Scope by design
The most important security control is what we refuse to hold. Discoverable works with public business data about law firms plus a single account email. We do not ingest consumer, claimant or matter data, so that risk simply does not exist in our system.
Data in transit and at rest
All traffic is served over HTTPS. Account data is stored in a managed database with access restricted to the systems that need it.
Access control
Access to production systems follows least-privilege principles and is limited to the people who operate the service. Team and agency access inside your account is scoped by role.
Authentication
Sign in with Google, a password, or a one-time email link. We recommend a strong, unique password if you set one.
Subprocessors
We use a small set of reputable providers for hosting, payments, sign-in and email. Each receives only the data required to perform its function.
Independence as integrity
Because we sell no directory and take no commission, there is no incentive to alter a measurement. Scores are computed from evidence and are reproducible from the published rubric and weight sets.
Reporting a vulnerability
If you believe you have found a security issue, email security@discoverable.law. We appreciate responsible disclosure and will respond promptly.