Security overview

Access that follows the matter.

Woodhouse combines identity, firm role and matter-level access so staff can work across the firm while clients see only what has been shared with them.

This is an accurate overview of the current product architecture, not a compliance certification or substitute for a reviewed production security statement.

Identity first

Firebase Authentication establishes the signed-in identity. A corresponding Firestore user profile supplies the Woodhouse role, organization and active status used by the application.

Firm roles

Internal profiles use admin, lawyer or staff roles. Administrators can manage staff roles, activation status, approved domains and invitation records from the firm workspace.

Matter-scoped portal access

Clients do not receive general firm access. Their portal account is created from an invited email and access is recorded against each specific matter shared with them.

Deliberate document visibility

Matter documents are marked internal or client-shared. Portal users can read shared documents on accessible matters and upload client-sourced files back to those matters.

Attributed activity

Uploads, fulfilled requests and key matter actions are attributed to the acting user. Relevant client activity is surfaced to staff through notifications and the matter history.

Rules aligned to the interface

Firestore and Storage rules mirror the staff/client split so the data layer enforces the same boundaries shown in the application interface.