Security
Last updated September 21, 2026
Configure Matruno auth, workspace scoping, roles, cookies, CORS, secrets, webhook signing, and operational hardening for confidential legal matter data without implying compliance certification.
Implemented controls#
The repository implements concrete security controls:
- password-backed login and registration
- TOTP setup, verification, backup codes, and temporary tokens
- login rate limiting
- access and refresh tokens
- httpOnly session cookies configured by environment variables
- workspace-scoped auth dependencies and tenant-scope activation
- workspace roles and permission checks
- field-level masking for blueprint-backed payloads
- encrypted secret storage helper for database-backed secrets
- webhook signing secret handling and delivery records
- external tool execution traces
- CORS settings with explicit origins when credentials are enabled
Matter documents, AI context, and participant data are workspace-scoped and matter-isolated. Unauthorized users must not access another matter's records.
Production hardening#
A production deployment should set high-entropy SECRET_KEY and TOKEN_HASH_SECRET, configure COOKIE_SECURE=true, restrict CORS_ORIGINS, avoid wildcard origins when credentials are enabled, store provider credentials outside source control, rotate webhook and connector secrets, and run migrations before routing traffic.
Compliance language#
The repository does not include evidence for SOC 2, HIPAA, GDPR compliance, attorney-client privilege certification, or regulated-industry readiness guarantees. Documentation should describe available controls and operator responsibilities, not formal compliance or privilege status.
Do not document guarantees the repo does not prove
Use language such as "configure," "operator should," and "Matruno includes." Avoid "Matruno guarantees," "certified," "privileged by default," or "compliant with" unless formal evidence is added to the repository.
Was this helpful?