; the Company does not require enrollment across the Services. A law firm account may require multi-factor authentication for its own seats in firm settings, and the Services then enforce it on every request from that firm's users. Customers are responsible for enrolling their own users where they require it, for revoking team member and delegate access promptly when a relationship ends, and for notifying the Company of any unauthorized access they detect.

9. Changes to this Statement

The Company may update this statement. Material reductions in the commitments described above will be communicated to affected customers before taking effect.