This page describes how the firm protects the information it holds. It is organized around the six functions of the NIST Cybersecurity Framework 2.0 — Govern, Identify, Protect, Detect, Respond, Recover — which is a voluntary framework published by the United States National Institute of Standards and Technology. Alignment with a framework is not certification by anyone: NIST does not certify, and nothing here should be read as an audit result or an assurance opinion.
It is written to be checkable rather than reassuring. Where a protection is partial, it says which part.
Govern
Carver Esq. is the sole practice of one attorney. There is no support team, no outsourced help desk, and no third-party administrator with access to client information. Decisions about how information is handled are made by the attorney, who is bound by California Rule of Professional Conduct 1.6 (confidentiality) and Rule 1.18 (duties to prospective clients) independently of anything on this page.
Every policy the firm publishes is registered in one place, with a status, so a document that has not been reviewed is never presented as though it had been. Documents still in draft render for transparency but are excluded from the site’s index and from the list of notices shown in the mobile application.
Identify
The information the firm holds is described in the Privacy Policy: contact details, the answers submitted through intake, scheduling information, messages sent through the consultation chat, and the records of any engagement. There is no analytics service, no advertising network, no tracking pixel, and no third-party sign-in provider on this site or in the mobile application, so there is no set of vendors receiving visitor information in the background.
Data is stored in a single database on one server, operated by the firm’s hosting provider in the United States. Payments are processed by Stripe, which receives the payment details directly; the firm does not receive, transmit or store card numbers. Email is sent through the firm’s own mail provider by ordinary authenticated SMTP rather than through a transactional-email platform, which is a deliberate choice to avoid adding a processor that would handle privileged content.
Protect
Connections to the site and the application are encrypted in transit using TLS, and the site instructs browsers to refuse an unencrypted connection to it in future.
ENCRYPTION AT REST, STATED PRECISELY. The answers submitted through the intake wizard, and the contents of consultation-chat messages, are encrypted before they are written to disk using AES-256-GCM with a fresh random initialization vector for each record and an authentication tag verified on every read. The identifier of the key that encrypted a record is bound into that record’s authentication, so a record cannot be silently re-attributed to a different key. Encryption keys are not stored alongside the data; they are derived from a single root secret held in the server environment using HKDF-SHA256, with a separate derived key for each distinct purpose — record encryption, search indexing, session signing, and each class of access token — so that no two purposes can ever share key material.
By contrast, a matter’s NAME, EMAIL ADDRESS AND TELEPHONE NUMBER are stored unencrypted. That is a deliberate design decision, not an oversight: the attorney has to be able to find a client’s matter without decrypting the entire table, and a design that made routine lookup require bulk decryption would in practice be worked around. Those fields are protected by access control, by the encryption of the underlying storage volume provided by the hosting platform, and by the firm’s professional obligations — not by record-level encryption. This is stated here so that nothing on this site claims more than the software actually does.
Access to the attorney’s own console requires a password that is never stored. What is stored is a scrypt verifier with a deliberately high work factor, so that a copy of the database does not yield the password, and it is compared in constant time. Sessions are carried in cookies that scripts cannot read, that browsers will not send from another site, and that expire; requests that change anything are additionally checked against the originating site. Client sign-in uses a single-use code sent to the email address the firm already holds for that client, and no client is issued a password.
The site sets a strict content-security policy with a fresh single-use value on every page load, which is what prevents an injected script from executing even if one were introduced. Pages containing client or prospective-client material are marked so that browsers and intermediaries do not retain a copy.
In the mobile application, the client matter area is additionally gated by Face ID or Touch ID on the device. That gate decides whether already-authorized material is displayed; it is not a substitute for authentication to the server, and the firm does not treat it as one. Notifications sent to a device deliberately omit any confidential detail, because a notification is displayed on a lock screen, which is the least private surface a telephone has.
Detect
Public endpoints — the intake form, the consultation chat, sign-in — are rate limited, both per visitor and by an overall ceiling, so that automated abuse is bounded rather than merely discouraged. The firm records a log of every email the application sends and of access events in the attorney console.
A limitation worth stating: the rate-limit counters are held in the memory of a single server process. They are meaningful while the application runs on one machine, which it currently does, and would need to be moved to shared storage before it ran on more than one.
Respond
If the firm becomes aware of a breach of the security of a system containing personal information, it will notify affected individuals in accordance with California Civil Code § 1798.82, and will notify any other authority or individual required by the law applicable to that person. Where a breach affects information covered by the attorney–client privilege or by Rule 1.6, the attorney’s professional obligations to the affected client apply in addition to, and independently of, any statutory notice requirement.
Suspected security problems can be reported to adar@carveresq.com. A report made in good faith about a vulnerability in this site or application is welcome, and the firm will not pursue a reporter who acts in good faith, does not access or alter information belonging to anyone else, and gives the firm a reasonable opportunity to correct the problem before describing it publicly.
Recover
The database is backed up, and the encryption root can be rotated without destroying existing records: each record names the key that produced it, so a new root can be introduced while records written under the previous one remain readable. That is what makes rotation something the firm can actually do rather than something it can only describe.
What this page is not
This is a description of practices, not a warranty, a service-level commitment, or a term of any engagement. No system is perfectly secure, and the firm does not represent that this one is. Nothing on this page creates an attorney–client relationship or alters the terms of any engagement letter.
Questions about anything described here can be sent to adar@carveresq.com or raised on (424) 210-5597.