Security

How Florida Court Tracker keeps your firm's data safe. Written for the people who have to sign off on a new vendor.

Architecture

• Application: static web app served by Vercel (US edge network) under a strict Content-Security-Policy (no third-party scripts).
• Data, auth, APIs: Supabase (PostgreSQL 17, Canada Central). Every table is protected by row-level security; a firm's users can only read their own firm's rows, and the public case library is readable only by entitled firms.
• Email: Resend, from flcourttracker.com with SPF, DKIM and DMARC.
• Monitoring: Sentry for errors; uptime and digest-delivery checks run daily.

Authentication

• Email + password (12-character minimum), optional TOTP two-factor authentication.
• Sign in with Microsoft (OAuth 2.0 / OIDC, multitenant Entra ID) and SAML 2.0 single sign-on for firms that want their own identity provider in control. See For your IT department.
• Concurrent-session limits and a credential-sharing monitor; sign-in events (IP, coarse location, device) are visible to firm admins.

Data we hold

Name/email, sign-in events, and each user's saved cases, folders, tags and private notes. We never receive client or matter data — the content is public court opinions, legislation, and our own summaries. Private notes are visible only to the user who wrote them (enforced in the database, not just the interface).

Encryption, backups, retention

TLS 1.2+ in transit; AES-256 at rest (Supabase/AWS). Daily automated database backups with point-in-time recovery. Firm data is deleted on request within 30 days of cancellation; sign-in logs are kept 12 months.

Testing and practices

• Independent penetration test, August 2026 — findings remediated (CSP, dependency updates, password policy). Summary available on request under NDA.
• Least-privilege service keys; privileged admin actions are server-side and audit-logged.
• Subprocessors (Vercel, Supabase/AWS, Resend, Sentry, Stripe) are SOC 2 Type II certified. Florida Court Tracker itself is not yet SOC 2 audited; we'll complete a security questionnaire or sign a DPA on request.

Incident response

We notify affected firms within 72 hours of confirming a breach that involves their data, with what happened, what was affected, and what we did.

Questions or a questionnaire to complete: Support or joseph@flcourttracker.com.