ProductSecurityPricingTrustWhitepaperSign InTry It Free
Security

We know what you are
trusting us with.

IOLTA trust accounts hold your clients' money. Bank statements, client ledgers, transaction histories, and non-public personal information. IOLTA.ai was built from the first line of code around the sensitivity of that data. Here is exactly how it is protected, and what we will never do with it.

Zero-Credential Architecture

Nobody logs into your system.
Nobody needs to.

IOLTA.ai does not require remote desktop access, shared credentials, or direct logins to your trust accounting software. You upload documents through a secure workspace. The platform processes them and returns your compliance deliverables. That is the entire data surface. There is no back door because no back door is needed.

No remote access
No RDP, no VPN, no screen sharing, no remote connection of any kind to your systems. There is no persistent link between IOLTA.ai and your infrastructure.
No credential sharing
No bank logins. No trust software passwords. No API keys. You upload files through a secure workspace. That is the only access model.
Read-only processing
IOLTA.ai never modifies your general ledger, client sub-ledgers, or source documents. Data flows in for reconciliation. Only compliance deliverables flow back.
You control the scope
You choose which documents to upload. Nothing is scraped, crawled, or accessed beyond what you explicitly provide. The platform sees only what you show it.
Data Protection

Protected at every layeryour data passes through.

01

Encrypted at Rest and in Transit

All trust data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256. Encryption is applied throughout the entire reconciliation lifecycle.

02

Read-Only by Design

IOLTA.ai processes the documents you provide and produces audit-ready compliance deliverables. It holds no credentials, moves no funds, and never modifies your existing records. The minimal footprint is a deliberate security decision.

03

Never Used for AI Training

Your trust data is processed for your reconciliation and then discarded by the analysis layer. It is never used to train, fine-tune, or evaluate any AI model. This is enforced at the infrastructure level, not buried in a settings panel.

04

Full Access Logging

Every action in your workspace is logged with the requesting identity and timestamp. Role-based permissions control who can view, approve, and seal reconciliations. There is always a clear record of who saw what, and when.

05

Workspace Isolation

Each workspace is isolated at the data layer. Trust account data belonging to one organization is structurally inaccessible to any other workspace on the platform. Your data is yours alone.

06

Cryptographic Compliance Vault

Every sealed reconciliation is hash-chained using SHA-256 and retained in a tamper-evident compliance vault. No party, including IOLTA.ai, can alter a sealed record without breaking the chain. When your State Bar asks for proof, the proof is mathematical.

How Your Data Is Processed

Your trust data produces your compliance.
It is never used for anything else.

No model training on your data
Your trust account data is never used to train, fine-tune, or evaluate AI models. This is a foundational design commitment, not a configurable setting. It applies to every reconciliation, every workspace, every plan.
Processed, then purged
The analysis layer reads only the data required for a given reconciliation, returns your compliance deliverables, and retains nothing. Your source documents are not logged or persisted by the processing layer once the request completes.
Scoped to the task
Only the documents required for a specific reconciliation cycle are transmitted for analysis. Your historical data, your other matters, and your other accounts are never included unless you explicitly provide them.
Encrypted throughout
All data transmitted between the platform and the analysis layer travels over encrypted, authenticated channels. There is no unencrypted segment at any point in the processing path.
Compliance Vault & Data Lifecycle

Source data is processed and purged.
Your compliance proof is retained forever.

Your State Bar requires 5-7 years of reconciliation records. IOLTA.ai separates the raw trust data (purged after processing) from your sealed compliance records (retained in the cryptographic vault for the full duration your jurisdiction requires). Your source documents do not linger. Your proof does.

Source documents purged after processing: The bank statements, trust ledgers, and client sub-ledgers you upload are processed for reconciliation and then purged. Raw trust data does not persist on the platform.
Sealed compliance records retained: Your cryptographically sealed reconciliation proofs, deliverables, and attestations are retained in the compliance vault for the full 5-7 year window your State Bar requires.
Instant auditor access: When the State Bar requests your reconciliation records, you produce them in seconds from the vault. Complete, organized, tamper-evident, and independently verifiable.
Full data portability: All reconciliation reports, compliance packages, and verification records can be exported at any time in standard formats. Your compliance history is yours.
Deletion on request: Request deletion of your account and all associated data at any time. Deletion is completed promptly and confirmed. Your data is never held hostage.
Security Summary

Everything that protects your trust data,in one place.

Encryption at rest and in transit (AES-256 / TLS 1.2+)
Zero-credential, zero-access architecture
No AI model training on customer data
Role-based access control with full audit logging
Workspace-level data isolation
Cryptographic compliance vault with 5-7 year retention
Tamper-evident, independently verifiable attestations
Source document purge after processing
Full data portability and export
100% US-based cloud infrastructure

SOC 2 Type II certification is in progress. Independent penetration testing results will be published upon completion.

Infrastructure

US-hosted. Fully encrypted.No offshore anything.

Compute and hosting
US-based managed cloud infrastructure with multi-zone redundancy. No single point of failure. No offshore data centers. No offshore personnel.
Data store
Fully managed, encrypted database with point-in-time recovery and automated backups across availability zones.
Compliance vault
Tamper-evident, hash-chained storage for sealed reconciliation records. Retained for the full duration your State Bar requires. Independently verifiable at any time.
Document storage
Encrypted object storage for uploaded trust documents during processing. Access scoped to the originating workspace. Purged after reconciliation completes.
Identity and authentication
Managed identity provider with support for multi-factor authentication and enterprise single sign-on integration.
Transport security
HTTPS-only across every endpoint with a TLS 1.2 minimum. Plaintext connections are rejected at the edge.
Secrets management
All keys and credentials are stored in a managed secrets service, never in application code, configuration files, or environment variables.
100% US-based. No offshore data centers. No offshore personnel.Encrypted end to end

Your trust data deserves this.

See the platform yourself. Drop your files, review your deliverables, and decide whether this is the compliance infrastructure your firm has been waiting for.

Start free · 3 reconciliations includedContact Security
security@iolta.ai