Security & Trust

Last updated: July 8, 2026

This page is written for the people who have to say yes: conflicts counsel, firm IT, and risk committees. It is suitable for attachment to a vendor-risk questionnaire. Deeper technical detail (threat model, penetration-test data, incident-response runbooks) is available under NDA — ask us.

The architecture is the security model

COIxist is single-tenant and on-premises. It ships as two components installed inside your firm's network perimeter:

COIxist Server — a native binary (MSI on Windows, pkg on macOS, deb on Linux) installed on one dedicated machine on your LAN. It owns a local PostgreSQL database and serves the REST API over HTTPS.
COIxist Desktop — a hardened desktop client installed on each attorney's machine, connecting to your server over HTTPS on the LAN (or firm VPN for remote attorneys).

Your client data never reaches us. There is no COIxist cloud, no shared infrastructure between customers, and no vendor telemetry — COIxist does not phone home with matter names, party lists, user identifiers, or anything else. Optional external integrations (D&B, SEC EDGAR, your CRM) are called by your server using your credentials, and sanctions screening downloads public list data (OFAC, UN, EU, UK) — outbound fetches of public reference data, never uploads of firm data.

Encryption

In transit

TLS for every connection between desktop clients and the server.
Trust-on-first-use certificate pinning on the desktop client: on first connection, the user confirms the SHA-256 fingerprint of the server's certificate; every subsequent connection verifies it. A changed certificate blocks the connection with a clear error instead of failing silently.
Firms with an internal CA can supply their own certificate.

At rest

Passwords — argon2id hashing; never stored or logged in plaintext.
Session tokens — stored as SHA-256 hashes server-side; the desktop client keeps its copy in the operating system's secure storage (DPAPI on Windows, Keychain on macOS, libsecret on Linux).
Integration credentials — encrypted at rest with AES-256-GCM in the server's configuration store; they never appear in logs, responses, or error messages.
Recovery codes — argon2-hashed; each burns on first use.
Licenses — signed with Ed25519; the signature is re-verified on every license check, so database tampering is detected. The private key never ships with the product.

Authentication & authorization

Username/password with argon2id hashing; sessions carry a 24-hour absolute lifetime and a 30-minute idle timeout (both operator-configurable).
Brute-force lockouts on both login (10 failed attempts → 15-minute lock) and recovery-code redemption (5 attempts → 30-minute lock).
Three roles — admin, attorney, staff — with admin as the only privileged role; admin-only routes are gated at the middleware layer, and every request except the health check passes authentication before reaching a handler.
Deactivating a user immediately revokes their live sessions.

Known gaps, stated plainly: COIxist does not yet support SSO (SAML/OIDC/Entra ID) or MFA. Both are on the roadmap. If enterprise SSO is a hard gate in your RFP, treat this as a gap today — we would rather tell you here than have you discover it in a demo.

Audit logging

Every user action writes to an append-only audit log — who, what, which entity, when, with structured detail. It supports State Bar audits, SRA reviews, client-requested conflicts audits, and insurer underwriting reviews. Retention is governed by your firm's own policy engine (3–15 years or indefinite, per category), and litigation holds can pin specific checks against deletion regardless of policy.

No AI or machine learning — by design

Every matching, deduplication, ranking, and classification decision in COIxist is made by explicit, deterministic, rule-based algorithms: fuzzy token matching, Soundex and Jaro-Winkler phonetics, a human-auditable alias database, Unicode transliteration tables, and an explicit role-vs-role risk matrix.

Client data never feeds any model. There is no training corpus, no vendor-side inference, and no behavioral drift — the algorithm that screens a name today is the same one that screens it tomorrow, and every match ships with a human-readable explanation of why it fired. For firms whose engagement letters carry strict confidentiality clauses, whose clients include government or defense work, or who face cross-border data-flow restrictions, this is materially easier to approve through risk review than an ML-based alternative.

Supply chain

Dependencies are exact-version-pinned with lockfile integrity checks (registry-only sources, https, integrity hashes) and registry signature verification on every CI run.
npm audit at high severity blocks the build; CodeQL static analysis (security-extended suite) runs on every push, PR, and weekly.
An OWASP Top 10 static scanner and a license audit (copyleft blocked, permissive-only tree) run in CI.
CI workflow actions are pinned to full commit SHAs; automated dependency updates observe a cooldown window before adoption.

Desktop client hardening

COIxist Desktop enforces the full set of recommended Electron security invariants, checked by CI on every commit: nodeIntegration: false, contextIsolation: true, sandbox: true, no remote module, a preload that exposes exactly two typed globals, and protocol validation on every external link.

Compliance posture — the honest version

Item	Status
Data retention policy engine (3–15 yr / indefinite, per category)	Built in
Archive-before-delete export + litigation holds	Built in
Append-only audit trail	Built in
Multi-jurisdiction rules (US, UK, EU, CA, AU, HK, SG)	Built in
SOC 2 Type II attestation	Not yet achieved — on the roadmap
ISO 27001 certification	Not yet achieved
HIPAA BAA	Not offered — consult your compliance counsel for PHI
FedRAMP	Not applicable — you operate the environment, not us

One framing that matters: because COIxist runs entirely inside your infrastructure, your existing controls and certifications govern your data. A vendor SOC 2 report attests to the vendor's cloud; here there is no vendor cloud to attest to. Security reviewers routinely find this a stronger position than a certificate about somebody else's data center — but we list the missing attestations above anyway, because you'd find them missing eventually.

Data portability — no lock-in

COIxist's backing store is standard PostgreSQL, on your server. The schema is documented, pg_dump produces a complete export restorable to any PostgreSQL 14+ instance, and there is no proprietary format anywhere in the data path. If you ever decide to leave, you take everything with you — no exit fees, no escape-from-lock-in tax.

Incident response

24-hour acknowledgment SLA for security reports (see security.txt).
Security advisories for fixed vulnerabilities are published in the product changelog for supported releases.
Incidents confined to your infrastructure are yours to investigate — but we cooperate on forensics around the COIxist application layer.

Questions?

Send your vendor-risk questionnaire or security-review request to contact@coixist.com. We'll return it completed, with the deeper internal posture documentation available under NDA. Or request a demo and bring your security team.