Sensitive records deserve a system that assumes they are.
AngelMedLegal handles protected health information for a living. Isolation, encryption and auditability aren’t features we added — they are the assumptions the platform is built on.
No cross-tenant data path is permitted by design.
Every firm using AngelMedLegal is a separate, isolated tenant. There is no shared path by which one firm’s records, results or activity can reach another’s — not through storage, not through caching, not through the application itself.
How firm-level isolation actually works.
- The tenant is the law firmEach firm is a distinct entity, and all data belongs to exactly one.
- Authentication binds users to one firmA non-admin user is tied to a single entity; any mismatch is rejected.
- Every data endpoint is scopedRequests are confined to the authenticated firm’s own data.
- Per-file ownership checksFile access is validated against tenant ownership before any processing.
- Tenant-prefixed storageSupports dedicated storage boundaries, regions and encryption settings per firm.
- Firm-scoped analysis cachingIdentical content across firms never shares an analysis result.
Enterprise isolation tier
Firms with stricter residency or isolation requirements can be pinned to dedicated storage boundaries — supporting heightened data-residency and separation needs beyond the standard isolated tenant.
Safeguards that are live in the platform now.
Encryption at rest & in transit
Records are encrypted where they live and whenever they move.
Tenant isolation
Strict separation by firm, with per-tenant storage boundaries.
Revocable sessions
Access can be withdrawn immediately; sessions do not linger.
Hashed credentials
Passwords are stored using strong one-way hashing — never in the clear.
Audit trails
Activity is recorded so access and actions can be reviewed after the fact.
Private administration
Administrative access is kept off the public internet.
Environment isolation
Development and production are kept firmly separated.
Upload safety controls
Incoming archives and files are validated before they are processed.
Records kept out of logs
Operational logging is designed to avoid capturing patient data.
Deepening the safeguards as we scale.
The platform’s security posture is actively expanding. Near-term work adds another layer of automated protection around the handling and generation of clinical content.
- Automated PHI detectionidentifying protected health information as a first-class step
- Generation guardrailsadditional grounding and content controls on AI output
- Expanded monitoring & threat detectionbroader visibility across the environment
- Hardened secret & key managementshortening the life of every credential in the system
Built for the obligations that come with PHI.
AngelMedLegal is designed around HIPAA-aligned safeguards for the handling of protected health information, and is built to operate under a Business Associate Agreement with the firms it serves. We work with each firm to meet its specific data-handling, residency and retention requirements.
A note on claims
Security is a shared responsibility and an ongoing program, not a one-time checkbox. We’re glad to walk your security or compliance team through our architecture, controls and BAA in detail — just ask.
Have a security review to run?
We’ll bring the documentation and answer your team’s questions directly.