Security at Kefilex.

1. Reporting a vulnerability.

Email security@kefilex.com with details. If the issue is sensitive enough to warrant encryption, say so in your first message and we'll exchange a PGP key.

We acknowledge every report within one UK working day and provide a status update at least weekly until resolution. Please do not open public GitHub issues for security reports.

2. Response targets.

3. Access & encryption.

Authentication & access

• ·Two-factor authentication (TOTP) — available to every user with any standard authenticator app, and enforceable firm-wide by policy; administrator resets are audited and the affected user notified.
• ·Passwordless sign-in — email magic-link authentication with anti-enumeration responses and per-email and per-IP rate limiting, so there is no password to phish or reuse.
• ·Role-based access — per-firm roles (super user, manager, fee earner, intake, reception, billing-only, reporting-only), with paid working surfaces and firm-wide reporting separately gated and every grant audited.

In transit

• ·HTTPS-only across every endpoint of app.kefilex.com, admin.kefilex.com and kefilex.com
• ·TLS 1.2 minimum (TLS 1.3 preferred)
• ·Non-HTTPS redirected to HTTPS; HSTS enabled with a 365-day max-age

At rest

• ·Customer data in PostgreSQL hosted by Supabase, encrypted at-disk with AES-256
• ·Integration credentials are encrypted before storage, but not uniformly: phone-system and similar third-party tokens are encrypted at the application layer with AES-256-GCM, while OAuth tokens for Clio and other connected services are stored encrypted in the database using PostgreSQL pgcrypto and decrypted only at the moment of use
• ·Backups encrypted with the same algorithm; managed daily backups retained for 7 days

Secrets

Kefilab's own service and provider keys live only in Netlify environment variables, never committed to source. Each firm's integration credentials (Clio, phone and ad-platform tokens) are stored encrypted at rest in the database, decrypted only at point of use. Secrets are scanned on every deploy; none are committed to the source repository.

4. Sub-processors.

Each processes data on our behalf under written terms that mirror or exceed UK GDPR Article 28. Current as of the last-updated date above; we notify customers by email if the list changes, with at least 30 days' notice before the change takes effect.

5. Compliance posture.

• ·UK GDPR + EU GDPR. Production personal data is stored in the UK / EEA, with one exception: transactional email is delivered by Resend, a US-established provider, as a restricted transfer safeguarded by the UK Extension to the EU–US Data Privacy Framework (with SCCs and a UK Addendum as fallback). Subject-access requests honoured within statutory timelines. See the Privacy Policy.
• ·MVSP (Minimum Viable Secure Product). Self-attested against the MVSP v3 controls. Detailed control-by-control results published on the in-app security page at app.kefilex.com/security.

Kefilex and Kefilab

Kefilex runs as its own product with its own data boundary. A firm's Clio data lives in that firm's isolated tenant and is used only to provide Kefilex to that firm. It is never pooled across firms, never used for Kefilab's marketing services, never sold, and never used to train models. Where a firm separately engages Kefilab's marketing services, only that firm's own Kefilex reporting — which the firm sees and directs — informs that firm's own campaigns.

6. Public status page.

Live uptime and recent incidents for app.kefilex.com, admin.kefilex.com and our public surfaces:

status.kefilex.com

Monitored externally by BetterStack on a 3-minute cadence. Incidents are auto-published; subscribe by email on the status page if you want notifications.

7. Breach notification.

As your data processor, we notify affected firms of a personal-data breach without undue delay — targeting 24 hours and within 48 hours of confirming it — so you can meet your own Article 33 obligation to the ICO. Where Kefilab's own controller data is affected, we report to the ICO within 72 hours.

Our notice to you carries the information required by Article 33(3) — the nature of the breach, the categories and approximate volume of personal data affected, the contact point for further information, the likely consequences, and the measures we are taking to address it — sent by email to your registered administrator address.

8. Customer data deletion.

Disconnecting the Clio integration removes our active session immediately. Clio-synchronised data (matters, contacts, time entries, bills) can additionally be hard-deleted immediately from inside the app at any time, without cancelling; that purge is irreversible.

There is no self-serve full-tenant deletion inside the app. On cancellation we provide a 90-day export window (free, on request), after which the firm's data is deleted from production and backups expire on their normal rotation. Earlier deletion is available on written request, subject to the legal-retention exceptions stated in the Privacy Policy.

9. Codebase security controls.

• ·Continuous integration runs tsc --noEmit, eslint, and npm audit --audit-level=high on every pull request and push to main
• ·Deploy-time secret scanning; Dependabot monitors dependency vulnerabilities and patches them automatically, raising pull requests for high-severity advisories
• ·Deploys are HTTPS-only and signed by our hosting provider; production secrets are only injected at runtime via the hosting provider's environment variables

10. Bug bounty / responsible disclosure.

We do not at this time operate a paid bug-bounty programme. We will however publicly credit researchers in our changelog or security page, on request, for verified reports.

Do not test against another customer's account or any tenant other than your own. If you don't have a Kefilex account and want to research the platform, contact security@kefilex.com first for a sandbox arrangement.

11. Contact.

• ·Security reports: security@kefilex.com
• ·Privacy queries: privacy@kefilab.com
• ·General support: support@kefilex.com

This page describes the security posture we maintain today and is reviewed at least annually. Kefilab is based at 301 Bath Road, Hounslow, London TW3 3DB, United Kingdom.