Account-level controls for sensitive recovery work.

Implemented today.

Authentication and sessions. Demo authentication is environment-controlled, rate-limited, and unavailable in production-like modes without a deliberate emergency override. Production identity remains an external launch dependency.

Tenant and role isolation. Server checks scope application state to an authorized organization membership. Business and law-firm roles have separate permissions, and attorneys see only expressly authorized opportunities or Engagement records.

Documents. Uploads are validated by signature, MIME type, size, scope, and quota, then quarantined until a configured scanner returns clean. File download requests are authorized on the server.

Audit and revocation. Consequential workflow actions append audit events. Organization administrators can revoke supported invitations or user access.

Transport. The hosted site uses HTTPS. Infrastructure-managed protections depend on the hosting provider; TORO Recovery does not claim a separate certification or customer-managed encryption system.

Operational readiness and planned controls.

Production identity, malware scanning, backup and restoration verification, expanded retention automation, SSO, customer-managed keys, monitoring, and a responsible-disclosure program remain launch dependencies unless separately verified. The product does not display them as active entitlements.

Retention, incidents, and reporting.

Application records are retained to operate the workspace and preserve required audit history. Retention after cancellation depends on applicable terms and legal or security obligations. Do not send debtor documents in ordinary support email. Report a suspected incident through the Contact page, and review the Privacy Policy.