---
title: Security
summary: How accounts, access and data in transit and at rest are protected.
order: 2
lastReviewed: 2026-10-07
---

## Signing in

- Every sign-in requires a password and a one-time code sent by email.
- Access is granted per firm. A person removed from a firm, or whose seat is unassigned, can no longer sign in to
  that firm, even if their password is still valid.

## Roles and permissions

Each user holds one or more roles within their firm. What a role can see and do is set by the firm's administrators.

## Data in transit and at rest

- All traffic between your browser, the Word and Outlook add-ins and LawManage is encrypted with TLS.
- Databases and file storage are encrypted at rest by Azure.

> **To confirm before publishing:** TLS minimum version, key management, and whether any field-level encryption
> applies to integration credentials such as InfoTrack logins.

## Who at LawManage can see firm data

> **To confirm before publishing:** who holds production access, how it is granted and logged, and under what
> circumstances support staff open a firm's data.