Data Security & Integrity Framework

MyCourtDocs is designed to support the documentation needs of individuals involved in high-conflict custody and family law matters. Because these matters often involve sensitive personal information, data security and record integrity are foundational principles of our platform.

This document outlines the safeguards, controls, and operational practices implemented to protect user data and maintain documentation integrity.

Our systems are hosted on secure cloud infrastructure providers with industry-standard security certifications.

The hosting environment includes:

• Automated security patching and vulnerability management
• Network-level firewalls and distributed denial-of-service (DDoS) protection
• Continuous monitoring of application servers, databases, and storage systems
• Geographically distributed infrastructure for availability and disaster recovery

Administrative access to production systems is restricted to authorized personnel, requires multi-factor authentication, and is logged for accountability. We do not operate our own physical data centers — we rely on established providers with documented compliance certifications.

Data is encrypted in transit using HTTPS/TLS. Sensitive account information is encrypted at rest where applicable.

In Transit

All data transmitted between user devices and MyCourtDocs servers is encrypted using TLS 1.3, preventing interception during transmission. This applies to all API requests, file uploads, and real-time data synchronization.

At Rest

Stored data — including documentation entries, uploaded files, and account information — is encrypted using AES-256 encryption. Database volumes, backup archives, and file storage systems all maintain encryption at rest.

File Storage

Uploaded files (photographs, documents, audio recordings) are stored in private, user-scoped storage. Access requires time-limited signed URLs that expire after a short window. Files are not publicly accessible and cannot be accessed by other users or unauthenticated parties.

Payment Data

MyCourtDocs does not store full payment card information. Payment processing is handled by a PCI DSS Level 1 certified payment processor. Only necessary billing identifiers are retained.

MyCourtDocs enforces strict access controls at every level of the system:

• Role-based access restrictions
• Authentication required for all accounts
• Internal administrative access limited and monitored

Row-Level Security

Every database table is protected by row-level security (RLS) policies that ensure users can only access their own data. This is enforced at the database level — not just in the application code. No user can see, access, or query another user's records under any circumstances.

Professional Access Controls

Professional accounts (attorneys, therapists, mediators) receive permission-controlled, read-only access to shared cases. Professionals cannot modify, delete, or create entries in a client's case. Users control which sections professionals can see and can revoke access at any time, with access terminating immediately.

User-Scoped File Storage

File storage is partitioned by authenticated user identity. Storage paths follow a strict /{user_id}/* structure, preventing cross-user file access. All file retrieval requires ownership verification.

Documentation entries are:

• Timestamped upon creation using server-generated Coordinated Universal Time (UTC)
• Stored with associated metadata including creation time, modification time, and authenticated user identity
• Logged for internal record integrity through a dedicated audit log system

MyCourtDocs does not modify user entries without user action.

Audit Trail

The system maintains audit logs that track:

• When a record was created (UTC timestamp)
• When a record was last modified (UTC timestamp)
• The authenticated user who performed the action
• The type of action performed (create, update, delete, finalize, unlock)
• Change details for modified records where applicable

Creation timestamps cannot be modified by users. Modification timestamps are recorded separately, preserving the original creation time alongside distinct "last updated" values to maintain a clear chain of custody.

MyCourtDocs implements a structured record lifecycle designed for litigation-grade documentation:

Draft vs. Final Status

New entries are created in "Draft" status and can be edited freely. When a user finalizes an entry, the record is locked to prevent accidental changes. This finalization creates a point-in-time snapshot of the record content.

Unlock & Re-Edit Controls

Unlocking a finalized entry requires explicit user acknowledgment and generates a mandatory audit log entry. This creates a transparent, documented chain-of-custody trail showing when and by whom a finalized record was reopened — suitable for judicial review.

Export Immutability

Court-ready exports generate immutable snapshots of documentation records. Each exported entry follows a standardized format. Exported documents include metadata headers, timestamp verification, and appropriate disclaimers regarding the nature of user-entered content.

Active subscribers maintain full access to data.

Upon subscription expiration:

• Data is retained in a read-only state for 6 months, allowing reactivation or export
• After 6 months, data may be permanently deleted from primary systems within 30 days and from encrypted backups within 90 days

Users may request a full data export at any time during their active subscription or within the 6-month retention window. Users may also request immediate deletion of their data at any time.

Anonymized, aggregated data that does not identify individual users may be retained for analytical and operational purposes.

Regular system backups are performed to reduce risk of catastrophic data loss.

• Automated daily database backups
• Backups are encrypted and stored in geographically separate locations
• Backup integrity is verified through automated testing
• Recovery procedures are documented and tested periodically

The infrastructure is designed to handle hardware failures and service interruptions without data loss. Recovery procedures prioritize restoring access to user documentation as quickly as possible.

If a material security incident occurs, affected users will be notified in accordance with applicable law.

MyCourtDocs follows a structured incident response process:

• Detection & containment: Identify scope and nature; take immediate containment steps
• Assessment: Determine what data was affected and the potential impact on users
• Notification: Notify affected users within 72 hours of confirming a breach involving personal data
• Remediation: Address root cause, implement corrective measures
• Documentation: Maintain a record of the incident, response actions, and preventive changes

Users are encouraged to report suspected security issues immediately to support@mycourtdocs.com.

We may utilize secure service providers (e.g., payment processors, hosting providers). These providers are contractually obligated to maintain appropriate safeguards.

Third-party providers are selected for their security practices and are bound by contractual obligations regarding data handling. Providers are contractually prohibited from using user data for their own purposes, including model training.

MyCourtDocs does not sell user data to any third party.

Users are responsible for:

• Protecting login credentials
• Using secure devices
• Reviewing documentation before sharing
• Keeping devices updated with current security patches
• Using secure, private networks when accessing sensitive documentation
• Logging out when using shared or public devices
• Reporting suspicious account activity immediately

MyCourtDocs is a neutral documentation platform. We do not take sides in any legal dispute, do not provide legal advice, and do not make determinations regarding the merits of any case.

The platform is designed as evidence infrastructure — a secure, systematic environment for creating and preserving documentation records. All automated features (timeline organization, pattern recognition, language neutralization) are informational tools that require user review before use in any legal proceeding.

No AI feature within MyCourtDocs makes custody recommendations, generates parenting time evaluations, or predicts judicial decisions. The platform remains neutral infrastructure.