How AOMS protects client confidentiality
Advocates hold some of the most sensitive information there is. Here is exactly how AOMS protects it.
Separate data for every office
Every record carries your office ID, and the server filters every query and checks every record you open against your office. Automated tests check that one office cannot open, change, search or export another office’s records.
Encrypted in transit
All connections use HTTPS. Passwords are stored as one-way hashes, never in plain text.
Private file storage
Documents are stored outside the public web folder and served only to signed-in users of your office after a permission check. Uploads are checked for type and size.
Two-factor authentication
Any user can turn on 2FA with Google or Microsoft Authenticator, with one-time recovery codes. It is mandatory for our own administrators.
Role-based permissions
Decide exactly what each person in your office can view, create, edit, delete or export.
Activity & sign-in logs
Important actions — sign-ins, exports, deletions, permission changes — are logged with user, time and IP. You can review active sessions and sign devices out. Deactivated users are signed out on their next request.
Attack protection
Login throttling and temporary lockouts stop password guessing; security headers and CSRF protection guard every form.
Encrypted backups
The database and documents are backed up every night, encrypted with a key that is kept offline, copied to separate storage and test-restored. Target: at most 24 hours of data at risk, service back within 4 hours.
Tamper-evident audit trail
Activity and security records are chained together with checksums and verified every night, so a changed or deleted entry is detected.
Monitoring and alerts
Failed backups, stuck jobs, low disk space, unusual exports or deletions and repeated failed sign-ins raise an alert to our team, and office owners see their own office’s activity in the Security Center.
Your data, your control
Export your clients, cases and records at any time. If you leave, you take your data with you.
Report a security issue
Think you found a weakness, saw data you should not see, or suspect someone is misusing an account? Tell us here — the report reaches our security team at once. You can also email [email protected].
What happens next
- We confirm we received it, normally within 1 working day.
- We investigate, contain anything urgent and keep you updated.
- If an office’s data was affected, we tell that office without undue delay, with what happened and what we did.
Please test only against your own account, do not access or change other people’s data, and give us reasonable time to fix an issue before sharing it.
Security questions
Can other law offices see my data?
No. Every office’s data is isolated at the database level and every request is checked against your office. No other office can see your clients, cases or documents.
Can AOMS staff read my files?
Our team does not access office data except when you ask us to help with a support issue, or when required by law. Admin access is logged.
Is my data backed up?
Yes. The database and documents are backed up daily, and you can export your own data at any time.
Do you support two-factor authentication?
Yes. Any user can turn on 2FA with an authenticator app such as Google Authenticator or Microsoft Authenticator.