Security & audit logDemo

Controls

Require two-factor

Everyone sets it up at first sign-in.

Sign-in methods

Email code, password, passkeys, Google, Microsoft, Apple.

Through WorkOS

Single sign-on

SAML or OIDC with the firm’s identity provider.

Firm email domains only

harborlegal.example

Idle sign-out

12-hour maximum session.

IP allowlist

Only sign-ins from listed networks.

Audit log retention

Append-only. Entries cannot be edited or deleted.

7 years

Signed in now

4 sessions

Maya ChenYou
Chrome · macOS · Boston, MA · Now
Daniel Brooks
Safari · iPadOS · Boston, MA · 12 min ago
Sam Rivera
Chrome · macOS · Cambridge, MA · 1 h ago
Jordan Lee
Edge · Windows · Quincy, MA · Yesterday

Security events

Opened source document — Records batch 3, p. 212
Daniel Brooks · Safari · iPadOS · Oct 28 · 8:58 AM
Invited noah.kim@harborlegal.example as Paralegal
Jordan Lee · Chrome · Windows · Oct 28 · 8:31 AM
Sign-in blocked — two-factor not completed
Unknown · Firefox · Linux · Oct 27 · 6:12 PM
Retention policy changed — 7 → 10 years for closed matters
Jordan Lee · Chrome · Windows · Oct 27 · 2:47 PM

Audit trail

TimeActorTypeEventDevice

Oct 28 · 9:42 AMSam RiveraExportChronology exported — Morgan v. Brightline FreightChrome · macOS

Oct 28 · 9:40 AMSam RiveraReviewChronology approved and sealed · 46 entriesChrome · macOS

Oct 28 · 9:15 AMAureon AIAIDraft chronology generated — Ellis v. Northstar TransitProcessing service

Oct 28 · 8:58 AMDaniel BrooksAccessOpened source document — Records batch 3, p. 212Safari · iPadOS

Oct 28 · 8:31 AMJordan LeeAdminInvited noah.kim@harborlegal.example as ParalegalChrome · Windows

Oct 27 · 6:12 PMUnknownAccessSign-in blocked — two-factor not completedFirefox · Linux

Oct 27 · 2:47 PMJordan LeeAdminRetention policy changed — 7 → 10 years for closed mattersChrome · Windows