Security
Confidential by construction.
A defender office holds privileged notes, home addresses, criminal charges, and household finances. The protections for that information are built into the database itself, so they hold no matter which screen, report, or export is asking.
Separation between unitsOne county's records cannot be reached from another's, by any route.
- Row-level security on every table
- Every table in the database carries a policy that limits each read to the reader's own unit. The rule lives in the database, so no screen, report, or export can step around it.
- Every write checked
- Each insert, change, and deletion is checked by the database against the unit of the row it touches. A change aimed at another unit's record is refused, whichever screen or function it comes through.
- Links checked too
- A record cannot point at another unit's record. A note, a hearing, or a billing line is refused if its case belongs somewhere else.
- Functions answer to the caller
- The database functions behind the screens check who is asking, not who wrote the function, before they read or change a unit's records.
- The demo is sealed
- The demonstration unit holds invented data and is never linked to a real unit, so a demo sign-in reaches nothing real.
- Several counties, one login, no leaks
- An attorney who works for two counties works in one at a time. One county's administrator cannot set the password of a login another county uses.
Access within a unitEach person reaches only what their job needs.
- Roles enforced by the database
- Administrator, office staff, attorney, attorney staff, read only, and reports only, each enforced by the database rather than by hiding buttons.
- Reports without client data
- A reports-only account and a state office run reports through one gate that removes client names, or every client-level list, before anything leaves the database. Both are refused every table that holds client information, and neither can change a record.
- Attorneys see their own cases
- An appointed attorney can read only the cases they are appointed on, and only their own notes and billing.
- Screenings stay with the office
- Financial screenings are visible to the office and the attorney on first appearance duty, not to the panel at large.
- Attorney staff follow their attorney
- A secretary or paralegal reaches exactly what their attorney can, and nothing else.
- Settings and accounts
- Only an administrator can change the roster, the accounts, the rates, or the unit's settings.
- Switching off
- An account switched off loses access at once and stays on file, so the record of what it did is intact.
- Support access, on the record
- When First Appearance support looks at a unit to help set it up, it sees only what the role it is viewing as can see, a banner says so on every page, and anything changed is recorded under the support person's own name.
- Units not yet signed up
- A unit set up ahead of time from the statewide report has no sign-in page and links nobody's account until it is switched on.
Signing inPasswords, a second factor, and visibility into who is using what.
- Two-factor authentication
- Any account can require a code from an authenticator app as well as a password.
- No passwords kept by the app
- Sign-in runs through a dedicated authentication service that stores only a one-way hash of each password.
- Resets by email
- A forgotten password is reset through a link sent to the account's own address.
- Sign-in activity
- Administrators see when each attorney last signed in, and which accounts still have the first password on them.
Files and documentsNothing is public, and nothing stays shareable for long.
- Private storage
- Every file store is private. No document has a public address.
- Links that expire
- Opening a document creates a link that works for one minute. A link sent by email expires too.
- Who uploaded what
- Each document records who added it and when.
In transit and at restEncrypted on the way and where it is kept.
- HTTPS only
- Every page and every request travels over an encrypted connection.
- Encrypted at rest
- The database and file storage are encrypted at rest by the hosting provider.
- Keys stay on the server
- The keys that can act as the system are held on the server and never sent to a browser.
- Import tables closed
- Tables used to load dockets and history are closed to every outside request.
The recordWhat happened, who did it, and when, kept where nobody can rewrite it.
- Change log
- Changes to cases, hearings, screenings, billing, and the other core records are logged with who made them and when.
- Nobody edits the log
- No account, administrator included, can change or delete an entry in the change log.
- Findings are superseded
- A corrected indigency screening is a new screening. The original stays on file.
- Email log
- Every message the system sends is logged with its recipient and whether it went.
Why the database
Screens can be wrong. The database is not asked.
A system that protects data by hiding it on screen is one mistake away from showing it. Here the limits are rules the database applies to every request before it answers, so a new screen or report starts out unable to see what it should not.
Tested
Checked the way an outsider would try
Each protection is tested by signing in as one unit and trying to read or change another's records directly. The attempt has to be refused by the database, not merely missing from the screen.