VakeelClient confidentiality is the whole point.
Vakeel is built for the standards UK firms are held to. We protect client data with layered controls and align with UK GDPR and the Data Protection Act 2018, so you can adopt new technology without compromising your obligations.
Vakeel is built for the standards Indian firms are held to. We protect client data with layered controls and align with the DPDP Act 2023, so you can adopt new technology without compromising your obligations.
Security across every layer.
Encryption
Data is encrypted in transit with modern TLS and at rest with strong ciphers. Documents are served through authenticated, streamed endpoints, never public links.
Access control
Role based permissions mean people see only the matters and documents relevant to their work. Administrators manage roles centrally, with optional single sign-on.
Audit trail
Every meaningful action, from viewing a document to preparing a filing, is recorded with who, what and when, so you can answer any question after the fact.
Data residency
UK data residency options keep client data where you expect it, supporting UK GDPR and the Data Protection Act 2018.India data residency options keep client data where you expect it, supporting the DPDP Act 2023.
Backups and resilience
Regular encrypted backups and tested restore procedures protect against loss, with monitoring to keep the service available.
Vendor management
We use a small set of reputable subprocessors under written data protection terms, and we keep the list available to customers on request.
Two-factor authentication
TOTP two-factor authentication, configurable session timeout and IP allow-listing, with a password policy covering history and forced change.
Isolation by architecture
Each firm's data lives in its own PostgreSQL database, not shared rows behind a flag. Multi-tenancy is enforced at the database level.
Field-level permissions
Control which roles can view or edit individual fields across clients, matters, time, diary and contacts, enforced server-side, not just hidden in the interface.
Single sign-on
Microsoft Entra ID with auto-provisioning and email domain gating, so access follows your existing identity provider.
Deployment choice
UK-hosted cloud or on-premise, so data residency is a decision your firm makes, not a limitation of the platform.India-hosted cloud with data resident in India, or on-premise, so data residency is a decision your firm makes.
Private AI
AI drafting runs on self-hosted local models inside your infrastructure, with a mandatory human review gate. Client data is not sent to third-party AI services.
Found something? Tell us.
We welcome reports from security researchers. If you believe you have found a vulnerability, please contact contact@vakeelcms.com with the details and steps to reproduce. We will acknowledge your report, investigate promptly, and keep you updated. Please give us reasonable time to fix an issue before disclosing it publicly.
Bring every matter into one calm workspace.
Start free, invite your team when you are ready, and let the busywork take care of itself. Built for UK law firms. Built for Indian law firms.