Security Practices
Last updated: October 15, 2026 · Version 1.0
BigLaw Bear is built to handle sensitive student and recruiting data with the care it deserves. This page describes our security architecture, data handling practices, and compliance posture.
1. Infrastructure & Hosting
BigLaw Bear is hosted on Vercel's edge network with Supabase (AWS us-west-2) as our database and storage provider. Both Vercel and Supabase hold SOC 2 Type II reports. Student and firm records are stored in the United States.
2. Encryption
All data is encrypted at rest (AES-256 via AWS) and in transit (TLS 1.2+). Database connections use SSL. File storage uses server-side encryption. HTTP Strict Transport Security (HSTS) is enforced with a 2-year max-age and preload directive.
3. Access Control
Row-level security (RLS) is enforced at the database layer on all tables. Firm accounts are fully isolated; no firm can access another firm's data. BigLaw Bear does not collect student demographic data. All access control is enforced server-side, not client-side.
4. Authentication
Students authenticate via Supabase Auth (email + password with email verification and Cloudflare Turnstile bot protection). Firm portal accounts use scoped JWT authentication with configurable session expiration and automatic idle timeout after 30 minutes of inactivity.
5. Audit Logging
Firm-side actions are logged, including profile views, data exports, application status changes, and message sends. Logs include timestamps, user attribution, and action targets. Firm administrators can read their firm's log on the Activity Log page. Firm users cannot edit or delete it.
6. Data Rights
Students can export all their data at any time, control their profile visibility, withdraw applications, and permanently delete their accounts with cascading removal of all associated data including uploaded files and engagement history.
7. Backup & Recovery
Supabase backs up the database daily. Backups are stored in AWS with the same encryption standards as production data.
8. Sub-Processors
| Provider | Function |
|---|---|
| Supabase (on AWS, US West) | Database, authentication, file storage |
| Vercel | Application hosting, edge network, cookieless page-view analytics |
| Resend | Transactional email |
| Google Workspace | Business email and meeting calendar |
| Cloudflare | DNS, edge network, bot protection |
| Sentry | Error monitoring |
| Twilio | SMS verification codes |
Student and firm records are stored in the United States.
9. Data Residency
Student and firm records are stored in AWS us-west-2 (Oregon, United States).
10. Employee Access
Access to production data is restricted to BigLaw Bear's platform team on a need-to-know basis. We do not employ overseas contractors with access to production student or firm data.
11. Incident Response
In the event of a confirmed data breach, BigLaw Bear will notify affected firms and students in accordance with applicable state breach notification laws. Incident response includes containment, investigation, remediation, and a post-incident report provided to affected parties.
12. Penetration Testing
BigLaw Bear conducts regular internal security reviews of authentication, authorization, and data access patterns.
13. Responsible Disclosure
If you discover a security vulnerability in BigLaw Bear, please report it to tulio@biglawbear.com. We will acknowledge receipt within 48 hours and work to address the issue promptly. We ask that you give us reasonable time to remediate before public disclosure.
14. SOC 2
BigLaw Bear does not hold its own SOC 2 report. Our core infrastructure providers (Supabase, Vercel and Resend) each hold SOC 2 Type II reports.
15. Contact
For security and privacy inquiries:
For a copy of our security questionnaire or Data Processing Agreement, contact us at the addresses above.