Security at Toposphora

Your records stay in your own workspace, encrypted, separated from every other practice, and shared only when you choose to share them.

Your workspace is yours alone

Each practice has its own workspace. Records are separated inside the database itself, not only by the application. Every request runs as the signed-in practice, and the database returns nothing that belongs to another practice.

Sign-in

Each account is activated through a link sent to its email address. A password needs at least 12 characters with mixed character types. Sign-in sessions expire and must be renewed. The Outlook add-in has its own sign-in and works only on the message you have open.

Encryption

All traffic is encrypted in transit. Files and records are encrypted at rest. Downloads use short-lived links that stop working when they expire.

Every upload is scanned

Every uploaded file and every email attachment is scanned for malware before you can open, download, or file it. A file that fails the scan stays blocked.

Sharing is deliberate

Nothing leaves your workspace unless you send it. Package links and upload links expire on the schedule you set and can be revoked at any time. A person who uploads through your link cannot see your files. Every email is shown to you before it is sent, and the calendar feed carries only the title, time, location, and notes of each event.

Email you file

Toposphora does not read your mailbox. It receives only the mail you forward, copy, or file from the add-ins, and nothing joins a matter until you file it. A message that passes the sender checks is saved on the contact of the other person and keeps its text until you delete the record. The raw inbound message is deleted once it is processed. A message you file to a matter or lead keeps its text there until you delete the record.

AI processing

The AI features run on managed services inside Toposphora's own cloud account. Most run only when you start an action, and read only the files you tick. Two run on their own when your AI Wallet has funds: Toposphora reads the name of a file you upload to label its type, and it writes a short summary of email that arrives at your intake address. Documents and text sent to the AI are not used to train models.

Deletion and retention

Deleting a file moves it to Deleted items, where you can restore it. Permanent deletion removes the current file at once. Earlier versions of a file, and the temporary copies made while filing email or receiving an upload, are removed on fixed schedules. Scheduled removal is not instant. The Privacy Notice gives each schedule.

Database backups are kept for 35 days. Account deletion removes your records and your files, including earlier versions of the files. Backups that hold your account age out over 35 days.

Where your data lives

Toposphora runs on Amazon Web Services in the United States, in an account Toposphora controls. Five other companies handle specific data for a specific job, and no other company receives your records:

Cloudflare checks that the public forms are used by a person. It receives a verification token and the visitor's IP address to do that.
Google powers the Gmail add-on, which reads the details of the open message to draw its card and fetches the message and its attachments only when you file it. Toposphora keeps no Google password or token. This public site also loads its fonts from Google.
Resend delivers the email you send from Toposphora, with any attachments you add.
SignWell delivers the agreement you send for signature and collects the signatures.
Stripe processes subscription and invoice payments. Card numbers go to Stripe and never pass through Toposphora.

Signed agreements

Toposphora signs a Business Associate Agreement with customers who need one. Read the agreement and how to ask for it.

The public site

This site uses no advertising or analytics trackers.

Certifications

Toposphora does not currently claim SOC 2 or ISO 27001 certification. This page describes the controls in place today.