← Back to QanoonAI

Data Security

Last updated 13 August 2026

Draft — pending legal review. This document describes how QanoonAI is built and operated today, but it has not yet been reviewed by a qualified lawyer and should not be relied on as a binding statement of our obligations. If you need a definitive answer before using QanoonAI with client material, please contact us at contact@qanoonai.pk.

QanoonAI holds material that is often privileged. This page describes the controls that are actually in place today — and, at the end, the ones that are not, because a security page that only lists strengths is not much use to anyone deciding whether to trust it.

Encryption

  • Database storage is encrypted at rest with AES-256.
  • Uploaded documents are encrypted at rest in object storage with AES-256.
  • All traffic between your browser and our servers is encrypted in transit with TLS.

Separation between users

Every table holding user data carries a PostgreSQL row-level security policy, and the application connects as a role that those policies apply to. Separation is therefore enforced by the database itself, not only by application code: a query that forgets its filter returns nothing rather than another firm's file.

Judge data sits in its own database schema, and the judge tools are additionally gated by role at the API. Lawyer tools cannot reach judicial material and judicial tools cannot reach lawyer material.

Sessions and sign-in

  • Session tokens are held in httpOnly cookies, which JavaScript in the browser cannot read. A cross-site scripting bug therefore cannot steal your session.
  • Tokens are short-lived and signed with RS256; sessions can be revoked.
  • You can see and end your active sessions from Settings → Security.
  • Two-factor authentication is available, and can be required for admin accounts.
  • Passwords are hashed with bcrypt. We never store them in a readable form.

Infrastructure

  • Hosted on AWS in the Asia Pacific (Mumbai) region.
  • The database is not reachable from the public internet — only from the application servers.
  • Administrative access to servers is through AWS Systems Manager with individual identities; there is no SSH port open.
  • Cloudflare sits in front of the service for TLS, DDoS protection and bot filtering.
  • Automated alerts cover service health, database load and storage.

AI processing

When you use an AI feature, the text of your request is sent to Anthropic to generate a response, and search queries are sent to Voyage AI to be converted into a search vector. Your material is not used to train models. If you would rather not send a particular document to an AI feature, do not attach it — the rest of the product works without it.

What is not in place yet

We would rather tell you than have you assume:

  • We hold no third-party security certification (no SOC 2, no ISO 27001). Nothing on this site should be read as claiming otherwise.
  • There is no contractual uptime guarantee.
  • Two-factor authentication is available but is not mandatory for ordinary accounts.
  • We have not yet commissioned an independent penetration test.

Reporting a vulnerability

If you believe you have found a security problem, please write to contact@qanoonai.pk with enough detail to reproduce it. Please give us a reasonable opportunity to fix it before disclosing it publicly. We will not pursue action against anyone who reports a genuine issue in good faith and does not access or alter other people's data.

Questions about this page: contact@qanoonai.pk