Closed by default
Opening a matter, logging time, issuing an invoice, inviting a member: each action requires an access right. What you have not opened stays closed.
What goes into Oslaw stays in your firm
Your matters are covered by professional privilege. We built Oslaw around that cardinal obligation.
You alone control access
Two-factor authentication (2FA)
Each user enables it on their account. Access to their mailbox is then no longer enough to enter the virtual firm.
Audit log
Who viewed, changed, exported, invited, and when. The trace of every action is kept and can be consulted at any time, including for what you might one day have to demonstrate.
Reinforced confidentiality
A sensitive matter gets its own document space, out of reach of those who are not members of it. You decide the walling-off, in Oslaw, and it also applies in your cloud.
A departure takes one action
Remove a member’s access from the firm’s settings: their sessions are closed and what they produced stays with the firm.
Our commitments
Each commitment restates a clause of our terms and conditions or of our data processing agreement.
Encryption
Your data is encrypted in transit and on the disks that store it.
Terms · GDPR art. 32
Isolation between firms
Every request is filtered by the database itself: one firm cannot read another’s data, even if our code contains an error.
Database access control (RLS)
Availability
99.5% of the time, measured every month, written into the contract.
Terms · art. 10
Backups
One backup a day, kept for twelve months on separate infrastructure, within the European Union.
Terms · art. 10
Return of data
We commit to returning your data: it is an obligation of result, the strongest that contract law provides.
Terms · Oslaw’s obligations
Transparency
Every provider that processes your data is named in our processing agreement, with its country and the law it is subject to.
DPA · annex 3
Traffic protection
All traffic heading to Oslaw first goes through OGO Security, a French cybersecurity company. Its firewall inspects every request and blocks intrusion attempts and flooding attacks before they reach our servers.
- Application firewall
- Protection against flooding
- Operated in France
Our providers
Supabase
Hosts, in Paris, the database that carries your business data and your members’ accounts.
Railway
Runs the server and the background jobs, in the Netherlands. Your data passes through without staying there.
Vercel
Serves Oslaw’s pages to your browser from Paris. Keeps only technical logs.
OGO Security
Filters all traffic heading to Oslaw and blocks attacks before they reach us. A French company.
Scaleway
Keeps an encrypted copy of the database in Amsterdam every day, and runs the model that helps import your data on our own servers in France. A French company.
Sentry
Receives enough to fix a technical error, without the content of the requests or the identity of whoever made them.
Stripe
Collects your Oslaw subscription. Your bank details never pass through our servers.
Sweego
Delivers the emails and notifications Oslaw sends for your firm. A French provider.
Supabase, Railway, Vercel, Sentry and Stripe are American companies. Your data is hosted in the European Union and transfers are governed by our processing agreement.
Our providers’ certifications
Oslaw does not yet hold a certification in its own name. Seven of our providers are audited every year by independent bodies. The attestations below are theirs: each name links to its compliance page.
Paris data centre that carries the database, underneath Supabase
- ISO 27001
- ISO 27017
- ISO 27018
- SOC 2 report
- C5
Supabase
Compliance pageDatabase and authentication
- SOC 2 Type II report
- ISO 27001
Vercel
Compliance pageApplication pages
- SOC 2 Type II report
- ISO 27001:2022
Railway
Compliance pageServer and background jobs
- SOC 2 Type II report
- SOC 3 report
Scaleway
Compliance pageBackups in Amsterdam, AI model in France
- ISO 27001:2022
Sentry
Compliance pageError reporting
- SOC 2 Type II report
- ISO 27001
Stripe
Compliance pageSubscription billing
- PCI DSS Level 1
- SOC 2 Type II report
Sweego
Compliance pageEmails
No published certification. States it complies with the GDPR, with data centres in France.
OGO Security
Firewall
No published certification to date.
Your freedom is our concern
Where is my data hosted?
The database and the authentication service are in Paris. The application server runs in the Netherlands and keeps no data. An encrypted copy of the database goes every day to Scaleway, a French host, in an Amsterdam data centre: a disaster in Paris does not take your backups with it. Your documents stay in your firm’s document space.
Are your providers subject to US law?
Five of them are: Supabase, Railway, Vercel, Sentry and Stripe. Your data stays hosted in the European Union, encrypted and isolated by firm. We name every one of them in our processing agreement, with the law they are subject to, so that you can judge for yourself.
Are my documents used to train an AI?
No. No model is trained on your data. The AI built into Oslaw runs on our own servers in France, and no model provider has access to it. When you plug your assistant into Oslaw, it is your firm’s model that works, under the contract you signed with its provider.
Can a matter be walled off in Oslaw?
Yes. A matter opened with reinforced confidentiality gets its document space in a dedicated Drive, out of reach of team members who have not been given access.
How do you check your security?
Our security procedures are daily. Drift between the code and production is reviewed every day, isolation tests between firms are rerun on every change, an isolation review runs on every proposed change, and our dependencies are audited every week. Traffic is filtered continuously by OGO Security, whose alerts we review.
What does my data export contain?
An archive with one file per data category in an open format, a user guide and a manifest carrying the checksum of every file. A second archive gathers your documents. You trigger them from your settings.
What happens if I leave Oslaw?
For us, great sadness. For you, simply an export of your data from your settings, in open formats. Your documents, for their part, never left your document space.