A practical privilege architecture for legal apps

Treat privilege as a boundary, not a field

The teams that struggle with privilege and confidentiality are the ones that scatter protected material across analytics payloads, crash logs and third-party SDKs. The fix is architectural: one server boundary owns privileged material, and nothing else is allowed to see it.

• Encrypted at rest and in transit, with keys rotated on a schedule you can evidence
• Row-level authorization enforced in the database, not the client
• Audit trails on every read, not just every write
• Redacted telemetry — crash reports never carry matter identifiers

Sign the paperwork that matters

Data processing agreements with every vendor that touches the boundary. If a vendor will not sign one, they sit outside the boundary or they do not ship.

Make the audit boring

The goal of the architecture is that an auditor's questions have short answers backed by logs. That is the difference between a two-week scramble and an afternoon.