Security & Confidentiality

Tapped is designed to give law firms a structured way to provide clients with post-matter guidance while maintaining clear controls around access to firm and client information.

Can other firms see our data?: No. Each firm's records are isolated from every other firm. These access controls are enforced at the database level, not simply through what appears on screen.
How do clients access their handoffs?: Clients receive an individual invitation and create or sign in to an authenticated account. The invitation must match the client's email address, can only be used once, and expires after 14 days.
Can clients see draft handoffs?: No. Clients can access a handoff only after the firm sends it. Draft handoffs remain visible only to authorized firm users.
Can a firm change a client's completed handoff after it has been delivered?: Once delivered, handoff content is protected from deletion or modification by firm users. Firm administrators may reassign the responsible attorney, with each reassignment recorded in a permanent audit history. Client progress and acknowledgment can only be recorded through the client's authenticated experience.
Does Tapped use client information with AI services?: No. Tapped does not currently use AI services to process client information, and client information is not sent to an AI provider for model training.
What happens if our firm wants its data removed?: Firms can request an export of their Tapped data followed by deletion. Deletion removes the firm's clients, handoffs, checklists, client progress, invitations, and team records from the live Tapped application. Certain records are retained separately, including evidence of Beta Agreement acceptance, a basic record of the offboarding, user sign-in accounts, and billing records maintained by our payment processor. Deleted application data may remain in routine database backups until those backups expire.
Where is Tapped data hosted?: Tapped uses managed cloud infrastructure built on Supabase. Tapped's database is hosted in the United States in an AWS US East region.
How is data protected in transit and at rest?: Connections to the Tapped website use HTTPS. Tapped's managed infrastructure provider documents encryption for stored database data and backups.