Security

Each Clio user signs in to MatterLynx and connects their own Clio account. MatterLynx applies firm and user boundaries, while Clio continues to enforce that user's native role and matter permissions. Connecting MatterLynx does not give a user firm-wide superuser access.

Users can view, revoke, and restore their own AI assistant connections. Revoking a connection blocks that client and preserves a limited security record so it cannot silently reconnect itself.

The current Clio application requests read and write scopes for Activities, Billing, Calendars, Communications, Contacts, Custom Fields, Documents, Matters, Reporting, and Tasks, plus read-only access to Users. It does not request Clio scopes for accounting or bank transactions, court rules, imports, payments, settings, or webhooks. MatterLynx exposes a narrower set of tools than those application scopes: it has no general-purpose Clio API tool by default and no bank, payment, or trust-transaction tool. Invoice tools can update metadata and supported states; they do not send invoices or move money. Communications and report tools require those additional Clio application permissions and renewed consent before they can be used.

Lawmatics has a separate connection and assistant authorization. Each person connects their own Lawmatics account; a Clio connection does not authorize Lawmatics access. MatterLynx binds the assistant connection to the user, firm, and provider account and rechecks those boundaries on later requests.

The current beta requires administrator access in both MatterLynx and Lawmatics. MatterLynx verifies the native Lawmatics Admin role before allowing tool access; missing or restricted roles are denied. Ordinary staff access is not available. Native restricted-role behavior and end-to-end access isolation between two separate real Lawmatics firms have not yet completed live acceptance testing.

Available tools include supported intake, contact, matter, task, event, document, and financial-record operations. Lawmatics tools differ from Clio tools; the Clio scope and tool limits above should not be read as a description of Lawmatics access.

OAuth access and refresh tokens are stored per connected user and encrypted with AES-256-GCM before database storage. Production secrets are held in managed environment variables. The token format supports controlled encryption-key rotation while the decryption keys needed for existing tokens are retained. Other stored records rely on the access and encryption controls provided by MatterLynx's infrastructure providers.

Private Clio document-upload sessions normally expire after two hours. Staged file contents are deleted after a confirmed result. An uncertain result may require up to seven additional days of restricted retention for reconciliation; active transfers and failed cleanup can take longer. Associated upload and retry records may remain. See the Privacy Policy for the complete retention summary, including temporary Matter Review data.

Your AI assistant's connection settings control whether it asks before each write or allows writes automatically. MatterLynx does not add a second approval prompt for ordinary assistant tool calls. The interactive Clio upload card separately asks you to confirm its files and destination before upload. MatterLynx keeps Clio writes inside the connected user's Clio permissions. Lawmatics uses the separate administrator boundary described above. Provider-specific target, current-state, duplicate-action, and financial-record safeguards apply where the action requires them. A timeout can leave an outcome uncertain; users should verify the record before repeating an action.

MatterLynx marks Clio content as untrusted data for the assistant. Text from any connected system, including a note, task, matter, calendar entry, email, or document, must not be treated as an instruction to use another tool or change a record.

MatterLynx keeps append-only, best-effort audit records of relevant operations. A completed provider action can still succeed if an audit write fails, so the audit log should not be treated as a guaranteed or complete legal record.

Audit and usage records are designed to keep structured metadata while excluding names, contact details, notes, documents, amounts, free text, and secrets. Before sending server error reports to Sentry, MatterLynx removes request bodies, cookies, query strings, and selected sensitive headers, and applies redaction to known OAuth and credential patterns. This is not a guarantee that all sensitive text is removed from every diagnostic. Warning and critical alerts may be sent to a private operations channel and are intended to exclude case content.

Operator access is limited to operating, securing, supporting, and complying with law. The routine operator dashboard is designed to show account, connection, and operational status rather than client or matter content. Suspected token exposure, tenant isolation, billing, and write-safety issues receive high-priority triage.

MatterLynx is not currently represented as SOC 2 or ISO 27001 certified, and it has not completed an independent penetration test. Internal testing and review reduce risk but are not substitutes for independent assurance.

Email Julian at julian@joulestudios.com with enough detail to reproduce the issue. Please do not include client or matter content unless it is necessary to explain the report.