SECURITY & CONFIDENTIALITY
Careful handling, by design.
Aperatex handles legal billing information with disciplined technical, administrative, and operational safeguards. Our practices are designed to limit access, reduce unnecessary collection, and keep client information under controlled handling throughout the review process.
Last updated: August 14, 2026
Our Security Commitment
We treat client information as sensitive business information and use safeguards appropriate to the nature of legal invoices, billing guidelines, engagement terms, matter details, and related communications. Security is incorporated into how information is received, accessed, processed, stored, shared, retained, and deleted. No method of transmission or storage is risk-free, but we work to reduce foreseeable risks through layered controls and regular review.
Encryption and Secure Transfer
Client information is encrypted in transit using current transport encryption and encrypted at rest in the systems used to provide the service. Aperatex uses controlled transfer methods for invoice files and supporting documents and discourages sending sensitive materials through unapproved or unsecured channels. Where practical, transfer links are access-restricted and time-limited.
Access Controls
Access is limited to authorized personnel and service providers who need the information to perform assigned responsibilities. Aperatex applies least-privilege principles, role-based permissions, strong authentication, and account review practices. Access may be removed or adjusted when responsibilities change, an engagement ends, or access is no longer required.
Monitoring and System Hygiene
Aperatex maintains logging and monitoring appropriate to the systems used for client work, applies security updates and patches on a risk-based schedule, uses endpoint and account protections, and reviews material security events. Backups, where used, are protected and managed as part of the same controlled information environment.
Information Lifecycle
We seek to collect only information reasonably necessary to evaluate invoices and support the requested review. Client information is used for the engagement, related quality control, service administration, and legal or operational obligations. Retention is limited according to engagement needs, client instructions, contractual requirements, dispute preservation needs, and applicable law. At the end of the applicable period, information is deleted, returned, or rendered inaccessible using commercially reasonable processes, subject to required archival or backup cycles.
Workforce and Service Providers
Personnel with access to client information are expected to follow confidentiality and security requirements and receive guidance appropriate to their roles. Service providers are evaluated based on the function they perform and are given only the access reasonably needed to support that function. Contractual confidentiality, data-use, and security obligations are used where appropriate, and provider access may be reviewed or terminated when no longer needed.
Responsible Use of AI
Aperatex uses technology to assist with organization, comparison, issue identification, and review workflows while retaining human oversight of client-facing findings. Client information is used only for authorized service purposes and is not used to train general-purpose or publicly available AI models. Access by AI or other technology providers is limited to approved workflows and subject to applicable contractual and technical controls. Automated output is reviewed before it becomes part of a client deliverable.
Incident Preparedness
Aperatex maintains procedures to identify, assess, contain, investigate, and remediate suspected security incidents. If an incident affecting client information occurs, we will evaluate the circumstances, take reasonable containment and recovery steps, preserve relevant records, and provide notice to affected clients when required by contract or applicable law. Communications will be based on verified information and updated as material facts become available.
Client-Directed Handling
Clients may identify authorized contacts, provide handling instructions, request use of a particular approved transfer method, or ask questions about access, retention, return, and deletion. We will work with clients to document reasonable engagement-specific requirements before sensitive information is provided. If a requested workflow cannot be supported safely, Aperatex may propose an alternative method.
Data Minimization and Separation
Review teams are instructed to avoid collecting information that is not needed for the engagement. Matter materials are organized to reduce accidental mixing between clients or projects, and exports or deliverables are checked before release. When test or demonstration data is needed, synthetic, redacted, or de-identified information is preferred where practical.
Questions About Security Or Confidential Handling
Before sending sensitive materials, contact Aperatex through the Request a Review page to discuss the appropriate transfer method and any engagement-specific handling requirements. Please do not send confidential invoice files through general website fields unless Aperatex has directed you to do so.