How Handled. protects your work

Security built for confidentiality obligations.

Handled. was built by a practicing litigator who carries the same confidentiality obligations you do. It was not built to monetize case data, run analytics on your matters, or build a database of client information across firms. That is why the product is local-first: your case information should be something you control, not something a vendor collects.

This page explains, in plain English, how Handled. protects your case information and your account. It is written to be useful both to you and to an IT or compliance reviewer, and every claim on it is consistent with, and does not go beyond, the commitments in the Privacy Policy, the Terms of Service, and the Data Processing Addendum.

Your case data

Free and Solo. Your case information stays in an encrypted local database on your own computer. The encryption key is held through your operating system's credential store, not sent to Handled. Free and Solo do not copy your case content to Handled.'s servers, or between computers through Handled., at all.

Pro. Pro keeps the same local database, and additionally creates a protected copy so you and one authorized assistant or paralegal can work from the same current information. That copy is encrypted on your device before it is uploaded, and Handled. does not hold the key needed to read it. Your recovery phrase, the human-readable key used to authorize additional devices, is generated on your own computer, and current setup does not transmit it to us. We cannot recreate it if you lose it.

What we can see. We can see and process operational metadata: which account made a change, when, and to which record, because that information is what lets us synchronize and run the service. We cannot see the actual content of your matters, notes, or client information in the protected Pro copy.

A caveat worth repeating. A CSV matter report is a plain, unencrypted file. It does not inherit the local database's encryption or Pro's online protection. A .lhbackup file is encrypted (backups made before version 0.2.16 are not), but it is still a complete copy of your matters: it can be opened on the computer that made it, or on another computer with its 24-word recovery phrase, so keep the phrase somewhere separate from the file. Exporting a backup or report takes information out of Handled.'s protected storage, and from that point forward, storing, transferring, and deleting it securely is on you.

Your account and the website

Signing in works the way most modern software handles it: credentials and session management through our authentication provider. Devices you authorize are tracked, and a Pro account owner can remove an assistant's or paralegal's access and registered devices from their account at any time.

Checkout and billing are handled entirely by Lemon Squeezy, acting as merchant of record. Your card details go directly to Lemon Squeezy, not to us. Handled. does not process or store your payment card information.

Information sent between your computer and Handled.'s servers travels over encrypted connections. Each plan enforces a device and seat limit, and every request to synchronize or access Pro data requires a currently valid license and an authorized device.

How we operate

Before a new feature ships, we review how it handles case information and account access, not only whether it works. Access to the infrastructure that runs Handled. is limited to what a person actually needs to operate and support the service, not open by default.

We would rather be direct about where we are today than imply otherwise: Handled. does not currently hold a SOC 2 certification, has not completed a formal third-party security audit, and does not run a bug bounty program. Those are not in place yet. If your firm needs documentation of our practices for its own review, email us and we will work with you directly.

If something goes wrong

We maintain an incident-response process. If a security incident affects information for which notice is legally required, we will notify affected individuals, and any required regulators, without unreasonable delay and within the timeframe the law requires. Where we are processing information on your behalf as a service provider, which covers most Pro case content, we will notify you without undue delay so that you can meet your own notification obligations to your clients.

Technical FAQ

Is my case information encrypted?

Yes, on every plan. On Free and Solo, your case information is encrypted in a local database on your computer, using a key held through your operating system's credential store. On Pro, that same local database exists, and the protected copy Pro uploads for sync is encrypted on your device before it ever leaves it. Handled. does not hold the key needed to read the Pro copy.

Can anyone at Handled. read my case files?

Not the protected Pro copy, and not the local database on Free or Solo, since neither ever reaches us in readable form. We can see operational metadata needed to run the service, things like which account made a change, when, and to which record, but not the content of your matters, notes, or client information.

What is not encrypted?

A CSV matter report is a plain, unencrypted file once you create it. It does not inherit the local database's encryption or Pro's online protection, so protecting, storing, and deleting it securely is your responsibility. A .lhbackup file is different: since version 0.2.16 (August 27, 2026), backups are encrypted, with the key kept in your computer's own credential store (Windows Credential Manager or the macOS Keychain). Restoring on another computer can ask for a 24-word recovery phrase. Backups made before version 0.2.16 are not encrypted, so consider making a new backup and deleting old copies.

What if I lose my Pro recovery phrase?

Handled. does not receive your recovery phrase or raw account key in current setup, so we cannot recreate it for you. Losing it together with access to every authorized owner device can make your protected Pro information permanently inaccessible. Keep it somewhere safe and separate from the computer.

Who hosts Handled.’s infrastructure?

Supabase handles authentication and storage. Netlify builds and hosts the website. GitHub hosts application release files. Lemon Squeezy is our merchant of record for billing. Resend sends our account, billing, launch-list, and assistant-invitation emails. Each operates under a written contract that limits what it can do with the information it touches. The Windows app is distributed through the Microsoft Store, under Microsoft's own terms.

Does Handled. see my card number?

No. Lemon Squeezy handles checkout and billing as merchant of record, and your payment details go directly to them. Handled. does not process or store your card information.

What happens to my data if I cancel Pro?

Your local case information is not affected. The protected Pro online copy, along with obsolete access and recovery records, is deleted within 30 days after you leave Pro. Copies already stored on another authorized user's computer, or anything they already viewed, copied, or exported, are not retrieved or erased by cancellation.

Does Handled. have SOC 2 or a completed third-party security audit?

Not yet. We don't hold a SOC 2 certification, haven't completed a formal third-party security audit, and don't run a bug bounty program. We'd rather say that plainly than imply a certification we don't have. If your firm needs documentation of our practices to complete its own review, email us and we'll work with you directly.

How do I report a security issue?

Email [email protected] with what you found. We read every message that comes to that address.

The binding legal language behind everything on this page lives in the Privacy Policy, the Terms of Service, and the Data Processing Addendum. Questions, or found a security issue? Email [email protected].